Transaction Graph

In a financial transaction graph, edges are inherently directed to represent the irreversible flow of value from a sender to a receiver. Each edge carries a weight encoding the transaction amount, and often a temporal feature like a Unix timestamp. This is critical for anti-money laundering, where the directionality of layering—splitting funds across multiple downstream accounts—is the primary signal. GNNs like Graph Attention Networks (GATs) can learn to attend asymmetrically to incoming versus outgoing payment flows, distinguishing legitimate payroll distributions from smurfing patterns.

Realistic financial graphs are heterogeneous, containing multiple node types (e.g., AccountHolder, Merchant, Device, IP_Address) and edge types (e.g., TRANSFERS_TO, LOGS_IN_FROM, OWNS). This semantic richness allows a Relational Graph Convolutional Network (R-GCN) to apply distinct transformation matrices per relationship type. For example, a TRANSFERS_TO edge between two accounts is processed differently than a REGISTERED_WITH edge linking an account to a device fingerprint, preserving the unique semantics of each connection.

Unlike static social networks, transaction graphs are dynamic and continuously evolving. New nodes (accounts) and edges (transactions) arrive as a streaming time-series. A Temporal Graph Network (TGN) models this by maintaining a compressed memory state for each node that updates after every interaction. This allows the model to capture concept drift in behavior—such as a dormant account suddenly becoming a high-velocity mule—by recognizing that the timing of edges is as suspicious as their topology.

The power of graph-based fraud detection lies in analyzing k-hop neighborhoods. A single transaction might look legitimate, but a 2-hop or 3-hop view reveals structural anomalies. For instance, a fraud ring often forms a near-clique or a dense bipartite subgraph between synthetic sellers and buyers. Message passing mechanisms in GNNs aggregate features across these hops, allowing a node to indirectly learn about the risk profile of its neighbor's neighbors, effectively detecting collusion without explicit rules.

Transaction graphs encode information in two domains. Spatial features include local statistics like degree centrality, clustering coefficient, and PageRank, which identify hubs and isolated clusters. Spectral features, derived from the Graph Laplacian matrix, capture the global smoothness of the graph signal. Anomalies often manifest as high-frequency noise in the spectral domain. Graph Convolutional Networks (GCNs) operate on this Laplacian eigenspectrum to filter out normal, low-frequency transactional hum and amplify the high-frequency signal of fraud.

Many payment networks naturally form bipartite graphs with two disjoint sets: originators (payers) and beneficiaries (payees). Fraudulent schemes like transaction laundering often create abnormally dense bipartite cores where a small set of illicit merchants is connected to a large set of synthetic payers. Algorithms like SUSPICION or custom bipartite GNNs analyze the adjacency matrix of this subgraph to detect density anomalies that would be invisible in a unimodal projection of the network.