TLDR: A new research paper demonstrates how GraphSAGE, an inductive Graph Neural Network, can effectively analyze large, dynamic banking transaction networks. By creating node embeddings that capture structural and contextual information, the model reveals interpretable clusters based on geography and demographics. When applied to money mule detection, these embeddings significantly improve the prioritization of high-risk accounts, offering a scalable solution for financial institutions to gain actionable insights from their transactional data.
Financial institutions constantly grapple with the challenge of analyzing vast and intricate transaction networks. Traditional methods for understanding these networks often fall short when faced with the dynamic, ever-evolving nature of real-world banking data. A recent research paper introduces a powerful solution: the practical application of GraphSAGE, an inductive Graph Neural Network (GNN) framework, to non-bipartite heterogeneous transaction networks within a banking context.
The core problem with many existing graph embedding techniques is their inability to scale and adapt to new information. Methods like matrix factorization and random walks are ‘transductive,’ meaning they require the entire network to be known during training and cannot easily generalize to new accounts or transactions without a complete retraining. Even some earlier GNNs, such as Graph Convolutional Networks (GCNs) and Graph Attention Networks (GATs), face scalability issues on very large graphs because they still need the full graph to compute embeddings.
This is where GraphSAGE shines. As an ‘inductive’ algorithm, it learns how to aggregate information from a node’s local neighborhood, allowing it to infer embeddings for unseen nodes. This capability is critical in finance, where new accounts and transactions emerge continuously. Furthermore, GraphSAGE employs neighborhood sampling and aggregation strategies that ensure computational efficiency, even when dealing with networks containing hundreds of millions of nodes and edges.
Building the Transaction Network
To demonstrate GraphSAGE’s utility, the researchers constructed a comprehensive transaction network using anonymized customer and merchant transactions. This network includes four distinct types of nodes:
- Core accounts: UK-based current accounts within NatWest retail banking.
- Non-core accounts: Other UK-based accounts that have transacted with a core domestic account.
- Foreign accounts: International accounts not based in the UK.
- Merchants: Entities receiving point-of-sale (POS) payments or issuing refunds to core accounts.
These node types create seven different types of edges, all representing the flow of money between accounts. The graph used for training and inference was built from a single week of transactions, encompassing over 100 million edges and more than 10 million nodes.
How GraphSAGE Generates Insights
The GraphSAGE algorithm works in three main stages:
- Feature Aggregation: This is the inductive heart of GraphSAGE. It computes a weighted aggregate of features from a node’s neighbors to generate an embedding (a low-dimensional vector representation) for the central node. The mean aggregator was chosen for its balance of computational efficiency and representational power.
- Neighborhood Sampling: To manage the computational load, especially for ‘super-connected’ nodes (like a popular supermarket merchant with thousands of customers), GraphSAGE samples a subset of neighbors rather than processing all of them.
- Loss Function: An unsupervised loss function is used during training. It aims to maximize the similarity between the embeddings of neighboring nodes while minimizing the similarity between non-neighboring nodes.
The researchers meticulously tuned various hyperparameters, such as the embedding dimension, learning rate, and the number of negative samples. They even developed a new evaluation metric based on cosine similarity to ensure the model effectively distinguished between neighboring and non-neighboring nodes, overcoming limitations of relying solely on the loss value.
Validating the Embeddings
The quality of the generated embeddings was rigorously validated. Over a 10-week period, the inferred embeddings consistently showed a clear distinction: neighboring nodes had significantly higher cosine similarity than non-neighboring nodes, confirming the model’s ability to capture relational patterns.
Beyond just connectedness, the embeddings revealed deeper topological information. Using dimensionality reduction techniques like UMAP, the researchers visualized the 32-dimensional embeddings in 2D space, uncovering fascinating patterns:
- Geographical Locations: The embeddings naturally clustered accounts based on their geographical location, with dense clusters appearing for cities like Belfast, Newcastle, and Aberdeen. This suggests that shared merchants and local transaction patterns induce geographical properties.
- Age Groups: Distinct patterns emerged for different age groups, indicating that the embeddings successfully capture underlying transactional behaviors linked to demographics.
- Account Types: The embeddings naturally grouped by node type. Further analysis showed that NatWest savings accounts formed distinct clusters from current accounts, reflecting their different transaction behaviors.
Also Read:
- Detecting Financial Crime: A Graph Machine Learning Approach to Uncover Transactional Patterns
- GTHNA: A New Framework for Detecting Anomalies in Graph Data
Application in Money Mule Detection
One of the most compelling applications of these embeddings in financial services is money mule detection. Money mules act as intermediaries in illicit financial flows, exhibiting unique transactional behaviors. The GraphSAGE embeddings, by capturing both local topological patterns and higher-order connectivity, are highly effective in representing these behaviors.
In an experimental setup, the embeddings were combined with traditional tabular account-level features to train a fraud detection model. The results were striking: the model using embeddings significantly improved its ability to prioritize high-risk accounts. Most notably, precision@20 (the precision for the top 20 positive predictions) improved by 57.1%. This means the model was much better at surfacing structurally suspicious accounts—those embedded in suspicious transaction clusters or ‘hub-and-spoke’ networks—earlier in the ranked predictions. Such improvements are invaluable for fraud analysts, who have limited bandwidth and prioritize investigating top-ranked alerts.
The paper concludes that GraphSAGE offers a scalable and adaptable framework for financial institutions to analyze complex transactional networks. Its inductive capability allows for continuous inference on dynamic data, a fundamental requirement for modern banking. The interpretable clusters based on geography and demographics validate the embeddings’ ability to capture structural and contextual insights. This work provides a clear blueprint for financial organizations to harness graph machine learning for actionable insights in their transactional ecosystems. For more details, you can read the full paper here.
