We report on a systematic measurement study of unauthenticated Ollama AI inference servers exposed on the public internet. Using passive enumeration via the Shodan Internet Intelligence Platform, we identify 20,971 publicly accessible Ollama endpoints and more than 54,000 total AI inference services across more than ten backend types, all reachable with no authentication. We conduct targeted proof-of-concept probing against three representative endpoints spanning enterprise cloud, residential broadband, and commercial VPS infrastructure across three countries (USA, Sweden, Austria). All three endpoints score maximum exploitability across five dangerous write operations (model deletion, arbitrary pull, push exfiltration, persistent model poisoning, and clone operations), zero security headers, and zero rate limiting. We document a previously unreported financial fraud vector arising from the proliferation of cloud API proxy models (:cloud suffix), through which unauthenticated access to an Ollama endpoint constitutes direct financial fraud against the endpoint owner's commercial AI API accounts. Extending beyond prior work, we characterize four Retrieval-Augmented Generation (RAG) layer PII exfiltration vectors that require no write access or special knowledge: (1) context-token session hijacking via /api/generate's persistent KV-cache state; (2) cleartext HTTP conversation history re-transmission; (3) co-deployed RAG database exposure; and (4) prompt-based RAG context extraction. In live testing, the fourth vector extracted 11 of 11 PII categories including financial credentials, medical diagnoses, and authentication passwords on the first plain-language prompt against a live production endpoint. We additionally identify a supply chain risk arising from shared model artifact digests across geographically separated endpoints, and a novel operator risk taxonomy distinguishing technically sophisticated but selectively insecure operators from the commonly assumed unaware operator class. All probing used entirely synthetic personal data. No real user conversations were accessed or retained. Responsible disclosure notices were sent to relevant ISPs prior to submission.
Siqin Li, Kun He, Min Shi, Yajing Huang · 6 authors
Anonymous submissions inspire people to speak up since hiding their identities can protect them from negative influence by their own words. However, the abuse of anonymity may bring harassment to those public submission callers. Existing works only handle DoS attacks or block harassment senders in an active manner, which behave poorly in the early prevention of uncharacterized harassment. In this paper, we propose MsgFliter, a sender-anonymous messaging system with proactive anti-harassment mechanism. Our core idea is to prevent unanswered senders from sending messages continually while keeping their identities, messages, and sender types secret. To meet the functionality and security requirements of MsgFliter, we propose the Anti-Harassment Anonymous Authentication (AHAA) protocol. We associate messages from the same sender through linkable tags and invalidate linkability when a message is replied to. To achieve session indistinguishability, we further combine the proposed anonymous authentication with zero-knowledge proofs of disjunctive relations. We implement MsgFliter and compare its performance with related solutions. Experimental results show that our solution is practicable.
The rapid growth of Ethereum has enabled innovation in digital finance, smart contracts, and non-fungible tokens (NFTs) but it has also facilitated increasingly sophisticated phishing schemes. The existing fraud detection systems have limitations in addressing large-scale phishing involving multi-hop transaction patterns, rich edge metadata, extreme class imbalance, and hierarchical account organizations. This paper proposes a hierarchical multi-scale graph convolutional network (HMG-CN) that can: (1) adaptively fuse 1-3 hop convolutions to avoid over-smoothing, (2) perform edge-aware message passing conditioned on transaction attributes, (3) discover organizational structure via two-level hierarchical pooling, and (4) combine class-balanced focal loss with contrastive learning. In an experiment with a transaction graph with 805,327 nodes and 17.1 million directed edges derived from 47,123 labeled phishing addresses, HMG-CN outperformed classic machine learning (ML), graph embeddings, standard graph neural networks (GNNs), and recent phishing detectors across five different graph sizes. On 150,000 nodes, HMG-CN attained 0.943 F1 and 0.957 AUROC, exceeding the best baseline by 8.1% and 6.6%, respectively, uniquely improving its accuracy as the graph size increased. These results demonstrate that jointly modeling multi-scale structure, edges, and hierarchy yields scalable, accurate detection under low-prevalence conditions, providing a practical foundation for real-world blockchain security.
