Overview
Reactive investigation catches fraud after it has happened. Graph also supports proactive fraud detection: you can save the queries that catch fraud, then run them automatically every time a new Account joins. A new Account that matches a known pattern is flagged at onboarding, rather than weeks later during a manual review.
Proactive detection runs inside Workflows. The queries themselves are Graph Query Templates.
Common Workflow structure
A proactive-detection Workflow typically looks like this:
- Trigger on a new Account. Start the Workflow when an event fires, most commonly
inquiry.completed. - Sync Graph. Add a Sync Graph step so the new Account’s data is in Graph before you query. Choose the sync mode based on whether your query needs similarity nodes.
- Run Graph Query. Add one or more Run Graph Query steps that run your Query Templates. If you run more than one query, use parallel steps so the checks run at the same time.
- Act on the results. Use conditional logic to take an action when a query finds matches. Common actions include tagging the Account, marking the Inquiry for manual review, creating a Case, or declining the end user.
Always sync before you query
Run the Sync Graph step before every Run Graph Query step. If you query Graph before the Account’s data has synced, the query runs against stale or incomplete data, which can produce missing or inaccurate results.
Make a case for manual review
When a query finds a match, you can open a Case so a human reviews the connection. Add the Graph module to your Case template to bring the related Accounts into the review.
Proactive detection and reactive investigation are two halves of the same practice: the queries you automate here are usually ones an analyst found by hand first. Conducting reactive fraud investigations with Graph covers that side, and it is where the patterns worth automating come from.