From Fraud Alert to Defensible Action: Building an Agentic Fraud Investigation System with TigerGraph
How we combined a temporal knowledge graph, GraphRAG, agentic investigation, and deterministic policy controls to turn suspicious transactions into auditable next-best actions. Every fraud team already has a way to generate alerts — a risk model scores a transaction, a rule fires, a customer calls in. That part is not the hard problem anymore. The hard problem starts one step later: given an…
The article outlines a system built for fraud investigation using a temporal knowledge graph on TigerGraph, GraphRAG, agentic investigation, and deterministic policy controls. The system turns suspicious transactions into auditable next-best actions, moving beyond simple alerts generated by risk models and rules. The key components are:
1. Fraud investigation is not classification: The challenge dataset requires more than just scoring transactions, as analysts need to investigate relationships between entities like customers, cards, devices, and transactions to understand the broader context of suspicious activity.
2. Relationships matter: Transaction data alone doesn't reveal important connections, such as devices used by multiple customers or the history of cards linked to confirmed fraud. The graph structure captures these relationships, enabling more comprehensive investigation.
3. TigerGraph is central: The graph database stores the connected facts and answers queries about the neighborhoods and counts of entities within a specific time frame. It doesn't perform fraud reasoning itself but provides the necessary data for the investigation process.
4. System architecture: The system separates the storage of connected facts (TigerGraph) from the reasoning about fraud (application code). GraphRAG retrieves prior cases, fraud patterns, and policy rules as context for the Investigation Agent, which then gathers evidence, synthesizes it, assesses uncertainty, and makes decisions based on fixed policies.
5. Temporal safety: The investigation is limited to what could have been known at the time of the transaction, not what might have happened afterwards. This ensures the investigation is based on the available data at the moment of detection.
The system aims to provide auditable decision trails, from evidence gathering to final actions, while adhering to predefined policy controls and avoiding speculative claims about guilt or wrongdoing.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
