Start with an ordinary event
Consider a recently created account requesting a payout. Its transaction amount, account profile, and payment destination may each appear plausible. An event score can be useful, but it describes only the information included in that event and its features.
Follow the reused infrastructure
Coordinated actors often reuse the things that make an attack practical: devices, payment instruments, addresses, or beneficiary accounts. When several apparently independent accounts share those resources, the relationships create a pattern worth investigating. A graph represents entities as nodes and their relationships as edges, making that connected structure available for analysis.
Let context change the question
Instead of asking only whether a payout is unusual, an analyst can ask which other accounts use the same device, whether a payment instrument has appeared elsewhere, and how a beneficiary connects to prior investigations. The answer can reveal a coordinated cluster without requiring every account to trigger an independent rule.
A connection is evidence, not a verdict
Shared infrastructure also has legitimate explanations. Households, workplaces, payment facilitators, and public networks can create overlapping signals. A reliable investigation combines relationship evidence with timing, business context, and source quality. High-impact decisions still need appropriate policy controls and human oversight.
Design for the analyst
A useful graph investigation should preserve provenance: what event established the relationship, when it occurred, and how confident the match is. Analysts need to inspect those details, distinguish inference from observation, and document a reasoned outcome. The graph is most valuable when it makes that reasoning easier to inspect.