Quantum Fraud Detection (FD4QC)

• FD4QC is a research domain that leverages quantum computing and machine learning to detect fraud in financial and cloud service contexts.
• It employs diverse techniques such as hybrid quantum-classical models, kernel methods, and graph neural networks, achieving competitive metrics like 95% accuracy in some studies.
• The field emphasizes system integration and federated protocols to enhance traditional pipelines while addressing quantum hardware limitations.

Searching arXiv for recent FD4QC-related papers and key quantum fraud-detection references. Fraud Detection for Quantum Computing (FD4QC) denotes a heterogeneous line of research at the interface of quantum computing, quantum machine learning, anomaly detection, and financial security. In current arXiv literature, the label is used in two distinct senses. One sense refers to quantum or hybrid quantum-classical methods for detecting fraudulent financial activity, including credit-card fraud, anti-money-laundering alerts, and related anomalies in transactional data (Weinberg et al., 2024). A second sense refers to detecting fraudulent service provision on quantum cloud platforms, especially machine substitution and profile fabrication attacks against quantum-computing users (Wu et al., 2024). Across both senses, FD4QC is not a single algorithm but a family of architectures, kernels, variational circuits, graph models, federated protocols, and deployment patterns whose common theme is fraud analysis under quantum or quantum-enhanced computation (Cardaioli et al., 25 Jul 2025).

1. Scope, definitions, and research setting

In the financial-detection sense, FD4QC is described as a nascent framework that applies quantum machine learning algorithms and quantum-enhanced subroutines to the detection and classification of fraudulent financial transactions. The surveyed methodological inventory includes variational quantum circuits, quantum support vector machines, quantum principal component analysis, amplitude amplification, and the quantum Fourier transform (Weinberg et al., 2024). Technical reports further recast FD4QC as a practical system architecture rather than only a model class, emphasizing a “classical-first, quantum-enhanced” philosophy with robust fallback mechanisms and API-level integration into production fraud pipelines (Cardaioli et al., 25 Jul 2025).

This body of work spans several data regimes. Some studies operate on small balanced subsets designed to fit current qubit budgets, such as 200 samples in a BankSim-based comparative study (Innan et al., 2023) or 1,500/1,000 train/test subsets in a real card-payment QSVM study (Grossi et al., 2022). Others use larger simulated or real industrial datasets, including approximately $200\text{ K}$ synthetic credit-card records (Ubale et al., 30 Apr 2025), $284{,}807$ transactions from the European credit-card dataset (Innan et al., 2023), and $145$ million transactions provided by Stone, from which a balanced $38{,}000$-sample set was formed for quantum-assisted RBM experiments (Neto et al., 19 Dec 2025).

A separate usage of FD4QC concerns fraud directed at quantum-computing consumers rather than fraud inside financial data. In that setting, the target is the integrity of quantum-as-a-service itself: users seek to determine whether a provider executed a job on the advertised machine or fabricated a device profile (Wu et al., 2024). This terminological bifurcation is central to the field’s current state and prevents treating all “FD4QC” papers as if they addressed the same problem.

2. Core supervised and hybrid model families

A large fraction of FD4QC research in finance is supervised and hybrid. One representative architecture is the hybrid quantum-classical Long Short-Term Memory network for credit-card fraud detection. It combines a classical LSTM that ingests and temporally filters transaction features, a trainable dense layer projecting the final hidden state to the qubit dimension, and a Variational Quantum Circuit whose measured outputs are mapped to a fraud probability by a sigmoid-activated linear layer (Ubale et al., 30 Apr 2025). In that implementation, $n\_\text{qubits}=10$, the circuit uses AngleEmbedding and PennyLane StronglyEntanglingLayers, and classical and quantum parameters are updated jointly in a single computational graph via the parameter-shift rule. After 80 epochs on 10 K samples, the reported hybrid QLSTM metrics were Accuracy $95.33\%$, Precision $94.16\%$, Recall $96.67\%$, and F1 score $95.39\%$, compared with a classical LSTM baseline at Accuracy $94.33\%$, Precision $284{,}807$0, Recall $284{,}807$1, and F1 score $284{,}807$2 (Ubale et al., 30 Apr 2025).

