FRAUDGUESS: Evidence-Coupled Fraud Detection
- FRAUDGUESS is a fraud-detection design pattern that couples algorithmic anomaly detection with analyst-facing justification using structured evidence.
- It integrates diverse methods such as interactive heatmaps in financial micro-clusters, Benford feature analytics in blockchain, and LLM-based retrieval for messaging systems.
- The approach enables the discovery of novel fraud patterns while providing clear, actionable visual or statistical evidence for forensic analysis.
FRAUDGUESS is a fraud-detection designation used in the supplied literature for several systems that infer suspicious behavior from structured transactional or textual evidence and, in the stronger formulations, also provide analyst-facing justification. The name is attached to at least three distinct implementations: a million-scale financial transaction system that detects previously unknown fraud patterns as micro-clusters and explains them with heatmaps and dashboards (Cordeiro et al., 19 Sep 2025), a blockchain-address detector that combines graph-derived transaction statistics with Benford’s Law features and a gradient-boosted tree model (Gridley et al., 2023), and a Retrieval-Augmented-Generation pipeline that scores potentially fraudulent messages by combining LLM judgment with retrieved evidence similarity (Chan et al., 27 Jan 2026). Taken together, these systems define FRAUDGUESS less as a single fixed algorithm than as a recurring design pattern: detection coupled to evidence.
1. Variant structure and defining objectives
Across the supplied sources, FRAUDGUESS serves two recurring purposes. The first is detection: identifying fraudulent transactions, addresses, or messages, including cases that do not match previously labeled fraud categories. The second is justification: producing evidence that supports analyst review, whether through feature importances, retrieved snippets, heatmaps, or dashboards. The 2025 financial-data system states these two goals explicitly as “Detection” and “Justification” (Cordeiro et al., 19 Sep 2025).
| Variant | Primary input | Core mechanism |
|---|---|---|
| Financial micro-cluster FRAUDGUESS | Card–merchant transaction logs | Four-feature space, log–log heatmaps, analyst-selected micro-clusters |
| Blockchain FRAUDGUESS blueprint | Ethereum address transaction history | Transactional features, Benford features, LightGBM |
| RAG-based FRAUDGUESS | Emails, chat logs, transaction requests | LLM feature extraction, retrieval, hybrid score |
These variants differ in supervision regime and operational assumptions. The financial system is designed to spot new, previously unknown fraud patterns as small islands in low-density regions. The blockchain system is a labeled-address classifier trained on scam and non-scam labels. The RAG pipeline is a message-level detector whose adaptation mechanism is retrieval-time evidence refresh rather than model retraining. A plausible implication is that FRAUDGUESS is best understood as a family of analyst-oriented fraud-detection workflows rather than a single canonical model.
2. Million-scale financial transaction FRAUDGUESS
In the 2025 formulation, FRAUDGUESS operates on a transaction set whose records are tuples , where , , , and (Cordeiro et al., 19 Sep 2025). The explicit objective is to find micro-clusters of cards whose transaction patterns do not resemble known fraud or normal behavior, while also generating visual evidence for forensic inspection.
The feature-extraction map is instantiated with four features per card: of txns of , 0 distinct inter-arrival times among 1’s txns, 2 distinct amounts among 3’s txns, and 4. The rationale in the source is specific: transaction count captures activity volume; few distinct inter-arrival times indicate nearly constant spacing; few distinct amounts indicate repetitive charging of the same amount; median amount isolates cards transacting almost exclusively at very small amounts. Each feature is computed in one linear scan of the card’s transactions, giving cost 5.
Detection is carried out through interactive heatmaps in log–log scale rather than a fixed black-box clustering routine. For each feature pair 6 with 7, FRAUDGUESS plots 8 and 9 and colors each cell by log-density of points. Outlying “puffs” or “islands” indicate cards far from the dense bulk. The description notes an implicit Euclidean interpretation, 0, but the actual workflow is analyst-driven: suspicious regions are selected manually, aggregated across feature pairs, and then examined through a per-card dashboard. The cluster score is described as rarity, approximately 1, and, in node form, 2.
Justification is integral rather than auxiliary. The dashboard includes a two-hop egonet with edge width proportional to 3, an inter-arrival scatter for consecutive transaction triplets using 4 and 5, a spreadsheet of actual transactions with repeated patterns highlighted, a temporal-evolution chart comparing transaction counts over wall-clock time, and interactive navigation through related merchants or cards. This visualization layer is the mechanism by which micro-clusters become interpretable.
