Fraud and network analysis

Weakly connected components over the transfers: each component with more than one account is a group that moved money among themselves.

CALL algo.wcc({relationshipTypes: 'SENT'}) YIELD node, componentId
WITH componentId, collect(node.id) AS accounts
WHERE size(accounts) > 1
RETURN componentId, accounts ORDER BY size(accounts) DESC, componentId;

+-------------+--------------------------------------+
| componentId | accounts                             |
+-------------+--------------------------------------+
| 0           | ["A-101", "A-102", "A-103", "A-104"] |
| 4           | ["A-105", "A-106"]                   |
| 6           | ["A-107", "A-108"]                   |
+-------------+--------------------------------------+
3 rows

Paths of two to four transfers that end where they began, each ring listed once.

MATCH p = (a:Account)-[:SENT*2..4]->(a)
WITH p, [n IN nodes(p) | n.id] AS ring
WHERE ring[0] = apoc.coll.min(ring)
RETURN ring, reduce(total = 0, r IN relationships(p) | total + r.amount) AS moved
ORDER BY moved DESC;

+--------------------------------------+-------+
| ring                                 | moved |
+--------------------------------------+-------+
| ["A-101", "A-102", "A-103", "A-101"] | 2640  |
| ["A-105", "A-106", "A-105"]          | 325   |
+--------------------------------------+-------+
2 rows

Different holders logging in from one phone is the second signal for the ring above.

MATCH (d:Device)<-[:USES]-(a:Account)
WITH d, collect(a.holder) AS holders
WHERE size(holders) > 1
RETURN d.id AS device, holders ORDER BY size(holders) DESC;

+-------------+------------------------+
| device      | holders                |
+-------------+------------------------+
| "phone-7f3" | ["Iris", "Jon", "Kai"] |
| "phone-b41" | ["Milo", "Nora"]       |
+-------------+------------------------+
2 rows