Kernel methods remain another major supervised branch. A comparative study of four quantum machine learning models on a balanced 200-example BankSim subset found that the Quantum Support Vector Classifier achieved the best performance, with F1 scores of $284{,}807$3 for fraud and non-fraud classes when paired with the ZFeatureMap; the Variational Quantum Classifier followed with F1 approximately $284{,}807$4, while Estimator QNN and Sampler QNN lagged (Innan et al., 2023). In a separate real-payment study based on IBM Safer Payments and IBM Quantum tooling, QSVM was not treated as a replacement for classical models but as a complementary component. On a drastically reduced balanced dataset, QSVM-selected features reached test Accuracy $284{,}807$5 and AUC $284{,}807$6, and a mixed QSVM+XGBoost ensemble reached $284{,}807$7 Accuracy versus $284{,}807$8 for optimized XGBoost alone (Grossi et al., 2022).

Architectural optimization studies further isolate the role of encoding and entanglement. A systematic VQC analysis on a balanced credit-card dataset reported that, under circular entanglement and $284{,}807$9, ZZ encoding reached $145$0 test Accuracy and $145$1 F1, compared with $145$2 and $145$3 for amplitude encoding and $145$4 and $145$5 for angle encoding (Abbou et al., 26 Sep 2025). The same study reported that, with ZZ encoding, circular entanglement achieved $145$6 Accuracy, $145$7 Precision, $145$8 Recall, and MCC $145$9, outperforming linear entanglement at $38{,}000$0 Accuracy and full connectivity at $38{,}000$1 Accuracy (Abbou et al., 26 Sep 2025). This suggests that in current NISQ-style VQC design, entanglement topology is a first-order design variable rather than a minor implementation detail.

Approach	Representative configuration	Reported result
Hybrid QLSTM	10 qubits, AngleEmbedding, StronglyEntanglingLayers	F1 $38{,}000$2
QSVC	4 qubits, ZFeatureMap	F1 $38{,}000$3 on both classes
VQC encoding study	ZZ encoding, circular entanglement, $38{,}000$4	Accuracy $38{,}000$5
Mixed QSVM+XGBoost	QSVM disagreement ensemble	Accuracy $38{,}000$6

These results establish several recurring design patterns: classical front ends for preprocessing or sequence handling, compact variational quantum cores, and classical post-processing heads or ensembles. They also show that favorable fraud metrics are often achieved only after strong dimensionality reduction, heavy balancing, or aggressive subset construction.

3. Unsupervised and anomaly-centric formulations

Because fraud data are typically highly imbalanced, several FD4QC works frame the task as anomaly detection rather than standard supervised classification. A prominent example is the unsupervised one-class SVM pipeline using quantum kernels. The method trains only on nominal samples, evaluates the decision function

$38{,}000$7

and uses average precision as the principal metric on imbalanced data (Kyriienko et al., 2022). The quantum feature map is IQP-like, uses data re-uploading with $38{,}000$8, and was simulated with registers up to 20 qubits. On a subsampled set of 525 transactions, the quantum OC-SVM with re-uploading reached average precision rising from approximately $38{,}000$9 at $n\_\text{qubits}=10$0 to approximately $n\_\text{qubits}=10$1 at $n\_\text{qubits}=10$2, while the classical RBF OC-SVM saturated near $n\_\text{qubits}=10$3; at 20 qubits the reported quantum-classical separation in average precision was approximately $n\_\text{qubits}=10$4 percentage points (Kyriienko et al., 2022).

Energy-based anomaly models form a second unsupervised strand. A quantum Local Outlier Factor algorithm was proposed as a quantum acceleration of LOF’s three standard steps—k-distance neighborhood search, local reachability density, and LOF score estimation—using amplitude estimation, minimum search, and quantum multiply-adder routines (Guo et al., 2023). The reported complexity claims are an exponential speedup on the dimension of the data points and a polynomial speedup on the number of data points compared to the classical LOF algorithm (Guo et al., 2023). Although presented at the algorithmic level rather than as a full financial benchmark, the work explicitly positions LOF-style unsupervised anomaly detection as relevant to fraud-detection settings.

