Open Source Tools for Fraud Teams
Defender-side open-source tools for transaction fraud teams (graph, rules, feature stores, imbalanced ML, anomaly detection, image hashing, monitoring platforms) with fit, license and caveats.
A minimal open-source fraud stack
Graph databases and graph analytics
Used for ring investigation, mule networks, referral graphs, multi-account linkage. See Graph Analytics, Entity Link Analysis, Referral Graph Patterns, Playbook - Fraud Ring Investigation Members.
| Project | What it's good for | License | Notes |
|---|---|---|---|
| Neo4j Community Edition | Property-graph database with the Cypher query language; investigator-friendly exploration | GPLv3 (Enterprise is commercial) | Most fraud graph tutorials assume it |
| Neo4j Graph Data Science | Community detection, centrality, similarity and node embeddings inside Neo4j | Mixed; see NOTICE | Plugin; check which algorithms are in the open tier |
| JanusGraph | Distributed graph database on pluggable storage backends | Apache-2.0 (code) | For very large graphs; heavier ops |
| Apache AGE | Graph queries (openCypher) inside PostgreSQL | Apache-2.0 | Good when your case data already lives in Postgres |
| NebulaGraph | Distributed graph database | Apache-2.0 | Scale-out alternative |
| Memgraph | In-memory graph database, Cypher-compatible, built for real-time graph analytics | BSL 1.1 / Memgraph Enterprise License (source-available) | Not OSI open source |
| Kùzu | Embedded graph database (Cypher) | MIT | Archived by its maintainers in 2025; prior releases still usable. Avoid for new builds |
| NetworkX | Python graph analysis: connected components, centrality, community detection | BSD-3-Clause | The default for notebook-scale ring analysis |
| python-igraph | Fast graph algorithms (C core), including Leiden/Louvain community detection | GPL-2.0 | Faster than NetworkX on larger graphs |
| cuGraph (RAPIDS) | GPU-accelerated graph analytics | Apache-2.0 | When graphs reach hundreds of millions of edges |
| PyTorch Geometric | Graph neural networks | MIT | Research-grade; most teams get more from simple graph features first |
| DGL | Graph neural networks | Apache-2.0 | Development has slowed (last commit mid-2025) |
| Gephi | Desktop graph visualization | CDDL/GPLv3 | Quick visual triage of exported subgraphs |
| Cytoscape | Network visualization and analysis desktop app | See repo | Strong layout and styling |
| PyGraphistry | Python client for GPU graph visualization | BSD-style | Client is open; the visualization server is a service |
Entity resolution
Linking records that refer to the same person or household without a shared key. This is the foundation for linkage Members and for SAR subject identification.
| Project | Good for | License | Notes |
|---|---|---|---|
| Splink (UK Ministry of Justice) | Probabilistic record linkage (Fellegi–Sunter) at scale on DuckDB or Spark; no training labels needed | MIT | Splink 5 released September 2026 |
| dedupe | Active-learning deduplication and linkage in Python | MIT | Good for smaller datasets with human labeling |
| Zingg | ML entity resolution on Spark | AGPL-3.0 | AGPL obligations matter if you offer it as a service |
| libpostal | International address parsing and normalization | MIT | Normalize addresses before matching (Address Risk Signals) |
| libphonenumber (Google) | Phone parsing, validation and formatting | Apache-2.0 | Normalize before velocity counts (Phone Risk Signals) |
| disposable-email-domains | Community list of disposable email domains | CC0 | A weak signal on its own; combine with others (Email Risk Signals) |
Rules and policy engines
See Rules Engine and Rule Governance and Change Management.
| Project | Good for | License | Notes |
|---|---|---|---|
| ZEN Engine (GoRules) | Business rules as JSON decision graphs and tables; Rust core with Python/Node/Go/Java bindings | MIT | Readable by non-engineers; version 2.0 released |
| Drools (Apache KIE) | Mature Java rules engine (DMN, decision tables) | Apache-2.0 | Powerful; steeper learning curve |
| Open Policy Agent (OPA) | Policy-as-code with the Rego language | Apache-2.0 | Better for access and authorization policy than for scoring, but works for simple fraud gates |
| CEL (Common Expression Language, Google) | Safe, fast embedded expressions | Apache-2.0 (spec) | Useful for letting analysts write conditions inside your own engine |
| json-rules-engine | Lightweight JavaScript rules | ISC | Small services and prototypes |
Open-source fraud and AML monitoring platforms
Full platforms (ingest, rules, ML, cases) you can self-host. Evaluate them like vendors (Vendor Selection and Evaluation).
| Project | What it is | License | Notes |
|---|---|---|---|
| Marble | Real-time transaction monitoring, screening and case investigation | Elastic License 2.0 (source-available) | Commercial enterprise tier |
| Jube | Real-time AML and fraud monitoring with rules, velocity, ML and case management | AGPL-3.0 | Now marketed with AI-agent investigation features |
| Tazama | Real-time transaction monitoring built around typologies and ISO 20022 messages; aimed at payment switches and FSPs | Apache-2.0 (docs) | Typology/rule processor design is a useful reference architecture even if you don't deploy it |
Streaming, feature stores and data tooling
See Fraud Data Architecture and Real-Time Decisioning Architecture.
