Join the 7/21 live chat & demo: How to turn KYB & KYC into your competitive advantage


Link analysis: How can it help you spot fraud?

Link analysis is a method of analyzing data that allows you to study relationships that aren't visible in raw data. Learn more.

Read time:
Share this post
Table of contents
⚡ Key takeaways
  • Link analysis is the process of identifying links or relationships that exist between entities in the data.
  • Link analysis can identity and prevent fraud by helping you find accounts connected by suspicious shared details, find accounts connected to known fraudsters, and find suspicious activity between accounts that seem unrelated.

If you run an online business, it’s important to understand how the different accounts on your platform may be linked together. 

Whether your business is a social media platform, online dating site, marketplace, or other platform, the clearer this picture is, the more likely you will be able to detect suspicious behavior and potentially identify (and stop or prevent) instances of money laundering, identity theft, fraud, or other crimes.

But how, exactly, can you begin to develop this understanding? 

In the past, identifying links between accounts was a time- and labor-intensive process that required you to manually review account details to potentially uncover similarities. Due to this manual nature, it also tended to be prone to error. 

Today, advancements in graph database infrastructure have made it possible to identify potential links much faster and more easily through link analysis.

Below, we define link analysis, walk through how it works, and explain how you can use it to identify suspicious links between accounts on your platform. 

But before we get into that, we first need to talk about graph databases.

What is a graph database?

A graph database, also called a graph network or a semantic database, is a type of database that is specifically designed to help the user identify and understand relationships that exist between different points of data. 

Graph databases consist of five key parts:

  • The data: As with all databases, graph databases first and foremost are a store of data. This data can take virtually any form; it simply depends on what data a business collects from its users. Personal data, payment data, business data, and a user’s activity can all be considered. Ideally, a graph database should be able to ingest as much data as possible in order to maximize its chances of catching fraud.
  • Nodes: A node represents an entity or object that is found in the data, such an account, user, location, business, etc. Nodes are often depicted visually as circles. 
  • Labels: A label is simply a means of describing a node. Labels make it possible to group similar nodes together so any relationships between them can be understood. For example, a single graph database may include nodes that represent both people and businesses. Labels would make it possible to differentiate between these two types of nodes.
  • Properties: A property is a piece of data about a specific node. For example, a social network might use properties to describe a user’s name, gender, location, and contact information. 
  • Edges: An edge is a relationship that exists between two or more nodes. These relationships can take many different forms, depending on the data stored about each node. Edges are typically depicted as straight lines connecting nodes. 

Graph databases are often designed to be visual in nature. This means that when a user runs a query, the output of that query will be in the form of a graph that makes it very easy to visualize how different pieces of data are related to one another. With this in mind, graph databases typically look something like this:

By comparison, a traditional database stores data in tables. These tables are highly effective at storing and retrieving large quantities of information but are not easily used to determine relationships between pieces of data. 

At the end of the day, it is the existence of nodes, labels, properties, and edges that makes link analysis possible. 

What is link analysis?

Link analysis is a data science technique that is used to identify, evaluate, and understand how different nodes in a network or graph database are connected to one another. In other words, it’s the process of identifying links or relationships that exist between entities in the data. 

Link analysis has three main purposes. It can be used to:

  • Look for known patterns: After a network is established, links between entities within the network tend to fall into known patterns. If you know what a certain pattern looks like, you can use link analysis to find instances of this pattern at scale. For example, when a new user creates an account on a social media platform, they will often grow their network of connections in a predictable way — first by adding close friends and family, then branching out to mutual connections they share with these individuals.
  • Look for anomalies: Because network relationships tend to follow patterns, you can also use link analysis to identify anomalies in the data, or violations of known patterns. A new user on a social media platform who immediately begins connecting to a large number of users who share no mutual connections, for example, may indicate suspicious activity because it does not follow the known pattern (established above).
  • Look for new patterns: Finally, active networks are constantly changing. This means that new patterns can periodically emerge. Link analysis can be used to identify these new patterns as they emerge.

How can link analysis help you identify and prevent fraud?

As discussed above, link analysis is the process of identifying relationships between different pieces of data. With this in mind, link analysis can be leveraged in a number of diverse applications. This includes search engine optimization, medical research, market research, digital security, and — importantly — fraud detection. 

For example, you might use link analysis to:

Find accounts connected by suspicious shared details.

In any online business, you’re likely to find accounts that share certain details in a completely legitimate way. For example, a family of four who lives together in the same house, who all use the same family computer, and who all have an account on a popular social media platform will all share the same IP address and device fingerprint — and it’s not a sign that anything fraudulent is going on. 

But sometimes, link analysis will show that certain accounts are connected in a suspicious way through shared details. For example, if two accounts share the same IP address but lack other similarities that would indicate they live together or know each other. Or maybe two accounts list the same physical address but share no other similarities. 

In both cases, there are suspicious links between accounts, which may indicate fraud. A business that identifies these similarities through link analysis might decide to flag the accounts as suspicious, or manually review their activity to see if fraud may have taken place in the past. 

Find accounts connected to known fraudsters. 