Alex J. Sinclair, Yuhan Zhang, Michael P. OâConnor, Li Wei
Graph Neural Networks (GNNs) have become the de facto standard for modeling blockchain transaction networks. However, standard GNN architectures predominantly operate under the assumption of homophily-that connected nodes share similar labels or features. This assumption catastrophically fails in the context of Ethereum phishing detection, a quintessential heterophilic learning problem where fraudsters (phishing accounts) actively connect with unlike victims (normal accounts) to facilitate theft. In this work, we argue that the "homophily bottleneck" in existing detection systems obscures critical high-frequency signals necessary for identifying illicit activity. We introduce the Heterophilic Semantic Graph Framework (HSGF), a novel architecture designed to decouple structural roles from feature smoothing. HSGF integrates a Motif-based Semantic Sampling (MSS) strategy to capture complex, directed transactional intents (e.g., dispersing, gathering, mixing) and a Heterophily-Aware Feature Fusion (HAFF) module that prevents the oversmoothing of fraudster representations into victim representations. Extensive experiments on real-world Ethereum datasets demonstrate that HSGF significantly outperforms state-of-the-art baselines, particularly in class-imbalanced scenarios, effectively breaking the ceiling imposed by traditional homophilic aggregation.
Zhen Chen, Fang Zhou, Bo Liu, Haixia Long · 5 authors
In recent years, phishing scams have become one of the most rampant criminal activities on Ethereum, causing significant financial losses to investors and disruptions to the Ethereum ecosystem. Existing phishing scam detection methods typically model Ethereum transaction records as graphs, extracting features from paired nodes based on the topological relationships. However, these methods mostly focus on low-order relational aspects, neglecting higher-order structural information in the network. In this paper, we propose a new method â Ethereum Phishing Scam Detection by Higher-Order Topology (EPSD-HOT), which improves phishing scam detection performance by mining higher-order topological features from the network. We conduct experiments on a public dataset and a crawled real-world dataset, extracting ten subgraphs with distinct network characteristics. The experimental results show that the average AUC-ROC for the ten subgraphs is 0.9970, with improvements ranging from 0.0181 to 0.1658 compared to baseline methods. This indicates that our approach is highly robust and can effectively detect phishing scams across different subgraphs while overcoming the issue of class imbalance. By incorporating higher-order structural information into node features, this work offers new insights for enhancing phishing scam detection in Ethereum.
In 2025, the largest cryptocurrency heist in history cost Bybit $1.5 billion because of a flaw known as blind signing. Essentially, cryptocurrency wallets ask users to sign transactions that look like gibberish code, so users often approve them based on trust and habit rather than real understanding. Attackers can exploit this by changing transaction details behind the scenes while keeping the on-screen transaction looking correct. In my project, I tackle this vulnerability in an Ethereum multi-signature wallet setting where multiple people must approve the same transaction. I first build a web-based simulation of the Bybit attack to understand how transaction swapping can mislead signers. Next, I implement four safety features across the transaction lifecycle: (1) Metadata validation to show the actual details of the transaction that is being signed, (2) Transaction simulation to preview what will happen to the funds, (3) Backend integrity verification to ensure the signed transaction has not been altered, and (4) Address whitelisting of approved destination addresses. My evaluation results show that these defences add negligible computational overhead, but they increase the time a user spends reviewing and confirming a transaction. To balance security with day-to-day usability, I propose an adaptive security approach that uses all defences for large, infrequent transactions, and a lightweight defence model for small, routine payments.
Phishing attacks pose significant risks to the Ethereum ecosystem, comprising over 50% of Ethereum-related cybercrimes, leading to the emergence of many machine learningbased defenses.This paper introduces a comprehensive framework aimed at enhancing machine learning-based phishing detection in Ethereum transactions.The framework addresses critical aspects such as feature selection, class imbalance, model robustness, and algorithm optimization.By systematically evaluating the strengths and limitations of existing approaches, we highlight gaps in current practices, particularly in feature manipulation and unsustainable performance outcomes.Through both analytical and experimental assessments, we demonstrate the framework's ability to streamline detection techniques, improving generalization and model effectiveness.Our findings emphasize the importance of refining detection strategies to meet the evolving challenges posed by sophisticated phishing schemes in the blockchain space.
