🤖 AI Summary
This study addresses the inefficiency in detecting organized abuse—such as credit card fraud and promotional misuse—on large-scale online platforms. Grounded in the fraudster’s trilemma theory, the work reveals the structural invariance of “centralized cash-out” behavior and proposes a detection framework that is label-free, nearly parameter-free, white-box interpretable, and evasion-resistant. Relying solely on graph topology, the method aggregates low-precision individual weak signals into high-accuracy collective decisions through a linear-complexity (O(|E|)) statistical mechanism, without requiring seed users or domain-specific business logic. In real-world deployment, weak signals with only 16% precision are amplified to achieve over 91% precision and 99% recall, and the approach successfully detects cross-tier credit card fraud, demonstrating its robust generalizability across diverse attack patterns.
📝 Abstract
Large-scale online service platforms face severe challenges from organized platform abuse: multiple forms such as credit card fraud and promotion abuse continually emerge, characterized by large numbers of involved accounts, rapid outbreaks, and constantly shifting tactics. Existing mainstream approaches, whether heuristic rules limited in precision, supervised learning with insufficient generalization, or graph models that are engineering-heavy and dependent on seed users, have failed to address such threats effectively.
This paper returns to first principles and, starting from the economic constraints of fraudulent behavior, proposes the Fraudster's Trilemma: organized attackers cannot simultaneously achieve scale, low cost, and dispersed cash-out. Building on this theory, we derive a robust structural invariant in organized fraud, namely centralized cash-out, and use a simple statistical method to turn low-precision individual weak signals into high-precision strong decisions. The method requires no labels, is nearly parameter-free, white-box interpretable, has linear complexity O(|E|), avoids cold-start issues, and its detection logic possesses the "open-hand" property: attackers cannot evade it even when fully informed.
We validate the approach on two real fraud incidents in backtests. In the promotion abuse case, a single near-zero-cost weak signal (global Precision of only 16%) after structural amplification achieves Precision above 91% and Recall exceeding 99% (z=10.0); at a higher threshold (z=40.0), Precision reaches 93.7%. In the credit card fraud case, an infrastructure-layer weak signal (device spoofing) successfully detects payment-layer attacks without any business-logic linkage, revealing the framework's natural MO-agnostic property: it relies more on the structural invariant than on signal semantics.