Spark-based graph motifs expose fraud rings in massive transaction networks

A team of computer scientists has built a scalable graph-mining framework that hunts down circular fraud schemes in enormous financial transaction networks, completing in seconds computations that push rival methods into memory errors and hours-long stalls. The approach, called FRGF, runs on Apache Spark GraphFrames and detects coordinated rings of buyers and sellers who trade securities among themselves in loops, at rising prices and timestamps, to extract illegal profits. The work appears in the International Journal of Data Science and Analytics.

Circular fraud is a systematic method of illegally extracting money from multiple parties in a coordinated, circular manner. In a typical scheme, a seller offloads a security to a buyer, the security passes through a chain of intermediaries, and the original seller eventually repurchases it at a higher price, closing the loop with a guaranteed gain. Detecting these rings is one of the most challenging problems in the financial domain, because the schemes involve multiple parties working together, mixing legitimate and suspicious transactions, and the telltale pattern is buried in millions of ordinary trades.

The researchers, T. Ramalingeswara Rao, Pradumn Kumar Pandey and Akrati Saxena, model transaction data as a weighted directed graph in which nodes represent buyers and sellers, and edges carry multiple attributes: timestamps, amounts, prices and the securities traded. A candidate fraud ring must satisfy two mathematical constraints. First, timestamps along the cycle must increase monotonically, so the security moves forward in time around the loop. Second, the amount on the first edge must be greater than or equal to the sum of the amounts on all remaining edges, a property that flags illegally obtained profit. Between any single seller-buyer pair there may be many transactions at different timestamps, so the algorithm must compare every combination; in a ring of order n with m rows of timestamps across n edges, the number of required comparisons grows as m to the power n.

The team developed three algorithms in sequence. FREJ extends Johnson’s classic algorithm for enumerating all simple cycles in a directed graph, adding the timestamp and amount constraints, but it is implemented in Python NetworkX and does not scale. FRCL uses closed-loop pattern queries in the Neo4j Cypher query language and offers intuitive visualization, but it too stalls on large graphs. FRGF, the centerpiece, integrates Spark GraphFrames with the concept of motifs, structural subgraph patterns expressed in a domain-specific language, to compute all simple cycles of arbitrary order in a distributed fashion. A circular motif begins and ends at the same node, forming a closed loop, and the framework filters these loops first by temporal ordering and then by the amount threshold, yielding what the authors call valid cycles or sorted fraud rings.

Experiments on a proprietary buyer-seller transaction dataset of 346 nodes and 110,079 edges, obtained under a non-disclosure agreement, show the scale of the gap. The FREJ algorithm could not process any network exceeding 67 nodes and 300 edges, and on a graph with 71 nodes and 300 edges it found 1,852,981 total cycles, of which only 19 met the validity criteria, while failing with memory errors on the full dataset. FRCL computed all simple cycles up to order five on the same small graph but also hit memory errors beyond 71 nodes and 350 edges. FRGF, by contrast, enumerated 802.91 million cycles on a graph with 350 edges and 79 nodes, identified 1,618 valid cycles, and completed the enumeration of all cycles in the full dataset within seconds, with a maximum execution time of 9.27 seconds compared with more than 6,045 seconds for FREJ and more than 1,900 seconds for FRCL, neither of which terminated.

The framework also outperformed the alternatives on the public IBM anti-money laundering benchmark, the synthetic LI-Small_Trans dataset of roughly 7 million transaction records and 577,944 nodes. As graph size grew from 10,000 to 40,000 edges, FRGF detected 12,496 cycles at the smallest scale against 6,440 for FREJ and 9,256 for FRCL, reaching 49,902 cycles at 40,000 edges. On the full-scale runs, at 2 million edges no method detected any cycles, and at 4 million edges all three terminated with a small number of valid cycles, but beyond that point FREJ and FRCL failed to terminate while FRGF kept running, finding 25 valid cycles at 6 million edges and 41 at 7 million edges, after filtering 79.7 million candidate cycles, in 1,072.05 seconds.

