Building an Autonomous Fraud Investigation Agent with TigerGraph and Gemini

Live Demo: fraud-investigationvajra.streamlit.app

Source Code: GitHub Repository

Team: Team Vajra · Hacker House Goa 2026

1. What We Built

Modern payment fraud is rarely an isolated incident. Sophisticated criminal syndicates coordinate across card-testing sequences, device-sharing rings, and out-of-region velocity spikes.

Traditional payment fraud detection relies on flat relational databases and isolated machine learning risk scores. When an alert flags, human fraud analysts spend 30 to 45 minutes manually copying card numbers, device fingerprints, and billing addresses across disconnected SQL tables.

At Hacker House Goa 2026, Team Vajra built the Autonomous Agentic Fraud Investigation System:
An end-to-end agentic workflow that connects TigerGraph Community Edition 4.2.5, the Model Context Protocol (MCP 2.2.0), LangGraph, and Google Gemini 2.5 Flash Lite to investigate transaction alerts, traverse multi-hop graph neighborhoods, evaluate bank governance policies, and file regulatory Suspicious Activity Reports (SARs) in under 2 seconds.

2. System Architecture

Our solution combines high-throughput graph analytics with deterministic agent orchestration:

Trigger Alert ──► TigerGraph Subgraph Traversal ──► GraphRAG Case Memory
                                                           │
   ┌───────────────────────────────────────────────────────┘
   ▼
Gemini 2.5 Flash Synthesis & Policy Evaluation (Rules R1–R10)
   │
   ├─► Dual-Phase Next-Best Actions (Before vs. After Graph Evidence)
   ├─► Automated FinCEN Suspicious Activity Report (SAR) Generation
   └─► Upsert Resolved Investigation to TigerGraph FraudCase Vertex

Core Technology Stack:

TigerGraph CE 4.2.5: High-performance graph database containing ~590,000 transactions, 14,000 cards, and 9,700 device profiles from the IEEE-CIS benchmark dataset.
TigerGraph MCP Server (MCP 2.2.0): Standardized Model Context Protocol server exposing parameterized GSQL queries and topological traversals as callable tools for AI agents.
LangGraph State Machine: Multi-stage cyclic graph orchestrating evidence gathering, uncertainty assessment, dual-phase actions, and graph persistence.
Google Gemini 2.5 Flash Lite: Fast reasoning LLM synthesizing graph facts into grounded analyst summaries and regulatory narratives.
Streamlit 1.64: Visual analyst dashboard featuring executive KPIs, interactive schema design, and live case review.

3. How We Used TigerGraph

Relational databases struggle with deep multi-hop joins. In contrast, TigerGraph’s native parallel graph architecture allowed our agent to traverse complex fraud topologies in sub-milliseconds.

Graph Schema (10 Vertices & 18 Edges):

Core Entities: Customer, Card, Transaction, DeviceProfile, EmailDomain, BillingRegion.
Topological Edges:
- (Customer)-[:OWNS]->(Card)
- (Card)-[:MADE]->(Transaction)
- (Transaction)-[:FROM_DEVICE]->(DeviceProfile)
- (Transaction)-[:BILLED_IN]->(BillingRegion)
- (Transaction)-[:NEXT]->(Transaction) (temporal velocity chain)
Memory & Compliance Vertices:
- ClosedCase: Over 5,500 historical cases indexed for GraphRAG memory retrieval.
- FraudCase: Dynamic vertex where live agent investigation outcomes are written back to graph storage.
- PolicyDocument & FraudPattern: Bank compliance rules R1 to R10.

Key GSQL Analytical Queries:

graph_txn_subgraph: Traverses 1-hop neighborhood of a flagged transaction (card, device, billing location).
graph_card_window: Aggregates 48-hour card velocity to catch rapid transaction spikes.
graph_card_testing_check: Detects low-value authorizations (< $5.00) preceding large fraudulent charges.
graph_device_neighbors: Traverses shared device profiles to detect multi-card fraud rings operating from the same hardware.

4. Key Agentic Capabilities

1. Dual-Phase Next-Best Actions

The agent records what action it recommended before graph evidence (e.g., VERIFY_WITH_CUSTOMER) and transparently documents why and how that action pivoted (e.g., to BLOCK_ALL_CARDS and L2_MANAGER_ESCALATION) after uncovering a shared-device fraud ring.

2. Automated FinCEN SAR Filing

If suspicious financial exposure exceeds $1,000 or organized rings are uncovered, the agent auto-drafts a complete Suspicious Activity Report (SAR) narrative with subject names, timestamps, and regulatory justifications.

3. Continuous Graph Memory Persistence

100% of investigated cases are upserted into TigerGraph as FraudCase vertices, allowing subsequent investigations to leverage past case knowledge without model retraining.

5. Benchmark Results Across 20 Cases

We evaluated our system against all 20 complex benchmark cases (HHG-001 through HHG-020):

Metric	Result
Total Cases Investigated	20 / 20 (100% Complete)
Confirmed Fraud Caught	15 cases (75%)
Legitimate Activity Cleared	3 cases (15%)
Uncertain (Step-up Auth)	2 cases (10%)
Average End-to-End Latency	1.84 seconds per case
Average Graph Tool Invocations	4.2 calls per investigation
Regulatory SARs Generated	12 reports
Graph Case Memory Upsert	100% retention in TigerGraph

6. Real-World Case Walkthrough: HHG-002

Trigger: Single \$280 online transaction flagged by an ML risk score of 0.92.
Graph Traversal: graph_txn_subgraph revealed that transaction 3514030 originated from device DBD75C3985A. Next, graph_device_neighbors traversed edges to discover that device DBD75C3985A was simultaneously active across 3 different customer accounts in a 24-hour window.
Agent Decision:
- Verdict: CONFIRMED FRAUD
- Pattern: card_not_present_new_device
- Exposure Identified: \$1,480.00
- SAR Filed: Yes — Automated narrative generated and assigned for L2 sign-off.
- Graph Persisted: Yes — Upserted to TigerGraph vertex FraudCase:HHG-002.