If you run an online business, it’s important to understand how the different accounts on your platform may be linked together.
Whether your business is a social media platform, online dating site, marketplace, or other platform, the clearer this picture is, the more likely you will be able to detect suspicious behavior and potentially identify (and stop or prevent) instances of money laundering, identity theft, fraud, or other crimes.
But how, exactly, can you begin to develop this understanding?
In the past, identifying links between accounts was a time- and labor-intensive process that required you to manually review account details to potentially uncover similarities. Due to this manual nature, it also tended to be prone to error.
Today, advancements in graph database infrastructure have made it possible to identify potential links much faster and more easily through link analysis.
Below, we define link analysis, walk through how it works, and explain how you can use it to identify suspicious links between accounts on your platform.
But before we get into that, we first need to talk about graph databases.
What is a graph database?
A graph database, also called a graph network or a semantic database, is a type of database that is specifically designed to help the user identify and understand relationships that exist between different points of data.
Graph databases consist of five key parts:
- The data: As with all databases, graph databases first and foremost are a store of data. This data can take virtually any form; it simply depends on what data a business collects from its users. Personal data, payment data, business data, and a user’s activity can all be considered. Ideally, a graph database should be able to ingest as much data as possible in order to maximize its chances of catching fraud.
- Nodes: A node represents an entity or object that is found in the data, such an account, user, location, business, etc. Nodes are often depicted visually as circles.
- Labels: A label is simply a means of describing a node. Labels make it possible to group similar nodes together so any relationships between them can be understood. For example, a single graph database may include nodes that represent both people and businesses. Labels would make it possible to differentiate between these two types of nodes.
- Properties: A property is a piece of data about a specific node. For example, a social network might use properties to describe a user’s name, gender, location, and contact information.
- Edges: An edge is a relationship that exists between two or more nodes. These relationships can take many different forms, depending on the data stored about each node. Edges are typically depicted as straight lines connecting nodes.
Graph databases are often designed to be visual in nature. This means that when a user runs a query, the output of that query will be in the form of a graph that makes it very easy to visualize how different pieces of data are related to one another. With this in mind, graph databases typically look something like this:
By comparison, a traditional database stores data in tables. These tables are highly effective at storing and retrieving large quantities of information but are not easily used to determine relationships between pieces of data.
At the end of the day, it is the existence of nodes, labels, properties, and edges that makes link analysis possible.
What is link analysis?
Link analysis is a data science technique that is used to identify, evaluate, and understand how different nodes in a network or graph database are connected to one another. In other words, it’s the process of identifying links or relationships that exist between entities in the data.
Link analysis has three main purposes. It can be used to:
- Look for known patterns: After a network is established, links between entities within the network tend to fall into known patterns. If you know what a certain pattern looks like, you can use link analysis to find instances of this pattern at scale. For example, when a new user creates an account on a social media platform, they will often grow their network of connections in a predictable way — first by adding close friends and family, then branching out to mutual connections they share with these individuals.
- Look for anomalies: Because network relationships tend to follow patterns, you can also use link analysis to identify anomalies in the data, or violations of known patterns. A new user on a social media platform who immediately begins connecting to a large number of users who share no mutual connections, for example, may indicate suspicious activity because it does not follow the known pattern (established above).
- Look for new patterns: Finally, active networks are constantly changing. This means that new patterns can periodically emerge. Link analysis can be used to identify these new patterns as they emerge.
How can link analysis help you identify and prevent fraud?
As discussed above, link analysis is the process of identifying relationships between different pieces of data. With this in mind, link analysis can be leveraged in a number of diverse applications. This includes search engine optimization, medical research, market research, digital security, and — importantly — fraud detection.
For example, you might use link analysis to:
Find accounts connected by suspicious shared details.
In any online business, you’re likely to find accounts that share certain details in a completely legitimate way. For example, a family of four who lives together in the same house, who all use the same family computer, and who all have an account on a popular social media platform will all share the same IP address and device fingerprint — and it’s not a sign that anything fraudulent is going on.
But sometimes, link analysis will show that certain accounts are connected in a suspicious way through shared details. For example, if two accounts share the same IP address but lack other similarities that would indicate they live together or know each other. Or maybe two accounts list the same physical address but share no other similarities.
In both cases, there are suspicious links between accounts, which may indicate fraud. A business that identifies these similarities through link analysis might decide to flag the accounts as suspicious, or manually review their activity to see if fraud may have taken place in the past.
Find accounts connected to known fraudsters.
Creating a fake identity online isn’t easy. As more and more online businesses embrace identity verification as a part of their account creation process, fraudsters must invest more time, energy, and resources to construct identities that pass these verification hurdles.
For this reason, when a fraudster has successfully verified a piece of information, they will often reuse it when opening additional accounts. (They may also share or trade the information with other fraudsters.) This is especially true for account details that are difficult to verify, such as a physical address, or those that are difficult to change, such as an IP address.
With this in mind, if you have identified a fraudster’s account on your platform, link analysis can help you find connected accounts that may also be fraudulent.
For example, imagine that you have identified an account as fraudulent. Through link analysis, you identify three additional accounts that have the same physical address listed on their account. You also identify five accounts that list the same IP address or device fingerprint. With this information, you can make an informed guess to flag or investigate these accounts further, due to their connection to the fraudulent account.
Start with known bad actors, and find the links that connect them.
Link analysis can also help you identify suspicious patterns of activity between accounts that may seem unrelated.
For example, perhaps you suspect a particular account of fraudulent activity, but you cannot find any other accounts on your platform that share suspicious details with that account (such as IP address or physical address). But through link analysis, you find that a handful of seemingly unrelated accounts are related to each other through activity in an abnormal way. For example, if you run an ecommerce marketplace, you might find a handful of accounts that all purchase from the same store and engage in an abnormally high number of chargebacks.
These insights can empower you to further investigate the accounts in question to determine if they are legitimate users or, potentially, a fraud ring abusing your platform.
Why is link analysis so important?
Link analysis is an incredibly powerful tool that empowers online businesses to quickly and easily identify, evaluate, and visualize links and relationships between accounts — which in turn makes it possible to identify and mitigate instances of potential fraud, money laundering, and other crimes or suspicious activity. Better yet, it achieves this in seconds or minutes, compared to the hours of work that would be required to identify these links manually.
Here at Persona, we know how important it is for online businesses to understand how their users are related to one another. That’s why we’ve developed Graph, our link analysis solution specifically designed to help you uncover fraud rings by visualizing your customer network. Consolidate your data, explore connected users, and easily act on insights to improve the health of your network.
Interested in learning more? Get a demo today.
.png)