Boltzmann-style models supply a third anomaly-oriented family. In an unsupervised anomaly-detection study built around Quantum Boltzmann Machines, training proceeded by minimizing $n\_\text{qubits}=10$5, with anomaly scores obtained by thresholding training energies at the $n\_\text{qubits}=10$6th percentile (Stein et al., 2023). On a synthetic 3-dimensional clustering dataset, the reported test-set results were F1 $n\_\text{qubits}=10$7 for a classical RBM, F1 $n\_\text{qubits}=10$8 for QBM+SA, F1 $n\_\text{qubits}=10$9 for QBM on D-Wave 2000Q, and F1 $95.33\%$0 for QBM on Advantage (Stein et al., 2023). The same paper reported that QBM reached superior F1 in approximately 7 epochs versus RBM’s optimum at 13 epochs. This suggests that anomaly-centric quantum models may exhibit training-efficiency gains even when hardware-limited end performance remains uneven.

4. Graph, topological, and federated extensions

FD4QC research has moved beyond flat tabular encodings toward graph-structured and distributed settings. In graph form, one study constructs a transaction-level graph representation from $95.33\%$1 credit-card operations and processes it with a Quantum Graph Neural Network that combines angle encoding, a variational quantum circuit, and a classical aggregation step (Innan et al., 2023). Using 6 qubits and $95.33\%$2, the reported QGNN test metrics were AUC-PR $95.33\%$3, Accuracy $95.33\%$4, Precision $95.33\%$5, Recall $95.33\%$6, and F1 $95.33\%$7, compared with GraphSAGE at AUC-PR $95.33\%$8, Accuracy $95.33\%$9, Precision $94.16\%$0, Recall $94.16\%$1, and F1 $94.16\%$2 (Innan et al., 2023). The significance of this line of work is that fraud often propagates through relational structure rather than isolated transactions.

More elaborate graph formulations add topological data analysis. A Quantum Topological Graph Neural Network framework combines quantum embedding, variational graph convolutions, persistent homology, and hybrid supervised-unsupervised training (Doost et al., 3 Dec 2025). In its PaySim ablation study, the full FD4QC configuration reported F1 $94.16\%$3, AUC $94.16\%$4, Precision $94.16\%$5, Recall $94.16\%$6, and FPR $94.16\%$7, while removing topology or replacing quantum embedding reduced these scores (Doost et al., 3 Dec 2025). A plausible implication is that some recent FD4QC proposals treat higher-order structure—not only pairwise interactions—as a core signal for fraud.

Federated learning introduces a different extension axis: privacy preservation. The Quantum Federated Neural Network for Financial Fraud Detection distributes training across $94.16\%$8 clients, uses angle encoding $94.16\%$9, a 4-layer PQC with CNOT chains, and server-side FedAvg aggregation (Innan et al., 2024). The detailed results table reports QFNN-FFD with Precision $96.67\%$0, Recall $96.67\%$1, F1 $96.67\%$2, and Accuracy $96.67\%$3, versus Classical FL at Precision $96.67\%$4, Recall $96.67\%$5, F1 $96.67\%$6, and Accuracy $96.67\%$7 (Innan et al., 2024). The same work also evaluates robustness under depolarizing, phase-damping, amplitude-damping, bit-flip, phase-flip, and bit-phase-flip noise. Separately, a privacy-preserving federated framework with hybrid quantum-enhanced learning embeds QLSTM cells inside a pseudo-centralized protocol and introduces the FedRansel sampling mechanism. That study reports an approximate $96.67\%$8 performance improvement across key evaluation metrics compared to conventional models and $96.67\%$9–$95.39\%$0 less performance degradation under attack than standard differential privacy mechanisms (Sawaika et al., 15 Jul 2025).

