Source-linked AI summary
Money-Mule Detection as a Relational Learning Problem: A Study on the RBIH NFPC Dataset
Owais Ahmad, Anirudh Deodhar
TL;DR
Mule accounts can be difficult to distinguish from ordinary transfers, and many systems classify transactions rather than accounts. This paper scores accounts from a bank-schema graph using each account’s pre-flag neighbourhood. On held-out accounts, it finds 115 more mules than the best tree with the same evidence, while queue results vary with review capacity.
Problem
Individual transfers can look ordinary, while account-level mule signals lie in shared relationships and activity over time.
Source: §1 · pp. 1–2Method
Results
115 more held-out mules were recovered than by the best tree with the same evidence, at 83.2% precision and a 0.50% false-alarm rate.
Source: §9 · p. 10Takeaways & Limitations
XGBoost and LightGBM lead in the first hundred alerts, while graph models retain higher precision by 500 alerts.
Source: §7.2 · p. 9, §9 · p. 10Undetected mule rings may be labelled normal, and precision is bounded by the investigative records available as ground truth.
Source: §8 · p. 9
Abstract
from arXiv · showhide
Money-mule networks move criminal funds through many small transfers, each of which looks ordinary on its own. What marks an account as a mule lies outside any single transfer: in the counterparties and addresses its network shares, and in the shape of its activity over time. Production systems remain largely rule-based and see neither, while most research classifies transactions rather than accounts, recovering account-level risk only by aggregating afterwards. We instead score the account directly, reading the bank's relational schema as a heterogeneous graph in which rows are nodes and foreign keys are edges. Each account is scored from a multi-hop neighbourhood using per-column encoders, a relative-time encoding and HeteroGraphSAGE message passing, with that neighbourhood restricted to rows predating the account's own pre-flag cutoff so that no model sees evidence recorded only after the account was flagged. On a five-year Reserve Bank Innovation Hub (RBIH) retail-banking dataset of 400 million transactions and 94{,}063 labelled accounts, 2.6\% of them confirmed mules, we compare against RelGNN, XGBoost, LightGBM and CatBoost trained on identical labels, splits and cutoffs. Our detector recovers nine in ten held-out mules at 83\% precision and a 0.5\% false-alarm rate, finding 115 more mules than the strongest tree ensemble given the same evidence. At the tuned thresholds the gap is mostly in recall: XGBoost and LightGBM lead across the first hundred alerts, but only the graph models hold their precision deep into the queue. Since the graph is the schema itself and every score is dated per account, the approach deploys on a bank's existing database without a custom feature graph build.
1 Introduction
Mule transfers can look ordinary individually, so account-level detection must capture shared relationships and activity over time. The paper reads the bank’s existing relational schema as a graph and scores each account from its time-bounded neighbourhood.
Context
- The RBIH release provides five years of retail banking activity, about 400 million transactions, and 96,091 labelled accounts, including 2,683 confirmed mules.The introduction situates the dataset within efforts to circulate suspected mule accounts and encourage banks to adopt AI models.Source: §1 · p. 1
Motivation
- Rules typically flag transfers, but mule detection requires deciding which accounts warrant investigation or suspension.Individual salary-sized credits, same-day debits, or cash withdrawals may not be anomalous on their own.Source: §1 · p. 2
- Shared counterparties, addresses, and postal codes, together with the temporal shape of activity, distinguish mule accounts beyond individual transfers.Fixed aggregate statistics erase relational links and collapse temporal ordering.Source: §1 · p. 2
Our approach
- The approach turns database rows into table-typed nodes and key references into edges, then scores each account from its neighbourhood as of its scoring time.The resulting embedding is converted to a mule probability and a tuned threshold produces an alert.Source: §1 · p. 2
2 Related Work
Prior work spans tree ensembles, graph methods, and mule-specific systems, but often differs in prediction unit, data, or temporal evaluation. This paper frames its approach as relational deep learning, where a database schema already supplies a graph.
