A node verifying that a transaction is performed looks at the block chain... but perhaps more explicitly, it looks at "block chains." There's no actual requirement that a node only look at just a single block chain when deciding whether a transaction is valid or not.
They can then assign some level of trust as to whether the transaction occurred, and act appropriately.
The algorithm is designed around eventual consistency. If most nodes are honest (meaning the follow the recommendations in the algorithm), the algorithm will naturally move towards all honest nodes agreeing upon which block chain is "true." This is managed with a feedback loop: miners trust the longest chain that they are aware of, and miners lengthen that chain by mining. A malicious player would need to have a majority on the mining power for the entire bitcoin network in order to convince the honest miners to believe their fraudulent claims. Practically speaking this would require hundreds of TW of energy (for comparison, the largest nuclear powerplant is currently 0.008TW). Without such power, they could only provide fraudulent chains which are shorter than the main chain. This would be detected by an honest node, and they would choose not to honor the transactions on that chain.
This is why it is typically recommended to wait for 6 blocks before considering a transaction to be "official." Due to networking, its plausible that you could see a fraudulent block appear with your transaction. However, it is exceedingly unlikely that you would see 6 blocks appear on the fraudulent chain without seeing the "honest" chain, with more work put into it. By 6 blocks (give or take), it is unlikely that someone could, say, buy up all of the AWS servers and quickly race ahead of the honest miners to make their fraudulent chain into the "best" chain.
As for mechanisms to confiscate illegal gains, there's none written into the algorithm. The algorithm only looks at the length of the chain when deciding which chain is valid. There are known tricks involving double-spending which take advantage of this. However, at the highest level, there is a way. If all "honest" actors decide that the longest block chain is "fraudulent," and they agree on another block chain that is not fraudulent, they are free to all shift to this new block chain. This would go against the algorithm, technically, but would be something that could be done socially.