A graph neural network flags coordinated mule-account rings by
looking at who an account is connected to, not just its own
transaction history.
...
Recall: real mule accounts correctly caught in the held-out test set
...
Precision
...
F1
...
False alarms
...
Mules in test set
Loading...
Why a graph, not a flat feature table
A single mule account often doesn't look suspicious on its own:
normal-ish transaction count, normal-ish amounts. What gives it away
is who it's connected to. A chain of accounts passing the same money
along fast, or a cluster of ordinary accounts quietly feeding into
one collection point. A flat per-account model can't see that,
because "my neighbor also looks weird" isn't a column in a feature
table. A GNN can. It passes information along edges, so a node's
prediction is built from its own features and its
neighbors'.
Account Lookup
Inspect any test-set account.
See the model's prediction, its confidence, and the immediate transaction neighborhood that shaped it.
Guided walkthrough
node 304
Also worth a look: ,
a false positive the model's own features can actually explain.
predicted mulepredicted normalpredicted, but wrongarrows show transaction directionscroll to zoom, drag to pan, click a ringed neighbor to jump in
PREDICTION
...
CONFIDENCE
...
TRUE LABEL
...
...
Error Analysis
Where it succeeds, where it fails.
Read honestly, including the mistakes that don't have a tidy explanation.
...
Layering-chain recall
...
...
Funnel recall
...
Funnel mules are harder to catch. They only look unusual once the
model sees that their neighbor (the collector) has an
abnormal in-degree, and that needs 2-hop reasoning, learned from just
6 funnel-collector examples in training.