What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A fraud investigation agent can use a graph to assemble connected evidence, a language model to request a bounded follow-up, and deterministic rules to select an action—without letting the model decide whether to block a card. That is the design Kaushal Chaudhari describes in a project built with TigerGraph, Jev, Bayesian scoring, and human approval. The author reports a graph spanning more than 590,000 transactions; that is the project’s stated scale, not an independently validated benchmark result.
What the fraud agent does—and what it does not
Chaudhari describes a workflow for investigating a card alert, whether it comes from a customer dispute, a high bank risk score, or an analyst request. TigerGraph supplies connected records, Jev can make a limited choice about where to look next, a Bayesian-style calculation updates risk, and a deterministic policy engine selects the response. The language model explains a decision already made by the policy; it does not decide that a transaction is fraudulent or that a card should be blocked.
As an Amazon Associate I earn from qualifying purchases.
The author summarizes this implementation with the line, “Jev decides when to look. TigerGraph decides what is true.” It is a description of this project’s division of responsibility, not a general guarantee about either technology. The account appears in Kaushal Chaudhari’s DEV Community project article; it does not provide independent performance validation or a head-to-head evaluation.
How evidence moves through the system
Every case starts with the same evidence pack
Rather than asking a model which facts to retrieve, the system begins with a fixed set of pre-installed TigerGraph queries. Chaudhari says this makes the initial evidence collection consistent across cases and prevents the model from silently omitting an evidence category.
#1 Best Overall
| Evidence area | Queries named in the project | What it is used to examine |
|---|---|---|
| Transaction and card history | txn_and_card, card_window |
The transaction under review and activity on its card. |
| Device and neighboring cards | device_profile, device_neighbors |
The device profile and other cards connected to that device. |
| Identity and location | identity_flag, region_history |
Identity flags and the card’s regional history. |
| Recurring payments | recurring_match |
Whether the transaction matches a recurring-payment pattern. |
| Earlier cases | prior_cases |
Relevant previous investigations on the card. |
| Current episode exposure | exposure_episode |
Transactions and exposure associated with the current episode. |
The graph’s named entities include Transaction, BankCard, DeviceProfile, ClosedCase, IdentityFlag, PolicyNote, and ExamCase. Relationships such as TXN_ON_CARD, FROM_DEVICE, and CASE_ON_CARD express how those records connect. The graph is named HHGOA.
Jev can request only one bounded follow-up
After the fixed lookups, Jev may choose one additional graph query. The available choices described by Chaudhari include checking connected component cards, walking a bounded card community, looking at prior cases, or retrieving a relevant policy passage. Queries were installed in advance and exposed through TigerGraph MCP; the system does not generate GSQL at runtime.
Graph retrieval and vector retrieval have different jobs here. The graph establishes which records are connected. Vector search locates a relevant policy paragraph that can inform an explanation. Jev may also identify a pattern not captured by the fixed checks and check whether explanatory sentences are supported by evidence references.
Rank #2
How evidence becomes a score and an action
The score updates risk; it does not dictate the response
The project uses the bank’s risk_score as a Bayesian prior, then updates log-odds using evidence and fixed weights. Earlier closed cases can inform the investigation, but they do not by themselves establish that the current transaction is fraud. Chaudhari says the mapping from bank risk scores and evidence weights is not yet fitted on earlier closed cases; fitting and freezing that configuration is described as a future improvement, not an implemented capability.
Scoring and action selection are separate. The policy engine applies the rules in this order:
- Close the case as legitimate if the evidence and rules support that outcome.
- Treat a pattern marked
undocumentedas fraud under the described policy. - Otherwise, compare the probability with the fraud threshold.
- If the threshold is not crossed, leave the case uncertain rather than forcing a binary answer.
A named pattern, a high bank score, or a customer dispute alone does not automatically trigger every possible action. Uncertainty is an intended result, not a system failure.
Rank #3
- Used Book in Good Condition
What the two example cases show
HHG-011: more evidence raises risk, then pulls it back
The customer says, “I never made this $131.30 purchase.” In the author’s example, the transaction matches the card_not_present_new_device pattern. The new device and a connection to a prior confirmed fraud case raise the estimated probability; a long quiet history lowers it. Chaudhari reports illustrative values of about 0.39 initially, then 0.56, then 0.83, and finally about 0.76 as evidence is considered.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe final example remains uncertain: the card stays open while the system opens a case, monitors other cards on the device, and escalates the matter to an analyst. These figures and actions are author-reported illustrations, not independently verified estimates of accuracy or real-world outcomes.
HHG-016: a later response changes the plan
For HHG-016, the first plan is to verify the customer and open a case. In the author’s assumed follow-up, the customer confirms the purchase came from a new phone. The estimated probability falls to about 0.12, and a second policy pass closes the case as legitimate. The original and revised plans are retained; alternative responses are stored as counterfactuals, not presented as events that actually occurred.
Where human approval and live systems enter
The described policy routes high-impact actions through approval. DECLINE_TRANSACTION, FILE_REPORT, and BLOCK_CARD require an appropriate approval route, and the system rejects an approval request for an action that is not on the final action list. Opening a case, monitoring, warning a customer, or closing a legitimate transaction may proceed automatically in this design.
The benchmark is simulated at the action boundary: it does not send a live SMS, freeze a real card, or write to a production CRM. That distinction matters. The examples demonstrate a proposed investigation workflow, not a deployed bank service or evidence that its interventions work with real customers.
Recommended Free Tools
What the project establishes—and what it leaves open
Chaudhari’s article presents an implementation pattern: standardize initial evidence retrieval, constrain follow-up queries, separate risk scoring from policy actions, preserve uncertainty, and require approval for specified high-impact actions. It reports a project scale of 590K+ transactions, but does not establish dataset provenance, benchmark methodology, fraud-detection accuracy, comparative model results, or independent evaluation. The scale figure should not be read as proof that the agent was tested successfully across that many cases.
The author also identifies proposed work rather than completed features: calibrating the prior and weights against earlier closed cases, freezing that configuration, and running community detection offline. Jev did not always return a probability map in the scored run, according to the article. These limits make it especially important not to conflate a graph’s ability to trace connections with proof that a connected transaction is fraudulent.
What to examine in a similar design
- Evidence control: Are the initial evidence categories fixed, or can a model omit them?
- Query boundaries: Are follow-up queries pre-installed and limited, or generated freely at runtime?
- Calibration: Is the score tied to validated historical outcomes, and can the system represent uncertainty?
- Action authority: Does deterministic policy choose actions separately from model-generated language?
- Approval and execution: Which actions need human approval, and does a simulation actually touch live customer systems?
- Evaluation quality: Are dataset provenance, methodology, and independent results documented?
On the evidence in the project account, this is a useful architecture example—not proof of an effective fraud detector. Its most important design choice is the boundary between investigation and authority: the system can gather and explain evidence, while policy and approval controls retain the power to act.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
