Ant Credit’s “Pay Later” service offers users a revolving credit line for purchases, enabling a buy-now-pay-later experience. A small subset of users, however, exploit this facility not for genuine consumption but to withdraw loan funds for other purposes, a process known as cash-out. Since no real goods or services change hands, these transactions diverge from true consumption and pose significant financial risk. In practice, cash-out schemes often exhibit distinctive short-term money-flow anomalies between buyer and seller accounts (Chen et al., 2024; Ji et al., 2022). Common patterns include:

An effective detection framework must recognize these multi-party, time-sensitive patterns in real time to block cash-out activity before funds are irreversibly disbursed.

We model the stream of transactions as a real-time dynamic graph with millisecond-level query latency and minute-level update propagation. Nodes represent user or account entities, and time-stamped edges represent transactions (transfers or payments) with attributes such as amount and platform. The graph retains edges within a sliding window of k days (typically a few days); older edges beyond k days are automatically removed (Barros et al., 2021). This ensures the graph reflects only the most recent activity.

Fraudulent signals often manifest within minutes or hours before a suspicious transaction. Therefore, our framework focuses on modeling recent behavior via the live graph. Longer-term historical patterns for each user are captured offline through persisted feature profiles, balancing detection accuracy with system efficiency (Weng et al., 2023). Figure 1 illustrates three successive one-minute snapshots of the dynamic capital-flow graph between 11:58 a.m. and 12:00 p.m. on March 5. Green edges represent transfers and blue edges represent payments. Note that the edge labeled “G ↔ B” disappears at 11:59 a.m. after exceeding the retention window, while a new payment edge appears between nodes F and B at the same time. This example highlights both edge expiry and real-time insertion as the graph evolves.

At the time of each target transaction (the transaction being evaluated), we extract a snapshot of the dynamic graph centered on the entities involved. Since we only care about the buyer and seller related to the current transaction, we construct subgraphs from the full graph that contain the information necessary for detecting cashback fraud. Our subgraph construction is carefully designed to balance scale and performance (Deng et al., 2022, 2023; Zhong et al., 2023):

The subgraph must include sufficient information to capture the classic fraud patterns described in Section 2.1. Overly aggressive pruning could omit important signals.

The online transaction system may process billions of events per day. Under such extreme concurrency, even slight increases in per-transaction processing time (due to complex graph construction) can cause performance bottlenecks or system failures, leading to unacceptable risk.

Following conventional link prediction heuristics, we first construct neighbor-centered subgraphs around the buyer and around the seller. By learning the clustering characteristics of the neighbors in these subgraphs, the model can effectively capture fraud patterns 1 and 2 defined earlier.

Buyer-centered subgraph: In financial transaction networks, buyer nodes typically exhibit a relatively low degree, meaning they interact with a smaller number of entities. To capture potentially complex fraud patterns, such as a buyer interacting with a mule account that then interacts with other suspicious entities, it is both feasible and beneficial to explore a wider neighborhood. Therefore, we include all neighbors up to 2 hops from the buyer. This wider view allows the model to learn from the buyer’s immediate and secondary connections. To manage computational load, we limit the sampling to a maximum of 30 edges per hop, sorted by time to select the 30 most recent interactions. This ensures the subgraph remains computationally tractable while retaining the most timely and relevant activity. Figure 4 shows an example buyer-centric subgraph.

Seller-centered subgraph: Conversely, sellers, especially large merchants, often act as high-degree hub nodes, potentially involved in tens of thousands of transactions within a short period. Constructing a 2-hop subgraph for a major seller would lead to a combinatorial explosion in size, making real-time processing computationally infeasible and violating the strict low-latency requirements of a live payment system. To balance performance and signal, we adopt a more conservative 1-hop neighborhood for sellers. This captures the seller’s direct interactions, which are crucial for fraud detection, without overwhelming the system. To further focus on the most relevant signals, we sample the seller’s transaction edges based on transaction amount, guided by the known monetary distribution of cashback fraud. This heuristic sampling maximizes the probability of including fraudulent patterns while keeping the subgraph size manageable for real-time inference. This asymmetric design is a deliberate engineering choice to optimize the information-to-computation ratio in a production environment. Figure 5 shows an example seller-centric subgraph.

