Network Link Analytics for Mule Account and Fraud Network Detection

Traditional account-level monitoring evaluates accounts in isolation. Sophisticated fraud networks — operating through shared identifiers, indirect relationships, and coordinated multi-account behaviour — are largely invisible to rule-based systems.

This project addressed that gap by designing a network analytics framework capable of mapping relationships across customers, accounts, transactions, and shared identifiers to identify suspicious clusters and bridge accounts.

Financial institutions face increasing sophistication in fraud and financial crime. Mule account networks — groups of accounts used to move, layer, and extract illicit funds — are a core mechanism in money laundering, fraud schemes, and scam operations.

Standard monitoring approaches evaluate each account against predefined thresholds. They do not capture the relationships between accounts: who shares a phone number, which accounts appear as intermediaries in multi-hop fund movements, or which communities of accounts transact unusually with each other.

The pipeline moves from raw banking data through entity resolution and graph construction to risk-scored investigative output:

The graph model represents the full relationship landscape around banking entities:

Centrality analysis identified bridge accounts — nodes connecting otherwise separate communities, often key intermediaries in fraud networks.

Validation was conducted against a labelled set of known suspicious accounts and confirmed mule network cases, with expert review by the financial crime investigation team.

False positive management was an explicit design consideration, with risk scoring thresholds calibrated in consultation with investigators to prioritise actionable output.