Modern financial frauds are frequently automated through specialized malware that hijacks money transfers from the victim's computer. An insidious type of fraud consists in repeatedly stealing small amounts of funds over time. A reliable detection of these fraud schemes requires an accurate modeling of the user's spending pattern over time. In this paper, we propose FraudBuster, a framework that exploits the end user's recurrent vs. non-recurrent spending pattern to detect these sophisticated frauds. FraudBuster is based on a learning stage that builds, for each user, temporal profiles and quantifies the deviation of each incoming transaction from the learned model. The final output is the aggregated score that quantifies the risk of a user of being defrauded. In this setting, FraudBuster detects frauds as transactions that are not simply "anomalous", but that would change the user's spending profile. We deployed FraudBuster in the real-world setting of a national banking group and measured the detection performance, showing that it can outperform existing solutions. positives due to legitimate, small-amount, recurrent transfers (e.g., subscriptions). The detection task is challenging because frauds are dynamic and "blend in" with legitimate transactions. Furthermore, the scarcity of publicly available, real-world datasets makes research in this area a daunting task. Our state-of-theart analysis revealed that existing works presume the existence of periodicities in users' spending patterns, without verifying it on real data. In this paper, we propose FraudBuster, a fraud-analysis system that aims to detect salami-slicing frauds by exploiting a precise modeling of recurrent vs. non-recurrent spending patterns. FraudBuster is based on a learning stage that automatically estimates the end user's temporal profiles by means of historical (and likely fraud-free) spending patterns and quantifies the deviation of the current user's spending profile from the learned model. In particular, we apply signal processing techniques to extract temporal patterns "hidden" in the time series obtained from the transaction history. We show that temporal patterns exist, and thus a fraud-detection technique augmented by temporal-pattern classification is more effective than conventional detection approaches. First, Fraud-Buster classify each user based on its spending pattern. Then if a user is labeled as "periodic" (i.e., his or hers spending patter is characterized by periodicity), FraudBuster aligns and averages the observed time series to create a reference pattern model. In other words, we derive the most likely spending activity. Small deviations from strict periodic pattern are accounted by the dynamic time warping (DTW) algorithm [4] that is adapted here to measure the similarity between two temporal sequences up to a small deviation from the reference pattern. For both users with and without periodic spending patterns, FraudBuster uses a proper time-windowing analysis of transactions. For each incoming transaction, FraudBuster ...