Interaction path subgraph: Fraud patterns 3 and 4 involve multi-hop fund flows between specific buyers and sellers. To capture these, we preserve the interaction paths between the buyer and seller. Due to the sampling above, the direct buyer–seller connection (especially if mediated by intermediaries) might not appear in either center subgraph. Thus, we construct a separate path subgraph connecting the buyer to the seller. Starting from the buyer node, we perform a breadth-first search (BFS) on the full graph to find all paths to the seller up to length 3 (yielding chains like buyer → intermediary → intermediary → seller). We then extract the subgraph induced by those path nodes and edges. This path-focused subgraph explicitly captures the transactional chains between the buyer and seller, facilitating the model’s learning of fraud patterns 3 and 4. Figure 6 illustrates an example path subgraph.

Our framework jointly learns from all three subgraphs (buyer-centric, seller-centric, and buyer–seller interaction). The buyer and seller neighbor subgraphs both aim to capture local neighborhood clustering features, so we use a single graph aggregation network (with shared parameters) for both. The path subgraph focuses on modeling fund flow patterns between the buyer and seller, which is a different objective; hence, it is handled by a separate graph aggregation network with its own parameters (Aburbeian and Fernández-Veiga, 2024; Raju et al., 2024). Through these two networks, we obtain four representation vectors: a buyer’s neighborhood (clustering) representation, a seller’s neighborhood representation, a buyer’s interaction-path representation, and a seller’s interaction-path representation. We concatenate these representations and feed them into a final discriminative model (such as a feedforward neural network) to produce the fraud risk score for the transaction.

Our framework is deployed in a production environment using a two-tier architecture (Figure 3). The offline system handles data preparation and model training, while the online system performs real-time inference. Offline, we consume log data from transaction servers, organize it into event streams, sample streams, and feature streams, and feed these into a simulation platform to construct the historical graph data. The simulation generates training samples for the graph learning model. Model training (including subgraph sampling and C2GAT computations) is performed on a distributed training platform.

The online system maintains the live dynamic graph and performs real-time risk scoring. A dynamic graph controller manages data flows and scheduling between components. The main online processes (labeled in Figure 3) are: (1) retrieving the relevant subgraph structures from the online graph database; (2) retrieving associated node/edge features from the feature platform; and (3) combining the subgraph and features as input to the online inference service, which computes the risk score.

In our industrial setting, the scale of data is enormous: roughly 300 million unique buyers and sellers active per day, about 1 billion transactions per day, and a lookback window of 3 days. Thus, the online graph database must handle on the order of 900 million nodes and 3 billion edges in memory at any given time. Despite this scale, our system can operate with millisecond latency, as discussed in Section 5.3.

Timestamps on transactions (edges) are critical in financial fraud detection. We design a temporal encoder that maps time information into a high-dimensional vector space, capturing fine-grained temporal patterns and ordering of events. First, we transform absolute timestamps into relative times with respect to the current transaction of interest. This centers the time features on the event being scored. Building on this, and inspired by Mercer’s theorem, we represent the temporal kernel function using a learned mapping. Formally, we define a temporal mapping function as:

where ϕ i ( t ) are basis functions and c i are coefficients.

