SlideShare a Scribd company logo

GraphTalk Stockholm - Fraud Detection with Graphs

•
Neo4j, profile picture
Neo4j

This document summarizes a presentation on fraud analysis with Neo4j. It discusses using graph databases and queries to analyze credit card fraud and detect fraudulent patterns in transaction data and referral programs. Examples are provided of Cypher queries to identify potentially fraudulent activity, such as transactions originating from high-risk terminals or complex referral fraud schemes. The benefits of using a graph database for this type of analysis are discussed.

Software
1 of 57
Download to read offline
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
Fraud Analysis with Neo4j GraphTalk Stockholm Oct 22, 2019 Dr. Jesús Barrasa Neo4j @BarrasaDV
May 2016…
...11.5M documents, 2.6 TB!
GraphTalk Stockholm - Fraud Detection with Graphs
May 2016… https://offshoreleaks.icij.org/pages/database
GraphTalk Stockholm - Fraud Detection with Graphs
What did we learn from the Panama Papers?
Look at this dataset
Swap glasses
Look at the dataset again
GraphTalk Stockholm - Fraud Detection with Graphs
Do I have a graph problem?
Law of the instrument (of the hammer) : cognitive bias that involves an over-reliance on a familiar tool. A.Maslow 1966
Did Google have a graph problem back in the early 2000s? I’d say it was an information retrieval problem
nd so, my fellow graphistas: ask not whether you have a graph problem - instead, look at your problem with a graph thinking mindset” J. Barrasa - Graph Connect Europe 2017 “A
Example 1: Credit card fraud origination and assessment of potential impact
GraphTalk Stockholm - Fraud Detection with Graphs
Mark Robert Sheila Kate
GraphTalk Stockholm - Fraud Detection with Graphs
GraphTalk Stockholm - Fraud Detection with Graphs
WITH { amount: 2.50, currency:"USD", txid:"05015244006", mid:"5073047", tid:"5073440-7", timestamp:1490060618007, cardno:"5224654370862586050" } AS newTxData MATCH (lastTx:Transaction { cardno: newTxData.cardno }) WHERE NOT (lastTx)-[:NEXT]->() CREATE (newTx:Transaction) SET newTx += newTxData CREATE (lastTx)-[:NEXT]->(newTx) WITH newTx, newTxData MERGE (term:Terminal { tid: newTxData.tid}) CREATE (newTx)-[:IN_TERMINAL]->(term) Tx Tx Tx Tx Fraud Fraud Data load: Transactions
WITH { amount: 2.50, currency:"USD", txid:"05015244006", mid:"5073047", tid:"5073440-7", timestamp:1490060618007, cardno:"5224654370862586050" } AS newTxData MATCH (lastTx:Transaction { cardno: newTxData.cardno }) WHERE NOT (lastTx)-[:NEXT]->() CREATE (newTx:Transaction) SET newTx += newTxData CREATE (lastTx)-[:NEXT]->(newTx) WITH newTx, newTxData MERGE (term:Terminal { tid: newTxData.tid}) CREATE (newTx)-[:IN_TERMINAL]->(term) Tx Tx Tx Tx Fraud Fraud Data load: Transactions
WITH { amount: 2.50, currency:"USD", txid:"05015244006", mid:"5073047", tid:"5073440-7", timestamp:1490060618007, cardno:"5224654370862586050" } AS newTxData MATCH (lastTx:Transaction { cardno: newTxData.cardno }) WHERE NOT (lastTx)-[:NEXT]->() CREATE (newTx:Transaction) SET newTx += newTxData CREATE (lastTx)-[:NEXT]->(newTx) WITH newTx, newTxData MERGE (term:Terminal { tid: newTxData.tid}) CREATE (newTx)-[:IN_TERMINAL]->(term) Tx Tx Tx Tx Fraud Fraud Data load: Transactions
WITH { amount: 2.50, currency:"USD", txid:"05015244006", mid:"5073047", tid:"5073440-7", timestamp:1490060618007, cardno:"5224654370862586050" } AS newTxData MATCH (lastTx:Transaction { cardno: newTxData.cardno }) WHERE NOT (lastTx)-[:NEXT]->() CREATE (newTx:Transaction) SET newTx += newTxData CREATE (lastTx)-[:NEXT]->(newTx) WITH newTx, newTxData MERGE (term:Terminal { tid: newTxData.tid}) CREATE (newTx)-[:IN_TERMINAL]->(term) Tx Tx Tx Tx Fraud Fraud Data load: Transactions
