When would you use unsupervised methods for fraud detection, and how would you evaluate them without reliable labels?

Use them when labels are scarce, delayed or blind to new attacks: isolation forests, autoencoder reconstruction error or graph clustering flag what's unusual, not what's known fraud.

Evaluate by proxy. Backtest on the labels you do have with precision at the top k, since investigators can review only so many. Send flagged and random cases to analysts to estimate precision and lift. Inject synthetic anomalies to check recall, and track alert volume and stability over time. Unusual isn't fraud, so feed confirmed cases into a supervised model.