Captured from the live deployment, not a mockup
01 · The problem
Promotion abuse is a group behaviour, so a queue built on per-account scores misses the ring. Reframed the output from flagged accounts to ranked rings, reaching 0.7292 precision against a 0.2242 base rate.
02 · How it works
- 01
Sized the queue to the team that works it with an exact knapsack over reviewer minutes, rather than flagging everything and calling it recall.
- 02
Published the cost beside the win, 0.371 genuine customers swept in per fraudster caught, with 36 dated failures including the attacker who splits rings into cells of three.
- 03
Promotion abuse is a group behaviour, so scoring accounts one at a time misses it. Built a multi-relation account graph with edges weighted by entity rarity times measured fraud lift, fitted on training accounts only.
- 04
Scored and pruned first, then extracted rings by greedy densest-subgraph peeling with a proved one-half approximation bound, reaching 0.7292 ring precision against a 0.2242 base rate on a 35.7M-edge graph.
03 · What it cost, and what it returned
Attached the cost to every number: 0.371 genuine customers swept in per fraudster caught, an exact knapsack over reviewer minutes sizing the queue to analyst capacity, and 36 dated failures published.