GraphTalk Stockholm - Fraud Detection with Graphs
WITH { txid:"0501524400006"} AS unrecognizedTx MATCH (tx:Transaction { txid: unrecognizedTx.txid }) SET tx:FraudTx Tx Tx Tx Tx Fraud Fraud Data load: Reported fraud
WITH { txid:"0501524400006"} AS unrecognizedTx MATCH (tx:Transaction { txid: unrecognizedTx.txid }) SET tx:FraudTx Tx Tx Tx Tx Fraud Fraud Data load: Reported fraud
WITH { txid:"0501524400006"} AS unrecognizedTx MATCH (tx:Transaction { txid: unrecognizedTx.txid }) SET tx:FraudTx Tx Tx Tx Tx Fraud Fraud Data load: Reported fraud
WITH { txid:"0501524400006"} AS unrecognizedTx MATCH (tx:Transaction { txid: unrecognizedTx.txid }) SET tx:FraudTx Tx Tx Tx Tx Fraud Fraud Data load: Reported fraud
GraphTalk Stockholm - Fraud Detection with Graphs
MATCH (term:Terminal)<-[:IN_TERMINAL]-(t)-[n:NEXT*]->(:FraudTx) WITH term , count(distinct t.cardno) as ct, min(t.timestamp) as mindate, max(t.timestamp) as maxdate WHERE ct > 1 MATCH (term)<-[:IN_TERMINAL]-(otherTx) WHERE otherTx.timestamp < maxdate and otherTx.timestamp > mindate RETURN term.tid AS terminal,mindate,maxdate, 100 * ct / COUNT(DISTINCT otherTx.cardno) AS impact, (maxdate - mindate)/(24*3600000) as timewindow ORDER BY impact DESC, timewindow DESC Query: Fraud origination at terminal level
MATCH (term:Terminal)<-[:IN_TERMINAL]-(t)-[n:NEXT*]->(:FraudTx) WITH term , count(distinct t.cardno) as ct, min(t.timestamp) as mindate, max(t.timestamp) as maxdate WHERE ct > 1 MATCH (term)<-[:IN_TERMINAL]-(otherTx) WHERE otherTx.timestamp < maxdate and otherTx.timestamp > mindate RETURN term.tid AS terminal,mindate,maxdate, 100 * ct / COUNT(DISTINCT otherTx.cardno) AS impact, (maxdate - mindate)/(24*3600000) as timewindow ORDER BY impact DESC, timewindow DESC Query: Fraud origination at terminal level
MATCH (term:Terminal)<-[:IN_TERMINAL]-(t)-[n:NEXT*]->(:FraudTx) WITH term , count(distinct t.cardno) as ct, min(t.timestamp) as mindate, max(t.timestamp) as maxdate WHERE ct > 1 MATCH (term)<-[:IN_TERMINAL]-(otherTx) WHERE otherTx.timestamp < maxdate and otherTx.timestamp > mindate RETURN term.tid AS terminal,mindate,maxdate, 100 * ct / COUNT(DISTINCT otherTx.cardno) AS impact, (maxdate - mindate)/(24*3600000) as timewindow ORDER BY impact DESC, timewindow DESC Query: Fraud origination at terminal level
MATCH (term:Terminal)<-[:IN_TERMINAL]-(t)-[n:NEXT*]->(:FraudTx) WITH term , count(distinct t.cardno) as ct, min(t.timestamp) as mindate, max(t.timestamp) as maxdate WHERE ct > 1 MATCH (term)<-[:IN_TERMINAL]-(otherTx) WHERE otherTx.timestamp < maxdate and otherTx.timestamp > mindate RETURN term.tid AS terminal,mindate,maxdate, 100 * ct / COUNT(DISTINCT otherTx.cardno) AS impact, (maxdate - mindate)/(24*3600000) as timewindow ORDER BY impact DESC, timewindow DESC Query: Fraud origination at terminal level
Query: Fraud origination at terminal level
WITH { tid : '2373743-7', from: 1487340089000, to: 1488039852000 } AS compTerm MATCH (term:Terminal { tid: compTerm.tid} )<-[:IN_TERMINAL]-(t) WHERE NOT (t)-[:NEXT*]->(:FraudTx) AND t.timestamp > compTerm.from AND t.timestamp < compTerm.to RETURN distinct t.cardno AS cardAtRisk Query: Proactive prevention
WITH { tid : '2373743-7', from: 1487340089000, to: 1488039852000 } AS compTerm MATCH (term:Terminal { tid: compTerm.tid} )<-[:IN_TERMINAL]-(t) WHERE NOT (t)-[:NEXT*]->(:FraudTx) AND t.timestamp > compTerm.from AND t.timestamp < compTerm.to RETURN distinct t.cardno AS cardAtRisk Query: Proactive prevention
