This work addresses the detection of layering patterns in transaction graphs by defining pass-through templates, a class of transaction graphs whose structure is indicative of a specific layering pattern in which entities receive funds and rapidly forward them, and using Edmonds'blossom algorithm, which provably finds an optimal solution to this problem.
Abstract
Layering is a key stage of the money laundering process in which assets are moved through intermediate entities to obscure their origin. We model this movement as a transaction graph, a labeled directed multigraph where nodes represent entities, such as individuals or organizations, and edges represent transactions between them. This work addresses the detection of layering patterns in transaction graphs. We define pass-through templates, a class of transaction graphs whose structure is indicative of a specific layering pattern in which entities receive funds and rapidly forward them. We formulate detecting instances of these templates within a larger transaction graph as a maximum-cardinality, maximum-weight matching problem. The resulting method uses Edmonds'blossom algorithm, which provably finds an optimal solution to this problem. Here we present a case study on publicly available Ethereum transaction data. We identify 283 pass-through template instances, chained through shared address nodes into a densely interconnected network that moves hundreds of millions of dollars in stablecoin value. We find that six addresses in the identified network are sanctioned by the U.S. Department of the Treasury for associations with criminal organizations, providing evidence of ties between the network and sanctioned criminal entities.
This paper introduces the Structure-Augmented Generative Graph Model (SAG^2M) to detect conspiracy spoofing through substructure frequency-augmented detection, and demonstrates its superior effectiveness in identifying complex fraudulent behaviors.
Sheng Xiang, Zi-Wen Xu, Yi-Dong Jiang et al.· Proceedings of the Thirty-Fi...· 0 citations
Account takeover (ATO) fraud is a growing threat to digital banking, requiring effective detection while minimizing friction for legitimate customers. Production systems predominantly rely on tabular models that score sessions in isolation, discarding the relational structure of the underlying interaction network. Alth...
M. Kerdabadi, Xin-Rou Li, Yao Xiao et al.· 0 citations
Money-mule networks move criminal funds through many small transfers, each of which looks ordinary on its own. What marks an account as a mule lies outside any single transfer: in the counterparties and addresses its network shares, and in the shape of its activity over time. Production systems remain largely rule-base...
As financial systems grow more complex and interconnected, traditional fraud detection methods struggle to keep pace with increasingly sophisticated attacks. Graph-based approaches have been explored with a focus on cross-user interactions. In this paper, we propose a graph-based approach that focuses on individual car...
Roya Amiri, Sardar F. Jaf· International Conference on...· 0 citations
Financial fraud poses a persistent and escalating threat to global economic systems, causing hundreds of billions of dollars in annual losses and severely undermining trust in digital financial infrastructure. Traditional rule-based and classical statistical detection methods have proven increasingly inadequate against...
Gurvinder Pal Singh, Vikas, Meghana Lokhande et al.· International Conference on...· 0 citations
Pulling a fixed set of fields out of documents that arrive in many formats and under drifting schemas is usually done with hand-written byte patterns, which break whenever a key is renamed, a value is reformatted, or a lookalike value appears first. We argue the cause is structural: one pattern must both describe the v...
Osama M. Mustafa· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.