Methods, systems, and apparatus for detecting malicious activities in a ride-hailing platforms are described. An exemplary method comprises: identifying a set of trips from historical data to form training data; training a classifier based on a plurality of features of the set of trips in the training data to identify whether a given trip is malicious or benign; deploying the classifier to classify new trips in the ride-hailing platform for a first period of time to obtain a plurality of malicious trip candidates; storing the plurality of malicious trip candidates in a staging database for a second period of time for data cleansing based on supplementary data collected during the second period of time; fetching, from the staging database, a set of malicious trip candidates that have been stored in the staging database longer than the second period of time; and re-training the classifier.