# Dual-Scale Relational Graph Transformers for Ecosystem-Aware Fraud Detection

arXiv: https://arxiv.org/abs/2610.04138 · HTML: https://mlsanity.com/paper/2610.04138/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 10 of its 14 references that are in the map.
- First posted on arXiv 2 Oct 2026.

## Builds on (most cited first, 10 of 10)

- [Inductive Representation Learning on Large Graphs](https://mlsanity.com/paper/1706.02216/) (2017)
- [Revisiting Deep Learning Models for Tabular Data](https://mlsanity.com/paper/2106.11959/) (2021)
- [Heterogeneous Graph Neural Networks for Malicious Account Detection](https://mlsanity.com/paper/2002.12307/) (2020)
- [Relational Graph Transformer](https://mlsanity.com/paper/2505.10960/) (2025)
- [xFraud: Explainable Fraud Transaction Detection](https://mlsanity.com/paper/2011.12193/) (2020)
- [Provably Powerful Graph Neural Networks for Directed Multigraphs](https://mlsanity.com/paper/2306.11586/) (2023)
- [Semi-supervised Credit Card Fraud Detection via Attribute-Driven Graph Representation](https://mlsanity.com/paper/2412.18287/) (2024)
- [TitAnt: Online Real-time Transaction Fraud Detection in Ant Financial](https://mlsanity.com/paper/1906.07407/) (2019)
- [Spade: A Real-Time Fraud Detection Framework on Evolving Graphs (Complete Version)](https://mlsanity.com/paper/2211.06977/) (2022)
- [Spatio-Temporal Directed Graph Learning for Account Takeover Fraud Detection](https://mlsanity.com/paper/2509.20339/) (2025)

## Abstract (arXiv)

Account takeover (ATO) fraud is a growing threat to digital banking, requiring effective detection while minimizing friction for legitimate customers. Production systems predominantly rely on tabular models that score sessions in isolation, discarding the relational structure of the underlying interaction network. Although graph-based models exploit relationships among sessions and network entities, they primarily reason over local neighborhoods and therefore capture only part of the problem: fraud risk depends jointly on the local relational structure surrounding a session and the evolving global state of the fraud ecosystem. We present HERMES (HEterogeneous Relational Micro--macro graph transformer Encoder for high-risk Sessions), a dual-scale architecture that jointly models these complementary scales of information. Micro-GT captures local heterogeneous graph structure through structured, relation-aware attention over a temporally safe session neighborhood. Complementing this local representation, Macro-GT models ecosystem-level context using non-anticipative climate tokens that summarize fraud dynamics, platform shifts, and infrastructure reuse, together with adaptive class prototypes that track representative fraud and benign session patterns over time. Evaluated on more than 130 million high-risk transaction sessions from a leading U.S. financial institution, HERMES consistently outperforms production and strong graph-based baselines, achieving a 44.44% relative reduction in customer friction and a 24.66% relative improvement in fraud recall over the production system. Ablation and temporal-stability analyses further demonstrate complementary gains from local relational modeling and global ecosystem context across changing fraud regimes.