Detect fraud with network visualization

As a fraud analyst, it’s your job to pinpoint fraudulent activity in huge datasets, identifying trends and patterns to prevent them from reoccurring. Ultimately, you need to uncover the story behind the data.

While conventional rule-based fraud systems are great at flagging known fraud patterns – fraudulent activity you’ve seen before – they can’t help you spot new and evolving tactics. When you only have seconds to make a decision, you need accurate insight, fast.

That’s where network visualization (often called link analysis) toolkits, like KeyLines and ReGraph, fit in. They help reveal key insight quickly and intuitively, making it easier to uncover fraud that would otherwise go unnoticed.

Turn complex and lengthy spreadsheet data into interactive and intuitive diagrams with network visualization
Turn complex and lengthy spreadsheet data into interactive and intuitive diagrams with network visualization.

In this blog post, we’ll see how network visualization works as part of a credit card fraud detection workflow. We’ll also have a quick look at timeline visualization, and how it helps fraud analysts make sense of transaction data over time.

Tackling credit card fraud with network visualization

To detect fraud, you need to find unusual connections. The fastest way to do that is to visualize them.

Here we’re visualizing some simplified fake data, adapted from this Neo4j graph gist. It shows a set of credit card transactions, some of which are disputed by their cardholders.

As an analyst, you need to understand what happened and make some decisions about the investigation’s next steps.

In our visual data model, nodes represent people and merchants, linked by transactions. We’ve highlighted the disputed transactions in red.

Credit card fraud detection -Nodes represent people and merchants, glyphs on merchant nodes show transaction values, and links represent transactions (red - disputed, green - undisputed).
Nodes represent people and merchants, glyphs on merchant nodes show transaction values, and links represent transactions (red – disputed, green – undisputed).

Loading the full dataset, we see this:

Credit card fraud detection - Chart showing disputed and undisputed credit card transactions
A link analysis chart showing disputed and undisputed credit card transactions

Using link analysis to detect fraud?

Download our white paper

Filter noise with advanced analysis features

Faced with this chart, an analyst will want to dig deeper into the disputed transactions to understand what happened. There’s a good chance an employee at one of these merchants is skimming credit cards. But which merchant?

Skimming, sometimes called cloning, is when a fraudster copies credit card information at the point of sale or ATM, usually with a specialized device.

The first step is to filter out the noise. Fraud data is usually big, noisy and complex, so our toolkits come with flexible filtering functionality. You can filter the data based on any logic you choose.

Here, we’ve used filters to highlight people connected to disputed transactions.

Credit card fraud detection - Chart highlighting people with disputes
That leaves us with a much shorter list of merchants and cardholders to inspect.

Walmart is an interesting node. We can see all 4 remaining cardholders spent money at Walmart, but none of those transactions were disputed. Could that be where the cards were cloned?

Visualizing transaction data over time

To dig deeper, we need to see when these transactions happened. Our toolkits come with a time bar component to help users see network activity over time.

Credit card fraud detection - Chart and time bar highlighting people with disputes
The time bar shows activity over time, revealing patterns and trends

The histogram shows the dollar value of the transactions over time. We’ve also used the same red color to show the value of the disputed transactions. We can filter the transactions by time, using the sliders or the controls at the bottom of the time bar.

Let’s filter to focus on the very first disputed transaction in early April.

Using the time bar, we can filter our data by time to hone in on specific periods of interest

That narrows it down further. We can see both Marc and Paul’s first disputed transactions were at Walgreens.

Next we need to see where they used their card before Walgreens. To do that, we’ll switch to our timeline view.

Revealing event sequences with timeline visualization

Timeline visualization gives a unique interactive view of events over time, and the connections between them. Here we’re using our KronoGraph timeline visualization toolkit to visualize the same credit card dataset.

Timeline visualization shows how sequences of events unfolded
We’ve listed merchants and cardholders (our entities) down the left-hand side, with transactions shown as events connecting those entities.

Let’s zoom in on early April again. We can also pin Mark and Paul, meaning we only see their activity in the timeline visualization.

Focusing our timeline visualization to see the sequence of events in early April

We immediately spot something interesting: their undisputed Walmart transactions happened just before their disputed Walgreen spends.

Credit card fraud detection - detecting disputed transactions
The timeline reveals which transaction took place directly before disputes began

To an analyst, this is a pretty clear indication: someone is skimming cards at Walmart.

Advanced timeline and network visualization tools for credit card fraud detection

This example shows only a few different approaches, but our data visualization toolkits offer many ways to unlock insight in your data, including social network analysis, graph layouts, combos and geospatial visualization.

If you’d like to try some of them out for yourself, request a free trial.

This post was originally published some time ago. It’s still popular, so we’ve updated it with fresh content to keep it useful and relevant.

More from our blog

Visit our blog

Registered in England and Wales with Company Number 07625370 | VAT Number 113 1740 61 | 6-8 Hills Road, Cambridge, CB2 1JP. All material © Cambridge Intelligence 2021.