Link analysis: How can it help you spot fraud?

If you run an online business, it’s important to understand how the different accounts on your platform may be linked together. 

Whether your business is a social media platform, online dating site, marketplace, or other platform, the clearer this picture is, the more likely you will be able to detect suspicious behavior and potentially identify (and stop or prevent) instances of money laundering, identity theft, fraud, or other crimes.

But how can you begin to develop this understanding? 

In the past, identifying links between accounts was a time- and labor-intensive process that required you to manually review account details to potentially uncover similarities. This manual review is difficult to scale and prone to human error. 

Today, advancements in graph database infrastructure have made it possible to identify potential links faster and more easily through link analysis.

Below, we define link analysis, walk through how it works, and explain how you can use it to identify suspicious links between accounts on your platform.

What is link analysis?

Link analysis is a data science technique that is used to identify, evaluate, and understand how different nodes in a network or graph database are connected to one another. In other words, it’s the process of identifying links or relationships that exist between entities in the data.

Link analysis as a data science technique has three main purposes. It can be used to:

• Look for known patterns: After a network is established, links between entities within the network tend to fall into known patterns. If you know what a certain pattern looks like, you can use link analysis to find instances of this pattern at scale. For example, when a new user creates an account on a social media platform, they will often grow their network of connections in a predictable way — first by adding close friends and family, then branching out to mutual connections they share with these individuals.

• Look for anomalies: Because network relationships tend to follow patterns, you can also use link analysis to identify anomalies in the data or violations of known patterns. A new user on a social media platform who immediately begins connecting to a large number of users who share no mutual connections, for example, may indicate suspicious activity because it does not follow the known pattern (established above).‍

• Look for new patterns: Finally, active networks are constantly changing, which means that new patterns can periodically emerge. Link analysis can be used to identify these new patterns as they emerge.

How can link analysis help you identify and prevent fraud?

Link analysis is the process of identifying relationships between different pieces of data. With this in mind, link analysis can be leveraged in a number of diverse applications. This includes search engine optimization, medical research, market research, digital security, and — importantly — fraud detection.

For example, you might use link analysis to:

Find accounts connected by suspicious shared details

In any online business, you’re likely to find accounts that share certain details in a completely legitimate way. For example, a family of four who lives together in the same house, who all use the same family computer, and who all have an account on a popular social media platform will all share the same IP address and device fingerprint — and it’s not a sign that anything fraudulent is going on. 

But sometimes, link analysis will show that certain accounts are connected in a suspicious way through shared details. For example, if two accounts share the same IP address but lack other similarities that would indicate they live together or know each other — such as the same physical address — it could be indicative of fraud. Or maybe two accounts list the same physical address but share no other similarities. 

In both cases, there are suspicious links between accounts. A business that identifies these similarities through link analysis might decide to flag the accounts as suspicious or manually review their activity to see if fraud may have taken place in the past.

Find accounts connected to known fraudsters

When you identify a fraudulent account on your platform, it’s important to determine whether or not the account is a one-off or part of a larger fraud ring. To understand why, consider two points:

• A single bad actor may have multiple accounts on your platform: If a bad actor has successfully opened an account on your platform, they’ll take full advantage of the situation. It’s likely that they’ll open multiple accounts — and thanks to recent technological advancements such as generative AI, it’s never been easier for fraudsters to do exactly that.

• Bad actors may share account details with others: Bad actors often swap information used to open fraudulent accounts. This is especially true for details that must be verified, such as an address. 

With this in mind, if you have identified a fraudster’s account on your platform, link analysis can help you find connected accounts that may also be fraudulent. 

For example, imagine that you have identified an account as fraudulent. Through link analysis, you identify three additional accounts that have the same physical address listed on their accounts. You also identify five accounts that share the same IP address or device fingerprint. With this information, you can make better decisions on a group of accounts that should be flagged for further investigation. 

This increases the likelihood that you can fully remove not just a single fraudster from your platform but also an entire fraud ring. 

‍

Start with known bad actors and find the links that connect them

Link analysis can also help you identify suspicious patterns of activity between accounts that may initially seem unrelated. 

For example, perhaps you suspect a particular account of fraudulent activity, but you cannot find any other accounts on your platform that share suspicious details with that account (such as IP address or physical address). But through link analysis, you find that a handful of seemingly unrelated accounts are related to each other through activity in an abnormal way. For example, if you run an e-commerce marketplace, you might find a handful of accounts that all purchase from the same store and engage in an abnormally high number of charge-backs.

These insights can empower you to further investigate the accounts in question to determine if they are legitimate users or, potentially, a fraud ring abusing your platform.

Link analysis examples

Virtually any business that collects and maintains data about its users and their activity can leverage link analysis to fight fraud. Below are a few examples of industries and use cases where link analysis can be especially effective. 

Link analysis for anti-money laundering (AML) and banking

Link analysis can be a powerful tool that fraud analysts use to uncover or rule out cases of suspected money laundering. 

