DOI: https://doi.org/10.36347/sjet.2026.v14i10.003

Pages: 616-628

Electronic mail remains the dominant medium for personal, institutional and commercial communication, and consequently the dominant delivery channel for unsolicited and fraudulent messages. Content-based filters degrade as adversaries adapt their vocabulary, obfuscate text and rotate sending identities, which motivates detection strategies that exploit interaction structure rather than message content. This paper presents a social-graph framework for identifying fraudulent email accounts using header-derived interaction data alone. Accounts are modelled as vertices of a directed weighted graph and messages as directed edges; each edge weight is modulated by three header-observable attributes, namely sender–recipient domain agreement, membership of the sender in the recipient’s contact list, and time-zone concordance. A cumulative trust score is accumulated for every account across successive observation windows and compared against a positive acceptance threshold and a negative rejection threshold, yielding a three-way decision that explicitly admits an unresolved band. The framework is instantiated in MATLAB and demonstrated on a seven-account illustrative network observed over three windows. The two accounts exhibiting the characteristic spammer signature of high outbound volume with negligible reciprocation separate from the legitimate population by a margin of 29 score units, and the classification remains invariant for any negative threshold in the interval [−1, −7]. Because the method depends on interaction topology rather than message content, it is inherently resistant to lexical obfuscation and is well suited to forensic triage of seized email corpora.