5. System architectures, operational trade-offs, and benchmark realism

A defining feature of mature FD4QC work is the move from isolated model benchmarks to system-level deployment logic. One technical report presents FD4QC as a stateless, RESTful, API-driven service. Transactions arrive as JSON payloads, pass through an API gateway and router, and are sent either to a classical engine or to a quantum engine; if the quantum backend is unavailable, a classical surrogate is invoked and the response is explicitly tagged for audit (Cardaioli et al., 25 Jul 2025). This architecture encodes a practical claim that quantum fraud detection is currently operationally viable mainly as an augmenting module inside a resilient classical stack.

Benchmark realism in that same report is instructive. On the IBM AML dataset, classical tree-based models significantly outperformed the quantum counterparts in the current setup: Random Forest achieved Accuracy $95.39\%$1 and F-measure $95.39\%$2, while XGBoost reached Accuracy $95.39\%$3 and F$95.39\%$4 $95.39\%$5 (Cardaioli et al., 25 Jul 2025). Among the quantum models, QSVM with 4 qubits delivered Precision $95.39\%$6 and False Positive Rate $95.39\%$7, but Recall only $95.39\%$8; VQC and HQNN variants performed markedly worse (Cardaioli et al., 25 Jul 2025). This directly contradicts any blanket claim that current quantum fraud detectors uniformly exceed classical baselines.

Other works attempt to recover utility through selective routing rather than universal replacement. A mixture-of-experts framework combines a Guided Quantum Compressor with XGBoost and learns a router that activates the hybrid model only where it strictly outperforms the classical expert (Chaves et al., 6 Mar 2026). On 3 repeated 5-fold cross-validation benchmarks, the reported Average Precision was $95.39\%$9 for the hybrid MoE at best $94.33\%$0, compared with $94.33\%$1 for XGBoost alone (Chaves et al., 6 Mar 2026). The operational cost was an added inference overhead of approximately 7 to 21 minutes, depending on the routing fraction. This suggests that one plausible near-term role for FD4QC is selective second-stage escalation rather than first-pass screening.

Quantum-assisted generative or energy-based models offer another operational profile. On the Stone dataset, quantum-sampling-assisted RBM training on a D-Wave 2000Q produced Accuracy $94.33\%$2, Precision $94.33\%$3, Recall $94.33\%$4, F1-score $94.33\%$5, and total training time $94.33\%$6 h, compared with classical PCD at Accuracy $94.33\%$7, Precision $94.33\%$8, Recall $94.33\%$9, F1-score $284{,}807$00, and total training time $284{,}807$01 min, and simulated-annealing-assisted PCD at F1-score $284{,}807$02 and $284{,}807$03 h (Neto et al., 19 Dec 2025). The practical lesson is not simple superiority but a rebalancing of model size, sampling behavior, and runtime budget. In a different hardware paradigm, CVQBoost on Dirac-3 was reported to maintain competitive AUC while significantly reducing training time relative to XGBoost as dataset size and feature complexity increased, including scalability tests from $284{,}807$04M to $284{,}807$05M samples (Emami et al., 14 Mar 2025). That line indicates that FD4QC also includes non-gate-model quantum hardware oriented toward optimization throughput.

6. Fraud against quantum cloud platforms

In the quantum-service sense, FD4QC addresses fraud committed by cloud providers against users of quantum hardware. The threat model contains two primary attacks: machine substitution, in which a job selected for a high-quality device is actually run on a different lower-fidelity device with the same qubit topology, and profile fabrication, in which the provider alters the published calibration profile to show overly optimistic error rates (Wu et al., 2024). In both cases, the user sees only final counts and the published device profile.

The proposed defense is dynamic fingerprinting using a single probing circuit. The circuit is chosen to deterministically prepare one computational basis state, typically via a small Bernstein–Vazirani circuit on 3–4 qubits, so that per-qubit marginal errors can be isolated (Wu et al., 2024). After $284{,}807$06 shots, the device-side fingerprint is the vector of survival probabilities

$284{,}807$07

The user-side fingerprint $284{,}807$08 is then computed from the transpiled gate sequence and the published gate or readout error rates by propagating per-qubit survival probabilities through $284{,}807$09, CNOT, Measure, and SWAP operations. Because each operation is processed once per involved qubit, the estimator runs in $284{,}807$10 time and $284{,}807$11 extra space (Wu et al., 2024).

