Defending Brazil’s Digital Economy: How iFood Dismantled Organized Fraud Rings by Connecting the Dots

iFood is an essential digital infrastructure for a large portion of the Latin American economy. The platform generates activity equivalent to 0.55% of Brazil’s Gross Domestic Product, thanks to 55 million active users and 400,000 drivers. For many small business owners and couriers, iFood is their primary source of income.

But scale attracts crime. As iFood expanded, so did the sophistication of criminal networks. Fraudsters progressed from simple credit card theft to complex schemes designed to steal subsidies and manipulate rewards.

Nathália Palazzo, Head of Fraud Prevention at iFood, faced a problem that traditional data analysis couldn’t solve. “Fraud has branched out,” she said. “It involves processes, systems, and people. We reached a point where we were identifying anomalies, but not every anomaly is fraud. To find the truth, we needed to see the connections.”

The Challenge: When Rows and Columns Miss the Picture

The most damaging fraud on the iFood platform looked like legitimate business.

iFood offers subsidies to new restaurants to help them gain traction. For example, if a burger costs $10 to produce, iFood might cover a percentage of that cost to offer a discount to the user. This subsidy model became a target for “consultancies” – shadowy firms that approached restaurants with a promise to boost profits.

These firms created fake user accounts and placed fake orders with complicit restaurants. The restaurant would “accept” the order but never cook the food. The “driver” (often a GPS spoofer or a complicit account) would mark it delivered. No food existed, but iFood paid the subsidy. The restaurant and the consultancy split the profit.

Detecting this with a standard Relational Database Management System (RDBMS) is difficult. SQL databases store data in rows and columns. To find a collusion ring, an analyst must join tables: User to Order, Order to Restaurant, Restaurant to Device ID, Device ID to Payment Hash.

“We tried to use relational databases,” Palazzo said. “The problem is that the fraud hides in the relationships, not the transaction itself.”

The fraudsters knew how to bury their tracks four or five layers deep. iFood needed a technology that could go as deep as the criminal networks themselves.

The Solution: Native Graph Performance

Neo4j treats relationships as first-class citizens, unlike graph stores that sit atop other storage engines. Traversing from a user to a shared credit card to a different account is an index-free adjacency operation. It is instant.

“We needed to go beyond three nodes,” Palazzo noted. “The sophistication of the fraud required us to look deeper. Neo4j allowed us to see connections that were previously invisible to us.”

iFood’s data ecosystem is massive. The team uses Databricks as the primary engine for data ingestion and data lake. Transactional data – orders, logins, device fingerprints – flows into Databricks, where it is cleaned and prepped. From there, high-value data subsets are piped into Neo4j AuraDB, running on AWS.

AuraDB, Neo4j’s fully managed cloud service, removed the operational burden of managing servers. “We needed speed,” said Jose Eduardo Machado, Neo4j’s Director of Solution Engineering for LATAM. “AuraDB meant the team didn’t have to worry about infrastructure. With a click, they were ready to model data.”

Technology is only as effective as the culture adopting it. To break the inertia of legacy systems, Palazzo’s team organized a “Fraud Hackathon.” They took 30 data scientists and analysts, split them into groups, and gave them one week to break the system using Neo4j.

The results were immediate. In five days, the teams built six fully functional fraud detection use cases.

One team focused on the subsidy abuse pattern. By loading the data into the graph, the shape of the fraud became obvious. Legitimate orders look like a starburst – random users connecting to random restaurants. Collusion looks like a dense spiderweb – a small group of users ordering repeatedly from the same small group of restaurants, often sharing device fingerprints or payment credentials.

“The team went from zero to production-ready models in a week,” Machado observed. “They used community detection algorithms to find groups of people working together to game the system. It wasn’t just theory anymore.”

Impact: Protecting the Ecosystem

The deployment of Neo4j transformed iFood’s defensive posture from reactive forensics to proactive identification. The most significant immediate win was in the detection of promotion abuse.

“When we started using Neo4j for investigative analysis, we doubled our identification of promotion abuse,” Palazzo revealed. “We knew the fraud existed, but we didn’t know the extent. The graph showed us the branching. We found that the losses were twice what we estimated.”

The fraud team’s graph has become iFood’s knowledge layer for trust and safety — a connected model of the relationships between accounts, devices, orders, and payments that reveals what no single table can.

iFood stopped the fraud by mapping these networks. They could block the payouts before the money left the building.

The technical victory translates directly to human protection. When a fraud ring drains the subsidy pool, there is less money to support honest restaurants. When fake orders flood the system, algorithms get skewed, and honest drivers lose out on real delivery routes.

“Preventing fraud builds trust,” Palazzo said. “When we block a dishonest restaurant, we ensure that an honest one gets the order. When we stop a fake courier account, a real driver gets the income. We are protecting the income of families.”

The success in the marketplace has spilled over into iFood’s fintech arm, iFood Pago. The company offers loans and bank accounts to restaurants. A restaurant that commits fraud on the delivery app is a high credit risk for a loan.

Previously, these data silos were difficult to bridge. Now, the graph connects the entities. If a restaurant owner defaults on a loan and tries to open a new restaurant under a different name to sell on the marketplace, the graph reveals the hidden link – perhaps a shared phone number or bank account associated with a banned entity.

Future: From “Cold” to “Hot” Defense

iFood began its graph journey in the “cold” layer – investigative analysis of historical data. The roadmap now points toward real-time prevention.

Palazzo’s team is integrating Neo4j directly into the fraud prevention engines. The goal is to query the graph in the milliseconds before an order is accepted. If the graph detects that a user is part of a known collusion cluster (a “community” in graph terms), the transaction can be blocked instantly.

“We are moving to integrate Neo4j with our machine learning models,” Palazzo said. “We want to be preventive, not just reactive. The fraudsters are sophisticated, but the graph allows us to be faster.”

For a company that processes 120 million orders a month, speed is essential. By visualizing the chaos of millions of transactions, iFood has not just saved money; they have secured the digital pavement for the millions of Brazilians who rely on them to eat, to work, and to grow.

“The world is connected,” Palazzo concludes. “If you don’t look at the depth of those connections, you are missing the truth of your business.”