# Getting started with Graph

> How organizations use Graph proactively or reactively for fraud investigations, with account statuses and case review setup.

Source: https://help.withpersona.com/articles/3f4U7X7lojUsDiEB2dco9h/
Section: Graph > Introduction > Using Graph

## Overview

This article covers the two ways organizations use Graph for fraud investigations, and the setup that pairs with them: account statuses, saved queries, and cases for review. For deeper guides, see [How to use Graph](https://help.withpersona.com/articles/6atsHmQOjAswNrwMR8NY0R/), the [Graph glossary](https://help.withpersona.com/articles/mDyQ4BlICWkXzVyUQyFwo/), and the [Graph Query reference](https://help.withpersona.com/articles/2dlG9Q9liRn43wUIxHntRT/).

## How to use Graph

Organizations use Graph **proactively** to run fraud investigative checks at scale or **reactively** to conduct fraud investigations.

### How might my organization use Graph _proactively_?

After an end user completes their inquiry, we will sync their account with Graph in the post-inquiry workflow and run queries to find linked accounts. Depending on the results, you may opt to create a case or decline the user outright.

![A Workflow canvas with a Sync Graph step followed by a Run Graph Query step](https://assets.withpersona.com/f_auto,q_auto/help-center/articles/graph/graphqueryininquiryworkflow.png '1493x718')

_A post-inquiry Workflow that syncs the new Account to Graph and then runs a Graph Query against it._

### How might my organization use Graph _reactively_?

After you detect a fraudulent user on your platform, you might use Graph to search for accounts linked to their Persona account and determine if the extent of the fraud.

![The Graph query configuration screen with a property and value selected](https://assets.withpersona.com/f_auto,q_auto/help-center/articles/graph/graphqueryconfigurationscreen.png '1493x714')

_Configuring a Graph Query against a known Account, the starting point of a reactive investigation._

## Use account statuses

Persona recommends using account statuses to make better Graph decisioning recommendations. The general idea is that accounts sharing properties with Fraudulent accounts are also likely to be fraudulent, so we can have higher confidence in auto-declining those inquiries.

| Account status | Description                                                                                          |
| -------------- | ---------------------------------------------------------------------------------------------------- |
| **Active**     | User has passed KYC (inquiry status = approved)                                                      |
| **Inactive**   | User is not active on the platform (their Persona inquiry was declined or they have been offboarded) |
| **Fraudulent** | User is confirmed fraudulent (this is likely a manual process to change an account to this status)   |

## Recommended queries

A Graph Query is a search request within Graph that surfaces accounts.

ℹ️

**Query formatting**

When you make a Query, you specify at least one property (like IP address or device fingerprint) and the value of that property. The Query result includes all accounts with a matching value for that property.

Persona can auto-decline inquiries that are revealed to have Graph clusters above a certain size or mark them for manual review. The action taken will depend on the fraud patterns you see with your demographic, how conversion-optimized you are, and your bandwidth for manual review.

| Query                                                            | Description                                                                                                                                                                                                                 |
| ---------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Shared email address                                             | The same email address on multiple Accounts often means the same person registered more than once.                                                                                                                          |
| Shared name **and** birthdate                                    | This might indicate one user creating multiple Accounts.                                                                                                                                                                    |
| Shared SSN **or** Government ID number                           | This might indicate one user creating multiple Accounts.                                                                                                                                                                    |
| Shared device fingerprint **or** device token                    | Both properties point at a shared device. At higher cluster sizes (3 or more), it becomes improbable that every Account sharing the value belongs to a different good actor.                                                |
| Shared device fingerprint with a Fraudulent Account              | A device fingerprint on its own is not always a sign of a shared device, because many people run the same browser settings. It links Accounts effectively, but it returns more false positives than the other queries here. |
| Shared IP address with a Fraudulent Account in the last 12 hours | On its own a shared IP address has a high false positive rate, since people on a work IP or a campus network share one. **At higher cluster sizes (3 or more) it becomes a more reliable indicator of fraud.**              |
| Shared custom property                                           | You can configure custom properties on your Graph instance, based on the information you hold about the user, such as a hashed bank account number or a hashed credit card number, and query them using Graph.              |

For the full list of properties you can query on, and the exact format each one matches, see the [Graph Query reference](https://help.withpersona.com/articles/2dlG9Q9liRn43wUIxHntRT/).

## Create cases to review

For any query results requiring manual review, you’ll want to view them in a Case. You can add the Graph module to any case template to view these results. For a full description of the module, see [Accounts: Graph module](https://help.withpersona.com/articles/iyb1Bl45vXZD5NTLAoCofW/).

## Where to go next

With statuses and a first set of queries in place, the two articles that follow this one cover the two ways teams work with Graph day to day. [Conducting reactive fraud investigations with Graph](https://help.withpersona.com/articles/pTsMvO8BQpnUQ7LhP2QlXy/) walks through investigating a suspicious Account by hand in Graph Explorer, and [Detecting fraud proactively with Graph](https://help.withpersona.com/articles/sSqJsbYrVxMw2ub3kq8aOd/) turns a query you trust into a Workflow that checks every new Account as it arrives.

If you need further assistance, [reach out to our support team](https://app.withpersona.com/dashboard/contact-us?category=other).