The present teaching generally relates to detecting fraudulent networks. First data associated with a plurality of entities may be obtained, and a representation characterizing similarities among the plurality may be generated. Based on the representation, at least one entity cluster may be identified as corresponding to a candidate fraud network. A score associated with each of the at least one entity cluster may be determined, where the score indicates a likelihood that a corresponding entity cluster represents a fraud network, and at least some of the at least one entity cluster may be identified as a fraud network based on the score.