Fraud doesn't hide in single transactions, it hides in the relationships between them. This system scores a 400M-edge entity graph in under 40ms, catching rings the moment they form.
Flat fraud models score each transaction alone, so a single mule account looks ordinary right up until the chargebacks land. The signal lives in structure, shared devices, recycled cards, accounts that all funnel to one payout node.
By scoring the neighborhood instead of the row, the GNN sees the ring. A brand-new account inherits risk the instant it connects to a known-bad cluster, which is exactly where the -62% loss reduction comes from.
The hard part isn't the model, it's serving graph context in under 40ms while the graph keeps mutating. TigerGraph handles bounded k-hop expansion, Redis absorbs the repeated reads, and PyTorch Geometric runs inductive message-passing so no per-node retraining is needed.
Confirmed fraud and cleared disputes feed back as labels, so the embeddings stay current as attack patterns shift, no nightly batch lag between a new fraud tactic and the model that catches it.
| Component | Technology | Why |
|---|---|---|
| Graph store | TigerGraph | Native k-hop traversal over 400M edges in single-digit ms |
| Model | PyTorch Geometric (GraphSAGE) | Inductive scoring on never-before-seen nodes |
| Feature cache | Redis | Sub-ms reads of embeddings and rolling aggregates |
| Event bus | Kafka | Ordered, partitioned ingest that scales horizontally |
| Serving | Python / TorchServe | Batched GNN inference behind a low-latency gRPC layer |
New accounts and devices are scored on first appearance without any retraining.
Bounded multi-hop traversal surfaces hidden links while keeping latency flat.
Connected-cluster signals catch coordinated fraud that per-transaction rules ignore.
Redis-served node embeddings keep p99 inference under 40ms at peak load.
Confirmed outcomes write back as labels for ongoing model refresh.
Score thresholds map to allow / review / block per risk appetite and segment.
“Stop scoring the transaction. Start scoring the company it keeps.”
By moving fraud detection from isolated rows to a live 400M-edge graph, the system cut fraud losses by 62% while slashing false positives by 80%, and it does it inline, in under 40ms, without making a single honest customer wait. The combination of TigerGraph traversal, Redis-cached embeddings, and an inductive PyTorch Geometric model means new attack patterns are caught the moment they connect to known-bad structure, not days later in a batch report. It's a fraud platform that gets smarter every time it's attacked.