Graph detection: networks, mules, and beneficial-owner rings

Three ways to see it

1. 1

   A graph is a set of nodes connected by edges. In banking, the nodes are typically accounts, customers, devices, IPs, phone numbers, and merchants. The edges are the relationships between them: a transaction is an edge from one account to another, a shared device is an edge between two customers, a common phone number is an edge between two CNICs. When you stack all of these relationships, you get a multi-layered graph that is the structural truth of how money and identity move through your bank. Most fraud and almost all organised laundering produces graph patterns that no transaction-by-transaction view can see. Mule rings, in particular, are graph phenomena by definition.

2. 2

   Three graph features have proven to do the bulk of the work in Pakistani fraud detection. Degree counts how many distinct counterparties a node interacts with in a window. A normal salary account has a degree of 3-8 per month; a mule typically has 30-80. PageRank-style centrality measures how important a node is in the network, where importance is recursively defined by being connected to other important nodes. Mules tend to sit on the high-centrality paths between source and destination accounts. Connected component size is the number of nodes you can reach from a given node by following edges. Healthy banking shows millions of small components; a single huge component containing thousands of unrelated personal accounts is a structural anomaly worth investigating.

3. 3

   Beneficial-owner detection is graph work even when it does not look like it. PVARA Pakistan and the FATF Recommendation 24 require banks to identify the natural person who ultimately controls a corporate customer. In practice, criminals lay several layers of shell companies between themselves and a regulated account. A graph view collapses these layers. Edges from corporate node to corporate node, weighted by ownership percentage, can be traversed to compute a single ultimate beneficial owner score per terminal natural person. Where the graph is incomplete, the very absence of expected edges is itself a feature: a corporate that has no documented natural-person owner above 25 percent and no documented person above 10 percent is a beneficial-ownership anomaly worth flagging.

The why-tree

Try this with Claude

AI-edge prompt: 'I have one Pakistani bank's 90-day Raast and IBFT transaction log, anonymised. Walk me through the steps to build a graph in Neo4j with accounts as nodes and transactions as weighted directed edges, compute degree, PageRank centrality, and connected-component size for every account, and output the top 50 accounts by suspicion-weighted score. Give me the Cypher queries and the threshold logic. Note where I should add a manual review step.' Run the queries on a sandboxed copy of your real data.