A fraud score can miss a relationship that is invisible in a single transaction: an account may share a device, phone number, or counterparty with other suspicious activity. A graph can expose those connections, and an AI agent can use bounded graph queries to gather evidence for an investigator. That can make a score easier to question and investigate; it cannot establish fraud by itself.
Why a transaction score can miss the bigger picture
A score evaluates the signals made available to it. If the scoring view focuses on one transaction or account at a time, it may not show that the same device appears on several applications, that multiple accounts send money to the same counterparty, or that a transaction sits within a larger pattern.
As an Amazon Associate I earn from qualifying purchases.
An entity graph represents records and events as connected objects. A transaction that looks ordinary in isolation may merit a closer look when its account shares identifiers or paths with other activity. The connection is a lead, not proof: a shared device or phone can have legitimate explanations, and a graph link can be wrong if the underlying identity resolution is wrong.
That distinction answers the practical question, “Why did the fraud score miss this?” The score may not have been designed to consider the relationship, or the relationship may not have been present in its input data. A graph-based investigation can help reveal what the score did not show, but it does not make the score infallible or replace a decision process.
#1 Best Overall
What an agentic graph investigator would do
In this design, the agent is an investigator’s tool user, not an autonomous authority to block transactions. TigerGraph describes graph queries as one of several tools an agent can call, using connected information about accounts, transactions, and behavior in a reasoning loop. That vendor description supports the concept of connected investigation; it does not establish that TigerGraph provides a complete, independently validated fraud agent or that an agent should make final decisions.
- Build and link the graph. Ingest relevant customer or person records, accounts, transactions, devices, phone numbers, email addresses, IP addresses, merchants, and known-risk entities when the institution has an appropriate legal basis. Record the events and relationships explicitly so a reviewer can see what connects two entities.
- Start with an investigation trigger. The input might be a transaction alert, a flagged account, or an analyst’s question such as “What is this account connected to?”
- Let the agent choose from bounded tools. The agent can select approved graph queries and investigation tools, rather than receiving unrestricted access to the data or the ability to invent and run arbitrary queries.
- Retrieve relevant connections. Queries can return linked entities, paths, communities, and event history. The investigator should be able to trace a finding back to the specific records and relationships that support it.
- Present a finding with uncertainty. A useful response states what was found, which path or events support it, and what remains unknown. “This account shares a device with three accounts involved in flagged activity” is more reviewable than an unexplained risk label; it still does not prove the account holder’s intent.
- Route the recommendation for review. A human investigator or a separately governed decision workflow can decide what action, if any, is appropriate.
What the graph needs to represent
The value of the approach depends on the quality and scope of the graph. Possible entities include people or customer records, bank accounts, transactions, devices, phones, emails, IP addresses, merchants, and known-risk entities. Relationships can represent ownership, use, payment, shared identifiers, or other relevant links. The institution should make the basis and provenance of each important connection inspectable.
Identity resolution is especially important. Two records linked to one person or device may be a mistaken match; conversely, a changed phone or device may conceal a real connection. A graph query can only surface the links represented in its data, so stale, incomplete, or incorrectly joined records limit what the investigator can see.
Data inclusion also requires care. Institutions should use identifiers only when they have a lawful and appropriate basis, and should govern access, retention, and review accordingly. The graph is not a reason to collect every available identifier.
What graph methods can contribute
Community detection
TigerGraph’s November 2021 fraud solution brief names Louvain community detection as a way to find groups with unusually dense interconnections. A community can help an analyst decide where to look; group membership does not establish that every person or account in it is fraudulent.
Centrality and PageRank
The same 2021 brief describes PageRank as a way to examine influence within suspicious transaction communities. It can help prioritize central entities for follow-up, but centrality is not a finding of intent or guilt. These are examples from a vendor brief, not a definitive or current ranking of fraud algorithms.
Rank #3
Graph features in existing models
Graph-derived features—such as the number of shared identifiers, proximity to a known-risk entity, or community membership—can be added to an existing model. TigerGraph’s 2026 risk-and-fraud blog also presents graph neural networks as a way to capture network structure. These are the vendor’s technical positions; the material available here does not establish a universal improvement in model accuracy.
In each case, the method helps surface structure for prioritization or analysis. The investigator still needs to inspect the underlying events, consider benign explanations, and assess evidence in context.
Where fraud detection and AML investigation differ
Fraud detection may be used to prevent a near-term loss, including by examining a transaction as it occurs. Anti-money-laundering investigation and compliance workflows can have different objectives, timelines, and review requirements. A graph can help explore upstream and downstream connections when the analyst does not know every suspicious branch in advance, but that shared capability does not make the two workflows interchangeable.
Rank #4
The appropriate response to a graph finding therefore depends on the institution’s use case and governed process. A connection can justify additional review without, on its own, justifying an adverse action.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to judge a proposed implementation
Before comparing an agentic graph investigator with a score-only workflow or another graph platform, evaluate the whole chain from input signal to recommendation—not a single model metric or vendor demonstration.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- Entity and event coverage: Which accounts, events, and identifiers are represented, and how are records resolved to entities?
- Performance under real workloads: Does the system meet the institution’s latency and scale needs on its own data and query patterns?
- Reviewability: Can an investigator inspect the paths, source events, and relationships behind a finding?
- Comparable outcomes: Are false positives and missed fraud measured on the same labeled data and time period for each workflow?
- Agent permissions: Which tools and queries may the agent use, and what actions are explicitly out of bounds?
- Governance: Are access, audit trails, privacy, retention, and human review defined for the deployment?
- Operational fit: What integrations, deployment work, and ongoing operating costs are required?
The sources discussed here do not provide a comparable independent benchmark across deployments, nor do they independently verify the architecture’s accuracy, regulatory suitability, or impact. A vendor’s speed, scale, customer outcome, or model-improvement claim should be treated as a vendor claim unless corroborated for the institution’s own conditions.
Best Value
What a customer story can—and cannot—show
TigerGraph’s published NewDay customer story quotes Danny Clark, Head of Fraud Prevention at NewDay: “At the same time, we wanted to enable our fraud investigation team to act autonomously—without relying on developers—tuning queries in near real-time with ‘train-of-thought’ analysis and speed.” This describes the customer’s stated goal in a vendor-published story; it is not an independent assessment of outcomes or a general guarantee that analysts can safely tune queries in any deployment.
Customer stories and vendor pages can illustrate implementation choices and reported results, but they should not be treated as independent benchmarks. The strongest evidence for a prospective user would be a reviewable evaluation using its own relevant data, workload, and decision criteria.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
