Building TigerGraph Agentic Fraud Shield: Auditable AI Fraud Investigation at Scale

When detecting financial fraud, the biggest challenge isn't just flagging anomalies—it's explainability, policy compliance, and minimizing false positives. An AI agent that blocks every suspicious account scores poorly in production and ruins customer trust.

For the TigerGraph x 247pmstudio Hacker House Goa Challenge, we built TigerGraph Agentic Fraud Shield—a hybrid fraud investigation workstation and pipeline. It combines deterministic graph-equivalent policy checks across 590K+ real-world transactions with Google Gemini’s natural language synthesis to deliver auditable, explainable, and actionable fraud case files.

1. Problem Statement & Architecture Investigating card fraud requires sifting through massive transaction logs to establish context: shared devices across cards, rapid velocity spikes, out-of-region usage, and recurring subscription disputes. Opaque end-to-end LLMs often hallucinate decisions, while traditional rule engines lack natural language summaries for compliance teams.

Our architecture solves this through a strict division of labor:

Deterministic Rule Engine (The Policy Layer): Pandas-driven data execution mimics graph queries to evaluate bank rules (R1–R10). It evaluates evidence, calculates fraud probability, determines the verdict, and computes recommended actions deterministically.

Generative LLM (The Synthesis Layer): Google Gemini (gemini-2.0-flash) receives the pre-computed facts and generates the natural-language Case Summary and formal Suspicious Activity Report (SAR) Narrative.

Analyst Workstation (The UI Layer): A React + TypeScript dashboard featuring interactive graph visualizations, timeline traces, evidence cards, and governance routing.

[590K+ Transactions Data]
│
▼
[Deterministic Policy Engine (R1-R10 Rules)] ──► Verdict, Fraud Score, Actions
│
▼
[Gemini 2.0 Flash Agent Call] ───────────────► Case Summary & SAR Prose
│
▼
[Analyst Workstation UI (React/TS)]

1. Key Features & Governance Controls Auditable Evidence Chains: Every case ties directly to factual claims (e.g., “3 cards shared across Device ID D-9021 within 24 hours”).

Deterministic Decision Logic: LLMs are never allowed to arbitrarily decide fraud verdicts or lock accounts. All decisions strictly follow pre-coded banking governance rules.

Smart SAR Generation: Suspicious Activity Reports are generated dynamically only when mandatory criteria are triggered.

Robust Fallback Safeguards: If API rate limits occur or LLM connectivity drops, the system seamlessly falls back to pre-formatted deterministic templates without halting generation.

1. Key Takeaway & Lessons Learned "An agent that blocks everything scores badly."

The most critical realization during development was that flagging every risk signal as fraud leads to high customer friction. The benchmark dataset explicitly rewards systems that recognize legitimate patterns, allow low-risk transactions, and mark borderline cases as Uncertain when evidence is inconclusive.

By keeping rule logic strictly auditable and using Gemini purely as an expressive narrative generator, the pipeline maintains 100% transparency while delivering readable reports for human analysts.

1. Future Roadmap: TigerGraph & GraphRAG While our initial prototype leveraged optimized DataFrame queries against the transaction CSVs as a graph-equivalent substitute, our production roadmap includes:

Native TigerGraph Cloud (Savanna) Deployment: Moving graph traversal logic into GSQL to run real-time multi-hop graph queries (device/IP sharing, cluster expansion).

GraphRAG Integration: Querying historical case graphs alongside structured rules to inform LLM synthesis with deep historical context.