Most fraud detection systems (whether they’re built on rules or on modern machine-learning models) evaluate one transaction at a time. A rule checks a transaction against a threshold. A gradient boosting model checks it against a feature vector. The feature vector is richer, but it’s still a description of a single event and one account’s own recent history. Which means an organized ring can pass straight through: no individual transaction crosses a threshold, and the relationships that would give the ring away (a shared device fingerprint, two addresses that differ by a unit number, a common funding source) never enter the score at all. Those connections do eventually get found, but usually by an analyst doing manual link analysis after an alert fires, which is downstream of the decision it should have informed.
This series of whiteboard explainers makes the case for a graph-first approach to detection: treating relationships as something you maintain and score continuously, before an alert exists, rather than something someone reconstructs by hand once the money is gone. Along the way it covers why the account ID in your transaction table is already a graph edge (and the only one most institutions ever use), why your fraud labels quietly teach a model to reproduce its predecessor’s blind spots, and what actually changes when the graph comes first.
Part 1 — The Ring That Never Tripped a Rule
Eleven accounts, opened over four months, each behaving like a model customer right up until all eleven ran the same bust-out play over nine days. No alert fired. No threshold was crossed. Then an analyst lays the accounts side by side and sees it in minutes; shared device fingerprints, addresses differing by a unit number, a common funding source. The structure had been in the data for roughly ninety days. The question the series answers: why couldn’t a good model see what an analyst found in minutes?
Part 2 — You Changed the Scoring Function, Not the Unit of Analysis
Rules and supervised machine-learning share a deeper assumption than the debate between them ever surfaced: both evaluate a single row. A rule checks a transaction against a threshold; a model checks it against a feature vector. Richer, but still one event. And a ring isn’t a row anywhere in your pipeline; so no scoring function can render a verdict on it. Closes with the uncomfortable corollary: independent scoring doesn’t just miss coordination, it quietly rewards it.
Part 3 — You’ve Been Computing Graph Features for Twenty Years
group_by(account_id) finds every transaction connected through one relationship and reduces them with a fixed function. That’s a one-hop neighborhood aggregation over a single edge type; a velocity counter, in graph terms. That edge got used because it was free: a foreign key someone stored decades ago. Device, address, funding source, session; all real, all in the building, none of them pointers. So when the model needs more signal, we add time windows. One hour becomes six becomes twenty-four. Ten columns, one relationship.
Part 4 — Your Labels Come From the System You’re Replacing
Confirmed frauds. Confirmed SARs. Charge-offs coded as fraud. Every label came from a case the current stack caught. The eleven accounts, absent link analysis, get coded as credit losses; now sitting in training data as normal accounts that happened to default. The model learns to reproduce the existing perimeter with better precision. It doesn’t learn to extend it. Meanwhile fan-out from a shared SSN needs no training set to be suspicious.
Part 5 — Downstream of the Decision It Should Have Informed
The alert fires, then the analyst reconstructs the network by hand. But the alert came from the model that already missed the ring. And when the case closes, the structure evaporates; a flag, a note, nothing queryable. Next week, an adjacent account, starting from zero.
Part 6 — “We Already Do Link Analysis”
Fair objection, wrong on the mechanism. The difference isn’t speed. That analyst who decided “Apt 4B” and “#4B” were the same address performed entity resolution by eye, once, then discarded it. Same SSN means same person. Same device means connected, maybe; two people at the same branch kiosk share a fingerprint.
Part 7 — Four Operations Your Feature Vector Can’t Phrase
Degree and fan-out. Connected components, and when the island formed. Shortest path to confirmed fraud. And k-hop traversal: account seven shares a device with five, five shares a funding source with three. Two hops. No velocity counter will ever surface it.
Part 8 — What Graph-First Actually Looks Like
A resolution rule you can read. Separate views for identity and behavior. A decomposed score (identity, neighbor, transaction) that gives a validator three things to challenge. A transition matrix you can print. And when the case opens, the network is already there.