Machine-Learning Fraud Detection and Cyber Stress Testing in RTGS and SWIFT Networks: An AI-Augmented Resilience Framework

High-value payment systems (HVPS) and SWIFT-linked wholesale payment networks are systemically important infrastructures in which operational disruption can propagate rapidly through liquidity and settlement interdependencies. Quantitative analyses of interbank networks indicate that the impairment of major nodes can generate broad spillovers affecting a substantial share of the network, and that delayed recovery can amplify system-wide liquidity shortfalls by an order of magnitude. International guidance for financial market infrastructures increasingly emphasizes pre-empting cyber-attacks, responding effectively, and resuming critical operations within strict recovery-time objectives. This paper proposes and evaluates a four-layer AI-augmented cyber-resilience framework for HVPS and SWIFT environments spanning 1) data aggregation and enrichment, 2) multi-model machine-learning analytics, 3) automated control and response, and 4) governance and continuous improvement. The empirical evaluation combines scenario-based cyber stress-testing simulations with machine-learning experiments on synthetic payment data, motivated by the well-documented scarcity of legitimate transaction datasets for fraud research. Across the scenario assumptions, simulations indicate that AI-augmented controls can reduce unsettled payment value by approximately 34% - 78%, with the magnitude varying by attack type and recovery dynamics. On the detection side, every figure reported here is generated directly from the released, seeded pipeline. A well-tuned XGBoost baseline reaches near-ceiling discrimination on the synthetic benchmark (AUC 0.9998). The hybrid supervised-unsupervised pipeline does not improve ranking performance; its measured value shows up at the operating point instead, where a second-pass anomaly filter strips out 12% - 26% of false alerts across replications while keeping ≈97.5% of true positives. A graph-approximation model built on k-nearest-neighbor similarity in feature space reaches AUC 0.9917 with a false-positive rate nine times lower than the boosting baseline, yet it misses every injected coordinated fraud ring (0 of 33), a documented negative result indicating that feature-similarity graphs cannot stand in for detection grounded in counterparty topology. SHAP inspection adds a further caveat: the top-ranked features line up with the generator’s fraud-injection signatures, so the absolute discrimination levels partly reflect benchmark leakage. This is disclosed and analyzed as a limitation, and the inspection procedure itself is put forward