Beyond the Risk Score: An Agentic Fraud Investigator on TigerGraph

Ankit Khatkar — Fri, 25 Sep 2026 02:24:18 +0000

About

Fraud teams don't lack signals — they lack time to connect them. We built an agent that takes a single fraud alert (a risk score, a customer complaint, or an analyst's request) and does what a human investigator would: pull the transaction history, walk the graph to find shared devices, regions, and cards, compare it against past cases, and decide — with evidence, not just a score — what to do next. Built for the TigerGraph Agentic Fraud Investigation hackathon on the HHGOA_IEEE dataset.

What we built

An agent that investigates a fraud alert end-to-end: gathers evidence, assesses the likely fraud pattern and risk, opens and progresses a case, asks for more evidence when it's genuinely unsure, and recommends (or auto-executes, within policy) the next action — then writes the whole investigation back into the graph so future cases can learn from it. It runs against 20 benchmark alerts and produces one structured case file per alert, with the reasoning and evidence trail attached.

The architecture

The flow mirrors how a human investigator works: trigger → open/lookup case → investigate (deterministic graph queries first) → assess (LLM reasons over the evidence) → check uncertainty → request more evidence if needed → re-assess → apply policy → explain → write to memory. Deterministic code (not the LLM) decides exposure math, approval routes, and SAR-vs-case calls, so the model's job is reasoning and explanation, not enforcing rules it might get wrong. Every step is logged to a trace so the whole investigation can be replayed in the UI.

How TigerGraph is used

A graph schema connecting customers, cards, transactions, devices, regions, and email domains, plus our own AgentCase vertices that are the case memory.
GSQL queries for the actual investigation work: pulling a card's transaction window, its normal baseline behavior, and its neighbors by shared device/region/email.
A graph algorithm to find fraud rings rather than checking cards one at a time.
Vector search over closed historical cases for GraphRAG — retrieving similar past investigations and their outcomes, then expanding them in the graph for real evidence, not just text similarity.
TigerGraph MCP exposes all of this to the agent as callable tools, so every graph lookup the agent makes is a logged, auditable tool call.

The agentic capabilities we implemented

Multi-trigger investigation (risk score, customer report, analyst request); evidence gathering across graph, transaction history, and prior cases; pattern and risk assessment; case creation and progression as evidence arrives; case memory that future investigations query; controlled evidence requests (customer validation, step-up auth, analyst input) only when uncertainty is genuinely unresolved; policy-bound next-best actions with approval routing (auto vs. requires human sign-off); and explicit stopping logic so the agent doesn't over-investigate once it has enough to act defensibly.

What we learned

A risk score alone is a weak signal — most high-score transactions in this data turned out legitimate, so the agent has to earn its confidence from graph evidence, not the score.
Base rates matter: historical closed cases skew heavily toward confirmed fraud, but real-world alerts are much closer to 50/50. Training our judgment on history alone would have made the agent trigger-happy.
Shared attributes (a device, a region) are only meaningful when they're rare — common device profiles connect thousands of unrelated cards and mean nothing on their own.
Separating "reasoning" (LLM) from "enforcement" (deterministic policy code) made the agent far more consistent and easier to debug.

What we'd improve with more time

Tighter calibration of fraud probability against a larger backtest sample.
A live autonomous monitor that scans new alerts proactively instead of only responding to the 20 benchmark cases.
Richer UI visualization of the fraud-ring graph for analysts.
More regulatory reference material fed into GraphRAG for stronger SAR narratives.

DEV Community: Ankit Khatkar