WITH { tid : '2373743-7', from: 1487340089000, to: 1488039852000 } AS compTerm MATCH (term:Terminal { tid: compTerm.tid} )<-[:IN_TERMINAL]-(t) WHERE NOT (t)-[:NEXT*]->(:FraudTx) AND t.timestamp > compTerm.from AND t.timestamp < compTerm.to RETURN distinct t.cardno AS cardAtRisk Query: Proactive prevention
Query: Proactive prevention
Why graph native matters DB#1 1027910 nodes 4017217 relationships 10044420 properties DB#2 509451186 nodes 1008977685 relationships 3551517114 properties Fraud origination at terminal level 93ms 104 ms Fraud origination at merchant level 102ms 116 ms Proactive prevention 11ms 12 ms
Example 1: Credit card fraud origination and assessment of potential impact
Example 2: Referral program fraud
The flatmates <-[:INVITES]------ <-[:INVITES]------------ -----[:TRANSFER{amount:200}]-> <-[:INVITES]- -------------[:TRANSFER{amount:200}]-> -[:TRANSFER{amount:200}]->
timestamp ,from,to ,amnt ,transferid 1492194035,3316,3606,33.52,f4d21fed-a307-4 1493759810,2693,3886,1655.53,8d060469-f363 1493889115,2229,3557,2725.36,f32b20de-f227 1493946497,3877,2343,672.9,064b98fb-5395-4 1493413944,2360,3358,78.68,d87308f4-508b-4 1491524249,3472,3490,1894.58,3e9bdf77-06be 1492912151,3576,3196,3335.02,d3a50a83-329a 1491846100,3717,2269,3891.62,3fc0f2d6-57c4 1492268780,2656,3527,1809.7,cbc16b4f-b95e- 1493420085,2873,3749,2960.73,4fbf48b8-7501 1492236572,2223,3120,2973.38,1e5b95e7-4e86 1492735617,2318,2820,36.04,c07bc1cd-8970-4
MATCH p = (u:User)-[i:INVITES]->(x)-[t:TRANSFER]->(u) WHERE t.timestamp - i.timestamp < 15*24*3600000 AND t.amount < 210 AND t.amount > 199 AND size((x)-[:TRANSFER]-())=1 RETURN p
MATCH p = (u:User)-[i:INVITES]->(x)-[t:TRANSFER]->(u) WHERE t.timestamp - i.timestamp < 15*24*3600000 AND t.amount < 210 AND t.amount > 199 AND size((x)-[:TRANSFER]-())=1 RETURN p
MATCH p = (u:User)-[i:INVITES]->(x)-[t:TRANSFER]->(u) WHERE t.timestamp - i.timestamp < 15*24*3600000 AND t.amount < 210 AND t.amount > 199 AND size((x)-[:TRANSFER]-())=1 RETURN p
GraphTalk Stockholm - Fraud Detection with Graphs
Fraudsters got more and more sophisticated... <-[:INVITES]-- --[:INVITES]-> ---[:INVITES]-> -[:TRANSFER]-> -[:TRANSFER]-> <-[:TRANSFER]---
But cypher beat them all! MATCH p = (u:User)-[i:INVITES]->(x)-[t:TRANSFER*3..]->(u) WHERE all(r IN relationships(p) WHERE type(r) <>'TRANSFER' OR (r.timestamp - i.timestamp < 15*24*3600000 AND r.amount < 210 AND r.amount > 199)) AND all(n IN nodes(p) WHERE n=u or size((n)-[:TRANSFER]->())=1) RETURN p
But cypher beat them all! MATCH p = (u:User)-[i:INVITES]->(x)-[t:TRANSFER*3..]->(u) WHERE all(r IN relationships(p) WHERE type(r) <>'TRANSFER' OR (r.timestamp - i.timestamp < 15*24*3600000 AND r.amount < 210 AND r.amount > 199)) AND all(n IN nodes(p) WHERE n=u or size((n)-[:TRANSFER]->())=1) RETURN p and *3.. detects chains of any length!
But cypher beat them all! MATCH p = (u:User)-[i:INVITES]->(x)-[t:TRANSFER*3..]->(u) WHERE all(r IN relationships(p) WHERE type(r) <>'TRANSFER' OR (r.timestamp - i.timestamp < 15*24*3600000 AND r.amount < 210 AND r.amount > 199)) AND all(n IN nodes(p) WHERE n=u or size((n)-[:TRANSFER]->())=1) RETURN p
GraphTalk Stockholm - Fraud Detection with Graphs
I could go on with more variants the pattern... <-[:INVITES]- --[:INVITES]->---[:INVITES]-> -[:TRANSFER]-> -[:TRANSFER]-> -[:TRANSFER]-> MATCH p = (u:User)-[i:INVITES]->(x)-[t:TRANSFER*3..]->()
Example 2: Referral program fraud
Three takeaways Graph thinking Graph native matters Graphs rock! Enjoy the rest of the day!
Tack!

