Abstract Web platforms, especially social media, are facing a new and ever-evolving cyber threat operating at the information level. Their open nature allows a high velocity flow of rumours that emerge unexpectedly and spread quickly. While rumour detection has attracted many theoretical and practice studies, the timing of the detection is often neglected or not properly considered. Rumours often cause irreversible damage worldwide before being successfully detected. To address this, we approach early rumour detection from a streaming perspective. We present a just-in-time rumour detection framework that is built on top of the continuous scoring of rumour-related signals. To overcome the trade-off between timeliness and the coefficient of detection, our model treats social graphs as a data stream and computes the anomaly score of potential rumours at both the element-level and subgraph-level. This multi-level approach not only captures the propagation structure of rumours but also focuses on abnormal elements that are responsible for bootstrapping or amplifying the rumours (the ‘explore vs exploit’ effect). With extensive evaluations on our published benchmark, our model identifies rumours earlier than the baselines while achieving an even better detection coefficient.