Unmasking fraud networks: How graph-grounded Copilots stop P2P fraud in Microsoft Fabric

Every second, financial networks log millions of data points across disconnected internal systems: debit transactions, peer-to-peer (P2P) transfers, device fingerprints, phone numbers, and IP addresses. But when organized crime rings strike, standard relational databases hit a wall trying to trace the connections.

The problem is that this information lives in siloed relational tables. Relational databases work well for recording one transaction at a time, but fraud almost never happens in a vacuum. When organized crime rings commit P2P payment fraud or identity theft, they do not reuse a single account. They spin up dozens of fresh accounts using new names and clean records, quietly sharing subtle infrastructure details like debit cards, phone numbers, and rapid money transfers behind the scenes.

Why flat tables confuse AI

When banks attempt to deploy Copilots and AI agents to assist fraud investigators, those tools often hit an architectural wall. Flat tables force AI agents to rely on standard SQL table joins. However, as the number of connections grows across multiple hops, relational joins face significant query complexity and performance challenges. As queries traverse layers of accounts, cards, and devices, relational databases either slow down, time out, or return thousands of irrelevant records, leaving AI agents unable to distinguish legitimate customers from coordinated crime rings.

Microsoft Fabric solves the storage silo problem by bringing transaction logs and customer data together in OneLake as open Delta tables. Neo4j Graph Intelligence integrates directly on top of Fabric to turn those flat tables into connected property graphs. Together, this architecture gives Copilots the relationship-level context they need to spot hidden fraud rings in milliseconds.

The “coffee shop Wi-Fi” problem

In P2P payment fraud, banks often discover crimes long after funds have been drained. Imagine account A-101 receives a chargeback for stolen funds. To stop further losses, investigators must quickly answer a critical question: Which other accounts belong to the same organized fraud ring?

When investigators ask a SQL-powered Copilot to locate all accounts linked to A-101, the agent translates the request into relational joins based on shared attributes such as card numbers, phone contacts, and IP addresses. That is where standard relational queries fall into a trap:

• Common infrastructure can create massive false positives: Account A-101 might share an IP address or Wi-Fi network with Account A-103. But if that Wi-Fi network is at a public coffee shop, an airport lounge, or a mobile carrier gateway, 8,000 legitimate users share the exact same IP address.
• Relational joins cannot distinguish link quality: Relational queries treat every shared key equally. To a SQL join, sharing a private debit card and sharing a public Wi-Fi network look identical.
• Investigators get flooded with noise: The SQL-driven Copilot returns a list of thousands of accounts linked to that single Wi-Fi connection. An alert that flags everyone proves nothing.

Viewing individual transactions in flat rows makes it nearly impossible for an AI agent to discern the actual structure of a fraud ring.

Separating signal from noise with graph algorithms

To stop coordinated fraud, AI agents need to evaluate connection strength and network structure, not just raw counts of matching values.

People rarely share personal credentials. Two different account holders almost never share a credit card number, a mobile phone number, or rapid, repeated P2P payments. When two or three accounts share those specific identifiers, the likelihood that they belong to the same ring skyrockets.

Neo4j Graph Intelligence introduces relationship reasoning directly into the Fabric workspace:

1. Filtering high-traffic hubs: Neo4j lets teams filter out noisy connections that are used by too many accounts (such as a public Wi-Fi network shared by hundreds or thousands of devices), preventing AI agents from mistaking public infrastructure for criminal collusion.
2. Scoring strong links: The graph focuses on rare, high-confidence identifiers, such as shared debit cards, phone numbers, and direct payment paths.
3. Resolving rings with community detection: Using Graph Data Science (GDS) algorithms like Weakly Connected Components (WCC), Neo4j groups accounts that share strong connections into discrete clusters.

When account A-101 is confirmed as fraudulent, WCC immediately isolates its entire group (accounts A-102, A-104, A-106, and A-107) as high risk. Meanwhile, account A-103 remains completely off the list because shared coffee shop Wi-Fi alone is not evidence of a crime. The investigator receives a short, prioritized list with clear reasoning attached, rather than thousands of false leads.

Capability	Standard Relational SQL Agent	Neo4j Graph-Grounded Copilot
Data model	Flat transactional rows and tables	Connected property graphs (:Account, :Device, :Card, :Phone, :Payment)
Connection logic	Direct foreign key joins (JOIN, WHERE)	Multi-hop pattern matching and network topology
Noise handling	Over-indexes on common hubs (flags thousands of accounts on shared Wi-Fi)	Filters out high-degree hubs to isolate rare, high-confidence links
Complex networks	Times out or fails when tracing multi-hop money laundering paths	Identifies complete rings in milliseconds using community algorithms
Copilot output	Returns thousands of noisy records or fails to answer	Returns a concise, ranked list with the specific shared evidence attached

How Microsoft Fabric and Neo4j power real-time fraud investigations

By integrating Neo4j Graph Intelligence into Microsoft Fabric, financial institutions combine governed relational storage with real-time graph context:

1. Unified foundation: Microsoft Fabric OneLake consolidates accounts, transactions, and authentication logs across the organization into open Delta tables, removing the need for custom pipelines and duplicate data sets.
2. In-engine graph analytics: Neo4j Graph Intelligence runs natively within Fabric. Data scientists and engineers can run Cypher queries and GDS algorithms (such as Weakly Connected Components or PageRank) directly in Fabric Notebooks to compute network-level risk across millions of entities in seconds.
3. Graph-enriched lakehouse storage: The resulting graph intelligence, Such as community group IDs, network risk scores, and centrality metrics, is written back into OneLake Delta tables.
4. Context-aware Copilots: Fabric Data Agents query these enriched Delta tables and Neo4j graphs. When a fraud investigator asks Copilot in plain English to review suspicious behavior around an account, the agent retrieves clear network relationships rather than blind row joins, providing Copilot with grounded, relationship-aware context.

Because the entire workflow operates within Microsoft Fabric, organizations can maintain existing enterprise guardrails, including native single sign-on (SSO), Microsoft Purview governance, and tenant isolation. Fraud teams can safely explore connected networks without setting up separate database clusters or splitting security boundaries.

Getting started with graph-grounded Copilots in Fabric

Deploying graph-grounded fraud detection does not require building new infrastructure from scratch. You can enable Neo4j Graph Intelligence directly inside the Fabric Workload Hub for single sign-on and native workspace management, or launch managed instances via the Azure Marketplace.

From there, you can turn OneLake Delta tables into graph models, run community detection to uncover organized fraud rings, and empower Fabric Data Agents to deliver accurate answers.