Tabular and graph learning
- Tree ensembles remain competitive on tabular data, and neighbourhood aggregates can match purpose-built graph detectors across ten datasets.This motivates treating gradient boosting as a serious baseline rather than a formality.Source: §2 · p. 2
Financial graph learning
- Much financial graph work predicts transactions or edges and recovers account risk by aggregation, while public datasets are often synthetic, cryptocurrency-based, or about another financial crime.Related graph methods include neighbour aggregation, attention, typed-relation parameterisations, and time-ordered edge operators.Source: §2 · pp. 2–3
Mule detection
- Mule-specific studies use proprietary data; prior systems include a temporal transaction graph, transductive heterogeneous message passing, weekly-state Markov models, and gradient-boosted trees [33].The closest architecture classifies nodes over a full graph while splitting labels, whereas this paper scores each account from its own cutoff-bounded neighbourhood.Source: §2 · p. 3
Evaluation protocols
Relational deep learning
- Relational deep learning treats rows as nodes and foreign-key references as edges, allowing tasks to be defined per entity at a timestamp [7].Temporal neighbour sampling provides an auditable point for enforcing per-account cutoffs; RelGNN is included as a graph-model comparator [34].Source: §2 · p. 3
3 Problem Formulation
The formulation represents the database as a heterogeneous graph and restricts each account’s prediction to its cutoff-bounded neighbourhood. It applies the same evidence rules to graph and tabular models, with the prediction unit fixed at the account.
Database as graph
- Each database row becomes a node typed by its table, each primary–foreign key reference becomes a bidirectional edge, and untimestamped rows receive timestamp ⊥.The graph is written G = (V, E, τ), where τ records the timestamp of the row behind each node.Source: §3 · p. 3
Scoring cutoffs
- Positive accounts are cut one day before their flag date, while non-mules are cut one day before their last transaction; non-mules without transactions are dropped.The positive cutoff follows the data, but the negative-account cutoff is a modelling choice.Source: §3 · p. 3
Admissible evidence
- The admissible graph contains an account’s L-hop neighbourhood within the subgraph of rows timestamped by its cutoff.Untimestamped identifiers and static branch attributes remain admissible, while timestamped attributes reached through them are filtered by the same cutoff.Source: §3 · p. 3
Prediction function
- Every reported model depends on the account only through that neighbourhood, making evaluation per-account rather than global-split and inductive.The equations’ evidence restrictions apply to graph and tabular models alike.Source: §3 · p. 4
Data and metrics
- Of 96,091 labelled accounts, 94,063 have a well-defined cutoff and 2,488 are mules, a prevalence of 2.6%.At that prevalence, an all-negative classifier reaches 97.4% accuracy, so the paper reports ranking and analyst-queue metrics instead.Source: §3 · p. 4
- The evaluation reports ROC-AUC and PR-AUC for ranking, plus precision, recall, F1, false-alarm rate, and confusion counts at fixed operating points.Thresholds are selected on validation data and applied unchanged; the top-k set contains the k highest-scoring held-out accounts.Source: §3 · p. 4
4 Dataset
The dataset covers five years of Indian retail banking activity and is restricted to labelled accounts and their transactions. A class-stratified entity holdout is used, with temporal safety enforced through each account’s cutoff.
Dataset
- The RBIH dataset spans 2020-07-01 to 2025-07-12 and includes seven tables, with 237.8 million transaction rows after restriction to labelled accounts and their transactions.Of 96,091 labelled accounts, 94,063 admit a cutoff; the resulting set contains 2,488 mules, or 2.6%.Source: §4 · p. 4
- The class-stratified 70/15/15 holdout separates entities rather than time, while per-account cutoffs carry temporal safety.The data excludes columns recording investigation aftermath, reporting-time balances, and the highly null, nearly unique IP field.Source: §4 · p. 4
- Among labelled accounts with well-defined cutoffs, mules have a median of 1,196 transactions versus 1,987 for non-mules; Figure 2 illustrates weekly trajectories for one mule and one genuine account.The illustrated histories cover the 24 weeks before each account’s cutoff.Source: §4 · p. 4
5 Method
The method turns the relational schema into a heterogeneous graph and scores each account from a temporally restricted neighborhood. Column and relative-time encodings feed three-hop message passing and an account-level classifier.
5.1 From relational schema to heterogeneous graph
- Each database row becomes a table-typed node, and each foreign-key reference becomes a bidirectional edge, yielding a graph directly from the schema.Featureless COUNTERPARTY, ADDRESS, and PIN nodes connect accounts through shared endpoints without forming cliques.Source: §5.1 · pp. 4–5, Figure 3 · p. 6
5.2 Leakage-safe temporal neighbour sampling
- A three-hop sampler admits only timestamped rows at or before each seed account’s own cutoff, with fanout [4096, 512, 128].The wide first hop preserves visible transaction history; untimed rows are admitted unconditionally.Source: §5.2 · p. 5, Figure 3 · p. 6
5.3 Column encoders and relative-time encoding
- A relative-time encoding adds each timestamped row’s age in days against the seed account’s cutoff to its embedding.This gives the model account-relative timing alongside calendar timestamp features.Source: §5.3 · p. 6, Figure 3 · p. 6
5.4 Message passing, readout and training
- Three SAGECONV layers aggregate messages across edge types, and a linear readout produces a softmax mule probability for each seed account.Training uses positive-class weight 36.80 and selects an epoch by validation ROC-AUC, although the selected epoch was not the best-PR-AUC epoch.Source: §5.4 · p. 6
6 Experimental Setup
The evaluation compares graph and tabular baselines under shared labels, splits, cutoffs, and threshold-selection protocols. Graph sampling uses each seed’s own cutoff, while the tabular models receive flattened per-account evidence.
