A methodological extension of a graph-based mobile-payment fraud detection project developed at AIMS Cameroon.
This repository documents a research-oriented reanalysis of a mobile-payment fraud detection project. The original study represented customers and transactions as a directed weighted graph and used network features with XGBoost. The extension asks a narrower methodological question:
Does temporal network context provide incremental predictive value for mobile-payment fraud detection under leakage-free evaluation?
The central contribution is not a new production fraud model. It is a leakage-aware experimental framework that reconstructs predictors from historical information, evaluates feature groups under controlled splits, and tests whether apparent network signal survives stricter validation.
Original project → V2 → V3
- Original project: graph-based fraud detection with XGBoost; reported ROC-AUC = 0.9342.
- V2: history-only temporal/network/community features, chronological snapshots, leakage tests, drift diagnostics, and nested feature-group evaluation.
- V3: early-history sensitivity, fixed customer-level endpoint experiments, paired bootstrap inference, and model/feature stability analysis.
The original 0.9342 score is retained as a reported V1 benchmark only. It is not treated as directly comparable with the clean V2/V3 estimates because the original workflow constructed neighbor_fraud_rate from retrospective fraud labels before splitting.
The primary V2 chronological experiment produced:
| Model | Feature set | Test ROC-AUC | Test PR-AUC |
|---|---|---|---|
| M_A | Static customer attributes | 0.7451 | 0.1424 |
| M_B | Static + temporal behavior | 0.5126 | 0.0542 |
| M_C | Static + temporal + network | 0.5070 | 0.0526 |
| M_D | Static + temporal + network + community | 0.5070 | 0.0525 |
The result is a methodological finding: the original high network benchmark did not reproduce when the retrospective label-derived feature was removed and predictors were reconstructed from transaction history only.
A secondary fixed customer-level experiment examined progressively longer history windows:
| History available | ROC-AUC | PR-AUC | Brier |
|---|---|---|---|
| 7 days | 0.5127 | 0.0528 | 0.2403 |
| 14 days | 0.4961 | 0.0506 | 0.2387 |
| 30 days | 0.5029 | 0.0529 | 0.2360 |
| 60 days | 0.5138 | 0.0525 | 0.2344 |
| 90 days | 0.5292 | 0.1087 | 0.2265 |
| Full | 0.5246 | 0.1055 | 0.2266 |
The 90-day cutoff falls about one hour after the final transaction timestamp in this dataset, so the 90-day and full-history conditions are effectively endpoint-history comparisons rather than independent long-horizon prospective tests. This is not a claim of real-time or pre-event fraud detection.
On the fixed full-history customer split:
| Model | ROC-AUC | PR-AUC | Brier |
|---|---|---|---|
| M_A Static | 0.5120 | 0.0529 | 0.2420 |
| M_B Static + Temporal | 0.5230 | 0.1062 | 0.2268 |
| M_C + Network | 0.5309 | 0.1088 | 0.2231 |
| M_D + Community | 0.5227 | 0.1078 | 0.2229 |
Paired stratified bootstrap inference used 2,000 replicates on the same test customers across models. The temporal block improved PR-AUC over static features by +0.0533 (95% CI 0.0386–0.0684). Adding network features after temporal behavior changed PR-AUC by only +0.0026 (95% CI −0.0025–0.0079). Community features changed PR-AUC by −0.0010 (95% CI −0.0051–0.0029).
The defensible conclusion is therefore:
Under the supplied endpoint-label formulation, temporal transaction behavior contains the clearest incremental predictive information; network and community features do not demonstrate statistically convincing incremental PR-AUC over the temporal baseline.
For temporal-only XGBoost models trained with five seeds:
| Horizon | Mean ROC-AUC ± SD | Mean PR-AUC ± SD |
|---|---|---|
| 90 days | 0.5245 ± 0.0043 | 0.1059 ± 0.0017 |
| Full | 0.5251 ± 0.0022 | 0.1067 ± 0.0007 |
Full-history feature-rank agreement was stronger than 90-day agreement: mean pairwise Spearman rank correlation was approximately 0.728 versus 0.577. The mean pairwise top-5 gain-feature overlap was 56% at both horizons. For SHAP, the same five leading features appeared in the top five at both horizons: 30-day incoming amount, median inter-arrival time, account age, age, and 30-day outgoing amount. The evidence supports reproducible broad behavioral patterns, but not identical feature rankings.
The repository currently contains 11 automated tests, covering temporal cutoff enforcement, label independence, network schemas and weighted-degree calculations, community schemas, and post-construction label attachment. Run pytest -q from the repository root.
At a historical cutoff (t), the feature vector is constructed only from customer information and transactions observed through (t):
[ \mathcal I_t = {\text{customer information and transactions observed up to }t}. ]
The historical transaction graph is:
[ G_t=(V_t,E_{\le t}), \qquad E_{\le t}={e_j:\tau_j\le t}. ]
The prediction unit is a customer snapshot at a prediction time.
