Building a fraud investigation agent on TigerGraph for Hacker House Goa

For the TigerGraph Hacker House Goa challenge, the team built an agent that simulates how an analyst would provide fraud alerts. The agent works by looking up the card's history, checking the device and billing region, finding other cards that were used on the same device, and reviewing past bank decisions on similar cases. If the agent doesn't have enough information to act, it asks the customer first.

The dataset used for this challenge is the IEEE-CIS fraud data, with the fraud flag removed, containing 590,742 card transactions from July to December 2016, along with 144,432 identity records for online purchases and 5,565 closed investigations from July to October. The benchmark for this challenge was 20 alerts from November and December, some of which came from the bank's risk model, customer disputes, or an analyst.

The Hacker House Goa challenge had two key points: the risk score is often incorrect, and half of the benchmark cases are legitimate. An agent that blocks everything would perform poorly, so the challenge focused on determining when not to act. All the components of the solution reside in a single graph on TigerGraph Savanna. Customers own cards, and transactions link to devices and purchasers. Transactions are chained in time order, and closed cases link to the transactions and cards involved.

The agent communicates with the graph through the TigerGraph MCP server using a set of predefined tools. These tools include running an installed query, adding a node, adding an edge, and reading a node. There are small and specific installed queries for tasks such as a card's timeline in a window, finding every card that used a device profile, and performing a vector search over the knowledge chunks.

The agent also uses a graph algorithm to search for connections between cards and device profiles, looking for patterns like a 28-card ring built around a single Samsung phone profile.

The investigation loop for the agent consists of several steps: trigger, investigate, assess, first recommendation, gather more evidence, final recommendation, explain, and write the case back to the graph. This loop ensures that each case learns from previous ones and that the agent only acts when it is confident enough to do so.

The agent can act alone on low-impact steps, while larger actions require approval from a team lead, fraud manager, or regulatory report. The agent's fraud probability is based on a classifier trained on July to October data and is adjusted based on various factors such as unique devices, amounts, and regions. If the agent is uncertain about a case, it assumes one of two possible actions based on the evidence, ensuring honest and uncertain verdicts rather than guesses.