Fraud Known by the Company It Keeps
A fraud model that scores the account alone misses the fraud that lives in the links between accounts. This page shows how much, measured: three ways of scoring the same accounts in the same time-ordered split, with 95% intervals.
R scores the transaction's own row. G adds features computed from the account's neighbourhood. N is a graph neural network. TabFM is a tabular foundation model that is handed the data and not trained. Each dot is the arm's headline run, and its line is the interval over time steps or hours, never over single accounts.
Does the graph help?
Precision-recall AUC on the test period. IBM's synthetic sets leave out the generator's last few days, which are nearly all laundering.
Table
One laundering ring, as each arm saw it
Thick arrows: transfers on the test days, which every arm scored. Coloured: in this arm's 1% alert queue. Grey: not flagged, or not scored (earlier days or the generator's tail). Select a transfer for its scores.
Which shapes only the graph can see
Of each laundering pattern's transfers on IBM HI-Small's test days, the share one 1% alert queue reaches. The patterns are the generator's. This measures what it plants, not what a bank sees.
Table
How far guilt travels
AUPRC by the number of hops of neighbourhood. Hop 0 of arm G is the row model.
Table
When the world shifts
Elliptic's illicit Bitcoin transactions change after a dark market shut down at step 43. Every frozen arm collapses. The last two rows recover by using the latest labels: the row model is retrained, and TabFM's context replaced, before each test step.