TigerGraph Hacker House Goa — Agentic Fraud Investigation Challenge
Project: Agentic Fraud Investigation System
Core Technology: TigerGraph + GraphRAG + Multi-Agent AI
LLM Runtime: Ollama + Llama 3
Graph Platform: TigerGraph Savanna
Frontend: React + Tailwind CSS
Backend: Python
Repository: GitHub Repository
Quick Summary: What We Built
Fraud investigation is rarely about looking at a single transaction.
A suspicious transaction may be connected to the same customer, card, device, email domain, billing region, or previously investigated fraud case. The real challenge is finding those relationships and turning them into actionable evidence.
For the TigerGraph Hacker House Goa challenge, we built an Agentic Fraud Investigation System that combines:
- TigerGraph for relationship-based fraud investigation.
- GraphRAG for retrieving evidence from connected entities and graph relationships.
- 11 specialized AI agents for different investigation tasks.
- Llama 3 through Ollama for local LLM reasoning.
- TigerGraph MCP integration for allowing agents to interact with graph data.
- Human-in-the-loop approval for important investigation actions.
- React + Tailwind CSS for an analyst-focused investigation workspace.
The goal was simple:
Instead of asking an AI model to guess whether a transaction is fraudulent, give it the tools to investigate the evidence behind the transaction.
Why Fraud Investigation Needs Graphs
Consider a transaction:
Looking at this transaction alone doesn’t tell us much.
But imagine that the same transaction is connected to:
Now the investigation becomes much more interesting.
The same device might have been used by multiple customers.
The same card might be connected to unusual transactions.
The customer might share infrastructure with previously investigated accounts.
A previous closed fraud case might reveal an important pattern.
This is where a graph database becomes extremely useful.
The Problem We Wanted to Solve
Traditional fraud investigation often requires analysts to jump between multiple systems.
A simplified investigation may look like:
The problem is that these relationships become increasingly difficult to manage as the investigation grows.
A language model can reason over information, but it does not automatically know which entities are connected in the underlying financial network.
That led us to a different architecture:
The LLM is not treated as the source of truth.
TigerGraph provides the structured evidence, while the agents reason over that evidence.
Our Architecture
The system is divided into several major layers.
The Fraud Graph
At the center of the system is the FraudDetectionGraph.
We model important fraud entities as graph vertices and their relationships as edges.
A simplified representation looks like this:
This gives our agents something much more useful than a flat transaction record.
They can investigate the neighborhood around a transaction.
For example:
This multi-hop relationship is one of the most important parts of the system.
Why TigerGraph?
TigerGraph is used as the relationship and evidence layer of the investigation.
Instead of retrieving isolated records, our agents can ask graph-oriented questions such as:
This is particularly useful for fraud because fraud patterns are often relational.
For example:
A flat transaction table makes this relationship harder to investigate.
A graph makes the relationship explicit.
The 11-Agent Investigation System
Instead of building one giant AI agent that tries to do everything, we divided the investigation into specialized responsibilities.
The architecture uses an Investigation Coordinator to manage the investigation and delegate work to specialized agents.
The agents work together around the same evidence graph.
The overall flow is:
The important design principle is that the agents have different responsibilities rather than repeatedly asking the same LLM to perform the entire investigation.
From Suspicious Transaction to Investigation
A typical investigation follows this pipeline:
This gives us a repeatable investigation lifecycle.
Risk Score Is Not the Verdict
One important design decision was to avoid treating the input risk_score as the final fraud decision.
For example:
does not automatically mean:
Instead, the risk score becomes one piece of evidence.
The agents can investigate:
- transaction behavior
- customer history
- device relationships
- card relationships
- geographic information
- previous fraud cases
- connected entities
- graph patterns
The final investigation is therefore based on multiple pieces of evidence, rather than blindly trusting one numerical score.
GraphRAG: Connecting AI Reasoning With Evidence
This is where GraphRAG becomes important.
Traditional RAG commonly follows:
Our architecture is different:
Suppose an analyst asks:
“Why was this transaction considered suspicious?”
Instead of simply sending the transaction record to the LLM, the system can retrieve the relevant graph evidence.
The model can then reason over something like:
This creates a much stronger connection between the AI response and the underlying data.
TigerGraph MCP
We also integrated the system with the TigerGraph MCP ecosystem.
The purpose is to allow the agentic layer to interact with graph capabilities through structured tools rather than manually embedding every database operation into the LLM prompt.
Conceptually:
This makes the graph a usable tool inside the investigation workflow.
Instead of the agent saying:
“I think this customer is connected to other suspicious accounts.”
it can actually request graph evidence and reason from the returned relationships.
The Agentic Investigation Loop
Our investigation system follows an iterative process.
This is important because fraud investigations are rarely solved from a single database query.
The agent can progressively expand the investigation when additional evidence is required.
Evidence-Driven AI
One of the core principles of the system is:
The AI should reason from evidence, not invent evidence.
For example, instead of generating:
the system should be able to show:
The graph provides the underlying evidence.
The LLM then turns that evidence into an understandable investigation explanation.
This separation is important:
The Analyst Workstation
We wanted the application to feel less like a generic chatbot and more like an actual investigation workspace.
