Fraud ring intelligence: the entity intelligence graph

A ring is a graph problem

A fraud ring is a set of accounts operated toward a common end, such as bonus farming, laundering, or coordinated account takeover, that your controls treat as independent. Per-account and per-transaction scoring evaluates each node on its own, so a ring whose individual accounts each stay under threshold passes clean.

The fraud isn't in the accounts. It's in the edges between them.

Structurally, a ring is a connected subgraph: a cluster of accounts joined by relationships that should not exist between strangers. So detection is a graph problem. Find the clusters, characterize their shape, and decide which shapes are coordination rather than coincidence.

The harder truth is that the graph worth building is not recomputed from scratch on each query. It is a standing asset that accumulates. Every account resolved, every device tied to an identity, every confirmed ring leaves the graph knowing something it did not know before, and the next attack is recognized from that accumulated knowledge rather than from a single event in isolation.

The entity intelligence graph

Loci keeps one relationship graph keyed on the entity: the entity intelligence graph. It has a single kind of node, the entity, and it accumulates edges from two independent sources.

Treating this as one graph rather than two is the whole point.

The two edge sources cover each other's blind spots, the same traversal and scoring machinery reads them together, and every confirmed case writes back into the same structure. What grows over time is a single, sharpening picture of how entities relate, not two datasets that have to be joined at query time.

Structural signals from value movement

Detection reads the graph's structure, not just its rows.

Connected components. A traversal partitions the graph into connected components: the maximal sets of accounts reachable through transaction edges. A large, dense component among accounts that claim to be unrelated is unusual.

Centrality. Within a component, degree centrality ranks the accounts the activity revolves around, such as a collector that receives from many or a funder that pays to many. Loci uses true degree centrality (an account's unique counterparties over the reachable network size) and normalizes it for time, typically to a 30-day window, so a high-throughput but short-lived account is not mistaken for a structural hub. Removing a central hub disconnects the ring.

Motifs. Centrality describes position; motifs describe behavior over time, and two are especially diagnostic:

Beyond single nodes, the graph exposes the routes value takes through multi-hop, depth-bounded paths, and where it concentrates among top counterparties by volume or count. Both the windows and the counts are configurable; the values here are illustrative defaults.

Identity and behavior edges

Value movement is blind to the device and the human. AccessGate contributes the edges that transactions do not show.

Device-sharing edges come from recording, per institution, which accounts have appeared on a device fingerprint and which devices an account has appeared on. Two accounts on the same fingerprint form an edge, and its weight reflects how exclusive the sharing is: a device behind two accounts is weaker evidence than one behind twenty.

Behavioral-similarity edges come from the per-account behavioral profile that AccessGate builds from interaction dynamics (mouse, keystroke, touch, motion, and navigation). High similarity between accounts that claim to be different people is strong evidence, because emails, cards, and IPs are cheap to rotate while motor behavior is not. It is weighed as corroborating evidence alongside the device and value-movement signals, so a finding is strongest when all three agree.

Session lineage ties an account's events into one verifiable thread across a journey, including pre-account anonymous activity. Lineage is what lets device and behavioral observations be attributed to the same session rather than scattered across unrelated events.

Family or fraud ring? Combining evidence

Shared infrastructure is normal. Households share tablets; offices share workstations. Treating a shared device as fraud outright generates false positives at a rate that gets network detection switched off. The graph resolves the ambiguity by combining edges rather than reacting to any single one.

Thin evidence should earn neither trust nor a verdict. It warrants continued monitoring.

Try it yourself. Toggle the evidence below. Notice that a single shared edge is not a ring, that corroborating signals tip the verdict, and that thin data returns "inconclusive" no matter what else is set:

Two things the combiner makes concrete: no single edge is a verdict, and thin data is answered honestly rather than forced into "trusted" or "fraud." That "inconclusive by design" behavior is what keeps network detection switched on instead of drowned in false positives.