LIU Ronglong, LI Ziwei, WAN Yue, WU Jiajing, JIANG Zigui
As the paradigm of âłdecentralized next-generation Internet,âł Web3, relying on blockchain technology, has become an emerging field with great potential in the digital intelligence service ecosystem. However, Web3 phishing websites pose a serious threat to ecological health. Phishers carefully design domain names as the primary bait, inducing users to visit and engage in high-risk operations to steal digital assets. Currently, the antiphishing works of Web3 primarily focus on phishing account detection, phishing transaction detection, and phishing gang mining, whereas the existing phishing website domain name detection primarily targets traditional phishing websites, which have limitations such as insufficient adaptability and a lack of systematic analysis. To this end, a detection method called WPWHunter is proposed for Web3 phishing website domain names, which conducts multidimensional analysis on the detected real Web3 phishing websites and explores the potential application of Large Language Model (LLM) in web page analysis. The WPWHunter algorithm detects three features in Web3 phishing website domain names: inducing words, visual deception, and item name imitation. The experimental results show that WPWHunter can effectively detect suspicious Web3 phishing domains with a G-means index of 0.769 on a test set, which is 0.048 higher than that of the best-performing baseline method. Additionally, as a supplementary exploratory experiment, three universal LLM are used to analyze the content of Web3 phishing websites that WPWHunter failed to detect and the logic used by LLM to determine Web3 phishing websites is summarized.
As stablecoins become increasingly prevalent in financial crimes, their usage for illicit activities has reached a scale of USD 51.3 billion. Detecting phishing activities within stablecoin transactions has emerged as a critical challenge in blockchain security. Currently, existing detection methods predominantly target mainstream cryptocurrencies like Ethereum and lack specialized models tailored to the unique transaction patterns of stablecoin networks. This paper introduces a deep learning framework, BERTSC, based on multi-modal fusion. The model integrates three core modules graph convolutional networks (GCNs), BERT semantic encoders, and soft prompt encoders to identify malicious accounts. The GCN constructs directed multi-graph representations of account interactions, incorporating multi-dimensional edge features; the BERT encoder transforms discrete transaction attributes into semantically rich continuous vector representations; the soft prompt encoder maps account interaction features into learnable prompt vectors. An innovative three-way gated dynamic fusion mechanism optimally combines the information from these sources. The fused features are then classified to predict phishing account labels, facilitating the detection of phishing scams in stablecoin transaction datasets. Experimental results on large-scale stablecoin datasets demonstrate that BERTSC outperforms baseline models, achieving improvements of 4.96%, 3.60%, and 4.23% in Precision, Recall, and F1-score, respectively. Ablation studies validate the effectiveness of each module and confirm the necessity and superiority of the three-way gating fusion mechanism. This research offers a novel technical approach for phishing detection within blockchain stablecoin ecosystems.
Baoyu Zhang, Tao Chen, Weishan Zhang, Tao Wang · 9 authors
In September 2024, Lebanon was rocked by an unprecedented cyber-physical attack using Pager bombs. The attack combined advanced cyber warfare techniques with physical destruction, resulting in significant loss of life, infrastructure damage, and geopolitical repercussions. In this paper, we analyze the attitudes on this attack, from both English and Arabic social media users, and investigate impacts on global electronic devices sales and usage. A new topic discovery approach using large models and small models collaboration is proposed. We compare English and Arabic topics generated on social media and find that people in different language spaces share common topics of anxiety on this event. By analyzing market share trends in both China and the United States, an obvious correlation can be found between this event and phone sales. In addition, we discuss the evolution of warfare, and how DAOs(Decentralized Autonomous Organizations) can be utilized to improve the security of electronic devices by secured monitoring of their whole lifecycle.
How users adapt after being sandwiched remains unclear; this paper provides an empirical quantification. Using transaction level data from November 2024 to February 2025, enriched with mempool visibility and ZeroMEV labels, we track user outcomes after their n-th public sandwich: (i) reactivation, i.e., the resumption of on-chain activity within a 60-day window, and (ii) first-time adoption of private routing. We refer to users who do not reactivate within this window as churned, and to users experiencing multiple attacks (n>1) as undergoing repeated exposure. Our analysis reveals measurable behavioral adaptation: around 40% of victims migrate to private routing within 60 days, rising to 54% with repeated exposures. Churn peaks at 7.5% after the first sandwich but declines to 1-2%, consistent with survivor bias. In Nov-Dec 2024 we confirm 2,932 private sandwich attacks affecting 3,126 private victim transactions, producing \$409,236 in losses and \$293,786 in attacker profits. A single bot accounts for nearly two-thirds of private frontruns, and private sandwich activity is heavily concentrated on a small set of DEX pools. These results highlight that private routing does not guarantee protection from MEV extraction: while execution failures push users toward private channels, these remain exploitable and highly concentrated, demanding continuous monitoring and protocol-level defenses.
