Why it matters
Shared devices, phones, or IPs hint at coordinated mule activity.
Without relationships, rules flood analysts with false positives.
RingDetect links the graph, surfaces the influencers, and lets you
rerun with new thresholds instantly.
How it works
Your proxy (Flask + Gunicorn) handles CORS and forwards
`/api/ringDetect` to TigerGraph. In local mode it talks to
`http://localhost:9000` without any Savanna token; if you deploy the
proxy remotely, a bearer token is optional.
Impact
Investigators can focus on accounts tied to high-risk merchants or
shared devices. RingDetect explains why each account is suspicious
(risk_score, shared_count, degrees), making it easy to tell the
story during demos or in production.
Problem
Legacy systems treat transactions in isolation. Coordinated rings
slip through when shared identifiers are ignored or too costly to
compute over wide datasets.
Solution
Fraud Graph links accounts to devices, merchants, phones, and IPs.
Queries like RingDetect and MuleRanking expose the clusters and rank
suspicious merchants so an analyst can validate the ring in minutes.
Business Outcome
Less manual triage, faster investigations, and auditable insights
for compliance teams. Prove the concept with the live viewer locally
first, then swap in a cloud proxy only if you want to deploy it
remotely.