Graph-Based Fraud Detection: Why Closing Accounts Doesn’t Stop Fraud Networks

On October 19, 2022, Bank of America restricted an account associated with Hailong Zhu over suspected fraud. The next day, he opened another account under a different company name. Within two weeks, he had secured four more accounts at three other banks.  If graph-based fraud detection had been applied appropriately perhaps he would have been caught or blocked before opening additional accounts.

The applications contained largely identical information, apart from the address and email.

According to a June 2025 ProPublica investigation, Zhu was involved in an operation moving proceeds from cryptocurrency investment scams through American banks to overseas criminal organizations.

The bank detected an account. The operation had replacements ready.

The case illustrates a challenge in modern fraud prevention: how do we detect organized fraud when accounts, identities and transactions keep changing?

Graph-based fraud detection offers one approach by identifying relationships that persist across seemingly unrelated activities.

How Can Network Analysis Identify Organized Fraud?

Fraud networks often reuse infrastructure even when individual accounts are replaced.

ProPublica uncovered a market for replacement bank accounts. Chinese-language Telegram channels advertised them as “cars” and “fleets,” with some operators offering money-transfer and cryptocurrency-conversion services.

A September 2026 British Financial Conduct Authority (FCA) investigation found evidence of similar reuse. Working with 22 financial institutions, investigators traced payments across 140 cases covering seven fraud categories. Some money-mule accounts had been used across different types of fraud.

These findings suggest that seemingly unrelated fraud cases may be connected through shared infrastructure, recurring intermediaries, and operational relationships that persist across different schemes. 

What Can Graph Analytics Reveal That Traditional Fraud Models Miss?

Graph analytics examines relationships among accounts, devices, identities, transactions and payment instruments, including indirect connections that traditional transaction-level fraud models may overlook.

In e-commerce fraud, different customer accounts may share reshipping addresses or refund channels. In online gaming, bonus-abuse networks may rotate identities while retaining common withdrawal infrastructure. In lending fraud, seemingly independent applications may connect through shared devices or identity attributes.

Graph databases organize these entities as nodes and their relationships as edges, enabling efficient multi-hop queries across large datasets.

Several techniques help identify suspicious networks:

• Connected-components analysis identifies groups of linked accounts and entities.
• Community detection highlights densely interconnected groups that may indicate coordinated activity.
• Temporal graph analysis reveals how networks change as fraudulent accounts are closed and replaced.
• Graph-derived features measure relationships such as proximity to confirmed fraud and recurring links to suspicious intermediaries.
• Graph neural networks (GNNs) learn patterns from entity attributes and network structure.

These capabilities can complement existing fraud rules and machine-learning models. A connection alone does not establish fraud. Shared IP addresses, payment processors and delivery locations can create legitimate relationships. Link reliability, timing and context remain essential.

What Are the Limitations of Graph-Based Fraud Detection?

Incomplete network visibility is a major limitation of graph analytics.

The FCA needed intelligence from 22 institutions because individual banks could not observe the complete payment chains.

The same challenge affects e-commerce platforms, payment providers and digital services. Fraud networks may operate across multiple organizations, leaving each with only a partial view.

An entity appearing peripheral in one organization’s graph may be central to a broader criminal operation.

The FCA’s earlier review identified another problem: of 194,084 suspected mule accounts closed by 25 institutions, only 37% were reported to the National Fraud Database maintained by CIFAS.

Even sophisticated graph algorithms cannot recover relationships that were never recorded or shared.

How Should Fraud Teams Implement Graph Analytics?

Fraud teams can start with existing investigation data before investing in specialized graph infrastructure.

1. Identify persistent fraud relationships. Analyze confirmed cases for recurring devices, beneficiaries, addresses and intermediaries.
2. Monitor network evolution. Track whether new accounts connect to previously identified fraud networks after enforcement actions.
3. Validate incremental detection. Compare graph-derived features against existing controls using point-in-time data. Measure incremental fraud detection, earlier intervention and false-positive costs.

In 2025, UK financial institutions closed 238,396 suspected mule accounts. The figure demonstrates the scale of enforcement activity but provides limited evidence of whether the underlying operations were disrupted.

Zhu’s replacement account was opened within 24 hours.

The opportunity for graph-based fraud detection is to identify the network relationships that remain active when individual fraudulent accounts disappear.