More Related Content

What's hot (11)

PDF
MongoDB Europe 2016 - Enabling the Internet of Things at Proximus - Belgium's...
MongoDB
 
PDF
MongoDB .local Houston 2019: Using Client Side Encryption in MongoDB 4.2
MongoDB
 
PDF
apidays LIVE New York - WT* is JWT? by Maciej Treder
apidays
 
PPTX
How to leverage what's new in MongoDB 3.6
Maxime Beugnet
 
PDF
Common Browser Hijacking Methods
David Barroso
 
KEY
Mongo db presentation
Julie Sommerville
 
PDF
MongoDB dla administratora
3camp
 
PDF
Meetup Analytics with R and Neo4j
Neo4j
 
PPT
Every Click Counts (But All the Money Goes to Me)
Avast
 
PDF
SITCON 雲林定期聚 #1
Ting-You Xu
 
PDF
MongoDB Performance Tuning
Puneet Behl
 
MongoDB Europe 2016 - Enabling the Internet of Things at Proximus - Belgium's...
MongoDB
 
MongoDB .local Houston 2019: Using Client Side Encryption in MongoDB 4.2
MongoDB
 
apidays LIVE New York - WT* is JWT? by Maciej Treder
apidays
 
How to leverage what's new in MongoDB 3.6
Maxime Beugnet
 
Common Browser Hijacking Methods
David Barroso
 
Mongo db presentation
Julie Sommerville
 
MongoDB dla administratora
3camp
 
Meetup Analytics with R and Neo4j
Neo4j
 
Every Click Counts (But All the Money Goes to Me)
Avast
 
SITCON 雲林定期聚 #1
Ting-You Xu
 
MongoDB Performance Tuning
Puneet Behl
 

Similar to GraphTalk Stockholm - Fraud Detection with Graphs (20)

PDF
Next Generation Solutions with Neo4j
Neo4j
 
PDF
Fraud Detection and Neo4j
Max De Marzi
 
PDF
Neo4j Graph Data Science Training - June 9 & 10 - Slides #8 - Graph Data Scie...
Neo4j
 
PDF
GraphTalks Italy - Using graphs to fight financial fraud
Neo4j
 
PDF
GraphTalks Frankfurt - Leveraging Graph-Technology to fight financial fraud
Neo4j
 
PDF
Build Intelligent Fraud Prevention with Machine Learning and Graphs
Neo4j
 
PDF
GraphTalks Copenhagen - Analyzing Fraud with Graph Databases
Neo4j
 
PDF
Quick Response Fraud Detection using Data Analytics: Hitting the Ground Runni...
FraudBusters
 
PDF
50 51
INTERNATIONAL INDEXED,REFERRED,MULTILINGUAL,INTERDISCIPLINARY, MONTHLY RESEARCH JOURNAL
 
PPTX
Data Analytics and fraud detection DAFD_unit_1_9july.pptx
Jagadeeswara Rao A
 
PDF
Online Transaction Fraud Detection System Based on Machine Learning
IRJET Journal
 
PDF
Fraud detection guide
CenapSerdarolu
 
PDF
A Comparative Study on Online Transaction Fraud Detection by using Machine Le...
IRJET Journal
 
PPTX
Fraud analytics
Simran Mondal
 
PPTX
Fraud Detection in Real-time @ Apache Big Data Con
Seshika Fernando
 
PPTX
Fraud Detection in Real-time @ Apache Big Data con
Seshika Fernando
 
PDF
Neo4j GraphTalk Copenhagen - Next Generation Solutions using Neo4j
Neo4j
 
PDF
A Novel Approach to Detect Mischief Activities (Fraud) In On-Line Transaction
IJMER
 
PDF
Leveraging graph technology to fight financial fraud
Neo4j
 
PDF
Hadoop BIG Data - Fraud Detection with Real-Time Analytics
hkbhadraa
 
Next Generation Solutions with Neo4j
Neo4j
 
Fraud Detection and Neo4j
Max De Marzi
 
Neo4j Graph Data Science Training - June 9 & 10 - Slides #8 - Graph Data Scie...
Neo4j
 
GraphTalks Italy - Using graphs to fight financial fraud
Neo4j
 
GraphTalks Frankfurt - Leveraging Graph-Technology to fight financial fraud
Neo4j
 
Build Intelligent Fraud Prevention with Machine Learning and Graphs
Neo4j
 
GraphTalks Copenhagen - Analyzing Fraud with Graph Databases
Neo4j
 
Quick Response Fraud Detection using Data Analytics: Hitting the Ground Runni...
FraudBusters
 
50 51
INTERNATIONAL INDEXED,REFERRED,MULTILINGUAL,INTERDISCIPLINARY, MONTHLY RESEARCH JOURNAL
 
Data Analytics and fraud detection DAFD_unit_1_9july.pptx
Jagadeeswara Rao A
 
Online Transaction Fraud Detection System Based on Machine Learning
IRJET Journal
 
Fraud detection guide
CenapSerdarolu
 
A Comparative Study on Online Transaction Fraud Detection by using Machine Le...
IRJET Journal
 
Fraud analytics
Simran Mondal
 
Fraud Detection in Real-time @ Apache Big Data Con
Seshika Fernando
 
Fraud Detection in Real-time @ Apache Big Data con
Seshika Fernando
 
Neo4j GraphTalk Copenhagen - Next Generation Solutions using Neo4j
Neo4j
 
A Novel Approach to Detect Mischief Activities (Fraud) In On-Line Transaction
IJMER
 
Leveraging graph technology to fight financial fraud
Neo4j
 
Hadoop BIG Data - Fraud Detection with Real-Time Analytics
hkbhadraa
 
Ad

More from Neo4j (20)

