Graph analytics for the network behind each transaction

Entity resolution into a party graph

Customer, counterparty and provider records resolve into a governed party master before network analysis runs, so one person recorded with three spellings becomes one node.

• Candidate blocking on normalized and phonetic name keys, email, phone and national ID
• Weighted-agreement match scoring, where a national ID mismatch acts as a veto
• High-confidence matches link automatically and borderline pairs queue for a reviewer
• Reviewer-confirmed merges pass through a second approver, and a wrong link can be split

Ring and community detection

Label-propagation community detection clusters connected parties and accounts into groups no single rule was written for. Identity clustering joins “distinct” customers who share a phone, email, device, ID number or address.

• Communities computed over the whole persisted graph, not one alert’s neighborhood
• Shared-attribute clusters shown as a party-and-attribute link view, with export
• Cluster risk broken down by the signals that formed the cluster
• Any cluster can be raised as an alert and worked as a case

Path and flow analysis

Follow value hop by hop across bank accounts, mobile-money wallets and remittance corridors. Transfers are stored as directed, weighted edges with first-seen and last-seen times.

• Fund tracing outward from any seed account, with per-hop netting
• Shortest-path and all-paths search between two suspects
• Cycle detection for layering and round-tripping
• Degree centrality to surface collector and pass-through accounts

Mule hunting on the money-flow graph

A dedicated hunt reads the flow graph with time on every edge. It looks for layering chains that move in sequence, inside a short window, passing most of the value on; for collector and pass-through hubs; and for wash cycles that return money to its origin.

• Findings arrive as one proposed network case with every member, the connecting flows and a before-and-after snapshot
• Payroll-style disbursers with no inflow are treated as benign and left unflagged
• Case creation and any holds still require a person to approve them

Network signals in the score

Graph structure feeds detection directly. Mule rings, mule hubs, funnel accounts, round-tripping, staged-accident rings and synthetic-identity clusters are network patterns by definition, and per-entity features such as counterparty diversity enter both the real-time score and the reason-coded model signal.

Visual investigation

Analysts work the network on an interactive link chart in the investigation workbench, next to the money-flow and cash-flow views for the same alert.

• Force-directed, concentric, hierarchical, circular and grid layouts
• Risk halos, filters by entity type and minimum risk, and search
• Double-click to expand a neighborhood, with a radial menu of actions on any node
• A timeline that replays how the network formed, cumulatively or in a moving window
• Export the chart as an image for the case file