Fraud is detected by comparing the two fingerprints with the average qubit-wise Manhattan distance

$284{,}807$12

The paper reports that an empirical threshold $284{,}807$13 cleanly separates honest from fraudulent executions on IBM hardware (Wu et al., 2024). In the reported evaluation, small devices yielded 11/12 correct identifications, large devices 8/9, and no false positives or false negatives were observed in 21 total fingerprinting experiments once $284{,}807$14 was fixed (Wu et al., 2024). In a real profile-fabrication case on belem using an old calibration, all nine distances exceeded $284{,}807$15. This branch of FD4QC is conceptually distinct from financial fraud detection: the object of detection is service deception in quantum infrastructure itself.

7. Limitations, misconceptions, and research directions

A common misconception is that FD4QC already denotes a stable, uniform benchmark category with established quantum advantage. The literature does not support that view. Some studies report favorable fraud metrics for hybrid models, such as the QLSTM recall of $284{,}807$16 and F1 of $284{,}807$17 (Ubale et al., 30 Apr 2025), the QGNN AUC-PR of $284{,}807$18 (Innan et al., 2023), or the QSVC F1 of $284{,}807$19 on a small BankSim subset (Innan et al., 2023). Other studies, however, show that classical ensembles remain stronger in the current setup, as in the IBM AML report where Random Forest and XGBoost outperform VQC, HQNN, and QSVM on overall fraud detection (Cardaioli et al., 25 Jul 2025). The evidence base is therefore heterogeneous and strongly dependent on dataset construction, imbalance handling, feature selection, simulator choice, and evaluation protocol.

A second misconception is that quantum models primarily fail because of missing hardware scale alone. Several papers identify more specific bottlenecks: $284{,}807$20 Gram-matrix formation for kernel methods and $284{,}807$21 inference cost for new samples in quantum OC-SVM (Kyriienko et al., 2022); longer epoch times from quantum simulation overhead even when end metrics improve, as in the 55 s average training time per epoch for hybrid QLSTM versus 1.5 s for classical LSTM (Ubale et al., 30 Apr 2025); and drastic feature and sample reduction to fit current qubit budgets in real-payment QSVM experiments (Grossi et al., 2022). In the federated QLSTM setting, performance was reported to saturate beyond 9 qubits on one dataset and 5 qubits on another because of hardware noise and barren-plateau effects (Sawaika et al., 15 Jul 2025). In cloud-service FD4QC, the fingerprinting method assumes that quantum errors remain stable within one calibration cycle and that probing qubits can be kept well spaced to limit crosstalk (Wu et al., 2024).

The field’s research directions are correspondingly concrete rather than abstract. For financial FD4QC, proposed next steps include error mitigation via zero-noise extrapolation and probabilistic cancellation, hardware-efficient ansätze, richer gating strategies for selective quantum routing, non-IID federated settings, personalization layers per client, and real-device validation on emerging backends (Ubale et al., 30 Apr 2025, Innan et al., 2024, Chaves et al., 6 Mar 2026). For kernel-based anomaly detection, the literature points to trainable circuit layers, randomized or block-diagonal Gram approximations, sparse OC-SVM variants, and shot-efficient kernel estimation (Kyriienko et al., 2022). For quantum-cloud-service FD4QC, the immediate operational recommendation is periodic threshold recalibration across calibration cycles and, where needed, augmentation with pairwise qubit correlations at the cost of higher estimation complexity (Wu et al., 2024).

Taken together, FD4QC presently designates a research domain rather than a settled technology stack. In finance, it encompasses supervised classifiers, anomaly detectors, graph and topological models, federated protocols, and deployment architectures that embed quantum components within classical infrastructure. In quantum cloud security, it denotes integrity checks against fraudulent service provision. The unifying theme is not a single algorithmic primitive, but the use of quantum representations, quantum hardware, or quantum-aware system design to detect fraud, reduce false positives, preserve privacy, or verify trustworthy computation.