Judge a Transaction by the Company It Keeps — Somya Rai & MD Sharique, EXL
Summary
This talk details an advanced fraud detection system that moves beyond traditional tabular feature engineering by leveraging Graph Neural Networks (GNNs). The core insight is that fraud is not a property of a single transaction (row), but a property of the neighborhood (edges) it belongs to. By feeding GNN-generated embeddings into an existing XGBoost classifier, the system achieved significant improvements in True Positive Rate (TPR) while maintaining a fixed, low alert budget. Key engineering achievements include managing data leakage through disjoint monthly graphs, optimizing the serving path by predicting on edges rather than nodes, and achieving a low latency of 3.1 ms at P99.
Key takeaways
-
Fraud Signal Location
Fraud is a property of the transaction's neighborhood (edges), not the transaction itself. Tabular features are limited because they only analyze the row, ignoring connections like shared devices or velocity chains across merchants.
-
Performance Improvement
19:50
The GNN + XGBoost model achieved a 33% relative lift in TPR for card-related merchant transactions and a 27% lift for online transactions, compared to the XGBoost baseline, all while maintaining a fixed alert budget.
-
Serving Optimization
20:00
To maintain low latency, the system optimized the cache footprint by predicting on the edge (user/merchant embeddings) rather than the node (transaction embeddings). This reduced the cache requirement from ~60 GB to 2-3 GB, enabling a 2.3 ms median / 3.1 ms P99 end-to-end latency.
Technical details
-
Graph Neural Network (GNN) Architecture
320s
The GNN processes a node by aggregating neighbor hidden states via three operations: Gather (pulling neighbor states across edges), Collapse (reducing the neighbor set into a fixed-width vector using a permutation function), and Update (concatenating the aggregate with the node's own state).
-
Advanced Aggregation Method
950s
Instead of simple averaging, the model concatenates three order-invariant statistics (Mean, Max, and Standard Deviation) of neighbor states. This is crucial because averaging can dilute the signal from a single dangerous outlier (e.g., a fraud ring).
-
Data Leakage and Sampling
730s
To prevent leakage, the system uses disjoint graphs for each calendar month, ensuring no edge crosses the temporal boundary. The training uses a soft target fraud rate (e.g., 10x the natural rate) while retaining the full transactional history for all users to preserve connectivity.
-
Feature Engineering
800s
The model utilizes 202 features across three node types (user, transaction, merchant). Derived features include behavioral baselines (e.g., mean/std dev of last five amounts) and rolling window velocity counts (e.g., 5-minute, 1-hour, 24-hour counts).
Mentioned resources
Channel & topics
Watch on YouTube · Back to latest
This independent, AI-assisted summary is provided for commentary and informational purposes. It may contain errors or omit important context. Please watch the original video for the creator's complete presentation. Video, thumbnail, and related copyrights belong to their respective owners.