Beyond Suspicion Scores: Competing-Explanation Inference for Fraud-Shaped Legitimate Activity

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Fraud detection systems commonly accumulate suspicious signals and act when a score crosses a threshold. That approach becomes unreliable when legitimate activity exhibits the same fraud-shaped structure. In our diagnostic corpus, structurally suspicious legitimate cases carried more relational coherence than genuine fraud, and purely structural formulations repeatedly ranked them in the wrong direction. We present AFIE, a knowledge-based evidentiary architecture that treats fraud recognition as adjudication between competing explanations rather than accumulation of suspicion. AFIE combines affirmative fraud evidence, mature recognition, positively evidenced legitimate explanation, and contradiction evidence within a reversible, mechanism-scoped inference process. We evaluate AFIE as a mechanism-level diagnostic architecture on a 160-case authored all-comers corpus designed to exercise genuine fraud, fraud-shaped legitimate activity, competing legitimate explanations, contradiction evidence, and benign drift. In the frozen M8 configuration, AFIE achieves a final-prefix AUC of 0.904 (95% bootstrap CI [0.847, 0.952]), complete mature-fraud detection, zero observed escalation across both legitimate families, 4.3% dangerous under-detection, and no prefix-isolation leakage. The principal ablation provides the clearest attribution: removing the competing-explanation channels while retaining affirmative fraud evidence and mature recognition reduces AUC to 0.785 and raises HARD_BENIGN escalation from 0/50 to 21/50 (42%). In this diagnostic environment, fraud-shaped legitimate activity is therefore resolved not because suspicious evidence disappears, but because positively evidenced legitimate explanations are evaluated against the same mechanism carrying that evidence. These results constitute a local mechanism proof, not evidence of real-world or generalisable fraud-detection performance. The final M8 architecture emerged through failure-driven refinement and now requires frozen confirmation, followed by independent validation, parameter robustness, investigator evaluation and, only then, deployment evaluation.