Application to a real, million-scale dataset from an Anonymous Financial Institution uncovered three previously unknown behaviors: Double Machine-gun, Penny Hunter, and Bursty Poster. Double Machine-gun consists of cards showing the same tiny inter-arrival times and the same amounts; one example had 66 transactions of $t=(c,m,a,\tau)t=(c,m,a,\tau)t=(c,m,a,\tau)$8\le $t=(c,m,a,\tau)$9. Bursty Poster consists of short bursts of many transactions in less than a minute at unusual time-of-day, with non-round, larger amounts; one example had 16 transactions within 60 seconds around 10 PM. The source reports that feature extraction is $c=\text{card-ID}$0, that $c=\text{card-ID}$1 M transactions yielded complete heatmap generation in $c=\text{card-ID}$2 min on a stock server, and that two of the three discovered patterns were confirmed as fraud, implying a precision $c=\text{card-ID}$3 in that subset (Cordeiro et al., 19 Sep 2025).
3. Blockchain-address FRAUDGUESS and Benford features
The blockchain formulation builds a directed Ethereum transaction graph $c=\text{card-ID}$4 in which nodes are individual Ethereum addresses, including EOAs and contracts, and edges are money-transfer events carrying $c=\text{card-ID}$5, $c=\text{card-ID}$6, $c=\text{card-ID}$7, and $c=\text{card-ID}$8 (Gridley et al., 2023). The graph is built by streaming transaction history per address using the Amberdata API, with full on-chain history and optional labels or tags to filter out non-user activity. Scam labels come from the Etherscan tag cloud, Uniswap-scam datasets from Xia et al., and the GitHub “crypto-hall-of-shame”; non-scam labels come from audited DeFi contracts such as Uniswap, Aave, Compound, and OpenSea, together with randomly sampled verified non-scam user addresses. The final labeled set contains 1,676 addresses and approximately $c=\text{card-ID}$9 M transactions.
The raw-feature layer consists of transactional features defined per address: $m=\text{merchant-ID}$0, $m=\text{merchant-ID}$1, total incoming and outgoing transaction counts, mean/median/std of transferred values, mean/median/std of gas limits, and counts of unique counterparties in and out. The system’s distinctive contribution is the addition of Benford features. Let $m=\text{merchant-ID}$2 be the first significant digit of $m=\text{merchant-ID}$3 in base 10 and $m=\text{merchant-ID}$4 the second digit. The theoretical first- and second-digit distributions are
$m=\text{merchant-ID}$5
and
$m=\text{merchant-ID}$6
For each address $m=\text{merchant-ID}$7 and digit position $m=\text{merchant-ID}$8, the method forms the multiset $m=\text{merchant-ID}$9 and computes two goodness-of-fit statistics against the corresponding Benford distribution:
$a=\text{amount}$0
where $a=\text{amount}$1 is the observed count and $a=\text{amount}$2, and
$a=\text{amount}$3
The four values $a=\text{amount}$4 are used as Benford features.
Prediction uses a gradient-boosted tree model, specifically LightGBM, with binary logistic objective
$a=\text{amount}$5
where $a=\text{amount}$6 and $a=\text{amount}$7. Hyperparameters are tuned via 5-fold CV. LightGBM also provides gain-based feature importance, and the reported ordering is explicit: $a=\text{amount}$8 was consistently the top feature, followed by transactions’ median value, out-degree, and $a=\text{amount}$9.
The reported evaluation uses an 80/20 train/test split, with 15% of training used for validation, under class imbalance of approximately 1,600 non-scam versus 80 scam addresses. With Benford features, the LightGBM row in Table IV reports Accuracy $\tau=\text{timestamp}$0, Macro-avg Precision $\tau=\text{timestamp}$1, Macro-avg Recall $\tau=\text{timestamp}$2, and Macro-avg $\tau=\text{timestamp}$3, implying false positive rate $\tau=\text{timestamp}$4 and false negative rate $\tau=\text{timestamp}$5. Without Benford features, Accuracy $\tau=\text{timestamp}$6, Macro-avg Precision $\tau=\text{timestamp}$7, Macro-avg Recall $\tau=\text{timestamp}$8, and Macro-avg $\tau=\text{timestamp}$9; the blueprint states that adding Benford features gave approximately 2 percentage points of lift in overall accuracy and approximately 0.023 lift in $\phi:\text{cards}\rightarrow\mathbb{R}^k$0 (Gridley et al., 2023).
The same source also describes extensions: PageRank, betweenness, ego-network density, triadic closures, motifs, temporal burstiness, contract-versus-EOA splits via Amberdata’s contract flag, bytecode-analysis features for smart-contract schemes such as Chen et al.’s dual-ensemble, adversarial hardening following Wen et al., and graph neural network embeddings such as GraphSAGE and GAT, with Shen et al. and Liu et al. cited as relevant directions.
