Graph Neural Networks and Network Analysis to Detect Financial Fraud
A technical overview of the methods behind modern fraud detection systems
Brian Curry | Vector1 Research
If you found this useful, you can support my independent research here: https://www.paypal.biz/vector1research
The June 2025 DOJ healthcare fraud takedown — $14.6 billion in fraudulent claims, 324 defendants — wasn’t detected by rule-based systems or traditional machine learning. It was detected by graph analytics: identifying “aberrant billing levels” that propagated across regions in patterns characteristic of coordinated networks rather than independent bad actors.
This article outlines the technical approach when applying graph-based methods to fraud detection: the mathematical foundations, the architectural choices, and the trade-offs that matter in practice.
The Graph Formulation
Financial fraud detection begins with representing transaction data as a graph G = (V, E, X, E) where:
— V is the set of n nodes (accounts, entities, individuals) — E ⊆ V × V is the set of edges (transactions, relationships) — X ∈ ℝⁿˣᵈ is the node feature matrix (d features per node) — E represents edge attributes (transaction amounts, timestamps, types)
This formulation captures what tabular representations miss: the relational structure between entities. A fraudulent medical supply company isn’t suspicious because of its billing amounts alone — it’s suspicious because of its relationship to shell companies in Estonia, shared device IDs with actors in Russia, and money flows that terminate in Kenyan real estate.
The fundamental insight, formalized by Cheng et al. in their 2024 review of GNNs for financial fraud detection, is that fraud networks exhibit structural signatures that are invisible in feature space but detectable in graph topology.
Classical Network Metrics: Where to Start
Before deploying neural approaches, classical graph algorithms provide interpretable baselines and often surface the most critical patterns.
Centrality Measures
For identifying key actors in fraud networks, I typically compute multiple centrality metrics.
Degree Centrality measures direct connections. For node i:
Cᴰ(i) = deg(i) / (n — 1)
High degree nodes in transaction networks often indicate money mules or aggregation points. In Operation Gold Rush, the shell companies that received funds from multiple medical supply companies had degree centrality 3–5x higher than legitimate businesses.
Betweenness Centrality identifies nodes that act as bridges:
Cᴮ(v) = Σₛ≠ᵥ≠ₜ (σₛₜ(v) / σₛₜ)
where σₛₜ is the total number of shortest paths from s to t, and σₛₜ(v) is the number of those paths passing through v.
In fraud networks, high-betweenness nodes often represent coordinators or “chokepoints” in money laundering pipelines. The Estonian coordinator in Operation Gold Rush had betweenness centrality in the 99th percentile — he was the bridge between Russian masterminds and US-registered shell companies.
PageRank provides a recursive measure of importance:
PR(i) = (1-d)/n + d Σⱼ∈N(i) PR(j)/deg(j)
where d is the damping factor (typically 0.85) and N(i) is the set of nodes pointing to i. Unlike degree centrality, PageRank accounts for the importance of the nodes connecting to you — being connected to a mastermind is more significant than being connected to a low-level mule.
Community Detection
Fraud rings cluster. The Louvain algorithm detects communities by maximizing modularity:
Q = (1/2m) Σᵢⱼ [Aᵢⱼ — (kᵢkⱼ/2m)] δ(cᵢ, cⱼ)
where Aᵢⱼ is the adjacency matrix, kᵢ is the degree of node i, m is the total edge weight, and δ(cᵢ, cⱼ) = 1 if nodes i and j are in the same community.
The algorithm iteratively moves nodes between communities to maximize Q, then aggregates communities into super-nodes and repeats. Time complexity is O(n log n), making it practical for large transaction graphs.
In the Feeding Our Future case, community detection immediately isolated the Minneapolis-based fraud ring from legitimate nutrition program participants. The ring formed a densely connected cluster with sparse connections to the broader network — a textbook community structure.
Graph Neural Networks: The Modern Approach
Classical metrics identify suspicious structures but don’t learn from labeled examples. Graph Neural Networks (GNNs) combine structural information with supervised learning.
Message Passing Framework
The core operation in GNNs is message passing. For node i at layer l:
hᵢ⁽ˡ⁾ = UPDATE(hᵢ⁽ˡ⁻¹⁾, AGGREGATE({hⱼ⁽ˡ⁻¹⁾ : j ∈ N(i)}))
where hᵢ⁽ˡ⁾ is the embedding of node i at layer l, N(i) is the neighborhood of i, and UPDATE and AGGREGATE are learnable functions.
After L layers, each node’s embedding encodes information from its L-hop neighborhood. This is precisely what fraud detection requires: understanding not just an entity’s features, but its relational context.
