Entity Link Analysis

What it measures

Most scaled transaction fraud is one controller (or a small crew) acting through many accounts. Each account can be made to look clean; the connections are much harder to hide because the operation has to reuse something: devices, payment instruments, payout destinations, receipts, infrastructure or money.

Entity types (nodes): accounts; people or verified identities; devices; IPs and network blocks; email addresses and domains; phone numbers; physical addresses; card fingerprints/tokens; bank accounts (funding and payout); crypto addresses; gift-card delivery destinations; receipt or document hashes; merchant/seller accounts; securities traded (for coordinated trading).

Link types (edges):

Cluster features: component size; density; how many members have confirmed fraud; growth rate (new accounts joining per day); number of distinct cash-out endpoints relative to members (many accounts, few exits = farm); age distribution of members; shared creation windows.

Why it matters

Linkage converts one confirmed case into many. Regulators describe the pattern directly: FINRA's Regulatory Notice 22-25 lists signs of central control over multiple brokerage accounts, including similar opening dates, referral sources, contact details, bank information, IP addresses and initial funding amounts. FinCEN's study of identity theft SARs from securities firms noted the same bank account, phone number, IP address, physical address or email used against multiple victims. The FinCEN deepfake alert (FIN-2024-Alert004) adds an artifact link: reverse-image matches of profile photos to galleries of AI-generated faces.

Each industry the site covers has its own version:

• Cashback, Coupons and Rewards: account farms sharing devices, receipt images and redemption destinations.
• Online Marketplaces: buyer–seller collusion; banned sellers returning with new accounts tied to old payout banks.
• Neobanks and Consumer Fintech and Payments and P2P: mule networks with shared beneficiaries and fan-in/fan-out flows.
• Brokerage and Investing: nominee accounts and coordinated buying in the same thin security.
• Retail and Ecommerce: reshipper addresses and card reuse across many customer accounts.

How to collect it

• Resolve entities first. Normalize and canonicalize attributes (addresses, emails with provider-specific aliasing, phone formats, names) before linking, or you'll both miss links and create false ones. See Fraud Data Architecture.
• Use a graph store or graph-shaped tables that support fast neighbor lookups at decision time (e.g., "how many accounts share this payout bank?") and periodic community detection over the whole graph.
• Keep edge metadata: first/last seen, count, and source. "Shared a device once two years ago" and "share a device every day" are different links.
• Cap or down-weight supernodes, the attributes that legitimately connect huge numbers of accounts (carrier IPs, popular office Wi-Fi, a retailer's shared kiosk, a large employer's payroll account).
• On build vs. buy, vendors offer device linkage, consortium identity graphs and graph analytics platforms (Graph Analytics, Consortium and Data Sharing). Your transactional edges (payouts, receipts, referrals, P2P flows) exist only in your data, and they are usually the most incriminating.

How to use it

• At decision time, feed neighbor counts and neighbor risk ("this payout bank is linked to 14 other accounts, 3 of them closed for fraud") into Real-Time Transaction Risk Scoring and Machine Learning Models as features.
• Apply guilt by association carefully. Propagate risk from confirmed bad nodes over strong links, with decay over weaker and older links. Weak links alone shouldn't drive adverse action.
• Score whole clusters for farm-like shape: many young accounts, synchronized creation, few cash-out endpoints, uniform behavior. Dense-subgraph methods are designed to find such blocks even when fraudsters add "camouflage" edges to legitimate entities.
• In investigations, expand from one case to its network before acting, so you can take down a ring at once rather than one account at a time (which teaches the ring what you see). See Playbook - Fraud Ring Investigation Members.
• Combine it with Referral Graph Patterns (incentive-specific edges), Payee and Counterparty Risk (fan-in), Fast In Fast Out Patterns (flow) and Device Reputation and Linkage.

Strengths and limitations

Strengths: turns isolated alerts into network-level cases; hard to evade because operations must reuse scarce resources (cash-out endpoints especially); one takedown removes many accounts; supports SAR narratives and law-enforcement referrals.

Limitations: sophisticated rings work to limit what they share, and individual link types can be degraded, which is why the strongest programs rely on many link types at once and on money-flow edges. Graphs get noisy and expensive at scale; supernodes create false clusters; link data ages. Results are only as good as entity resolution.

False positives and fairness

• Households and families sharing devices, addresses, cards and bank accounts.
• Shared and public infrastructure such as libraries, campuses, workplaces, carrier-grade NAT and shared family tablets.
• Small businesses where an owner manages several accounts or pays several contractors.
• Caregivers legitimately managing accounts for relatives.
• Shelters, group homes and multi-unit buildings with a single address for many residents; immigrant communities pooling resources.
• Customer support or kiosk devices used for many customers.

Weight link types, require multiple independent links before adverse action, and review household-sized clusters differently from farm-sized ones.

Privacy and compliance considerations

Linking data across accounts is profiling; disclose it in privacy notices and keep it to fraud-prevention purposes. Consortium identity graphs may implicate FCRA if used for eligibility decisions. Cross-institution sharing of linked entities relies on frameworks such as Section 314(b) for eligible financial institutions. Restrict who can query the graph, because it is also a powerful insider tool (Insider Access Controls). See Privacy and Data Use in Fraud Prevention.

Mechanisms it helps detect

Multi-Accounting · Fraud Rings and Collusion · Money Mules · Account Farming and Resale · Referral Abuse · Receipt Fraud (Cashback) · Synthetic Identity Fraud · Triangulation Fraud · Ramp-and-Dump via Account Takeover · Fake Account Creation (Bots)

Related signals and controls

Device Reputation and Linkage · Referral Graph Patterns · Payee and Counterparty Risk · Fast In Fast Out Patterns · Identity Element Consistency · Graph Analytics · Negative Lists and Deny Lists · Consortium and Data Sharing · Playbook - Fraud Ring Investigation Members · Playbook - Multi-Accounting and Linkage Members · Playbook - Money Mule Detection Members · Entity Resolution

Sources and further reading

• FINRA Regulatory Notice 22-25: Heightened Threat of Fraud: signs of central control across accounts (shared contact, bank, IP, funding).
• FinCEN: Identity theft SARs filed by securities and futures firms: same bank account, phone, IP, address or email used against multiple victims.
• FinCEN Alert on Deepfake Media (FIN-2024-Alert004): reverse-image matches and inconsistent identity elements as red flags.
• Dolhansky and Canton Ferrer: Adversarial collision attacks on image hashing functions (2020): limits of image-hash links; combine link types.