Identity graph

A fraud-detection tool that flags unusual clusters, like one device logging into 10 different accounts.

It works like a map of connections. Each account, device, phone number, and address is a point, and shared details draw lines between them, so a group of supposedly unrelated accounts that all link to one device stands out.

A graph database, which stores information as points (nodes) and the links (edges) between them, where each identity attribute, device, or account is a node. A shared connection, for instance a device reused across accounts or a phone number reused on multiple applications, becomes an edge between two nodes. Unusually dense clusters of these edges expose a coordinated fraud ring that looks clean from any single account.

An identity graph typically works in three steps:

1. The system records attributes from each application or session, such as names, emails, phone numbers, addresses, devices, and IP addresses.
2. It links any two records that share an attribute.
3. It analyzes the links for clusters, unusual density, and connections to known fraud.

The graph helps catch several patterns:

• Fraud rings, where a coordinated group runs the same attack across many accounts.
• Synthetic identities, which often reuse real attributes across several invented people.
• Duplicate applicants, where one person opens multiple accounts under different names.

An identity graph sits next to terms that are easy to mix up:

• Fraud ring is the group of linked fraudulent identities that the graph helps reveal.
• Duplicate detection matches a new applicant against existing records, which the graph can support.
• Device fingerprinting produces one of the identifiers that feeds the graph.