Overview
This article covers the two ways organizations use Graph for fraud investigations, and the setup that pairs with them: account statuses, saved queries, and cases for review. For deeper guides, see How to use Graph, the Graph glossary, and the Graph Query reference.
How to use Graph
Organizations use Graph proactively to run fraud investigative checks at scale or reactively to conduct fraud investigations.
How might my organization use Graph proactively?
After an end user completes their inquiry, we will sync their account with Graph in the post-inquiry workflow and run queries to find linked accounts. Depending on the results, you may opt to create a case or decline the user outright.
How might my organization use Graph reactively?
After you detect a fraudulent user on your platform, you might use Graph to search for accounts linked to their Persona account and determine if the extent of the fraud.
Use account statuses
Persona recommends using account statuses to make better Graph decisioning recommendations. The general idea is that accounts sharing properties with Fraudulent accounts are also likely to be fraudulent, so we can have higher confidence in auto-declining those inquiries.
| Account status | Description |
|---|---|
| Active | User has passed KYC (inquiry status = approved) |
| Inactive | User is not active on the platform (their Persona inquiry was declined or they have been offboarded) |
| Fraudulent | User is confirmed fraudulent (this is likely a manual process to change an account to this status) |
Recommended queries
A Graph Query is a search request within Graph that surfaces accounts.
Query formatting
When you make a Query, you specify at least one property (like IP address or device fingerprint) and the value of that property. The Query result includes all accounts with a matching value for that property.
Persona can auto-decline inquiries that are revealed to have Graph clusters above a certain size or mark them for manual review. The action taken will depend on the fraud patterns you see with your demographic, how conversion-optimized you are, and your bandwidth for manual review.
| Query | Description |
|---|---|
| Shared email address | The same email address on multiple Accounts often means the same person registered more than once. |
| Shared name and birthdate | This might indicate one user creating multiple Accounts. |
| Shared SSN or Government ID number | This might indicate one user creating multiple Accounts. |
| Shared device fingerprint or device token | Both properties point at a shared device. At higher cluster sizes (3 or more), it becomes improbable that every Account sharing the value belongs to a different good actor. |
| Shared device fingerprint with a Fraudulent Account | A device fingerprint on its own is not always a sign of a shared device, because many people run the same browser settings. It links Accounts effectively, but it returns more false positives than the other queries here. |
| Shared IP address with a Fraudulent Account in the last 12 hours | On its own a shared IP address has a high false positive rate, since people on a work IP or a campus network share one. At higher cluster sizes (3 or more) it becomes a more reliable indicator of fraud. |
| Shared custom property | You can configure custom properties on your Graph instance, based on the information you hold about the user, such as a hashed bank account number or a hashed credit card number, and query them using Graph. |
For the full list of properties you can query on, and the exact format each one matches, see the Graph Query reference.
Create cases to review
For any query results requiring manual review, you’ll want to view them in a Case. You can add the Graph module to any case template to view these results. For a full description of the module, see Accounts: Graph module.
Where to go next
With statuses and a first set of queries in place, the two articles that follow this one cover the two ways teams work with Graph day to day. Conducting reactive fraud investigations with Graph walks through investigating a suspicious Account by hand in Graph Explorer, and Detecting fraud proactively with Graph turns a query you trust into a Workflow that checks every new Account as it arrives.
If you need further assistance, reach out to our support team.