Imagine, for example, that through transaction monitoring you uncover suspicious activity among three of your customers: A series of transactions that fall just below the $10,000 threshold for reporting set by the Bank Secrecy Act. 

These customers could be structuring their transactions to avoid regulatory scrutiny or part of a fraud ring. It’s also possible that the transactions are unrelated and legitimate. The only way to know is further investigation — and link analysis can help. 

A fraud analyst could use a link analysis tool to uncover connections among the accounts in question. Depending on what those connections are and whether or not they’re suspicious, it can be easier to discern the legitimacy of each transaction.

Link analysis for social media platforms

Despite the recent passage of the UK’s Online Safety Act, and the proposal of similar regulations in other jurisdictions, by and large, social media platforms are not required to verify the identities of their users prior to onboarding. This means that bad actors looking to engage in fraud or other malicious activities (harassment, online bullying, spamming, etc.) can easily create multiple accounts in order to further their efforts — often with only a first name and email address required. 

Imagine that a user account has been reported for harassing other users. You could immediately take action by deactivating or blocking the account that originated the harassment. But there’s no guarantee that the same user doesn’t have multiple accounts that they can also use to continue the harassment. 

But through link analysis, it may be possible to identify connections between accounts that might otherwise go unnoticed. Passive signals — such as a user’s IP address, device fingerprint, and browser fingerprint — can be collected in the background during account creation. And because these signals are difficult to fake, accounts created by the same bad actor are more likely to be linked by at least one such signal. 

Link analysis can help you uncover these less-obvious connections  to enable you to take action against all of a problematic user’s accounts instead of just one of them. 

Link analysis for online marketplaces

Many of the most common varieties of marketplace fraud involve bad actors leveraging multiple accounts. 

A seller might, for example, create a number of accounts and then use those accounts to inflate their review score with positive reviews. Likewise, a buyer might open multiple accounts in order to spam a seller that they don’t like, or to take advantage of a referral promotion that your platform is running to increase sign-ups. On an online auction site, multiple accounts can be used to engage in auction fraud, such as shill bidding or bid shielding, both of which can significantly damage user trust in a platform.

Link analysis makes it much easier to identify these duplicate or fraudulent accounts by surfacing the connections between them, empowering you to block them and maintain trust and safety on your platform.

Best practices for implementing link analysis in your fraud-detection strategy

If you are considering implementing link analysis as a part of your fraud detection and mitigation strategy, it’s important to understand how it can integrate into your tech stack and enhance existing processes.

Integrating link analysis with your fraud tech stack

While link analysis is a powerful tool that can help you scale your fraud detection efforts, there’s no silver bullet to fighting fraud. Depending on the types of fraud you encounter and your risk profile, it’s generally best to leverage multiple fraud-detection methods — such as allow/block lists, point solutions, probabilistic and risk scoring models, manual review, and link analysis —  to make it harder for bad actors to consistently avoid detection.

Link analysis can enhance your fraud-fighting capabilities in many ways. It can, for example, be a useful tool for fraud analysts who manually review cases, empowering them to more quickly follow various threads of an investigation to confirm or rule out their suspicions. Likewise, when you uncover a bad actor on your platform through link analysis, adding relevant account details to your block lists will make it harder for the fraudster to regain access to your platform. 

Integrating link analysis into your KYC processes

Link analysis isn’t just a tool to help you identify bad actors who have already made it onto your platform. By incorporating it into your Know Your Customer (KYC) or Know Your Business (KYB) processes, it can help you gauge a customer’s risk during account creation — empowering you to proactively fight fraud and prevent bad actors from opening an account. 

Leveraging link analysis for KYC looks something like this: During the account creation process, you collect information (like name, date of birth, and address) and passive signals (such as IP address, browser fingerprint, and device fingerprint) from the customer. Then, as you verify the customer’s identity (via government ID verification, document verification, database verification, etc.) you also use a link analysis tool to cross-check the collected signals against your database of existing customers.

In this way, link analysis can help you understand if and how the individual creating the new account may be related to your existing customers, which in turn can help you create a more robust risk profile of the individual. If link analysis uncovers links to a customer currently under investigation for suspicious activities, for example, it may raise a red flag indicating that the new customer needs to go through enhanced due diligence (EDD) or manual review. 

Why is link analysis so important?

Link analysis is an incredibly powerful tool that empowers online businesses to quickly and easily identify, evaluate, and visualize links and relationships between accounts — which in turn makes it possible to identify and mitigate instances of potential fraud, money laundering, and other crimes or suspicious activity. Better yet, it achieves this in seconds or minutes, compared to the hours of work that would be required to identify these links manually.

Here at Persona, we know how important it is for online businesses to understand how their users are related to one another. That’s why we’ve developed Graph, our link analysis solution specifically designed to help you uncover fraud rings by visualizing your customer network. Consolidate your data, explore connected users, and easily act on insights to improve the health of your network. 

Interested in learning more? Get a demo today.