4. RAG-based LLM FRAUDGUESS
A separate FRAUDGUESS formulation is a Retrieval-Augmented-Generation fraud-detection pipeline for messages such as emails, chat logs, and transaction requests (Chan et al., 27 Jan 2026). Its architecture comprises message ingestion, an LLM-based feature extractor, a document retriever, an evidence store implemented as a vector database, an LLM reasoning module, a score aggregator, and a decision threshold $\phi:\text{cards}\rightarrow\mathbb{R}^k$1. The data flow is fully specified: ingest message; extract intent, urgency, tone, entities, and requested actions; generate an embedding and query the evidence store; retrieve top-$\phi:\text{cards}\rightarrow\mathbb{R}^k$2 evidence; build a RAG prompt; obtain an LLM judgment score $\phi:\text{cards}\rightarrow\mathbb{R}^k$3 and rationale; collect evidence similarity scores $\phi:\text{cards}\rightarrow\mathbb{R}^k$4; compute the composite score; compare it to $\phi:\text{cards}\rightarrow\mathbb{R}^k$5; and output a decision with explanation.
The retrieval layer uses overlapping passages of approximately 512 tokens with stride $\phi:\text{cards}\rightarrow\mathbb{R}^k$6–$\phi:\text{cards}\rightarrow\mathbb{R}^k$7, storing metadata such as source ID, timestamp, and pattern tags. Embedding can be produced with SentenceTransformer, for example “all-mpnet-base-v2,” or OpenAI “text-embedding-ada-002,” with dimensionality 384–768. Similarity search uses HNSW or IVF+PQ via FAISS or Pinecone, retrieving top-$\phi:\text{cards}\rightarrow\mathbb{R}^k$8 passages by cosine similarity and selecting top-$\phi:\text{cards}\rightarrow\mathbb{R}^k$9 snippets for the second LLM call.
Decision-making is governed by a hybrid score:
$f_1(c)=\#$0
where $f_1(c)=\#$1 is the LLM fraud-likelihood judgment, $f_1(c)=\#$2 is the max or mean cosine similarity among retrieved evidence, and $f_1(c)=\#$3 is the weight on the LLM judgment. The threshold $f_1(c)=\#$4 is chosen via ROC-curve analysis on held-out validation data. The source notes standard tradeoffs: low $f_1(c)=\#$5 yields high recall with more false positives, whereas high $f_1(c)=\#$6 lowers false positives while risking missed fraud.
The adaptation mechanism is explicitly retrieval-based rather than parametric. Analysts can add new scam-pattern documents, scripts, transcripts, or policy updates to the evidence store; the vector index is then updated incrementally, for example by FAISS or HNSW rebuild for new vectors, and “No LLM retraining required; new patterns immediately influence retrieval and final judgment.” The same section describes a human-in-the-loop loop in which analysts review flagged messages, annotate false positives and false negatives, write labeled examples back to the evidence store, and adjust $f_1(c)=\#$7 or $f_1(c)=\#$8.
The reported experiments use approximately 10 K scam examples, approximately 10 K legitimate messages, and a 20 K-message mixed test set equally split. Relative to an LLM without RAG, the RAG-enhanced FRAUDGUESS yields FPR $f_1(c)=\#$9 versus $c$0, FNR $c$1 versus $c$2, and ROC-AUC $c$3 versus $c$4. The source summarizes this as an $c$5 relative reduction in false positives, a reduction in false negatives, and a $c$6 ROC-AUC improvement (Chan et al., 27 Jan 2026).
5. Methodological relatives and adjacent research
Several supplied papers situate FRAUDGUESS within a broader fraud-detection landscape. For graph-based camouflage resistance, FraudTrap models user–object interactions as a bipartite graph, builds an Object Similarity Graph with similarity
$c$7
and ranks object clusters by
$c$8
where $c$9 is the average C-score and $D$00 is the average number of shared users. The method is designed for loose synchronization and camouflage, and its unsupervised and semi-supervised variants outperform Fraudar, CatchSync, and CrossSpot on several datasets (Ban et al., 2018).
For unsupervised graph fraud detection under heterophily, HUGE introduces the label-free heterophily metric HALO and a joint MLP–GNN architecture trained with ranking and asymmetric alignment losses. The node-level heterophily score is defined as
$D$01
and the detector is evaluated on Amazon, Facebook, Reddit, YelpChi, AmazonFull, and YelpChiFull, where it is reported as best or second-best in AUROC/AUPRC across the six datasets (Pan et al., 18 Feb 2025). This is directly relevant to any FRAUDGUESS variant that operates on graphs without labels.
