Abstract
The rapid migration of financial fraud to encrypted messenger platforms such as WhatsApp and Telegram has created an urgent need for lightweight, endpoint-based detection tools capable of operating on small, multilingual datasets characteristic of real-world "cold start" conditions. Unlike traditional email spam, messenger-based fraud is short-lived, conversational, and heavily obfuscated through mixed scripts and artificial urgency, rendering static rule-based filters ineffective. Existing machine learning solutions predominantly address English-language SMS spam and rely on large labeled corpora, leaving a significant gap for post-Soviet and Central Asian deployment contexts where Russian, Kazakh, and English frequently co-occur within a single message. This study aims to identify the optimal classical machine learning architecture for binary fraud classification of such multilingual text messages under severe data scarcity constraints. A balanced pilot dataset of 189 messages (95 legitimate / 94 fraudulent) was manually collected from Telegram, WhatsApp, Reddit, Pikabu, and verified news sources. Text was vectorized using TF-IDF (unigrams and bigrams, max 100 features, min_df=2) without morphological preprocessing to preserve cross-language token integrity. Five classifiers were benchmarked: Logistic Regression, Linear SVM, Multinomial Naive Bayes, Random Forest, and XGBoost. Regularization strategies including L2 penalty, additive smoothing, and structural tree constraints, combined with class-weight balancing, were applied to mitigate overfitting on the small sample. Model evaluation used 5-fold stratified cross-validation and an independent test set, with Recall (Fraud) as the primary safety metric alongside Accuracy, F1-score, and ROC-AUC. Logistic Regression and Linear SVM achieved the highest overall performance (Accuracy = 0.97, Recall = 1.00, F1 = 0.97, ROC-AUC = 0.957–0.962), successfully identifying all fraudulent messages with only one false alarm each. XGBoost also reached perfect recall (1.00) at a cost of lower precision (Precision = 0.88), while Random Forest and Naive Bayes were less stable, achieving accuracies of 0.86 and 0.79 respectively. The findings demonstrate that for small, sparse, and multilingual fraud datasets, aggressively regularized linear models with minimal feature spaces outperform complex ensemble architectures, offering a viable, computationally lightweight foundation for real-time endpoint fraud filtering on encrypted platforms.