GNN
A graph neural network (GNN) is a model that learns over data structured as a graph — entities as nodes, relationships as edges — by passing information along the edges so that each node's representation reflects its neighbours and their neighbours, and using that structure as a signal; a customer who shares a device with three accounts linked to a known fraudster is suspicious in a way no feature about the customer alone reveals. GNNs find fraud rings.
- Also known as
- Graph neural network, Graph neural networks, Graph learning, Network analytics
- Used at
- fraud-ring and mule-network detection, transaction-monitoring alert prioritisation, KYB and beneficial-ownership resolution, collusion and merchant-fraud detection, credit risk with related-party structures, recommendation, and, outside finance, molecule and protein modelling, and social networks
- Binding
- none for the method; the graph's data is personal data linked across customers, which needs a lawful basis and a data-protection assessment; explanations for decisions based on a customer's connections must be defensible (guilt by association is not a reason code a regulator accepts without the evidence)
- Typical mechanics
- nodes (accounts, devices, addresses, companies, people) and edges (transactions, shared attributes, ownership) form the graph; message passing aggregates neighbours' features into each node's representation over several layers (each layer reaches one hop further); a task head classifies nodes (is this account a mule?), edges (is this transaction suspicious?) or subgraphs (is this cluster a ring?); training is supervised on labelled cases or self-supervised on the structure
- Typical gains
- detection of coordinated fraud that per-account models miss — vendors and banks report lifts of 20–50% in ring and mule detection at constant false-positive rates; the gain comes from the structure, so the graph's completeness (which entities and links are captured) bounds it
- Parties
- the fraud and financial-crime teams, the graph-database and network-analytics vendors (Quantexa, Linkurious, TigerGraph, Neo4j and the fraud platforms with graph modules), the data engineers who build the entity-resolution and graph pipelines, and the investigators who read the subgraphs
How a graph neural network works in practice
A neobank has 4 million accounts and per-account fraud scores that miss a growing pattern: accounts opened with different identities that share devices, funding sources and payees, moving money in a chain. The team builds a graph — accounts, devices, IP addresses, phone numbers, payees, funding accounts as nodes; logins, transfers and shared attributes as edges — resolved from its own data, and trains a GNN on 6,000 confirmed mule accounts and their neighbourhoods. The model learns that an account two hops from a confirmed mule through a shared device and a common payee is very likely a mule; it scores every account nightly; and for each alert it produces the subgraph — the accounts, the links, the confirmed case at the centre — that an investigator reads in a minute. Detection of mule accounts rises from 44% to 78%; the alerts come as networks of 20–200 accounts rather than one at a time, and the bank closes rings rather than accounts.
The prerequisites are the reason it is a project. Entity resolution — knowing that two addresses, two device fingerprints or two company names are the same — decides the graph's quality, and it is most of the work. The graph must be stored and queried at scale, which means a graph database or a graph layer over the data platform. Explanations must be the subgraph, not a score, because the investigator, the SAR narrative and the regulator need to see the connections. And the data-protection assessment must cover linking customers to one another by attributes they share. The AML use is the strongest: transaction monitoring per account generates the false positives the industry knows; monitoring the network finds the structure that laundering has. For a buyer, a fintech's network analytics is diligenced on its entity resolution, its graph's coverage and its explanation design; a vendor's is diligenced on results at customers.
For a fintech, a GNN is the model for fraud that is organised, which is most fraud that matters; its value is the graph beneath it, and the graph is built from entity resolution the company must do itself.
Example
An acquirer onboards 8,000 merchants a month and loses €6 million a year to bust-out and collusive-merchant fraud that per-merchant underwriting misses. It builds a merchant graph — legal entities, directors, beneficial owners, addresses, bank accounts, websites, devices, shared customers — resolved from applications, registers and transaction data, and trains a GNN on 400 confirmed collusive networks. At onboarding, each applicant is scored with its neighbourhood: an applicant whose director was a director of two terminated merchants and whose settlement account is shared with a third is flagged with the subgraph shown to the underwriter. Results in a year: collusive-merchant losses down 65%; 90 networks identified that the per-merchant process had approved; false-positive rate at review 30%. The entity-resolution pipeline took seven months; the model, six weeks.
Common mistakes
- Building the model before the entity resolution; the graph's quality is the result. - Alerts as scores without the subgraph that explains them. - Linking customers by shared attributes without the data-protection assessment. - A graph that omits the entities (devices, payees) where the structure lives. - Reading a vendor's ring-detection lift without asking what graph it was measured on.