Reading the graph from both sides

Because value-movement and identity edges sit on the same entities, a cluster can be examined from both. The two edge sources cover each other's blind spots, which is where the model earns most of its value.

A laundering ring that layers through freshly provisioned, unshared devices leaves no identity edges, but its pass-through and fan-out motifs show in its value movement. A promo-abuse ring that never moves money between its accounts leaves no transaction edges, but its shared devices and near-identical behavior show in its identity edges. A ring that has learned to evade one of these is unlikely to evade both at once.

The check runs automatically. A cluster flagged from one kind of edge is tested against the other, and the findings both confirm are the strongest of all. One entity, seen from two independent angles at once, on one graph.

An intelligence asset that compounds

Confirmed outcomes feed back into the same structure, so a resolved investigation changes later scoring.

• Labels propagate. Confirming an account as fraud flips the label on its transaction edges and triggers recomputation of the surrounding neighborhood's centrality and risk, so the cluster is subsequently scored with that knowledge rather than from scratch.
• Standing is a running posterior. Entity and device standing updates a prior with each new observation rather than replacing it, so history informs the next decision instead of being discarded.
• Signatures recur. A confirmed ring's structural and behavioral signature becomes a pattern the graph matches faster on recurrence.

The practical effect is that detection gets sharper the longer an institution runs it. The graph an analyst queries in month twelve knows the devices, the behavioral signatures, and the confirmed rings that month one did not, and that knowledge is doing work on every new event.

Worked examples

Promo and bonus farming

Forty accounts sign up for a referral bonus, each with a distinct email and a plausible name, and per-account checks clear most of them. Value movement shows little, because the accounts do not pay each other. On the identity edges, the forty accounts collapse onto six device fingerprints, their behavioral profiles are near-identical, and several devices were added within minutes of each other. The cluster is flagged from the identity side and the bonus is held before the fortieth payout. The family sharing one tablet, with three accounts, consistent behavior, and a gradual device history, stays inconclusive and is not touched.

Mule network

A layer of accounts receives inbound transfers and forwards roughly 90 percent within the hour. Each account, alone, looks like an active customer. The pass-through motif fires across the layer, connected components tie the accounts to a common funder that shows a fan-out pattern, and centrality identifies the collector. Even with fresh, unshared devices and no identity edges at all, the value-movement edges carry the finding. If AccessGate is enabled and the mules also share devices or behavior, both kinds of edge corroborate and confidence rises further.

Limits and failure modes

An honest reference states what the system does not do.

• No transactions, no value-movement motifs. Fan-out, pass-through, centrality, and paths all require transaction edges, so an entity with no transaction history contributes only identity signal.
• No AccessGate, no identity edges. Device and behavioral edges exist only for institutions that have enabled the module. Ring detection then runs on value-movement edges alone, which is fully functional but single-sided.
• Thin evidence yields "inconclusive" by design, so low-history entities are not scored confidently in either direction.
• Behavioral similarity is corroborating evidence. It strengthens a finding alongside device and value-movement signals rather than standing alone as the sole proof.
• Per-tenant isolation is deliberate. Each institution's graph is its own, and data is never pooled across institutions. This forgoes any cross-institution "seen elsewhere" signal in exchange for data sovereignty, which matters where residency rules make pooling impossible.
• Money-flow analysis needs the transaction domain. Mule and layering detection operate on the value-movement edges and are not inferred from device or behavioral signals.

Working with it

For an analyst, the graph supports investigation as much as scoring. A single suspicious login or transaction becomes a starting node, and expanding its neighborhood shows the cluster, the central accounts, the motifs that fired, and, where AccessGate is enabled, the devices and behavioral overlaps that corroborate or contradict the money-flow picture. The output of an investigation, a confirmed label, is also an input to future scoring, which closes the loop and is what makes the graph worth more next quarter than it is today.

Appendix: example data flow

Two illustrative sequences show how a single decision draws on the graph, and how a blocked attack feeds back into it. They are conceptual and simplified; production naming, parameters, and internal steps are omitted.