Fraud Ring Detection Data Flow

Entity resolution, graph build, community detection, ring scoring, and analyst feedback

Fraud Ring Detection Data Flow Entity resolution, graph build, community detection, ring scoring, and analyst feedback 01 / Sources 02 / Resolve 03 / Graph 04 / Detect 05 / Consume Account Signups · profiles, KYC · 01 / Sources · identities Account Signups profiles, KYC identities Device + Card · fingerprints, BINs, IPs · 01 / Sources · attributes Device + Card fingerprints, BINs, IPs attributes Payment Stream · authorizations · 01 / Sources · events Payment Stream authorizations events Entity Resolution · dedupe + link · 02 / Resolve · canonical IDs Entity Resolution dedupe + link canonical IDs Edge Builder · counterparties · 02 / Resolve · money edges Edge Builder counterparties money edges Entity Graph · nodes + edges · 03 / Graph · shared attrs Entity Graph nodes + edges shared attrs Community Detect · components / Louvain · 04 / Detect · clusters Community Detect components / Louvain clusters Ring Scoring · subgraph features · 04 / Detect · velocity Ring Scoring subgraph features velocity Feature Store · real-time scores · 05 / Consume · low latency Feature Store real-time scores low latency Alert Queue · ranked rings · 05 / Consume · cases Alert Queue ranked rings cases Analyst Review · triage + decision · 05 / Consume · SME Analyst Review triage + decision SME identities profiles shared attrs fingerprints auth events append-only resolved nodes canonical payment edges weighted components connected subgraphs neighborhoods clusters dense groups risk scores real-time ring alerts ranked cases queue confirmed labels feedback Legend primary data policy / PII async batch data store

Build The Graph

  • • Accounts, devices, cards, addresses, and IPs become nodes
  • • Entity resolution collapses duplicates into canonical IDs
  • • Shared attributes and payments form the edges

Find The Rings

  • • Connected components isolate candidate clusters
  • • Community detection splits dense subgraphs
  • • Ring and velocity signals score whole neighborhoods, not single payments

Close The Loop

  • • Scores land in a low-latency store for auth-time decisions
  • • Ranked rings queue for analyst triage
  • • Confirmed labels feed back to tune scoring

Data-flow diagram • Built with Archify • Create yours ↗ • Hover to trace • R route • Click to focus • +/− zoom • M radar • [/] views • P play story • T theme • E export