Fraud rings and the network graph: what one event cannot show you

One event looks clean

Organised fraud rarely looks dramatic one event at a time. A ring spreads its activity thin: many accounts, each new, each moving small amounts, each passing the checks a single event can run. The device is unknown, the email is valid, the card goes through.

What gives the group away is what its members share. The same phone appears on six sign-ups. One card is used by four identities. A device that opened one account last week opens three more today. None of that is visible from inside a single event. It only shows up when you link identities through the things they use.

What the data says about networks

Money mule activity is the clearest case, because a mule account exists to sit inside someone else's scheme. In its Fraudscape 2026 6 Month Update, Cifas said cases linked to money muling rose 70% in the first half of 2026 compared with the first half of 2025, to nearly 13,000, and that muling accounts for 30% of misuse-of-facility cases. UK Finance's Intelligence Unit reports that 12,438 money mules were disrupted in 2025.

Synthetic identities point the same way. The Federal Reserve's synthetic identity toolkit says that similar customer information across accounts is the biggest indicator, and tells analysts to look for matching contact details such as address, phone and email.

Researchers have tested the idea on card payments. In a 2015 paper in Decision Support Systems, Van Vlasselaer and colleagues added network features, built from the graph linking cardholders and merchants, to the usual transaction features, and found the two kinds of features complement each other.

False links are the real risk

A graph that links everything is useless. Families share cards, offices share Wi-Fi, shops hand customers the same tablet. A ring detector has to tell coordination from coincidence, or analysts stop trusting it within a week.

That means treating some links as weak or not linking on them at all, capping how many identities one device or IP can join before it stops counting, and letting analysts mark an entity as a known shared one. It also means saying exactly what a ring is: a group that appears to act together, never proof that its members are the same person or that they are all committing fraud.

In practice a ring is a starting point for an analyst, not a verdict. The useful question is which link holds the group together, and whether that same link would also join a family, a shared flat or an office.

How FRAPE uses this

Every scored event adds observations to an identity graph: the devices, browser fingerprints, card fingerprints, emails, phones, addresses and IPs each identity was seen with. Each link carries a confidence based on where the value came from, so a merchant-supplied device ID counts for more than a browser hint. Analysts can explore up to three hops out from an identity and see the path that connects two of them.

Ring detection runs on that graph. It looks for shared devices and cards, identities created in a coordinated burst, pairs that share two or more kinds of entity, and groups that already contain fraud-labelled identities. IP addresses can support a ring but never create one, very widely shared entities stop linking, and an identity that suddenly gains many new links has those links held back until they are reviewed or cleared. Each ring shows why it was formed and how strong the link is, and analysts can review it, confirm or dismiss it, or open a case. Your rules can read whether an identity belongs to a confirmed ring. The network graph and ring detection are included from the Starter plan.

• How a FRAPE decision is made
• Identity graph
• Fraud ring detection