Baselines
- Four comparison systems include RelGNN on the same relational input and XGBoost, LightGBM, and CatBoost on flattened per-account evidence.The tree models receive 58 features, including account, customer, and branch attributes plus aggregates of visible transactions.Source: §6 · pp. 6–7
Temporal sampling
- Figure 4 depicts temporal sampling at each account’s cutoff, excluding timestamped candidates that fail the filter before drawing the three-hop sample.Untimed rows are admitted unconditionally; the graph models use a three-hop sample.Source: Figure 4 · p. 7
Evaluation protocol
- The graph models are single-seed in Table 2, while boosted-model rows use the seed selected on validation PR-AUC from three runs.The held-out split contains 373 mules among 14,110 accounts, with a base rate of 0.0264.Source: Table 2 · p. 8, §6 · p. 8
- All five systems share label tables, split masks, cutoffs, class weighting of 36.80, and threshold-selection protocol.Tree aggregates use the same per-account temporal filter as graph sampling; no system receives label-derived features.Source: §6 · pp. 7–8
7 Results
On the held-out split, graph models pull ahead of trees beyond roughly 0.4 recall, while the tuned detector leads at its fixed threshold. The preferred model changes with analyst-queue depth: trees lead in the first hundred alerts, but graphs retain higher precision by 500.
7.1 Ranking quality and fixed thresholds
- 0.044 PR-AUC separates RelGNN from our model, while trees cluster at 0.721–0.733 PR-AUC; graph models pull ahead sharply after roughly 0.4 recall.Trees match or exceed graph models up to roughly 0.4 recall.Source: Figure 5 · p. 8, §7.1 · p. 8
- F1 = 0.8663 at 83.2% precision and 90.3% recall is our model’s held-out fixed-threshold result, catching 337 of 373 mules against 68 false alarms.The threshold was selected on validation and applied unchanged to the held-out split.Source: §7.1 · p. 8, Table 3 · p. 9
7.2 Analyst-queue behaviour
- At k = 100, XGBoost finds 99 mules versus 92 for ours; at k = 500, graph precision is 0.676–0.680 versus trees’ 0.562–0.564.LightGBM and CatBoost find 98 and 96 mules, respectively, among their first 100 alerts.Source: Table 4 · p. 9, §7.2 · p. 9
- Fanout widening moves our test PR-AUC from 0.746 to 0.815, comparable to the graph–tree margin and limiting how much of that gap can be credited to architecture.The passage also notes that tree seed-to-seed validation PR-AUC spreads provide an informal noise floor on the tabular side.Source: §7.2 · p. 9
8 Limitations and Future Work
The evaluation treats every account without a confirmed mule label as negative, so undetected mule rings are taught as normal. The authors propose alternative training objectives and ring-level detection as future work.
8 Limitations and Future Work
- Undetected mule rings are treated as normal because every account without a confirmed mule label is assigned a negative label.The available ground truth is limited to the investigative record, bounding the reported precision by what that process reached.Source: §8 · p. 9
- The authors propose positive–unlabelled training or an anomaly objective over the same graph to avoid treating unlabelled accounts as confirmed negatives.Source: §8 · p. 9
- Scoring connected structures rather than individual accounts is proposed as future work to align detection with ring-level behaviour.Source: §8 · p. 9
9 Conclusion
With per-account pre-flag cutoffs, the detector performs strongly on held-out accounts and finds more mules than the best tree given the same evidence. Further comparisons show the graph models’ advantage is mainly in recall and depends on review-queue depth and cutoff choice.
9 Conclusion
- 337 of 373 held-out mules are recovered at 83.2% precision and a 0.50% false-alarm rate, 115 more than the best tree given the same evidence.The detector also reaches ROC-AUC 0.959 and PR-AUC 0.815.Source: §9 · p. 10
- At a fixed threshold, relational models differ from trees more in recall than precision, while RelGNN ranks higher but loses 0.073 F1 once a threshold is fixed.XGBoost and LightGBM lead across the first hundred alerts, but all three trees fall well behind by five hundred.Source: §9 · p. 10
- The non-mule cutoff is a modelling choice, not a fact in the data, and is better tied to an event independent of the account’s own activity.Source: §9 · p. 10