Empirically, temporal patterns can be characterized by a series of periodic kernel functions. According to the theorem introduced in reference (Wang et al., 2021), a mapping function Φ ( ⋅ ) with frequency ω can be further formalized as:

This Fourier series representation provides better truncation properties because the truncated d-dimensional mapping function Φ ω , d M ( t ) can approximate the original infinite-dimensional mapping. Subsequently, the mapping functions of k periods (i.e., ω 1 , ω 2 , … , ω k ) are concatenated to form the final temporal encoding:

This temporal encoding, defined by Equations 1–3, is initially node-independent: any two nodes have the same encoding for the same time difference Δt . However, in our fraud scenario, the significance of a given time interval can vary by node. For example, a transaction at 2 a.m. might be unusual for one user (indicating risk) but normal for another user who frequently transacts at night. Therefore, we introduce a node-specific temporal encoding. For a specific node v, we define:

Equation 5 combines the node-specific temporal encodings across all k frequency components into a unified representation. where c i ( v ) : ℝ d ← ℝ ( i = 1 , 2 , … ) is a set of mapping functions that use node attributes as input to calculate Fourier coefficients. Multilayer perceptrons are used in experiments to implement c i ( v ) because of their excellent modeling capability for complex interactions, i.e., c i ( v ) = MLP ( f v ) , where f v ∈ ℝ d is the attribute feature vector of node v. Furthermore, by forcing the last layer of the perceptron to output positive values, we satisfy the inherent properties of Mercer theory.

Frequency Selection Rationale. The temporal encoding frequencies ωk are selected based on domain knowledge of financial transaction patterns and validated through sensitivity analysis. We use three primary frequencies:

We incorporate the above temporal encoding into a graph attention mechanism that operates in continuous time. As illustrated in Figure 2, the C2GAT module learns to weigh a node’s neighbors based on both structural context and temporal relevance. It computes attention scores between a target node and each of its neighbors, taking into account when interactions occurred and the context of those interactions (Raju et al., 2024).

Specifically, at layer l of C2GAT, given a target node v t at time t , an attention distribution is created for the neighbor node set N v t ( t ) = v ∣ t v < t to fuse the representation of each neighbor node. Translation invariance exists in the defined temporal kernel function, so we use t − t v v ∈ N v t ( t ) . At time t, the continuous-time and context-aware attention value between the node pair—the target node v t and any of its neighbors v ∈ N v t ( t ) , can be determined via Equations 6 and 7 as follows:

where W Q and W K are two mapping matrices, the former used to obtain the “Query” matrix and the latter used to obtain the “Key” matrix; e v t , v ( t ) is the edge feature vector between nodes v t and v at time t; h ( l − 1 ) ∗ is the node output at layer l − 1 of C2GAT. For more stable training, this attention mechanism can be flexibly extended to multi-head attention. As described above, a key factor in the attention values between target nodes and neighbor nodes is the temporal context information and mutual influence between node neighbors. To explicitly describe such influence, we designed a context aggregation function called F ( l − 1 ) ( v , t , t v ) to implement this functionality. For a target node v t , any neighbor node v, and its corresponding time t v , the following neighbor set is defined: S v t , v ( t v ) = v ′ ∈ N v t ( t ) ∣ t v ′ ≤ t v . Furthermore, we use two aggregation functions to implement F ( ⋅ ) :

where W ∈ ℝ ∣ S u , v ( t v ) ∣ × d × d is the convolution kernel.

By stacking L layers of the aforementioned C2GAT layers, we can leverage higher-order structural information in dynamic graphs from broader and deeper dimensions. Thus, each node’s representation at time t is denoted as h v T ( t ) = h ( L ) v ( t ) v ∈ V . Since user representation is the focus of this work, we rewrite each user’s representation at time t as h u T ( t ) .

Distinction from Prior Work. While C2GAT shares the general paradigm of temporal graph attention with methods like TGAT and TGN, it introduces two key innovations:

(1) Node-Specific Temporal Encoding. Unlike TGAT’s fixed Fourier basis where all nodes share identical time representations, C2GAT learns node-dependent Fourier coefficients (Equation 4). This allows the model to capture that the same time interval (e.g., 2 h) may have different significance for different entities; a late-night transaction may be anomalous for one user but routine for another. Our ablation (Section 5.3) shows this contributes approximately 4.9 percentage points to P@20R.