PDF
MASTERDECK GRAPHSUMMIT SYDNEY (Public).pdf
Neo4j
 
PDF
Jin Foo - Prospa GraphSummit Sydney Presentation.pdf
Neo4j
 
PDF
GraphSummit Singapore Master Deck - May 20, 2025
Neo4j
 
PPTX
Graphs & GraphRAG - Essential Ingredients for GenAI
Neo4j
 
PPTX
Neo4j Knowledge for Customer Experience.pptx
Neo4j
 
PPTX
GraphTalk New Zealand - The Art of The Possible.pptx
Neo4j
 
PDF
Neo4j: The Art of the Possible with Graph
Neo4j
 
PDF
Smarter Knowledge Graphs For Public Sector
Neo4j
 
PDF
GraphRAG and Knowledge Graphs Exploring AI's Future
Neo4j
 
PDF
Matinée GenAI & GraphRAG Paris - Décembre 24
Neo4j
 
PDF
ANZ Presentation: GraphSummit Melbourne 2024
Neo4j
 
PDF
Google Cloud Presentation GraphSummit Melbourne 2024: Building Generative AI ...
Neo4j
 
PDF
Telstra Presentation GraphSummit Melbourne: Optimising Business Outcomes with...
Neo4j
 
PDF
Hands-On GraphRAG Workshop: GraphSummit Melbourne 2024
Neo4j
 
PDF
Démonstration Digital Twin Building Wire Management
Neo4j
 
PDF
Swiss Life - Les graphes au service de la détection de fraude dans le domaine...
Neo4j
 
PDF
Démonstration Supply Chain - GraphTalk Paris
Neo4j
 
PDF
The Art of Possible - GraphTalk Paris Opening Session
Neo4j
 
PPTX
How Siemens bolstered supply chain resilience with graph-powered AI insights ...
Neo4j
 
PDF
Knowledge Graphs for AI-Ready Data and Enterprise Deployment - Gartner IT Sym...
Neo4j
 
MASTERDECK GRAPHSUMMIT SYDNEY (Public).pdf
Neo4j
 
Jin Foo - Prospa GraphSummit Sydney Presentation.pdf
Neo4j
 
GraphSummit Singapore Master Deck - May 20, 2025
Neo4j
 
Graphs & GraphRAG - Essential Ingredients for GenAI
Neo4j
 
Neo4j Knowledge for Customer Experience.pptx
Neo4j
 
GraphTalk New Zealand - The Art of The Possible.pptx
Neo4j
 
Neo4j: The Art of the Possible with Graph
Neo4j
 
Smarter Knowledge Graphs For Public Sector
Neo4j
 
GraphRAG and Knowledge Graphs Exploring AI's Future
Neo4j
 
Matinée GenAI & GraphRAG Paris - Décembre 24
Neo4j
 
ANZ Presentation: GraphSummit Melbourne 2024
Neo4j
 
Google Cloud Presentation GraphSummit Melbourne 2024: Building Generative AI ...
Neo4j
 
Telstra Presentation GraphSummit Melbourne: Optimising Business Outcomes with...
Neo4j
 
Hands-On GraphRAG Workshop: GraphSummit Melbourne 2024
Neo4j
 
Démonstration Digital Twin Building Wire Management
Neo4j
 
Swiss Life - Les graphes au service de la détection de fraude dans le domaine...
Neo4j
 
Démonstration Supply Chain - GraphTalk Paris
Neo4j
 
The Art of Possible - GraphTalk Paris Opening Session
Neo4j
 
How Siemens bolstered supply chain resilience with graph-powered AI insights ...
Neo4j
 
Knowledge Graphs for AI-Ready Data and Enterprise Deployment - Gartner IT Sym...
Neo4j
 
Ad

Recently uploaded (20)

PDF
Generating Union types w/ Static Analysis
K. Matthew Dupree
 
PDF
Salesforce Pricing Update 2025: Impact, Strategy & Smart Cost Optimization wi...
GetOnCRM Solutions
 
PPTX
Role Of Python In Programing Language.pptx
jaykoshti048
 
PDF
WatchTraderHub - Watch Dealer software with inventory management and multi-ch...
WatchDealer Pavel
 
PDF
ChatPharo: an Open Architecture for Understanding How to Talk Live to LLMs
ESUG
 
PDF
New Download FL Studio Crack Full Version [Latest 2025]
imang66g
 
PDF
Applitools Platform Pulse: What's New and What's Coming - July 2025
Applitools
 
PDF
Using licensed Data Loss Prevention (DLP) as a strategic proactive data secur...
Q-Advise
 
PDF
Salesforce Implementation Services Provider.pdf
VALiNTRY360
 
PPT
Brief History of Python by Learning Python in three hours
adanechb21
 
PDF
Download iTop VPN Free 6.1.0.5882 Crack Full Activated Pre Latest 2025
imang66g
 
PPTX
GALILEO CRS SYSTEM | GALILEO TRAVEL SOFTWARE
philipnathen82
 
PDF
How Agentic AI Networks are Revolutionizing Collaborative AI Ecosystems in 2025
ronakdubey419
 
PPTX
TRAVEL APIs | WHITE LABEL TRAVEL API | TOP TRAVEL APIs
philipnathen82
 
PDF
Supabase Meetup: Build in a weekend, scale to millions
Carlo Gilmar Padilla Santana
 
PDF
Enhancing Healthcare RPM Platforms with Contextual AI Integration
Cadabra Studio
 
PDF
SAP GUI Installation Guide for macOS (iOS) | Connect to SAP Systems on Mac
SAP Vista, an A L T Z E N Company
 