The interface contains multiple investigation views:
Case Management
Analysts can view active investigation cases and select a specific case for analysis.
AI Chat
The analyst can ask questions such as:
Agent Activity
The interface exposes what the investigation system is doing instead of hiding the entire process behind one loading indicator.
Fraud Graph
The graph view provides a visual representation of relationships between:
Action Center
When the investigation produces a recommended action, the analyst can review the recommendation before approving or rejecting it.
Visualizing Fraud Relationships
Graph visualization is particularly useful when the investigation contains many relationships.
A simplified fraud ring might look like:
The important insight is not necessarily one transaction.
It is the structure connecting the transactions.
The graph allows the analyst to visually explore those relationships.
Next Best Action
Finding suspicious activity is only part of the investigation.
The system also needs to answer:
What should happen next?
Depending on the evidence and policy context, possible actions can include:
The recommendation is then presented to the analyst.
For higher-impact actions, the system supports human approval rather than silently executing an irreversible decision.
Human-in-the-Loop Governance
We deliberately avoided designing the system as a completely uncontrolled autonomous system.
The workflow can include:
This creates a balance between:
- AI-assisted investigation
- automated evidence gathering
- explainability
- analyst control
The system is therefore designed as an investigation assistant and decision-support workspace, rather than a black-box replacement for the analyst.
The Technology Stack
The major technologies used in the project are:
Layer Technology Frontend React + Tailwind CSS Backend Python LLM Llama 3 LLM Runtime Ollama Graph Database TigerGraph Savanna Graph Querying GSQL GraphRAG Graph-based retrieval + evidence grounding Agent Architecture 11 Specialized Agents MCP TigerGraph MCP Visualization Graph-based interactive UI Dataset IEEE-CIS Fraud Detection Deployment Web applicationWorking With the IEEE-CIS Fraud Dataset
For evaluation, we worked with the IEEE-CIS fraud dataset and the provided investigation case pack.
The important thing about the dataset is that it contains more than transaction amounts.
It provides information that can be connected across multiple dimensions.
Our graph representation allows these entities to participate in investigations instead of treating every record as an isolated row.
The investigation therefore becomes:
What We Learned
1. Fraud Is a Relationship Problem
The most important lesson was that fraud investigation is often less about a single transaction and more about the relationships surrounding it.
A suspicious transaction becomes much more meaningful when we understand:
Graphs naturally represent these relationships.
2. The LLM Should Not Be the Database
An LLM is excellent at:
- reasoning
- summarization
- explanation
- natural-language interaction
- synthesizing evidence
But it should not be expected to remember or invent the underlying fraud network.
That belongs in the data layer.
Our architecture therefore separates responsibilities:
3. Multi-Agent Systems Need Clear Responsibilities
A common mistake in agentic applications is creating multiple agents without giving them meaningful boundaries.
Our approach was to divide investigation tasks into specialized responsibilities.
This makes the overall investigation easier to reason about:
The second architecture gives us clearer separation between different investigation activities.
4. GraphRAG Is Different From Traditional RAG
Vector retrieval answers:
“What text looks similar to my question?”
Graph retrieval can answer:
“What entities and relationships are connected to the entity I’m investigating?”
For fraud investigation, both approaches can be useful, but relationship-heavy questions naturally benefit from graph-based retrieval.
What We Would Improve Next
There are several areas we would like to take further.
1. Advanced Graph Algorithms
We can extend the investigation engine with graph algorithms for:
- community detection
- connected components
- centrality
- similarity
- anomaly detection
- fraud-ring discovery
This would allow the system to combine agentic reasoning with deeper graph analytics.
2. Better Agent Evaluation
Instead of only evaluating the final answer, we want to evaluate:
This would help identify exactly where an investigation succeeds or fails.
3. Stronger Evidence Tracing
A future version could make every statement in an AI response directly traceable to:
This would make investigations easier to audit.
4. Real-Time Fraud Streaming
Another direction is connecting real-time transaction streams to the graph:
This would move the system closer to real-time fraud investigation.
Final Thoughts
Building this system changed how we think about agentic AI.
The most important part of an AI investigation system is not simply choosing a larger language model.
It is building the right environment around the model.
For fraud investigation, that environment includes:
TigerGraph provides the relationship layer.
The 11 agents divide the investigation into specialized tasks.
GraphRAG connects those agents to structured evidence.
Llama 3 provides the reasoning and natural-language interface.
And the analyst remains in control of important decisions.
The result is a system designed to move from:
“This transaction looks suspicious.”
to:
“Here is the connected evidence, here is the reasoning, here is the recommended next action, and here is the evidence behind it.”
That is the direction we believe agentic AI can take fraud investigation: from isolated transaction analysis to connected, evidence-driven investigation.
Project Links
Resource Link GitHub Repository Agentic Fraud Investigation System Technology TigerGraph + GraphRAG + 11 AI Agents LLM Llama 3 + Ollama Graph Platform TigerGraph Savanna Frontend React + Tailwind CSSBuilt For TigerGraph Hacker House Goa
This project was developed as part of the TigerGraph Hacker House Goa Agentic Fraud Investigation Challenge.
The project explores how graph databases, GraphRAG, multi-agent systems, and human-in-the-loop workflows can work together to build more explainable fraud investigation systems.