(2) Explicit Context Aggregation. TGAT computes attention scores independently for each neighbor without considering inter-neighbor relationships. C2GAT introduces the context function (Equations 8–10) that explicitly aggregates information from neighbors preceding a given neighbor in time. This captures sequential dependencies among a node’s interactions, critical for detecting fraud patterns where the ordering of transactions matters. The recurrent variant (Our-R) consistently outperforms the convolutional variant, confirming the value of sequential context modeling.

In the cashback fraud detection scenario, we formally define a sample D as a quadruple D = ( u , , , v , , , t , , , y ) . Here, u represents the buyer; v represents the seller; t represents the timestamp when the sample occurred; y is the label, which in the cashback fraud detection scenario indicates whether the transaction was confirmed as fraudulent during the subsequent tracking period. The final dataset we use is S D . Due to the large number of users and transactions involved, we use random negative sampling to approximate the calculation. Following a maximum likelihood estimation strategy, the final loss function is given by Equation 11:

where S D = S D + ∪ S D − , S D − represents all negative samples obtained after fixed-ratio downsampling of negative samples, S D + is the set of all positive samples in the training set; C ( ⋅ , ⋅ ) represents the cross-entropy loss function; ‖ ω ‖ 2 indicates that an L₂ regularization term is used.

Given the industrial-scale datasets involved (with millions of samples and high-dimensional features), we used a parameter server-based distributed training setup. Our training cluster consisted of 10 worker nodes and 2 parameter-server nodes. For a fair comparison, we aligned our hyperparameters with those used by strong baselines.

We used the popular Adam optimizer for gradient optimization, with a learning rate of 10⁻⁴, a regularization term of 10⁻³, and a batch size of 256. For simplicity, we uniformly set the hidden representation dimension for users and events in the graph to 64. Notably, we used a 3-layer graph neural network architecture during aggregation. By expanding the set of nodes participating in aggregation, we increased the information available to the model and further slightly improved model performance.

For the temporal encoding function, we selected temporal encoding parameters consistent with those in reference (Thongprayoon et al., 2023) and set the normalized time unit to 1 day (86,400 s). The frequency parameters in the Fourier basis were carefully tuned to capture both short-term and long-term temporal dependencies, with multiple frequencies covering patterns from hours to weeks.

The experiments in this section are designed solely to validate the core temporal graph learning capabilities of C2GAT—specifically, temporal encoding effectiveness and context-aware attention design—through reproducible comparison with academic baselines. These datasets (Reddit, Wikipedia, MOOC, LastFM) represent general interaction networks that lack fraud semantics, exhibit different class distributions, and contain no adversarial dynamics. Readers should not extrapolate fraud detection performance from these results; Section 5.3 provides the appropriate evidence for domain-specific claims. Table 1 summarizes the statistics of these datasets.

We compared C2GAT against eight baseline methods across three categories:

Next, we evaluate our framework on real-world production data from Ant Financial’s cashback fraud detection system. We consider two large-scale datasets: one from Taobao (online marketplace) transactions and one from offline merchant transactions (e.g., in-store QR code payments). Table 5 provides an overview of these datasets. Each dataset spans several months of transactions and uses labels obtained via retrospective analysis (combining rule-based triggers and manual verification after the fact). Because fraud labels are confirmed with a delay (often up to a month later), these datasets were compiled to ensure we had ground truth for evaluation. We also downsampled the negative (non-fraud) transactions in the training set to make the positive instances more prominent for learning. The test set, however, reflects the true production class imbalance.

We evaluate our deployed framework from two perspectives: detection accuracy (versus the previous production system) and system performance under real-time constraints. For detection accuracy, we use Precision at X% Recall (P@XR) as the metric, which is standard in fraud detection. P@20R, for example, is the precision when the model captures 20% of all actual fraud cases (i.e., at 20% recall). This metric reflects the precision in the “high-alert” region when only a portion of frauds are recalled, which is often of greatest interest to risk controllers.

