# Conducting reactive fraud investigations with Graph

> Investigate a suspicious Account in Graph Explorer: find what it connects to, understand the chain, and take action on the results.

Source: https://help.withpersona.com/articles/pTsMvO8BQpnUQ7LhP2QlXy/
Section: Graph > Introduction > Using Graph

## Overview

Most customers start with Graph by using it **reactively**: after a fraud signal appears, an analyst opens [Graph Explorer](https://help.withpersona.com/articles/7DbcO4qiCbn4aY0Oc5iO8W/), queries the suspicious Account, and works through the results.

This article walks through the two query approaches you are most likely to use, and the actions you can take once you have results.

## Two ways to query

Most investigations start with a known Account. Check the results of the case being investigated, or search your Accounts, to obtain the exact value of the property you want to search on.

### Search by a specific Account property

Start with a specific identity. Enter an exact property value, such as an email address, and Graph surfaces every Account connected to it, up to the number of hops you choose.

Use this when you know who you are investigating, and you want to find out what they are connected to.

### Search for a pattern across all Accounts

Start with a pattern, not an identity. Query across Accounts within a time frame that share a specific property, and Graph surfaces the cluster of Accounts that match.

Use this when you have identified the shape of a fraud pattern and want to find every Account that fits it.

For the full walkthrough of the query editor, see [Graph Explorer interface](https://help.withpersona.com/articles/7DbcO4qiCbn4aY0Oc5iO8W/).

## Work through the results

Results appear on the [canvas](https://help.withpersona.com/articles/7DbcO4qiCbn4aY0Oc5iO8W/) as connected nodes. To understand the connection between two Accounts, count the hops. For a full description of nodes, links, hops, and clusters, see the [Graph glossary](https://help.withpersona.com/articles/mDyQ4BlICWkXzVyUQyFwo/).

When you find an Account that matters, continue the investigation:

- **See the details**: hover the Account's node to open its info card.
- **Expand the canvas**: if an Account has more connections, use the Show Connections action to reveal them.
- **Save the query**: if the query is one you will want again, save it as a [Graph Query Template](https://help.withpersona.com/articles/HrEtfnRzxodCUWvBVD86wL/).

## Take action on the results

From the Explorer, you can act on the Accounts you found:

- **Tag Accounts** to group them.
- **Update Account status**, for example marking an Account as Fraudulent.
- **Export Accounts** as a CSV.
- **Create a Case** so the connection goes to manual review.

Most of these actions work in bulk: select multiple Accounts, then apply the action to all of them at once.

Once you have run the same investigation a few times, the next step is to stop running it by hand. [Detecting fraud proactively with Graph](https://help.withpersona.com/articles/sSqJsbYrVxMw2ub3kq8aOd/) picks up here, and turns a saved query into a Workflow that checks every new Account as it arrives.