PDF
advancepresentationskillshdhdhhdhdhdhhfhf
jasmenrojas249
 
PDF
Balancing Resource Capacity and Workloads with OnePlan – Avoid Overloading Te...
OnePlan Solutions
 
PPTX
classification of computer and basic part of digital computer
ravisinghrajpurohit3
 
Generating Union types w/ Static Analysis
K. Matthew Dupree
 
Salesforce Pricing Update 2025: Impact, Strategy & Smart Cost Optimization wi...
GetOnCRM Solutions
 
Role Of Python In Programing Language.pptx
jaykoshti048
 
WatchTraderHub - Watch Dealer software with inventory management and multi-ch...
WatchDealer Pavel
 
ChatPharo: an Open Architecture for Understanding How to Talk Live to LLMs
ESUG
 
New Download FL Studio Crack Full Version [Latest 2025]
imang66g
 
Applitools Platform Pulse: What's New and What's Coming - July 2025
Applitools
 
Using licensed Data Loss Prevention (DLP) as a strategic proactive data secur...
Q-Advise
 
Salesforce Implementation Services Provider.pdf
VALiNTRY360
 
Brief History of Python by Learning Python in three hours
adanechb21
 
Download iTop VPN Free 6.1.0.5882 Crack Full Activated Pre Latest 2025
imang66g
 
GALILEO CRS SYSTEM | GALILEO TRAVEL SOFTWARE
philipnathen82
 
How Agentic AI Networks are Revolutionizing Collaborative AI Ecosystems in 2025
ronakdubey419
 
TRAVEL APIs | WHITE LABEL TRAVEL API | TOP TRAVEL APIs
philipnathen82
 
Supabase Meetup: Build in a weekend, scale to millions
Carlo Gilmar Padilla Santana
 
Enhancing Healthcare RPM Platforms with Contextual AI Integration
Cadabra Studio
 
SAP GUI Installation Guide for macOS (iOS) | Connect to SAP Systems on Mac
SAP Vista, an A L T Z E N Company
 
advancepresentationskillshdhdhhdhdhdhhfhf
jasmenrojas249
 
Balancing Resource Capacity and Workloads with OnePlan – Avoid Overloading Te...
OnePlan Solutions
 
classification of computer and basic part of digital computer
ravisinghrajpurohit3
 