| Project | Good for | License |
|---|---|---|
| Apache Kafka | Event backbone for login, transaction and payout events | Apache-2.0 |
| Apache Flink | Stateful stream processing for real-time velocity features (Velocity Signals) | Apache-2.0 |
| Feast | Feature store with offline/online consistency; point-in-time correct training sets | Apache-2.0 |
| Featureform | Virtual feature store over existing infrastructure | MPL-2.0 (slower activity since 2025) |
| Hopsworks | Feature store and ML platform | AGPL-3.0 (open repo less active since early 2025) |
| DuckDB | In-process analytical SQL; fast ad-hoc analysis on Parquet exports | MIT |
| Polars | Fast DataFrame library | MIT |
| pandas | Standard Python DataFrames | BSD-3-Clause |
| Great Expectations | Data quality tests on feature and label pipelines | Apache-2.0 |
Machine learning for imbalanced, adversarial data
See Machine Learning Models and Model Risk Management.
| Project | Good for | License | Notes |
|---|---|---|---|
| scikit-learn | Baselines, pipelines, calibration, metrics (precision-recall curves) | BSD-3-Clause | Calibrate before setting thresholds |
| XGBoost | Gradient-boosted trees; the workhorse for tabular fraud | Apache-2.0 | |
| LightGBM | Fast gradient boosting on large tabular data | MIT | |
| CatBoost | Gradient boosting with native categorical handling | Apache-2.0 | Good with high-cardinality merchant/BIN features |
| imbalanced-learn | Resampling (over/under-sampling, SMOTE variants), balanced ensembles | MIT | Resampling often hurts calibration; class weights plus threshold tuning is usually enough |
| River | Online/streaming ML that updates incrementally | BSD-3-Clause | For fast drift and cold-start contexts |
| Optuna | Hyperparameter search | MIT | |
| MLflow | Experiment tracking, model registry | Apache-2.0 | Model inventory evidence for MRM |
| SHAP | Feature attributions for model explanations | MIT | Analyst-facing reason codes; watch the cost at inference time |
| InterpretML | Glass-box models (EBMs) and explanations | MIT | EBMs are a good compromise when you need explainability |
| LIME | Local explanations | BSD-2-Clause | Largely unmaintained since 2021 |
| Evidently | Data and model drift monitoring and reports | Apache-2.0 | Drift dashboards for champion-challenger (Experimentation and Champion-Challenger) |
| cleanlab | Finding label errors in training data | Apache-2.0 | Useful when labels come from noisy sources such as disputes (Fraud QA Program) |
| Label Studio | Annotation tool for building labeled sets (e.g., receipt images) | Apache-2.0 |
Anomaly detection and time series
Useful for novel attack sentinels Members, loss early-warning and promo monitoring (Promo and Reward Redemption Patterns).
| Project | Good for | License | Notes |
|---|---|---|---|
| PyOD | Large library of outlier detection algorithms with a common API | BSD-2-Clause | Version 3 adds agentic workflows; stick to the core detectors |
| ADBench | Benchmark comparing anomaly detectors across datasets (NeurIPS 2022) | BSD-2-Clause | Read before choosing a method |
| Alibi Detect | Outlier, adversarial and drift detection | BSL 1.1 (source-available since 2024) | Production use may need a commercial license |
| STUMPY | Matrix profile for time-series motif and discord discovery | BSD-3-Clause | Good for spotting repeated attack patterns in metric streams |
| Prophet | Seasonal forecasting for baselines (expected volume per hour) | MIT | Alert on residuals |
| Merlion (Salesforce) | Time-series anomaly detection and forecasting framework | BSD-3-Clause | |
| ADTK | Rule-based time-series anomaly detection | MPL-2.0 | Unmaintained since 2020 |
Image forensics, hashing and provenance
For Receipt Fraud (Cashback), Check and Mobile Deposit Fraud and document review. See Receipt and Document Image Forensics and Receipt and Purchase Verification.
| Project | Good for | License | Notes |
|---|---|---|---|
| ImageHash | Perceptual hashes (average, perceptual, difference, wavelet, color, crop-resistant) for near-duplicate detection | BSD-2-Clause | Duplicate and shared receipt detection across accounts |
| PDQ (in Meta's ThreatExchange repo) | Edit-tolerant 256-bit perceptual image hash with similarity matching; also TMK/vPDQ for video | BSD | Designed for large-scale matching |
| OpenCV | Image processing primitives (alignment, edge detection, OCR pre-processing) | Apache-2.0 | |
| scikit-image | Scientific image processing in Python | BSD-3-Clause | |
| Pillow | Image I/O and basic manipulation | MIT-CMU | |
| ExifTool | Reading image and PDF metadata | Perl Artistic / GPL | Metadata is easily stripped or forged. Treat it as a weak signal |
| Sherloq | Interactive digital image forensics workbench (error level analysis, noise, cloning) | GPL-3.0 | Research/education tool for reviewers, not an automated verdict |
| c2pa-rs (Content Authenticity Initiative) | Reading and validating C2PA Content Credentials | MIT / Apache-2.0 | Provenance is rare on receipts today; absence proves nothing |
Authentication and account-security building blocks
See Passkeys and Phishing-Resistant Authentication, Breached Password Detection and Bot Management and CAPTCHA.