Our experiments show that the real-time dynamic graph framework significantly outperforms the existing machine learning baseline across both industrial datasets. Compared to the MLP model with manually engineered real-time features, our method achieves substantial gains in P@20R: from 68.5 to 86.2% (+17.7 points) in the Taobao scenario and from 47.2 to 56.5% (+9.3 points) in the offline merchant scenario. These improvements translate to much lower false-alarm rates at the same fraud detection rate, which is highly valuable in production. Moreover, the system meets strict real-time requirements, with an average inference latency of ~18 ms and a 99th percentile latency under 30 ms when deployed in Ant’s payment infrastructure, ensuring near-instantaneous responses from a user perspective.

Label Quality and Delayed Supervision. Our industrial datasets rely on retrospectively confirmed labels, introducing challenges we explicitly acknowledge. First, label delay (14–30 days for confirmation) means models train on potentially stale patterns; we mitigate this through weekly retraining and prioritized labeling of high-confidence predictions. Second, label noise (estimated 3–5%) arises from undetected sophisticated fraud (false negatives) and overly aggressive rule flagging (false positives); we employ label smoothing (ϵ = 0.1) and confident learning techniques, yielding a 1.2-point P@20R improvement. Third, rule-based bias from the predecessor system may cause the model to replicate existing patterns rather than discover novel indicators; we address this by including a holdout set of fraud confirmed through non-rule channels (e.g., customer complaints) and auditing model coverage against rules, notably, 23% of our detected frauds were not flagged by the previous rule-based system, demonstrating complementary pattern learning. Given these factors, our reported P@20R and P@40R metrics should be interpreted as conservative lower bounds, as some evaluated “false positives” may represent undetected fraud. Practitioners should invest in faster confirmation pipelines and diverse labeling sources to improve label quality.

Table 6 compares our Real-time Dynamic Graph approach to the previous industry solution (which was a machine learning model using real-time engineered features) and also includes ablation results for our model. The ablation study further highlights the contribution of each component. Center and path subgraphs provide complementary information, and removing either degrades performance, especially the path subgraph in the Taobao setting, where its absence lowers P@20R by 6.6 points, reflecting the importance of modeling multi-hop fraud patterns. Removing edge attributes causes the most dramatic drop, even below the baseline, underscoring the critical role of transaction features (amounts, timestamps, device data, etc.) beyond pure graph structure. Disabling the C2GAT temporal encoder also reduces performance, confirming that continuous-time modeling and attention over transaction timing provide essential signals for distinguishing normal behavior from suspicious activity.

We further stress-tested the system to measure throughput and latency under increasing load. Figure 12 shows the average and 99th-percentile latencies as a function of queries per second (QPS). The framework maintains an average latency below 30 ms (and P99 below 50 ms) up to around 20 k QPS, which meets our design target. Beyond this point, latencies rise nonlinearly, indicating the system is approaching saturation. This capacity is well above the typical load in production, providing headroom for traffic spikes or future growth. Importantly, it demonstrates that an advanced graph neural network model can be deployed in a live financial system without sacrificing performance or reliability, thanks to careful system optimization and architecture design.

While our framework targets cashback fraud, its components have varying transferability. The C2GAT mechanism (node-specific temporal encoding, context-aware attention) is fully general and applicable to any temporal graph learning task. The subgraph construction strategy is moderately transferable: buyer/seller roles map naturally to sender/receiver in money laundering or account/device in account takeover scenarios; path subgraphs capture entity chains relevant to multiple fraud types. Our cross-domain experiments (Figure 10) support this, showing 75–92% performance retention when transferring across different interaction domains without fine-tuning. Domain-specific components include the asymmetric hop configuration (optimized for our degree distributions) and amount-stratified sampling (based on cashback fraud characteristics), which require recalibration for new domains. For adaptation, practitioners should: (1) analyze target domain degree distributions to set appropriate hop depths; (2) identify domain-specific features for sampling heuristics; and (3) adjust temporal encoding frequencies to match relevant behavioral cycles (e.g., minute-level for account takeover, monthly for subscription fraud).