Graph Convolutional Networks (GCN)
The GCN layer (Kipf & Welling, 2017) implements message passing as:
xᵢ⁽ᵏ⁾ = Σⱼ∈N(i)∪{i} (1/√(deg(i)·deg(j))) · (Wᵀ · xⱼ⁽ᵏ⁻¹⁾) + b
The normalization term 1/√(deg(i)·deg(j)) prevents high-degree nodes from dominating the aggregation — important in financial networks where some accounts have thousands of transactions.
Graph Attention Networks (GAT)
GATs (Veličković et al., 2018) replace the fixed normalization with learned attention weights:
αᵢⱼ = softmax(LeakyReLU(aᵀ [Whᵢ || Whⱼ]))
hᵢ’ = σ(Σⱼ∈N(i) αᵢⱼ · Whⱼ)
The attention coefficient αᵢⱼ ∈ [0,1] represents the importance of node j’s features for node i. In fraud detection, this allows the model to learn which neighbors are informative — a legitimate customer’s transaction history matters more than a one-time interaction with a fraudulent merchant.
Multi-head attention improves stability:
hᵢ’ = ||ᵏ₌₁ᴷ σ(Σⱼ∈N(i) αᵢⱼᵏ · Wᵏhⱼ)
where || denotes concatenation and K is the number of attention heads.
Challenges in Fraud Detection Graphs
Financial fraud presents specific challenges that require architectural adaptations.
Class Imbalance
Fraud is rare. In typical datasets, fraudulent transactions represent 0.1–1% of the total. Standard cross-entropy loss causes the model to predict “not fraud” for everything.
Solutions I use:
— Focal loss: FL(pₜ) = -αₜ(1-pₜ)ᵞ log(pₜ), which down-weights easy negatives — SMOTE-based oversampling of fraud node neighborhoods — Class-balanced sampling during mini-batch construction
The PC-GNN framework (Liu et al., 2021) addresses this by oversampling minority class neighborhoods during aggregation — the model sees more fraud-adjacent information during training.
Heterophily
Classical GNNs assume homophily: connected nodes share labels. Fraud networks violate this. Fraudsters deliberately connect to legitimate entities to camouflage their activity.
The HA-GNN (Hierarchical Attention GNN) addresses this by learning separate aggregation functions for similar and dissimilar neighbors. The recent PMP (Partitioning Message Passing) framework goes further:
hᵢ⁽ˡ⁾ = fᵢ(AGGₛₐₘₑ({hⱼ : j ∈ N(i), yⱼ = yᵢ}), AGGdiff({hⱼ : j ∈ N(i), yⱼ ≠ yᵢ}))
By partitioning aggregation based on neighbor labels, PMP prevents the “over-smoothing” problem where fraud signals get diluted by benign neighbors.
Over-smoothing
As GNN depth increases, node embeddings converge to similar values. After approximately 6 layers, all nodes become indistinguishable.
The JA-GNN (Jump-Attentive GNN) architecture addresses this with skip connections that preserve features from earlier layers:
hᵢ⁽ᴸ⁾ = COMBINE(hᵢ⁽⁰⁾, hᵢ⁽¹⁾, …, hᵢ⁽ᴸ⁾)
This is critical for fraud detection because suspicious signals (e.g., a chargeback) at 2–3 hop distance shouldn’t be smoothed away by intervening legitimate transactions.
Temporal Dynamics
Fraud patterns evolve. A model trained on 2023 patterns will miss 2025 schemes.
Temporal GNNs like T-GCN incorporate time-series modeling:
hᵢ⁽ᵗ⁾ = GRU(GCN(G⁽ᵗ⁾), hᵢ⁽ᵗ⁻¹⁾)
The GCN captures spatial structure at each timestep; the GRU captures temporal evolution.
Graph Transformers: The Frontier
The FraudGT architecture (IBM, 2024) adapts transformers for transaction graphs.
For input H⁽ˡ⁻¹⁾ ∈ ℝⁿˣᵈ, the multi-head attention computes:
Q = H⁽ˡ⁻¹⁾Wᵠ, K = H⁽ˡ⁻¹⁾Wᴷ, V = H⁽ˡ⁻¹⁾Wⱽ
Attention(Q,K,V) = softmax(QKᵀ/√dₖ)V
Unlike message-passing GNNs, transformers can attend to any node in the graph, not just neighbors. This captures long-range dependencies that fraud schemes exploit.
FraudGT also incorporates edge features directly — critical for financial graphs where transaction amount, timestamp, and type carry most of the signal.
