EXL's graph model finds fraud in the edges

AI Engineer hosted Somya Rai and MD Sharique of EXL to show how a graph neural network lifted fraud capture 27 to 33% at the same alert rate. The pair reported about $65 million in projected annualized incremental capture while holding P99 latency at 3.1 milliseconds.

Same transaction, same row. Rai said a tabular model scored it 0.04, well below any alert threshold. Allow the model to see the neighborhood and the same row scored 0.91. Three of four linked entities had flat fraud in the last hour.

That gap defines their thesis. Rai said fraud is not a property of a transaction, it is a property of the neighborhood it sits in. Physical point-of-sale fraud runs at 0.05%, or one in 2,000, while online runs at 0.6%, 12 times higher and noisier, so EXL runs two models. The alert budget is fixed at the top 0.5 to 1.5% of scores, so precision at K beats area under the curve, and adding tabular features hit a ceiling. Going from 40 raw attributes to 87 engineered features moved true positive rate from 35.5% to 36.6% for point-of-sale, and nearly 200 features added about a point online.

The build is GraphSAGE style, two layers of sample, aggregate, combine and embed. Each transaction gathers neighbor hidden states from its user and merchant plus a five-hop follow chain to its own recent history. Instead of mean pooling alone, EXL concatenates mean, max and standard deviation, which keeps a single 0.92 risk neighbor from diluting to 0.32 in a crowd of normal 0.1 neighbors. The team runs 202 features across three node types, 73 on user, 109 on transaction and 20 on merchant, with 32 derived fraud features, and found 128 dimensions is the sweet spot. Sampling holds a soft target fraud rate of 0.5% for card present and 6% for online, about 10 times natural, while keeping every fraud user's genuine transactions as hard negatives and never capping fraud users. Each calendar month is its own disjoint graph with no edges across months, vocabularies frozen on training months, and only earlier timestamps allowed to aggregate.

Measured at a fixed 0.5% alert rate, XGBoost alone hit 36% true positive rate on card present while XGBoost plus graph embeddings hit 48%, a 33% relative lift, and 48% to 61% online, a 27% lift, per EXL. That tension between scarce fraud labels and graph connectivity is not unique to payments. Recent work on class imbalance in graphs finds graph neural networks tend to master abundant categories and fumble scarce ones such as fraudulent accounts, precisely the failure mode EXL tried to avoid with gentle oversampling and balanced batch sampling.

Serving is the hard part. Offline, a layer-wise GraphSAGE forward is sharded by destination node and cached. Online, a ring buffer holds each user's last five transactions and a lightweight assembly reconstructs neighbor states with exponential decay, then runs only the new transaction's two-layer forward plus the XGBoost head. The GNN forward is 1.61 milliseconds, end to end 2.3 milliseconds median and 3.1 milliseconds at P99 inside a 3 to 4 millisecond SLA, after pinning math library threads to one and warming the model. Caching every transaction embedding would cost 60 GB and add a one-day lag and drop true positive rate from 48% to 44%, so EXL predicts on the edge and caches only user and merchant embeddings to 2 to 3 GB, about 20 times smaller, which Nvidia independently recommended as on par. The team said that interface maps directly to a distributed cache when scale demands it.