ABSTRACT Phishing attacks in decentralized Web3 systems continue to evolve beyond the detection capabilities of traditional Web2 security models. Existing decentralized authentication systems typically lack either mutual verification or dynamic threat awareness. We present PhishGuard++, a crossâchain, privacyâpreserving authentication framework that introduces two core innovations: (1) a novel mutual ZeroâKnowledge Proof (ZKP) protocol that validates both users and services using Decentralized Identifiers (DIDs), and (2) a realâtime, onâchain Graph Neural Network (GNN) threat oracle that assigns phishing risk scores integrated directly into smart contractâbased access control logic. A stakeâbased validator reputation system with antiâcollusion incentives further reinforces trust without sacrificing decentralization or privacy. Experimental results on a simulated Arbitrum testnet show a statistically significant 40.4% reduction in phishing success rate across five attack vectors, 98.6% authentication accuracy, and subâsecond latency with gasâefficient operations. Unlike prior works that independently apply ZKPs, DIDs, or GNNs, this framework offers the first privacyâpreserving, mutual authentication system that combines these technologies with stakeâbased economic enforcement and realâtime smart contract enforcement. The novelty lies in the architecture's realâtime threatâaware access decisions, validatorâlinked risk accountability, and practical crossâchain deploymentâan integration not previously achieved.
The web3 applications have recently been growing, especially on the Ethereum platform, starting to become the target of scammers. The web3 scams, imitating the services provided by legitimate platforms, mimic regular activity to deceive users. However, previous studies have primarily concentrated on de-anonymization and phishing nodes, neglecting the distinctive features of web3 scams. Moreover, the current phishing account detection tools utilize graph learning or sampling algorithms to obtain graph features. However, large-scale transaction networks with temporal attributes conform to a power-law distribution, posing challenges in detecting web3 scams. To overcome these challenges, we present ScamSweeper, a novel framework that emphasizes the dynamic evolution of transaction graphs, to identify web3 scams on Ethereum. ScamSweeper samples the network with a structure temporal random walk, which is an optimized sample walking method that considers both temporal attributes and structural information. Then, the directed graph encoder generates the features of each subgraph during different temporal intervals, sorting as a sequence. Moreover, a variational Transformer is utilized to extract the dynamic evolution in the subgraph sequence. Furthermore, we collect a large-scale transaction dataset consisting of web3 scams, phishing, and normal accounts, which are from the first 18 million block heights on Ethereum. Subsequently, we comprehensively analyze the distinctions in various attributes, including nodes, edges, and degree distribution. Our experiments indicate that ScamSweeper outperforms SIEGE, Ethident, and PDTGA in detecting web3 scams, achieving a weighted F1-score improvement of at least 17.29% with the base value of 0.59. In addition, ScamSweeper in phishing node detection achieves at least a 17.5% improvement over DGTSG and BERT4ETH in F1-score from 0.80.
Ethereum's swift development has elevated phishing scams to primary security concerns within blockchain networks. Current detection methods face three key challenges: insufficient hierarchical temporal modeling, inadequate pattern-aware structural recognition, and the lack of effective mechanisms to integrate multi-modal information. This paper presents an innovative approach for phishing detection using Multi-modal Hierarchical Temporal Graph Representation (MHTGR). Our method analyzes phishing behaviors by jointly considering temporal dynamics and structural topology of transaction data. First, we construct Hierarchical Transaction Graph Network (HTGN) to organize raw transaction records into structured graph representations. Then, multiple feature modalities are extracted through a Parallel Feature Extraction (PFE) module. Finally, these features are integrated via a Multi-modal Fusion (MMF) module for comprehensive phishing detection. Empirical evaluations conducted across multiple datasets from Ethereum demonstrate that the proposed method outperforms existing methods, providing effective solutions towards blockchain security.
