How We Reduced Fraud by 67% at a Tier-1 Bank Using Graph Neural Networks

Fraud rings rarely act alone. A stolen card, a mule account, and a synthetic identity often share a device fingerprint, an IP range, or a beneficiary account several hops away — connections that traditional rule-based and tabular ML models struggle to see because they evaluate each transaction in isolation.

The Problem With Transaction-Level Scoring

Most fraud detection stacks score a transaction using features derived from that transaction and its immediate account history: amount, merchant category, velocity, geolocation. This works well for obvious anomalies but misses coordinated fraud, where each individual transaction looks unremarkable and only the relationships between accounts reveal the pattern.

Modeling the Transaction Graph

We modeled the bank's transaction data as a heterogeneous graph — accounts, devices, merchants, and beneficiaries as nodes, transactions and shared attributes as edges — and trained a Graph Neural Network to learn representations that capture multi-hop relationships between entities.

Key architectural decisions:

• Heterogeneous graph construction — separate node and edge types for accounts, devices, and merchants, so the model can learn type-specific propagation rules rather than treating every relationship the same way.
• Temporal windowing — the graph is rebuilt on a rolling window rather than as a single static snapshot, so the model reflects recent behavior rather than a graph that has drifted out of date.
• Inductive learning — using GraphSAGE-style neighborhood sampling so the model can score accounts it has never seen during training, which matters for a bank onboarding new customers daily.

Serving at 2M Transactions per Second

A GNN that only works offline is a research artifact, not a fraud control. Getting inference latency low enough for real-time authorization required:

1. Precomputing and caching node embeddings on a rolling basis rather than recomputing the full graph per request
2. A lightweight scoring model at the authorization edge that consumes cached embeddings plus real-time transaction features
3. An asynchronous graph-update pipeline that keeps embeddings fresh without blocking the transaction path

Results

Working alongside the bank's existing fraud team, the system reduced confirmed fraud losses by 67% over the prior rules-based baseline, while keeping false-positive rates — and the customer friction that comes with them — within the bank's target thresholds.

What We'd Do Differently

Graph construction and feature engineering took longer than model training. If we were starting over, we'd invest earlier in a shared entity-resolution layer, since a meaningful share of the graph's early noise came from near-duplicate account and device identities rather than the model itself.