Practical Implementation
Here’s my typical pipeline:
- Graph Construction — Nodes: accounts, entities, devices, IP addresses — Edges: transactions, ownership relationships, shared attributes — Edge types: OWNS, CONTROLS, TRANSACTS_WITH, SHARES_DEVICE
- Feature Engineering — Node features: account age, transaction volume, geographic location — Edge features: transaction amount, frequency, time-of-day patterns — Derived features: PageRank, clustering coefficient, neighborhood fraud rate
- Model Selection — For interpretable baseline: Louvain clustering + centrality ranking — For high performance: GAT with 2–3 layers, multi-head attention — For cutting-edge: FraudGT or PMP if heterophily is severe
- Training — Stratified sampling to handle class imbalance — Focal loss with γ = 2 — Early stopping on validation AUC-PR (not accuracy)
- Evaluation — AUC-ROC and AUC-PR (precision-recall is more informative for imbalanced data) — Recall at fixed precision thresholds (e.g., 95% precision) — Time-stratified validation to test generalization to new fraud patterns
Results from Recent Literature
The Cheng et al. (2024) review benchmarks GNN methods on public fraud datasets:
YelpChi (review fraud): — MLP baseline: AUC 0.732 — GCN: AUC 0.845 — GAT: AUC 0.871 — PC-GNN: AUC 0.892
Amazon (product fraud): — MLP baseline: AUC 0.697 — GCN: AUC 0.823 — GAT: AUC 0.856 — GTAN: AUC 0.891
The pattern is consistent: graph-based methods outperform feature-based methods by 10–15 AUC points. Attention mechanisms and heterophily-aware architectures provide additional gains.
Vallarino (2025) benchmarks GNNs against traditional methods on financial transaction data: — Random Forest: Recall 0.78 — XGBoost: Recall 0.81 — GNN (GAT-based): Recall 0.89
The recall improvement translates directly to fraud dollars caught.
The FATF Framework
The Financial Action Task Force (FATF) provides the regulatory framework for anti-money laundering (AML). Their 2024 Money Laundering National Risk Assessment Guidance identifies four primary predicate offenses: fraud, corruption, drug trafficking, and tax crimes.
Graph analytics align with FATF’s emphasis on:
— Beneficial ownership transparency: Graph queries surface hidden control relationships — Transaction monitoring: Community detection identifies coordinated activity — Typology development: Network analysis reveals modus operandi patterns
The 2024 FATF guidance explicitly calls for leveraging “advanced analytics” to identify “emerging ML typologies” — language that maps directly to GNN-based detection.
What’s Next
Three trends are shaping the field:
- Explainable GNNs
Regulators require explanations for fraud decisions. Methods like GNNExplainer identify which edges and node features drove a prediction. This is essential for SAR (Suspicious Activity Report) filing.
- Federated Graph Learning
Banks can’t share transaction data. Federated learning trains GNNs across institutions without centralizing data. The challenge is handling cross-institutional edges.
- LLM + GNN Integration
The FLAG framework (KDD 2025) combines large language models with GNNs — LLMs process textual features (transaction descriptions, entity names) while GNNs handle structure. Early results show significant improvements on datasets with rich text.
Conclusion
Graph-based fraud detection isn’t a single technique — it’s a framework that spans classical network analysis, modern deep learning, and regulatory compliance.
The mathematical foundations (message passing, attention mechanisms, community detection) provide the toolkit. The architectural choices (handling imbalance, heterophily, over-smoothing) determine practical performance. The regulatory context (FATF, SAR requirements) shapes deployment.
When the DOJ prevented $4.45 billion in fraudulent Medicare payments during Operation Gold Rush, they were using these methods. The fraud was hiding in the relationships — and the graph revealed it.
References
Cheng, D., Zou, Y., Xiang, S., & Jiang, C. (2024). Graph Neural Networks for Financial Fraud Detection: A Review. arXiv:2411.05815.
Veličković, P., Cucurull, G., Casanova, A., Romero, A., Liò, P., & Bengio, Y. (2018). Graph Attention Networks. ICLR 2018.
Kipf, T. N., & Welling, M. (2017). Semi-Supervised Classification with Graph Convolutional Networks. ICLR 2017.
Vallarino, D. (2025). AI-Powered Fraud Detection in Financial Services: GNN, Compliance Challenges, and Risk Mitigation. SSRN 5170054.
Liu, Y., et al. (2021). Pick and Choose: A GNN-based Imbalanced Learning Approach for Fraud Detection. WWW 2021.
FATF. (2024). Money Laundering National Risk Assessment Guidance. Financial Action Task Force.
Akartuna, E. A., Johnson, S. D., & Thornton, A. (2024). A Holistic Network Analysis of the Money Laundering Threat Landscape. Journal of Quantitative Criminology.
Gilmer, J., Schoenholz, S. S., Riley, P. F., Vinyals, O., & Dahl, G. E. (2017). Neural Message Passing for Quantum Chemistry. ICML 2017.
About the Author
Brian James Curry is a Kansas City-based Data Scientist, AI researcher, economist and founder of Vector1 Research. Creator of the Autonomy Economy and Human Data Commons frameworks for post-employment civilization.
