Fraud Data Architecture

What data lives where across AWS and Neo4j

A fraud ring shows why an investigation needs both views

One transfer can look ordinary. Its connections can reveal coordinated activity.

Account ACC-1001 ⇄ Account ACC-2047
         ↘         ↙
   742 Evergreen Terrace
  • Shared identity signal: Accounts belonging to different customers use the same address.
  • Reciprocal movement: A $4,200 wire and a $3,800 ACH transfer move in opposite directions.
  • Corroborating evidence: Devices, phone numbers, merchants, and timing strengthen or weaken the case.
Investigation question: Do the shared address and reciprocal transfers indicate ordinary household activity or coordinated fraud?

Why a knowledge graph fits fraud investigations

  • See the full network: Connect customers, accounts, devices, addresses, merchants, alerts, and cases in one view.
  • Find hidden relationships: Reveal shared identifiers and indirect connections that isolated transactions do not show.
  • Follow the money: Trace transfers across any number of accounts without knowing the chain length in advance.
  • Explain why a pattern matters: Link suspicious activity to known fraud patterns, policies, KYC documents, and prior cases.
  • Adapt as schemes change: Add new entities and connections without rebuilding a rigid relational model.
Investigator value: Move from isolated transactions to an evidence-backed view of who is connected, how money moved, and why the pattern matters.

The fraud ring as a property graph

What the graph enables for investigators

Investigation question How the graph helps
Which accounts share a device or address? Traverse identity relationships across customers and accounts.
Does money return to its starting point? Detect circular transfer paths.
What is exposed through a compromised account? Follow downstream accounts, merchants, and counterparties.
Which prior cases resemble this pattern? Connect findings to typologies, policies, evidence, and outcomes.
Graph advantage: Relationship questions become traversals instead of expanding join chains.

AWS analyzes activity; Neo4j reveals connections

AWS analytics: transaction activity at scale

  • Aggregation: Athena calculates totals, averages, min/max, and standard deviation for amounts and risk scores.
  • Time-series trends: SQL produces hourly, daily, and monthly rollups by account, merchant, or channel.
  • Filtering and ranking: SQL finds transactions above P95 and accounts generating the most alerts.
  • Key-based joins: Fixed joins connect transactions to accounts, customers, and merchants.
  • Dashboards: Amazon Quick Sight presents volume, alerts, exposure, losses, and case throughput.

Neo4j Cypher: how the fraud network is connected

  • Multi-hop traversal: Follow funds across accounts, devices, addresses, and merchants.
  • Pattern search: Identify circular transfers and shared identity signals.
  • Path and reachability: Find everything downstream of a compromised account.
  • Variable depth: Investigate chains whose length is unknown in advance.
  • GraphRAG: Link entities to KYC documents, typologies, policies, and prior cases.

A dual data architecture puts each workload in the right place

Two query paths: Athena queries transaction evidence in S3 Tables; Cypher traverses connected context in Neo4j.

One investigation uses both data paths

  1. Detect in AWS: SQL in Athena flags unusual transactions, accounts, or merchants in governed S3 data.
  2. Expand in Neo4j: The investigation starts from those identifiers and traverses the connected network.
  3. Find the pattern: Cypher detects shared identities, circular transfers, and exposed entities.
  4. Explain the finding: Policies, fraud typologies, KYC documents, and prior cases establish significance.
  5. Return the result: Graph findings flow back to AWS for analytics, reporting, and case workflows.
Combined outcome: AWS supplies authoritative activity; Neo4j supplies the connected context needed to investigate it.

Sources: https://docs.aws.amazon.com/athena/latest/ug/functions.html and https://docs.aws.amazon.com/quick/latest/userguide/what-is.html

Sources: https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables.html and https://docs.aws.amazon.com/athena/latest/ug/gdc-register-s3-table-bucket-cat.html