Beyond raw cycle counts, the researchers analyzed the structure of the suspicious subgraphs using centrality measures and community detection. On the BST data, nodes such as P5, P26, P1 and P6 emerged as highly connected transactional hubs, with P5 showing the highest total degree and, together with P26, the highest betweenness scores, marking them as bridge accounts connecting multiple entities. On the LI-Small_Trans data, accounts 8068CE0D0 and 8068D9920 repeatedly topped the degree, betweenness, closeness and PageRank rankings, suggesting they play structurally important roles in the suspicious network. Louvain community detection on the BST suspicious subgraph found a top community with a density of 0.715789 across 20 nodes and 136 edges, a tightly connected cluster the authors associate with coordinated suspicious transaction patterns.

To measure detection quality, the team framed the constraint pipeline as three models: M1 detects structural cycles only, M2 adds temporal consistency, and M3 applies all structural, temporal and amount constraints. Because the framework is constraint-driven rather than a supervised classifier, M3 served as the reference set of valid fraud cycles. On the BST dataset, for order-3 cycles, M1 flagged 1,245,904 cycles with 640 false positives, M2 cut false positives to 177, and M3 identified all 2,648 fraudulent instances among 101,614 analyzed cycles with zero false positives, perfect precision and perfect recall. For order-4 cycles, M3 detected all 335 fraudulent cases with zero false positives using only 2,153 cycles, while M1 produced 359 false positives. The same pattern held on the LI-Small_Trans data, where order-3 false positives fell from 590 in M1 to 77 in M2 and zero in M3, with all 680 fraudulent instances retained.

The authors also compared FRGF against graph neural networks, which estimate cycle counts through learned message passing rather than exact enumeration. Vanilla message-passing GNNs are bounded by the one-dimensional Weisfeiler-Lehman test and cannot exactly count cycles regardless of depth or width, and in the experiments the GCN, GAT, GraphSAGE and GIN models consistently overestimated cycle numbers, predicting between 707 and 4,670 order-3 cycles on a graph where Johnson’s algorithm found 31 and FRGF found 98 valid cycles. On the largest LI-Small_Trans graph of 4.35 million edges, Johnson’s algorithm could not complete, while FRGF detected 302 order-3 and 825 order-4 cycles in roughly 64 to 267 seconds without any training phase. Noise-perturbation experiments on a 10,000-edge BST sample further showed that valid cycle counts stayed stable, around 139.5 thousand for order-3, under amount perturbations of up to 20 percent, because structural cycle discovery is separated from transaction-level validation.

The researchers note that FRGF has so far been evaluated on static and synthetic datasets, and they point to extensions toward heterogeneous and multi-layer transaction networks, streaming environments, blockchain-based systems and real-time graph processing as future work. The framework is training-free, interpretable and scalable, and its authors argue that exact, constraint-based cycle enumeration can serve as a fundamental graph-processing component for anti-money laundering, terrorist financing detection and financial crime investigation, domains where knowing precisely which closed loops of money and securities exist matters more than approximating how many there might be.

Subject of Research: Scalable detection of circular fraud rings in weighted financial transaction networks using Spark GraphFrames motif mining

Article Title: Fraud rings detection in weighted transaction networks with multiple attributes using Spark GraphFrames

Article References: Rao, T. R., Pandey, P. K., & Saxena, A. (2026). Fraud rings detection in weighted transaction networks with multiple attributes using Spark GraphFrames. International Journal of Data Science and Analytics, 22(1), Article 363. https://doi.org/10.1007/s41060-026-01299-z

Image Credits: AI Generated

DOI: 10.1007/s41060-026-01299-z

Keywords: fraud rings, circular fraud, Spark GraphFrames, cycle detection, financial transaction networks, anti-money laundering, graph motifs, timestamp constraints, amount threshold, graph neural networks, centrality measures, community detection