Find possible fraud rings by linking applications
Drop in applications with their phones, emails, devices and known outcomes. The page links applications that share a detail and shows which ones sit close to a known bad.
Applications file
400 applications read, including 7 known bad and 122 known good.
The file is read in this browser and never uploaded; only counts go anywhere, and only if you ask for the result by email.
The columns linked as details are email, phone, device_id, iban, ip.
A value many applications share, such as an office IP or a test email, would join everything, so above this limit it is set aside and listed below.
These are 400 generated demo applications with a few rings planted in them.
Applications near known bads
7 known bad applications reach 11 others within 2 steps through shared details; each is a reason to look, not proof of fraud.
Cluster graph
Known bad Known good Unknown Near bad Shared detail
Click an application to mark it bad, then good, then unknown again; the clusters and the exposure list follow.
Clusters
| Rank | Applications | Known bad | Known good | Unknown | Exposed | Linked by |
|---|---|---|---|---|---|---|
| 1 | 8 | 3 | 0 | 5 | 5 | email, device_id, phone |
| 2 | 12 | 1 | 0 | 11 | 2 | phone, email |
| 3 | 5 | 1 | 0 | 4 | 4 | iban |
| 4 | 2 | 0 | 2 | 0 | 0 | ip |
| 5 | 2 | 0 | 1 | 1 | 0 | phone |
Exposed applications
| Application | Label | Steps | Linked by |
|---|---|---|---|
| A0011 | Unknown | 1 | device_id: dev-ring-a1 |
| A0012 | Unknown | 1 | device_id: dev-ring-a1 |
| A0014 | Unknown | 1 | phone: 447700910518 |
| A0015 | Unknown | 1 | device_id: dev-ring-a2 |
| A0017 | Unknown | 1 | email: user10.c694@example.com |
| A0040 | Unknown | 1 | iban: gb29demo00000000ringb |
| A0042 | Unknown | 1 | iban: gb29demo00000000ringb |
| A0043 | Unknown | 1 | iban: gb29demo00000000ringb |
| A0044 | Unknown | 1 | iban: gb29demo00000000ringb |
| A0061 | Unknown | 1 | phone: 447700912220 |
| A0062 | Unknown | 2 | email: user61.a6f7@example.com |
Set-aside values
| Value | Detail | Applications |
|---|---|---|
| 81.2.69.160 | ip | 40 |
Get the result by email
The next step is checking every new application against the confirmed-fraud records automatically, at the moment of the decision. Start free
Link method
Application link = Shared detail ≤ Shared value limit Clusters = Application link + Application link + … Step 1 = Application link → Known bad Step 2 = Application link → Step 1 Step 3 = Application link → Step 2
Values match exactly after cleaning, with no fuzzy matching or time windows. A link is a reason to look at an application, not proof of fraud.
What fraud link analysis finds
Fraud link analysis connects applications that share a detail such as a phone, email, device fingerprint or bank account. This tool cleans the values, sets aside widely shared values and links applications through the remaining exact matches.
A cluster shows applications connected through shared details, with known bad, known good and unknown outcomes. You can see which applications sit close to a known bad and use those links as reasons to look more closely.
Common questions
What is fraud link analysis?
Fraud link analysis finds applications connected through shared details. The tool groups connected applications into clusters and shows their known outcomes.
How are fraud rings found through shared details?
Applications join a cluster when they share an exact value after cleaning. A shared phone, email, device fingerprint or bank account can connect applications for review.
What does a fraud network graph show?
The graph shows applications as circles and shared values as small squares. Lines show which applications connect through each shared value.
How do I find applications connected to known fraud?
Choose the number of steps from a known bad and review the exposed applications. Each link gives you a reason to look, not proof of fraud.
Why set aside widely shared values?
A value shared by many applications can join unrelated records, such as applications using an office IP or a test email. The tool sets aside values above the chosen limit and lists them separately.