CaseGuard: Agentic Fraud Investigation with TigerGraph

🚨 Meet CaseGuard — an agentic AI fraud investigation system powered by TigerGraph.

🔍 GSQL + GraphRAG
🛡️ Evidence-gated investigation
🧠 Graph-based case memory
📄 Automated SAR narrative generation

Built for the TigerGraph × Hacker House Goa 2026 Agentic Fraud Investigation Hackathon with @TigerGraphDB and @247pmstudio 🚀

🚨 Introduction

Traditional fraud systems often make a simple fraud vs. legitimate decision from static thresholds or risk scores.

But real fraud investigations are rarely that simple.

A transaction can look suspicious because of a new device, unusual geography, or rapid small payments — while still being completely legitimate.

That is why we built CaseGuard: an agentic AI fraud investigation system designed to investigate suspicious transactions, gather additional evidence when confidence is low, recommend the next-best action, generate SAR narratives, and remember previous cases.

CaseGuard combines TigerGraph, GSQL, GraphRAG, and agentic reasoning to create an evidence-driven investigation workflow.

---

🏗️ Architecture

The CaseGuard workflow is:

Alert → TigerGraph Analysis → Fraud Pattern Detection → GraphRAG Policy Grounding → Uncertainty Gate → Evidence Gathering → Next-Best Action → SAR Generation → Case Memory

TigerGraph acts as the graph-based foundation of the system.

Our graph contains entities such as:

• Customer
• Card
• Transaction
• DeviceProfile
• BillingRegion
• ClosedCase
• InvestigationCase

These entities are connected through relationships such as OWNS, MADE, FROM_DEVICE, BILLED_IN, and INVOLVES.

This graph structure allows CaseGuard to investigate relationships between transactions, customers, cards, devices, locations, and previous cases.

---

⚡ How We Used TigerGraph

Instead of asking an LLM to perform complex graph calculations, CaseGuard uses native GSQL queries for deterministic graph analysis.

1. Card Testing Detection

The card_window query analyzes transaction windows to detect rapid micro-authorizations followed by larger spending activity.

This helps identify patterns that may indicate card-testing behavior.

2. Device Connection Analysis

The device_neighbors query expands through shared devices to discover connections between multiple accounts.

This allows the investigation to look beyond an individual transaction and identify relationships between different entities.

3. Geographic Anomaly Detection

The region_burst query compares transaction geography against a customer's historical behavior to identify unusual out-of-region activity.

---

🧠 Uncertainty-Gated Investigation

One of the main ideas behind CaseGuard is simple:

If the system doesn't have enough evidence, it shouldn't guess.

For example, when an alert is based on limited evidence, CaseGuard does not immediately take a high-impact action.

Instead, the system can request additional evidence such as:

• Customer verification
• Step-up authentication
• Transaction confirmation

This creates a safer investigation workflow instead of relying on a single signal.

---

🔄 Next-Best Action

CaseGuard generates recommendations at different stages of an investigation.

Before additional evidence is collected, the system may recommend:

ALLOW + VERIFY_WITH_CUSTOMER

or

DECLINE + STEP_UP_AUTH

After additional evidence is collected, the recommendation can evolve into actions such as:

BLOCK_CARD

CREATE_CASE

FILE_REPORT

with appropriate approval routing such as:

auto

L1

L2

The goal is to connect the available investigation evidence with an appropriate next step.

---

🧠 TigerGraph Case Memory

CaseGuard can store completed investigation outcomes back into TigerGraph.

This creates a foundation for case memory, allowing future investigations to retrieve relevant information from previous cases.

For example, if a previous investigation established legitimate travel-related activity for a cardholder, that information can provide useful context when a similar geographic anomaly appears again.

This turns previous investigations into reusable institutional knowledge.

---

📄 Automated SAR Generation

When a case meets the applicable reporting conditions, CaseGuard can generate a structured Suspicious Activity Report (SAR) narrative.

This helps organize investigation findings into a structured format that can be reviewed by investigators.

The generated narrative can help reduce the manual effort involved in reconstructing an investigation from multiple pieces of evidence.

---

📊 Results

We evaluated CaseGuard against the benchmark scenarios available for the Hacker House Goa challenge.

The evaluation focused on:

• Fraud pattern detection
• Graph-based relationship analysis
• Policy and schema handling
• Investigation decision routing
• Evidence-gathering logic
• Case-memory retrieval

The evaluation helped us validate how the graph layer, AI reasoning layer, and investigation workflow work together.

---

💡 What We Learned

One of the biggest lessons from building CaseGuard was the importance of separating graph computation from LLM reasoning.

TigerGraph handles deterministic relationship and graph analysis, while the AI layer focuses on interpreting structured evidence and applying the investigation workflow.

This separation makes the system easier to reason about because the graph is responsible for finding relationships and patterns, while the AI layer works with the evidence produced by those operations.

We also found that storing investigation outcomes directly in the graph provides a useful foundation for entity-level case memory.

---

🚀 Future Improvements

With more development time, we would add:

1. Real-time transaction streaming using Kafka or Redpanda.
2. Community detection using graph algorithms such as Louvain or WCC.
3. Interactive analyst co-pilot with conversational investigation capabilities.

These improvements could make the investigation workflow more suitable for larger-scale and continuously changing transaction environments.

---

🏁 Conclusion

CaseGuard demonstrates how TigerGraph + GSQL + GraphRAG + Agentic AI can work together to create an evidence-driven fraud investigation workflow.

Instead of simply asking:

"Is this transaction fraud?"

CaseGuard asks:

"What evidence do we have, what don't we know, and what should we investigate next?"

That's the idea behind CaseGuard — an investigator that knows what it doesn't know. 🕵️‍♀️⚡

TigerGraph #GraphRAG #AIAgents #FraudDetection #FraudTech #GSQL #HackerHouseGoa #HHGOA