Because the fraud labels do not include confirmation timestamps, the primary target is described as eventual customer-level fraud classification from history-only information. It is not described as cold-start detection, real-time detection, or future-event prediction.
| Split | Period | Role |
|---|---|---|
| Train | 2025-11-11 → 2026-01-09 | Model fitting |
| Validation | 2026-01-10 → 2026-01-24 | Model/threshold selection |
| Test | 2026-01-25 → 2026-02-09 | Later-period endpoint evaluation |
Each V2 snapshot uses transactions observed through its own cutoff, while the static endpoint fraud label is attached only after feature construction. Thus the design is leakage-free with respect to retrospective labels, but it is not a true prospective fraud-event evaluation: the dataset provides no fraud-confirmation timestamp that would define a future event horizon.
- Static: age, account age, KYC completion, location.
- Temporal behavior: counts, amounts, counterparties, recency, active hours, inter-arrival statistics, daily concentration, transaction mix, and device behavior over fixed historical windows.
- Network structure: directed degree, weighted degree, PageRank, clustering, reciprocal-neighbor structure, and historical changes.
- Community structure: historical weighted communities and community-level transaction characteristics.
The primary pipeline explicitly prohibits:
- random train/test splitting as the main temporal estimate;
- full-period graph construction before historical feature extraction;
- future transactions in a historical feature vector;
- retrospective fraud labels inside predictors;
neighbor_fraud_ratein the primary analysis;- future-derived community assignments;
- normalization fitted on future periods.
The original workflow calculated a neighbor_fraud_rate feature using the complete final fraud-label table before the train/test split. Because the labels are retrospective and have no confirmation times, this feature can transfer target information across the split. The original random split also mixes observations from different periods.
This repository therefore treats the original 0.9342 ROC-AUC as a historical benchmark from the initial project, not as evidence of leakage-free generalization.
The supplied project data contain:
- 100,000 customers;
- 351,836 transactions;
- 5,000 fraud-labelled customers (5% prevalence);
- transaction timestamps spanning 2025-11-11 to 2026-02-09;
- hourly timestamp resolution in the supplied transaction stream.
The release includes the three raw CSV files used by the experiments. See data/README.md for schemas, validation, SHA-256 checksums, provenance, and redistribution notes. The transaction CSV is ~27.8 MB; GitHub's browser interface limits non-media uploads to 25 MiB, so this file is committed through Git instead.
network-based-fraud-ring-detection/
├── README.md
├── requirements.txt
├── requirements-tested.txt
├── pytest.ini
├── .gitignore
├── data/
│ └── README.md
├── docs/
│ ├── methodology.md
│ ├── results.md
│ └── reproduction.md
├── notebooks/v2/
│ ├── 01_temporal_data_audit.ipynb
│ ├── 02_leakage_free_temporal_features.ipynb
│ ├── 03_temporal_network_features.ipynb
│ └── 04_temporal_community_features.ipynb
├── src/v2/
│ ├── temporal_features.py
│ ├── network_features.py
│ ├── community_features.py
│ ├── fast_network.py
│ └── fast_community.py
├── scripts/
├── tests/
├── results/
│ ├── v2/
│ ├── v3/
│ ├── v3_decomposition/
│ ├── v3_incremental_inference/
│ └── v3_stability/
├── figures/
└── reports/original/
The main empirical story is summarized visually below.
This repository is released under the MIT License. A machine-readable citation record is provided in CITATION.cff.
git clone <YOUR-REPOSITORY-URL>
cd network-based-fraud-ring-detection
python -m venv .venv
source .venv/bin/activate # Windows: .venv\Scripts\activate
pip install -r requirements.txtPlace the three source CSV files in data/:
data/project3_customers.csv
data/project3_transactions.csv
data/project3_fraud_labels.csv
Then run the test suite:
pytest -qExpected validation: 11 tests passed.
See docs/reproduction.md for the recommended experiment order. A core dependency-version snapshot used for repository verification is provided in requirements-tested.txt; it is not claimed to be the historical experiment environment.
This repository is deliberately conservative about what the experiments establish.
- The endpoint fraud labels do not contain fraud-confirmation timestamps, so the experiments cannot establish genuine pre-event detection.
- The V2 chronological design is preferable to the original random split for testing history-only predictors, but the endpoint target remains retrospective.
- Several temporal features exhibit substantial covariate shift across observation cutoffs. Some, such as activity span, mechanically increase as more history becomes available.
- Some network relative-change variables were numerically unstable near zero and require stabilization before being treated as a production-quality representation.
- The large-scale community experiment uses weighted asynchronous label propagation as a scalable baseline; the research layer also contains a weighted Louvain implementation. These algorithms are not assumed to be equivalent.
- The experiments are offline research analyses, not deployment or latency benchmarks.
The most useful outcome of the project is methodological: a strong-looking fraud result can disappear when retrospective label-derived graph features and random evaluation are replaced by history-only feature construction and temporally structured evaluation. The subsequent V3 analyses show how to separate modest behavioral signal from unsupported claims about graph structure.
The repository is intended as a transparent research portfolio artifact for graduate/doctoral research applications, emphasizing reproducibility, leakage control, uncertainty, ablation, and negative results.
The reports/original/ directory preserves the original project report, executive summary, and presentation for provenance. The V2/V3 result tables in results/ are compact research artifacts; customer-level prediction files and intermediate graph caches are intentionally excluded from the public package.
See docs/results.md for the consolidated empirical record and docs/methodology.md for the methodological rationale.