Most fraud and AML controls look at one account, one customer, one transaction at a time. Organized fraud doesn’t work that way. Rings spread activity across many accounts and identities precisely so that no single one looks suspicious. To catch coordination, you have to look at the connections — which means resolving entities and drawing the graph.
Step one: entity resolution
The same person or business appears many times across your data — slightly different names, addresses, phone numbers, devices. Entity resolution deduplicates those into a single resolved entity and links the records that belong together. Without this step, a ring looks like a dozen unrelated customers.
Step two: the relationship graph
Once entities are resolved, you connect them: shared devices, addresses, beneficiaries, counterparties, funding sources. The result is a graph where fraud rings show up as unusually dense clusters — many accounts routing through a few shared nodes.
KeplerAI renders this as an interactive entity graph, with node shapes by type and a legend, so investigators can focus an entity and see its neighborhood.
Signals only the graph reveals
- Shared attributes across supposedly independent accounts.
- Funnel structures — many accounts feeding one beneficiary (the smurfing pattern).
- Ring density — clusters far denser than the population average.
- Bridge nodes — a single entity connecting otherwise separate groups.
Why it runs near the data
Graphs are built from your full relationship data — accounts, identities, transactions. That’s exactly the data you don’t export. Resolution and graph construction run in your data plane; the control plane sees the resulting structure and risk scores, not the underlying records.
Per-account rules find lone actors. Graphs find organizations. For serious fraud and AML, you need both. Explore the fraud solution.