| Project | Good for | License |
|---|---|---|
| SimpleWebAuthn (TypeScript) | Passkey/WebAuthn server and browser libraries | MIT |
| py_webauthn (Duo Labs) | WebAuthn in Python | BSD-3-Clause |
| PwnedPasswordsDownloader | Download the Pwned Passwords hash corpus for offline breached-password checks | BSD-3-Clause |
| zxcvbn-ts | Password strength estimation (maintained TypeScript port; original Dropbox zxcvbn unmaintained since 2017) | MIT |
| ALTCHA | Self-hosted proof-of-work challenge (CAPTCHA alternative) | MIT |
| Anubis | Proof-of-work reverse proxy against scraping bots | MIT |
| FingerprintJS (open-source) / ThumbmarkJS | Client-side browser fingerprinting libraries | MIT |
Notebooks and investigation workbench
| Project | Good for | License |
|---|---|---|
| JupyterLab / Jupyter Notebook | Standard analyst notebooks | BSD-3-Clause |
| marimo | Reactive, git-friendly Python notebooks that run as apps | Apache-2.0 |
| DFIR-IRIS | Collaborative incident response case management (security-oriented, adaptable for fraud war rooms) | LGPL-3.0 |
TheHive's open versions (3.x/4.x) are no longer distributed, and current TheHive is commercial. Don't build on old forks.
Learning datasets and simulators
| Project | Use | License | Notes |
|---|---|---|---|
| Fraud Detection Handbook (Le Borgne, Siblini, Lebichot, Bontempi) | Reproducible Machine Learning for Credit Card Fraud Detection: notebooks and simulated data | Code licensed; prose separately | Best free intro to time-aware validation |
| PaySim | Mobile-money transaction simulator | GPL-3.0 | Last updated 2021 |
| AMLSim (IBM) | Laundering-typology transaction graph simulator | Apache-2.0 | Last updated 2022 |
Choosing well
- License fit. GPL/AGPL in a networked product vs internal analytics. BSL and Elastic are not open source.
- Maintenance. Check last release, issue response and bus factor. Several projects here are archived or slowing (Kùzu, ADTK, LIME, DGL, Featureform).
- Security review. Treat packages as supply chain. Pin versions, scan dependencies, and never run untrusted notebooks against production data.
- Privacy. Self-hosting keeps data in-house, but PII rules still apply (Privacy and Data Use in Fraud Prevention).
- Model governance. OSS models are still models under your MRM policy (Model Risk Management).
Related
- Vendor Landscape · Reports and Data Sources · Fraud Data Architecture · Building a Fraud Program from Zero
Sources and further reading
Each project below was verified by cloning its public repository (last commit dates checked, late October 2026). Licenses were read from each repository's license file.
- neo4j/neo4j and neo4j/graph-data-science: Community Edition GPLv3; GDS plugin
- JanusGraph, Apache AGE, NebulaGraph, Memgraph, Kùzu (archived): graph databases
- NetworkX, python-igraph, cuGraph, PyTorch Geometric, DGL: graph analytics and GNNs
- Gephi, Cytoscape, PyGraphistry: graph visualization
- Splink, dedupe, Zingg: entity resolution
- libpostal, libphonenumber, disposable-email-domains: normalization and lists
- ZEN Engine, Drools (Apache KIE), Open Policy Agent, CEL spec, json-rules-engine: rules and policy engines
- Marble, Jube, Tazama docs: monitoring platforms
- Apache Kafka, Apache Flink, Feast, Featureform, Hopsworks, DuckDB, Polars, pandas, Great Expectations: data and feature tooling
- scikit-learn, XGBoost, LightGBM, CatBoost, imbalanced-learn, River, Optuna, MLflow: ML
- SHAP, InterpretML, LIME, Evidently, cleanlab, Label Studio: explainability, monitoring, labels
- PyOD, ADBench, Alibi Detect (BSL), STUMPY, Prophet, Merlion, ADTK: anomaly detection and time series
- ImageHash, ThreatExchange (PDQ/TMK/HMA), OpenCV, scikit-image, Pillow, ExifTool, Sherloq, c2pa-rs: image forensics and provenance
- SimpleWebAuthn, py_webauthn, PwnedPasswordsDownloader, zxcvbn-ts, ALTCHA, Anubis, FingerprintJS, ThumbmarkJS: authentication and bot-friction building blocks
- JupyterLab, Jupyter Notebook, marimo, DFIR-IRIS, TheHive (archived open versions): notebooks and case tooling
- Fraud Detection Handbook, PaySim, AMLSim: learning datasets and simulators
- C2PA Explainer: Content Credentials provenance model and its limits
- NIST SP 800-63B-4: blocklist and authenticator guidance relevant to password and passkey libraries