Explainable Graph Neural Fraud Detection for Real-Time Digital Payment Networks Using Temporal Neighborhood Inference

Real-time fraud detection in digital payments must balance high detection accuracy, strict latency constraints, and audit-ready explanations. This study proposes an explainable graph-based framework that models payment activity as a temporal, attributed interaction network and performs transaction-level (edge) risk scoring using bounded K-hop neighborhoods within a sliding time window. Evaluation was conducted under a time-ordered protocol to prevent label leakage and to reflect delayed fraud confirmation. The dataset exhibits extreme class imbalance typical of production payment systems (fraud prevalence <1%), and performance is reported using ranking, capacity-aligned, and calibration metrics. Across baselines and graph models, results show that relational learning consistently improves decision-relevant performance. Compared with feature-only models, the proposed explainable graph neural approach achieved the strongest discrimination and alert quality, reaching AUROC = 0.985 and AUPRC = 0.532, outperforming XGBoost (AUROC = 0.972, AUPRC = 0.418) and logistic regression (AUROC = 0.948, AUPRC = 0.312). Under fixed investigation capacity, the proposed method attained Precision@200 = 0.66 and Recall@200 = 0.31, exceeding attention-based GAT (Precision@200 = 0.62, Recall@200 = 0.29) and GraphSAGE (Precision@200 = 0.58, Recall@200 = 0.27). Probability reliability also improved, yielding ECE = 0.038 versus 0.049 (XGBoost) and 0.062 (logistic regression), supporting safer threshold selection for operational actioning. Real-time feasibility was maintained through incremental updates and localized subgraph inference: the proposed system recorded p95 inference latency = 24 ms, remaining within practical authorization-time constraints while delivering the best AUPRC–latency tradeoff among compared methods. Explainability outputs (subgraph rationales and ranked feature drivers) enabled analysts to trace alerts to recent high-salience counterparties, burst-transfer patterns, and device/session inconsistencies, improving triage readiness and audit defensibility.