Creating a fake identity online isn’t easy. As more and more online businesses embrace identity verification as a part of their account creation process, fraudsters must invest more time, energy, and resources to construct identities that pass these verification hurdles.

For this reason, when a fraudster has successfully verified a piece of information, they will often reuse it when opening additional accounts. (They may also share or trade the information with other fraudsters.) This is especially true for account details that are difficult to verify, such as a physical address, or those that are difficult to change, such as an IP address.

With this in mind, if you have identified a fraudster’s account on your platform, link analysis can help you find connected accounts that may also be fraudulent. 

For example, imagine that you have identified an account as fraudulent. Through link analysis, you identify three additional accounts that have the same physical address listed on their account. You also identify five accounts that list the same IP address or device fingerprint. With this information, you can make an informed guess to flag or investigate these accounts further, due to their connection to the fraudulent account. 

Free ebook
Learn how to proactively fight fraud with link analysis

Start with known bad actors, and find the links that connect them.

Link analysis can also help you identify suspicious patterns of activity between accounts that may seem unrelated. 

For example, perhaps you suspect a particular account of fraudulent activity, but you cannot find any other accounts on your platform that share suspicious details with that account (such as IP address or physical address). But through link analysis, you find that a handful of seemingly unrelated accounts are related to each other through activity in an abnormal way. For example, if you run an ecommerce marketplace, you might find a handful of accounts that all purchase from the same store and engage in an abnormally high number of chargebacks.

These insights can empower you to further investigate the accounts in question to determine if they are legitimate users or, potentially, a fraud ring abusing your platform. 

Why is link analysis so important?

Link analysis is an incredibly powerful tool that empowers online businesses to quickly and easily identify, evaluate, and visualize links and relationships between accounts — which in turn makes it possible to identify and mitigate instances of potential fraud, money laundering, and other crimes or suspicious activity. Better yet, it achieves this in seconds or minutes, compared to the hours of work that would be required to identify these links manually.

Here at Persona, we know how important it is for online businesses to understand how their users are related to one another. That’s why we’ve developed Graph, our link analysis solution specifically designed to help you uncover fraud rings by visualizing your customer network. Consolidate your data, explore connected users, and easily act on insights to improve the health of your network. 

Interested in learning more? Get a demo today.

Frequently asked questions

What is link prediction?

Link prediction is a link analysis technique in which the underlying statistical model is used to identify pairs of nodes within a network that are currently unlinked, but which may become linked in the future. 

Like general link analysis, link prediction can be applied to a variety of applications. For example, a social network might use link prediction to suggest new “friends” or “connections” to its users if it believes that they will eventually form a link on their own. Likewise, link prediction may be able to determine fraudulent accounts that may become linked.

What signals does link analysis consider in fraud detection?

Link analysis can consider virtually any signals or data that a business collects about its users and accounts. Commonly, this will include:

  • Names
  • Email addresses
  • Phone numbers
  • Physical addresses
  • Payment details
  • IP addresses
  • Device fingerprint

Beyond this, link analysis can also consider user activity. For example, a social network using link analysis to understand its users might consider whether accounts share interests or have interacted with a mutual third account, etc. 

What steps should a business take after a suspicious link has been found?

The answer to this question will depend on a variety of factors, including how likely it is that fraud has taken place or will take place, as well as your own internal policies for dealing with fraud. 

Some businesses may use link analysis to identify links and then immediately block suspect accounts, pending verification or reverification. Others may initiate a manual review of suspect accounts, and leave the final determination to an investigator. Others yet may choose to simply flag a suspect account without taking further action until more evidence of suspicious activity has been gathered.

Continue reading

Continue reading

Trust & safety in the age of AI
Trust & safety in the age of AI

Trust & safety in the age of AI

LLMs and other types of generative AI have the potential to destroy customer trust in your marketplace or platform. Learn more about the risks and solutions.

LLMs + fraud: How criminals use large language models to commit fraud
LLMs + fraud: How criminals use large language models to commit fraud

LLMs + fraud: How criminals use large language models to commit fraud

Large language models (LLMs) have a lot of potential to be used for fraud. Learn how fraudsters have added this and other AI programs to their toolkit.

DAC7 compliance: What is it, and who does it impact?
DAC7 compliance: What is it, and who does it impact?

DAC7 compliance: What is it, and who does it impact?

See how DAC7 impacts businesses, consumers, and governments, and understand what you need to know to stay compliant. Learn how Persona can help.

Linked fraudulent accounts: A threat and an opportunity

Linked fraudulent accounts: A threat and an opportunity

Spotting a fraudster on your platform is like spotting ants in your kitchen. If you see one, there are probably hundreds or thousands hidden behind the wall.

Capture more fraud with less effort using link analysis via Persona Graph

Capture more fraud with less effort using link analysis via Persona Graph

Proactively stop hard-to-catch fraud in its tracks with Persona

How marketplaces like Neighbor design trust & safety programs to mitigate and fight fraud

How marketplaces like Neighbor design trust & safety programs to mitigate and fight fraud

Learn about key moments when fraudsters are likely to strike, Neighbor’s approach to fighting fraud, and more.

Ready to get started?

Get in touch or start exploring Persona today.