A Graph Database Approach to Multi-Hop Fraud Pattern Analysis

Abstract

Modern financial fraud rarely occurs in isolation; bad actors increasingly rely on coordinated networks spanning accounts, devices, merchants, synthetic identities, and network identifiers. A transaction that appears entirely legitimate when evaluated individually often reveals suspicious behavior once its broader relational context is analyzed. This paper presents a graph-database-driven framework engineered for multi-hop fraud pattern analysis, representing financial entities as nodes and their interactions as explicit relationships. Built on a Neo4j architecture, the system integrates bounded multi-hop traversals, path analysis, structural centrality measures, and Louvain community detection accessible via an interactive web interface. The framework specifically targets five recurring investigation topologies: shared device or hardware infrastructure, shared network identifiers, intermediary pass-through chains, circular money transfers, and indirect exposure to flagged entities. To mitigate false positives, an explainable risk scoring model is introduced, combining structural topology with pattern-based indicators to ensure connectivity alone is not treated as definitive proof of fraud. We present an end-to-end operational architecture encompassing real-time data ingestion, graph construction, automated alert generation, and web-based visualization. Finally, a reproducible evaluation protocol is established to measure multi-hop query latency across varying depths, graph scale-up performance, analytical execution runtime, pattern coverage, and predictive accuracy (precision, recall, F1-score, and ROC-AUC). This work provides a focused, relationship-centric methodology aimed at delivering transparent, evidence-backed insight for fraud investigations.