Oneytrust Maps the Shape of Deception to Stop Fraud-as-a-Service

Forget the lone hacker stereotype. Fraud is a $10.5 trillion global industry, with CEOs, R&D departments, and service-level agreements. Fraud-as-a-Service has professionalized cybercrime, allowing criminals to rent botnets or purchase synthetic identities. For Oneytrust, a European leader in digital profiling and payment security, the adversary isn’t a person. It’s an interconnected network.

Oneytrust secures transactions for major e-retailers and financial institutions across Europe. For more than a decade, Oneytrust has built its fraud prevention platform around the idea that risk is not contained within isolated events, but emerges from the relationships between identities, devices, payment instruments and digital behaviours.

“Fraud is all about connections,” says Guillaume Beauventre, Solutions & Technology Director at Oneytrust. “When you structure your data to look like the real world in Neo4j, you stop looking for rows in a spreadsheet and start seeing the shape of the network. That is how you catch them.”

Understanding relationships

“For two decades, the standard approach to fraud detection involved collecting massive amounts of data and storing it in relational databases,” shares Guillaume Beauventre. If a user logged in, the system checked their credentials against a list. If they made a purchase, the system checked their balance. While these approaches remain highly effective for many fraud detection scenarios, Oneytrust needed an additional way to analyse large-scale relationship structures and evolving fraud networks.

Fraud rings operate by creating thousands of synthetic identities. They might use a clean IP address for one transaction, a valid credit card for another, and a fresh email address for a third. In a cloud data warehouse, these entities live in separate tables. Connecting them requires JOIN operations — computationally expensive queries that stitch tables together. This makes detecting sophisticated fraud a challenge.

If Oneytrust wanted to check whether a new user was connected to a known fraudster through three degrees of separation (for example, User A shares a phone number with User B, who used a device previously flagged by User C), the query would grind the database to a halt.

“If you put this data in a table, you lose velocity,” explains Guillaume Beauventre. “The treatment becomes very long or very expensive in terms of computing power. In our business, we cannot wait minutes for a query to finish. The transaction has to be approved or denied now.”

The rise of Generative AI accelerated the problem. Criminals can now generate realistic fake documents and profiles at scale, flooding systems with noise. Oneytrust needed a way to ignore surface-level details and focus on the attack’s underlying topology. The relational database approach couldn’t provide this view because it lacked the ability to efficiently represent and query relationships between entities.

Building the knowledge layer

Neo4j complements the existing fraud detection stack rather than replacing it. Traditional databases remain essential for processing large volumes of transactional events, while the graph provides a new way to explore, connect, and understand the relationships hidden within that data. Together, they enable faster and more effective fraud detection. Oneytrust built a dedicated graph intelligence layer powered by Neo4j AuraDB running on Microsoft Azure. In the new architecture, data is ingested from the Azure cloud ecosystem directly into Aura. Instead of rows and columns, the data is modeled as nodes and relationships:

Nodes: Customers, Devices, IP Addresses, Credit Cards, IBANs, Phone Numbers.

Relationships: HAS_USED, CONNECTED_TO, SHARED_DEVICE, TRANSFERRED_TO.

Graph technology alone does not detect fraud. Effective fraud prevention still relies on behavioral signals, risk scoring models, machine learning, and fraud expertise. What the graph provides is a powerful way to connect those signals, uncover hidden relationships, and expose patterns that would otherwise remain invisible. For Oneytrust’s analysts and data scientists, it creates an entirely new way to investigate, understand, and continuously improve fraud detection strategies.

This structure allows Oneytrust to perform two distinct types of detection that were previously impossible at scale.

“Hot” Detection (Real-Time)

When a transaction occurs, the system queries the graph instantly. Instead of only validating the user’s transaction history, the system now also traverses the network.
Query: “Does this new customer share a device fingerprint with any node flagged as ‘Fraud’ within 3 hops?”
Result: Even if the customer name and card are new, the graph reveals the hidden connection to a known criminal ring. The transaction is flagged in milliseconds.

“Cold” Detection (Retro-Analysis)

Fraudsters are adaptive. When they change tactics, Oneytrust analysts use the graph to look backwards. Oneytrust’s data science teams use Neo4j Graph Data Science to develop community detection and network analysis algorithms that identify suspicious clusters of accounts. These insights help uncover coordinated fraud activity and continuously enrich the company’s risk scoring models.

“We use the graph to understand how fraud networks create themselves, how they mutate, and how they evolve,” says Guillaume Beauventre. “It allows our experts to adapt our scoring models based on the reality of the network.”

One of the most significant shifts occurred outside the engineering team. Oneytrust uses Neo4j Bloom, a visualization tool that allows non-technical business analysts to explore data visually.

Previously, an analyst investigating a suspicious pattern would need to ask a data engineer to write a complex SQL query. Now, they simply type a search or click on a node. The interface displays the fraud ring as a visual cluster — a literal ring of connected nodes on the screen.

“Our business users embraced the interface immediately,” notes Guillaume Beauventre. “They can see the community and the links. It turns an abstract data problem into a visual investigation.”

Thanks to graph technology, Oneytrust can identify and block fraud networks much earlier, before they have a chance to expand. The integration of Neo4j into their Azure stack has created a defense system that scales as fast as the attackers.

Defense at the speed of AI

Oneytrust views the graph as the foundation for the next generation of cybersecurity: AI-driven defense.

The company is currently exploring how to combine its graph intelligence with Large Language Models (LLMs) and Generative AI. The goal is to move toward GraphRAG (Retrieval Augmented Generation), where an AI assistant could answer complex investigative questions by pulling verified context from the knowledge graph.

Consider a fraud analyst investigating a series of suspicious transactions. Using a GraphRAG system, the analyst could ask, “Show me all communities that formed in the last 24 hours that share characteristics with the ‘Ticket Scam’ ring from last month.” The AI would translate that natural language into a graph query, retrieve the specific cluster patterns, and present the evidence.

“At Oneytrust, understanding the meaning carried by data—and the relationships behind it—has always been part of our DNA,” shares Guillaume Beauventre. “Neo4j enabled us to take this philosophy further by exploring connections across entities at a much greater depth and scale, while giving our analysts, fraud experts, and data scientists entirely new ways to visualize, investigate, and understand risk.”

“We integrated graph technology because it gave us a new way to operationalize what we have always known: fraud is a network problem,” Guillaume Beauventre concludes. “Neo4j does not replace our expertise, our models, or our fraud intelligence. It amplifies them. By making relationships visible and actionable, it gives our analysts and data scientists new ways to connect signals, understand behaviours, and continuously improve detection performance at scale.”