Skip to content

Follow the money. Find the ring.

GraphMule turns a transaction ledger into a network and searches its shape for money-muling cycles, smurfing bursts and layered shell accounts — the structures rule-based checks walk straight past.

Analyze a ledgerSee how it works
Circular flows · 3–5 hopsFan-in · ≥10 senders in 72hFan-out · ≥10 receivers in 72hLayered shells · 3-hop chainsPer-account suspicion scoresfraud_report.json exportCircular flows · 3–5 hopsFan-in · ≥10 senders in 72hFan-out · ≥10 receivers in 72hLayered shells · 3-hop chainsPer-account suspicion scoresfraud_report.json export

Rules check transactions. Launderers design networks.

A $900 deposit looks clean. So do the eleven others that land in the same account before the day is out. On its own, no single transfer crosses a threshold.

GraphMule reads the ledger the way an investigator would. It maps accounts as nodes and transfers as edges, then looks at the shape of the whole.

How it works

From spreadsheet to suspect in three moves.

  1. 01 · Ingest

    Drop in a ledger

    A CSV of transfers with five columns: transaction id, sender, receiver, amount and timestamp. There's nothing to configure.

  2. 02 · Model

    See it as a graph

    Every account becomes a node and every transfer a directed, timestamped edge. A flat list of payments becomes a shape you can inspect.

  3. 03 · Detect

    Isolate the rings

    Four detectors walk the graph for cycles, fan-in, fan-out and shell layering. Each account they touch gets a suspicion score and a ring id.

Fig. 01 — Ledger as graphStage 01 / IngestScanning

What it looks for

Four detectors, each tuned to a laundering typology. Every match is returned as a ring with its member accounts and a risk score.

  1. Circular flow

    01/04

    Money leaves an account and returns to it through three to five hops. This is the signature of a muling ring laundering its own funds.

    3–5 hopsScore 95

  2. Fan-in smurfing

    02/04

    Ten or more senders feed a single account within 72 hours. A large sum gets broken into deposits that each stay under reporting thresholds.

    ≥10 senders72hScore 88.5

  3. Fan-out smurfing

    03/04

    One account pays out to ten or more receivers inside 72 hours, scattering the trail before anyone can follow it.

    ≥10 receivers72hScore 88.5

  4. Layered shells

    04/04

    Funds pass through a chain of low-activity accounts, each with only two or three transactions. Their only job is to put distance between source and destination.

    3 hops2–3 tx eachScore 92

Output

One upload. A complete case file.

You get an interactive network, ranked rings and accounts, and a structured report that downstream compliance tooling can read.

Detectors
4Cycles, fan-in, fan-out and layered shells run on every upload.
Smurfing window
72hBursts only count when they land inside 72 hours.
Hop cycles
3–5Short loops are where muling rings hand funds back to themselves.
Click export
1Every ring, account and score in one fraud_report.json.
fraud_report.jsonsample run
{
  "fraud_rings": [{
    "ring_id": "RING_002",
    "member_accounts": ["RING1_A", "RING1_B", "RING1_C"],
    "pattern_type": "cycle",
    "risk_score": 95.0
  }, …],
  "summary": {
    "total_accounts_analyzed": 243,
    "suspicious_accounts_flagged": 140,
    "fraud_rings_detected": 7,
    "processing_time_seconds": 0.076
  }
}

FastAPI · NetworkX · Pandas · Next.js

graphmule

See the network behind the numbers.

Upload your own ledger or start with the bundled sample. It holds seven planted rings and takes under a second to analyze.

Analyze a ledgerTry the sample ledger