GraphTalk Stockholm - Fraud Detection with Graphs

  • 1. Fraud Analysis with Neo4j GraphTalk Stockholm Oct 22, 2019 Dr. Jesús Barrasa Neo4j @BarrasaDV
  • 7. What did we learn from the Panama Papers?
  • 8. Look at this dataset
  • 10. Look at the dataset again
  • 12. Do I have a graph problem?
  • 13. Law of the instrument (of the hammer) : cognitive bias that involves an over-reliance on a familiar tool. A.Maslow 1966
  • 14. Did Google have a graph problem back in the early 2000s? I’d say it was an information retrieval problem
  • 15. nd so, my fellow graphistas: ask not whether you have a graph problem - instead, look at your problem with a graph thinking mindset” J. Barrasa - Graph Connect Europe 2017 “A
  • 16. Example 1: Credit card fraud origination and assessment of potential impact
  • 21. WITH { amount: 2.50, currency:"USD", txid:"05015244006", mid:"5073047", tid:"5073440-7", timestamp:1490060618007, cardno:"5224654370862586050" } AS newTxData MATCH (lastTx:Transaction { cardno: newTxData.cardno }) WHERE NOT (lastTx)-[:NEXT]->() CREATE (newTx:Transaction) SET newTx += newTxData CREATE (lastTx)-[:NEXT]->(newTx) WITH newTx, newTxData MERGE (term:Terminal { tid: newTxData.tid}) CREATE (newTx)-[:IN_TERMINAL]->(term) Tx Tx Tx Tx Fraud Fraud Data load: Transactions
  • 22. WITH { amount: 2.50, currency:"USD", txid:"05015244006", mid:"5073047", tid:"5073440-7", timestamp:1490060618007, cardno:"5224654370862586050" } AS newTxData MATCH (lastTx:Transaction { cardno: newTxData.cardno }) WHERE NOT (lastTx)-[:NEXT]->() CREATE (newTx:Transaction) SET newTx += newTxData CREATE (lastTx)-[:NEXT]->(newTx) WITH newTx, newTxData MERGE (term:Terminal { tid: newTxData.tid}) CREATE (newTx)-[:IN_TERMINAL]->(term) Tx Tx Tx Tx Fraud Fraud Data load: Transactions
  • 23. WITH { amount: 2.50, currency:"USD", txid:"05015244006", mid:"5073047", tid:"5073440-7", timestamp:1490060618007, cardno:"5224654370862586050" } AS newTxData MATCH (lastTx:Transaction { cardno: newTxData.cardno }) WHERE NOT (lastTx)-[:NEXT]->() CREATE (newTx:Transaction) SET newTx += newTxData CREATE (lastTx)-[:NEXT]->(newTx) WITH newTx, newTxData MERGE (term:Terminal { tid: newTxData.tid}) CREATE (newTx)-[:IN_TERMINAL]->(term) Tx Tx Tx Tx Fraud Fraud Data load: Transactions
  • 24. WITH { amount: 2.50, currency:"USD", txid:"05015244006", mid:"5073047", tid:"5073440-7", timestamp:1490060618007, cardno:"5224654370862586050" } AS newTxData MATCH (lastTx:Transaction { cardno: newTxData.cardno }) WHERE NOT (lastTx)-[:NEXT]->() CREATE (newTx:Transaction) SET newTx += newTxData CREATE (lastTx)-[:NEXT]->(newTx) WITH newTx, newTxData MERGE (term:Terminal { tid: newTxData.tid}) CREATE (newTx)-[:IN_TERMINAL]->(term) Tx Tx Tx Tx Fraud Fraud Data load: Transactions
  • 26. WITH { txid:"0501524400006"} AS unrecognizedTx MATCH (tx:Transaction { txid: unrecognizedTx.txid }) SET tx:FraudTx Tx Tx Tx Tx Fraud Fraud Data load: Reported fraud
  • 27. WITH { txid:"0501524400006"} AS unrecognizedTx MATCH (tx:Transaction { txid: unrecognizedTx.txid }) SET tx:FraudTx Tx Tx Tx Tx Fraud Fraud Data load: Reported fraud
  • 28. WITH { txid:"0501524400006"} AS unrecognizedTx MATCH (tx:Transaction { txid: unrecognizedTx.txid }) SET tx:FraudTx Tx Tx Tx Tx Fraud Fraud Data load: Reported fraud
  • 29. WITH { txid:"0501524400006"} AS unrecognizedTx MATCH (tx:Transaction { txid: unrecognizedTx.txid }) SET tx:FraudTx Tx Tx Tx Tx Fraud Fraud Data load: Reported fraud
  • 31. MATCH (term:Terminal)<-[:IN_TERMINAL]-(t)-[n:NEXT*]->(:FraudTx) WITH term , count(distinct t.cardno) as ct, min(t.timestamp) as mindate, max(t.timestamp) as maxdate WHERE ct > 1 MATCH (term)<-[:IN_TERMINAL]-(otherTx) WHERE otherTx.timestamp < maxdate and otherTx.timestamp > mindate RETURN term.tid AS terminal,mindate,maxdate, 100 * ct / COUNT(DISTINCT otherTx.cardno) AS impact, (maxdate - mindate)/(24*3600000) as timewindow ORDER BY impact DESC, timewindow DESC Query: Fraud origination at terminal level
  • 32. MATCH (term:Terminal)<-[:IN_TERMINAL]-(t)-[n:NEXT*]->(:FraudTx) WITH term , count(distinct t.cardno) as ct, min(t.timestamp) as mindate, max(t.timestamp) as maxdate WHERE ct > 1 MATCH (term)<-[:IN_TERMINAL]-(otherTx) WHERE otherTx.timestamp < maxdate and otherTx.timestamp > mindate RETURN term.tid AS terminal,mindate,maxdate, 100 * ct / COUNT(DISTINCT otherTx.cardno) AS impact, (maxdate - mindate)/(24*3600000) as timewindow ORDER BY impact DESC, timewindow DESC Query: Fraud origination at terminal level
  • 33. MATCH (term:Terminal)<-[:IN_TERMINAL]-(t)-[n:NEXT*]->(:FraudTx) WITH term , count(distinct t.cardno) as ct, min(t.timestamp) as mindate, max(t.timestamp) as maxdate WHERE ct > 1 MATCH (term)<-[:IN_TERMINAL]-(otherTx) WHERE otherTx.timestamp < maxdate and otherTx.timestamp > mindate RETURN term.tid AS terminal,mindate,maxdate, 100 * ct / COUNT(DISTINCT otherTx.cardno) AS impact, (maxdate - mindate)/(24*3600000) as timewindow ORDER BY impact DESC, timewindow DESC Query: Fraud origination at terminal level
