Investigating Fraud with a Graph, Not Just a Prompt

In September 2026, researchers developed an artificial intelligence agent capable of investigating suspicious card transactions, modeled after a human fraud analyst. The agent, built for the TigerGraph Agentic Fraud Investigation hackathon, operates by gathering evidence from a live graph database using the TigerGraph platform.

The agent is triggered by risk-scored transactions, customer complaints, or analyst requests. It gathers evidence from the transaction's recent card activity, the cardholder's baseline behavior, and whether the device used has appeared on other cards. The agent then checks the flagged activity against five documented fraud patterns, using the bank's own written policy as guidance. The agent assesses a fraud probability and decides if there is enough evidence to take action.

If insufficient evidence is found, the agent requests additional information such as customer validation, step-up authentication, or input from a fraud analyst. Once this additional information is received, the agent reassesses the situation and decides on an appropriate action. The agent recommends one or more actions, which can be approved by either an auto route, a Level 1 team lead, or a Level 2 fraud manager, with each action citing the specific policy rule behind it.

The agent writes its findings back into the graph, creating a memory of the investigation for future reference. The researchers tested the agent against all 20 cases from the hackathon's benchmark, generated graded answer files for each case, and made the investigations available through a live dashboard.

The architecture of the agent relies on TigerGraph's graph database, with the agent's tools being six pre-installed GSQL queries. Both case memory and policy grounding are native TigerVector attributes within the graph, including 5,565 closed-case narratives and the bank's fraud policy and documented patterns. The agent's state machine and decision logic were validated against a mock graph before being tested on the real graph, MCP session, and Gemini calls.