For weak text-attributed multi-relational fraud graphs, LGSPF replaces hard textualization with soft prompt injection of relation-specific GNN embeddings into an LLM. Its end-to-end architecture uses a parallel GNN encoder, a soft-prompt injector, and a Qwen2.5-7B decoder with LoRA, achieving AUC values of 0.9805 on Amazon, 0.9208 on YelpChi, and 0.8719 on S-FFSD (Zuo et al., 27 May 2026). This line of work is important because several FRAUDGUESS variants rely on structured relational signals rather than rich natural-language node attributes.
For text classification, Chadalavada et al. distinguish scams from non-scam fraud in CFPB complaint narratives using a strict-conjunction ensemble of Gemini and GPT-4 prompt variants. On a hand-labeled training set of 02 with 64% scams, the reported precision is 0.95, recall is 0.84, and 03; on a 2,569-complaint subset, a manual 10% check yields precision 0.97 (Chadalavada et al., 2024). This work is methodologically adjacent to the RAG-based FRAUDGUESS because it highlights prompt design, high-precision operating points, and the importance of separating “scam” from broader “fraud.”
In financial-report fraud analysis, AuditFraudBench evaluates LLMs on Profit Source Attribution, Misleading Narrative Detection, and Fraud Pattern Classification using authentic filings, XBRL facts, and SEC AAERs. The benchmark shows that models still struggle to jointly reason over financial figures, disclosure framing, restatement evidence, and enforcement-grounded fraud mechanisms (Liu et al., 6 Jun 2026). This is salient for any FRAUDGUESS extension aimed at corporate disclosures rather than payments or messages.
Finally, Benford-based reasoning has an explicit caveat. “Double-Crossing Benford’s Law” constructs manipulated datasets with arbitrary minimum, maximum, mean, and size while preserving perfect first-digit Benford proportions, and recommends augmenting first-digit checks with second-digit, divergence, range, and smoothness diagnostics (Kazemitabar, 2021). This matters directly for the blockchain FRAUDGUESS, whose strongest features are Benford-derived.
6. Limitations, misconceptions, and open directions
One common misconception is that Benford conformity is itself strong evidence against fraud. The supplied literature rejects that view. The blockchain FRAUDGUESS shows that Benford-derived features are highly informative for Ethereum address classification, but “Double-Crossing Benford’s Law” shows that a fraudster can generate data with arbitrary 04, 05, 06, and 07 while preserving perfect first-digit Benford proportions (Gridley et al., 2023, Kazemitabar, 2021). The natural inference is not that Benford features are unhelpful, but that they are insufficient in isolation.
The blockchain blueprint lists additional technical limitations. The 08 statistic performs poorly when 09. A contract-versus-EOA split may be necessary for separating smart-contract schemes from traditional Ponzi behavior. The current system omits “UsedObfuscationTool,” suggesting a gap around mixers and coinjoin-like obfuscation. The same source also notes adversarial robustness as an open problem because scam operators may adapt to Benford tests, and recommends graph neural network embeddings as a richer alternative to purely hand-crafted structural features (Gridley et al., 2023).
The RAG-based FRAUDGUESS has a different failure surface. Its performance depends on evidence quality, chunking, retrieval relevance, threshold selection, and prompt discipline. The best-practice guidance therefore emphasizes pruning outdated passages, enforcing a minimal similarity threshold when adding evidence, version-controlling the evidence store, and explicitly instructing the LLM to “reason only over provided snippets” and “Do not invent facts beyond these excerpts” (Chan et al., 27 Jan 2026). These are not incidental implementation details; they are the controls by which the system limits hallucinations and maintains groundedness.
The literature also shows that “fraud” is not a monolithic label. Chadalavada et al. define scams as cases where the complainant was tricked into self-harmful actions, whereas non-scam fraud involves unauthorized third-party action, and they recommend treating the ensemble as task-specific rather than a general scam detector (Chadalavada et al., 2024). AuditFraudBench makes an analogous distinction in financial reporting by separating profit-source attribution, misleading narrative detection, and fraud pattern classification, and it finds persistent omission blindness and category-boundary confusion in current LLMs (Liu et al., 6 Jun 2026). This suggests that any generalized FRAUDGUESS deployment must match its fraud ontology to the domain.
A final limitation concerns human oversight. The financial micro-cluster system is explicitly analyst-in-the-loop: suspicious islands are selected by a human, and justification is visual and forensic rather than purely probabilistic. The RAG pipeline similarly routes flagged content through analyst review. A plausible implication is that FRAUDGUESS, in its strongest formulations, is not a fully autonomous adjudicator. It is a decision-support framework that elevates rare patterns, grounds them in evidence, and supports professional review (Cordeiro et al., 19 Sep 2025, Chan et al., 27 Jan 2026).