  • 34. MATCH (term:Terminal)<-[:IN_TERMINAL]-(t)-[n:NEXT*]->(:FraudTx) WITH term , count(distinct t.cardno) as ct, min(t.timestamp) as mindate, max(t.timestamp) as maxdate WHERE ct > 1 MATCH (term)<-[:IN_TERMINAL]-(otherTx) WHERE otherTx.timestamp < maxdate and otherTx.timestamp > mindate RETURN term.tid AS terminal,mindate,maxdate, 100 * ct / COUNT(DISTINCT otherTx.cardno) AS impact, (maxdate - mindate)/(24*3600000) as timewindow ORDER BY impact DESC, timewindow DESC Query: Fraud origination at terminal level
  • 35. Query: Fraud origination at terminal level
  • 36. WITH { tid : '2373743-7', from: 1487340089000, to: 1488039852000 } AS compTerm MATCH (term:Terminal { tid: compTerm.tid} )<-[:IN_TERMINAL]-(t) WHERE NOT (t)-[:NEXT*]->(:FraudTx) AND t.timestamp > compTerm.from AND t.timestamp < compTerm.to RETURN distinct t.cardno AS cardAtRisk Query: Proactive prevention
  • 37. WITH { tid : '2373743-7', from: 1487340089000, to: 1488039852000 } AS compTerm MATCH (term:Terminal { tid: compTerm.tid} )<-[:IN_TERMINAL]-(t) WHERE NOT (t)-[:NEXT*]->(:FraudTx) AND t.timestamp > compTerm.from AND t.timestamp < compTerm.to RETURN distinct t.cardno AS cardAtRisk Query: Proactive prevention
  • 38. WITH { tid : '2373743-7', from: 1487340089000, to: 1488039852000 } AS compTerm MATCH (term:Terminal { tid: compTerm.tid} )<-[:IN_TERMINAL]-(t) WHERE NOT (t)-[:NEXT*]->(:FraudTx) AND t.timestamp > compTerm.from AND t.timestamp < compTerm.to RETURN distinct t.cardno AS cardAtRisk Query: Proactive prevention
  • 40. Why graph native matters DB#1 1027910 nodes 4017217 relationships 10044420 properties DB#2 509451186 nodes 1008977685 relationships 3551517114 properties Fraud origination at terminal level 93ms 104 ms Fraud origination at merchant level 102ms 116 ms Proactive prevention 11ms 12 ms
  • 41. Example 1: Credit card fraud origination and assessment of potential impact
  • 42. Example 2: Referral program fraud
  • 44. timestamp ,from,to ,amnt ,transferid 1492194035,3316,3606,33.52,f4d21fed-a307-4 1493759810,2693,3886,1655.53,8d060469-f363 1493889115,2229,3557,2725.36,f32b20de-f227 1493946497,3877,2343,672.9,064b98fb-5395-4 1493413944,2360,3358,78.68,d87308f4-508b-4 1491524249,3472,3490,1894.58,3e9bdf77-06be 1492912151,3576,3196,3335.02,d3a50a83-329a 1491846100,3717,2269,3891.62,3fc0f2d6-57c4 1492268780,2656,3527,1809.7,cbc16b4f-b95e- 1493420085,2873,3749,2960.73,4fbf48b8-7501 1492236572,2223,3120,2973.38,1e5b95e7-4e86 1492735617,2318,2820,36.04,c07bc1cd-8970-4
  • 45. MATCH p = (u:User)-[i:INVITES]->(x)-[t:TRANSFER]->(u) WHERE t.timestamp - i.timestamp < 15*24*3600000 AND t.amount < 210 AND t.amount > 199 AND size((x)-[:TRANSFER]-())=1 RETURN p
  • 46. MATCH p = (u:User)-[i:INVITES]->(x)-[t:TRANSFER]->(u) WHERE t.timestamp - i.timestamp < 15*24*3600000 AND t.amount < 210 AND t.amount > 199 AND size((x)-[:TRANSFER]-())=1 RETURN p
  • 47. MATCH p = (u:User)-[i:INVITES]->(x)-[t:TRANSFER]->(u) WHERE t.timestamp - i.timestamp < 15*24*3600000 AND t.amount < 210 AND t.amount > 199 AND size((x)-[:TRANSFER]-())=1 RETURN p
  • 49. Fraudsters got more and more sophisticated... <-[:INVITES]-- --[:INVITES]-> ---[:INVITES]-> -[:TRANSFER]-> -[:TRANSFER]-> <-[:TRANSFER]---
  • 50. But cypher beat them all! MATCH p = (u:User)-[i:INVITES]->(x)-[t:TRANSFER*3..]->(u) WHERE all(r IN relationships(p) WHERE type(r) <>'TRANSFER' OR (r.timestamp - i.timestamp < 15*24*3600000 AND r.amount < 210 AND r.amount > 199)) AND all(n IN nodes(p) WHERE n=u or size((n)-[:TRANSFER]->())=1) RETURN p
  • 51. But cypher beat them all! MATCH p = (u:User)-[i:INVITES]->(x)-[t:TRANSFER*3..]->(u) WHERE all(r IN relationships(p) WHERE type(r) <>'TRANSFER' OR (r.timestamp - i.timestamp < 15*24*3600000 AND r.amount < 210 AND r.amount > 199)) AND all(n IN nodes(p) WHERE n=u or size((n)-[:TRANSFER]->())=1) RETURN p and *3.. detects chains of any length!
  • 52. But cypher beat them all! MATCH p = (u:User)-[i:INVITES]->(x)-[t:TRANSFER*3..]->(u) WHERE all(r IN relationships(p) WHERE type(r) <>'TRANSFER' OR (r.timestamp - i.timestamp < 15*24*3600000 AND r.amount < 210 AND r.amount > 199)) AND all(n IN nodes(p) WHERE n=u or size((n)-[:TRANSFER]->())=1) RETURN p
  • 54. I could go on with more variants the pattern... <-[:INVITES]- --[:INVITES]->---[:INVITES]-> -[:TRANSFER]-> -[:TRANSFER]-> -[:TRANSFER]-> MATCH p = (u:User)-[i:INVITES]->(x)-[t:TRANSFER*3..]->()
  • 55. Example 2: Referral program fraud
  • 56. Three takeaways Graph thinking Graph native matters Graphs rock! Enjoy the rest of the day!
  • 57. Tack!