Fatih Ertam, Duzgun Kucuk, İlhan Fırat Kılınçer
ABSTRACT The proliferation of phishing scam tokens on the Ethereum blockchain, including honeypot, rug pull, and impersonation schemes, poses a grave threat to financial security. Although earlier studies have documented detection accuracies that exceed 95%, they frequently depend on random trainâtest partitions. These partitions frequently overestimate realâworld performance by disregarding the temporal progression of phishing behaviors. This study addresses the methodological gap by employing a temporally validated evaluation. A labeled dataset comprising 5408 Ethereum token contracts was constructed. This dataset was verified through a twoâstage process that integrated cyber threat intelligence and onâchain evidence. A total of 16 discriminative features were extracted, reflecting transaction volume, network structure, and temporal behavior. In lieu of employing random partitioning, temporal validation (70% training, 15% validation, and 15% testing) was adopted to assess generalizability to emerging threats. Six machine learning models (LightGBM, XGBoost, Random Forest, Gradient Boosting, Decision Tree, and MLP) were tuned via GridSearchCV. LightGBM demonstrated optimal performance, attaining 85.59% accuracy, 81.63% F1âscore, and 92.02% AUC on temporally heldâout data. The feature ablation process yielded the identification of transaction volume as the most discriminative factor, with a corresponding increase in performance of 13.09 points on the performance scale. Conversely, temporal features exhibited a marginal decline in performance, with a decrease of 0.87 points. Temporal validation resulted in a 3.95âpointâpercentage decrease compared to random splitting, thereby exposing the optimistic bias present in prior studies. Despite the fact that the resulting F1âscore of 81.63% falls short of the 85% threshold stipulated in the literature, it is indicative of a realistic deployment expectation. This work underscores the importance of temporal validation for reliable fraud detection research.
As fraud patterns in the Ethereum ecosystem become increasingly sophisticated, traditional detection methods face limited generalization capability and insufficient interpretability. Although Large Language Models (LLMs) possess powerful semantic understanding and reasoning abilities, their direct application in fraud detection still suffers from critical issues, including inadequate domain knowledge integration and scarcity of high-quality interpretable training data. To address these challenges, this paper proposes Large Language Model for Transaction Anomaly Detection (LLM-TAD), a framework that constructs interpretable training data through a dual interpretation strategy combining XGBoost with SHAP/LIME to provide complementary feature-level insights, and achieves domain knowledge injection and capability optimization via a two-stage approach involving supervised fine-tuning and instruction fine-tuning. Experimental results demonstrate that the proposed method achieves a fraud detection accuracy of 93.01% and an explanation quality (BERTScore) of 0.7939, achieving synergistic improvement in both accuracy and interpretability.
The decentralized and anonymous nature of Ethereum makes it a prime target for phishing scams. These scams account for nearly 50% of all blockchain-related fraud, thereby causing a substantial financial loss and eroding user trust. Unlike conventional phishing, Ethereum phishing users exploit user anonymity, lack of awareness, and market-driven dynamics to deceive normal users. Despite of a plethora of research in this direction, there is a lack of a rigorous and comprehensive survey which can fortify an insightful comparison of the existing works and provide a concrete future research guidance. To this end, this paper presents a systematic review of 90 studies published between 2020 and 2024, offering the following novel contributions, (1) Structured Taxonomy: We introduce a structured three-fold taxonomy that classifies existing methods into feature engineering-based, representation learning-based, and fusion-based frameworks. (2) Theoretical Analysis: Through theoretical analysis, we evaluate these approaches against the critical research challenges, such as rapid network dynamism, data leakage, and network sparsity and provide a comparative mapping of novel techniques adopted across the studies. (3) Empirical Evaluation: We conduct an extensive empirical evaluation of 14 representative models over multiple public datasets to assess their robustness under varying data conditions. The findings indicate that while feature-based models are more interpretable, they struggle with temporal adaptability; representation learning approaches, particularly GNN-based models, capture complex behavioral patterns but are computationally demanding and less explainable. Fusion methods demonstrate the most balanced trade-off between accuracy, scalability, and interpretability. (4) Future Research Guidance: Finally, we identify still persisting issues such as network sparsity, behavioral volatility, and scalability, and outline future research directions emphasizing temporal graph reasoning, self-supervised fusion, and explainable AI for developing transparent and deployable phishing detection frameworks on Ethereum.
In today’s technologically advancing world, many fields from finance to healthcare and education are shifting toward a digital and decentralized format. A significant transformation is underway with the currency of the masses. Blockchain-based cryptocurrencies like Bitcoin and Ethereum allow users to generate fungible tokens anonymously through smart contracts. However, these features also facilitate illicit transactions and cybercrimes like fraud, phishing, and money laundering. The proposed work explores the identification of suspicious transactions on the Ethereum blockchain by leveraging advanced machine-learning techniques. An Extreme Gradient Boosting (XGBoost) classifier is optimized for spotting unauthorized or malicious transactions, exploring features like transaction patterns and value anomalies. Feature scaling and log transformations normalize skewed distributions, while rigorous model training and hyperparameter tuning enhance the system's precision, recall, and overall accuracy. Other aids, such as feature importance rankings, precision-recall curves, and diagnostic statistics, provide useful information on fraud patterns. Evaluation of the model shows that integrating cost-sensitive learning significantly reduces false positives, from 51 to 44, representing a 13.7% decrease, which enhances practical usability by minimizing false alerts and manual verification efforts. Although there was a slight increase in false negatives (from 14 to 15), the overall classification accuracy improved. The model demonstrated strong performance in managing class imbalance which is common in fraud detection contexts.
Jianlong Xu, C. F. Xu, Rongtao Zhang, Feixiang Diao · 5 authors
With the wide application of blockchain technology in finance, IoT, healthcare, and other fields, phishing scams have emerged as a growing security threat. Existing detection methods often lack in-depth modeling of the directional properties of transaction flows and struggle to effectively capture diverse transaction behaviors, directional relationships, and key neighbor dependencies. To address these limitations, we propose TGAT-MPGCN, a direction-aware phishing detection model that constructs three complementary first-order subgraphs, a sending graph, a receiving graph, and a bidirectional graph to explicitly capture transaction directionality. By integrating a graph-attention mechanism with weighted neighbor aggregation, the model enhances feature learning. Experimental evaluations on an Ethereum transaction dataset demonstrate the superior performance of our approach, achieving an accuracy of 97.21%, an AUC of 0.9721, an F1-score of 0.9719, a recall of 0.9629, and a precision rate of 98.11%, significantly outperforming traditional detection methods. This study offers a practical and scalable solution for accurate phishing detection in blockchain transaction networks.
One of the most prevalent and harmful forms of cybercrime remains phishing, which is often based on email as its primary avenue of attack. Traditional detection methods apply both rule-based filtering as well as machine learning classifiers, though they often come with large false-positive rates and no defense against message authenticity. To enhance the communication trust and detection accuracy, this paper proposes a hybrid framework integrating blockchain technology with artificial intelligence (AI). The AI module utilizes machine learning models trained with a labeled dataset of phishing, spam, and legitimate emails. The high performance of classification is evidenced by the experimental results, where up to 98.4% accuracy is achieved in binary classification and 97% accuracy for multiclass detection. A Solidity-based smart contract deployed on an Ethereum testnet irrevocably keeps hashed records of authenticated emails to ensure integrity and non-repudiation. This hybrid approach compares favorably with AI-only approaches in that it reduces false positives by as much as 35% and has traceability and tamper-resistant logging that blockchain-only approaches do not have. The results show that the integration of blockchain technology and artificial intelligence (AI) is a feasible method of secure and trustworthy email communication by balancing detection efficiency and protection of privacy.
Nov 28, 2025·2025 IEEE 1st International Conference on Smart Innovations in Systems, Infrastructure, Mechanical, Power, AI and Computing Technologies (SISIMPACT)
Deepak Singh Rana, Rahul Rathi, Tomi Ete, Sunil Kumar Shah · 6 authors
For this research, a strong framework is suggested for recognizing fraudulent Ethereum transactions by using both ML and DL approaches. As more people adopt Ethereum for DeFi, NFTs and smart contracts, the integrity of the system is being threatened more often. To deal with these difficulties, the work presents a hybrid RFDNN model which is trained over a labeled dataset of 9,841 Ethereum transactions, including 2,179 that are fraudulent. Class imbalance presents a big issue, so an advanced version of the Synthetic Minority Oversampling Technique (ISMOTE) is used to produce better synthetic data samples that make the model more general. To avoid overfitting and increase results in the real world, the methodology stresses feature engineering, data cleaning and adjusting for the right partitions. The research compares how traditional fraud detection works with adaptive ML models and highlights how adapting to new situations can catch more updated as well as advanced fraud. We need to ensure that any automated fraud system is both understandable and can handle large amounts of data for people to put faith in it. This study reveals that staying flexible and re-training models regularly is important due to the growing number of threats. Experiments were done with Logistic Regression (LR), Decision Tree (DT), Gradient Boosting (GB) and XGBoost, with the hybrid RFDNN model reaching the best results: 97% accuracy, 96% precision, 96% recall and a 97% F1 score.