Graph Networks - Striking fraud syndicates in the dark

Summary

Grab's Integrity team faced escalating threats from organized fraud syndicates operating device farms and GPS spoofing tools that mimic normal user behavior. To overcome the limitations of traditional rule-based systems, Grab built a Graph-based Prediction Platform that links entities across shared attributes to expose hidden network structures. The architecture includes a scalable graph database platform holding over one billion nodes, powering real-time graph visualization for analysts alongside a configurable network feature extraction system. In addition, the team deployed Graph Neural Networks to capture structural correlations across transaction networks. These systems collectively help detect coordinated promo abuse, payment fraud, and complex money laundering schemes.

Context

Professional fraud syndicates using device farms and GPS spoofing apps camouflage as legitimate users, making them difficult to detect through traditional rule-based scoring systems.

Approach / What changed

Implementing a Graph-based Prediction Platform featuring a graph database with over one billion nodes, real-time visualization tools, a network-based feature engine, and Graph Neural Networks for anti-money laundering and fraud detection.

Takeaways

• Graph systems distinguish benign sharing patterns from large-scale syndicate operations by analyzing wider network connectivity rather than isolated entity pairs.
• Grab's Graph Database Platform stores over one billion nodes to power real-time visualizations across more than 10 feature dimensions and compute network metrics such as hop counts.
• Graph Neural Networks leverage structural correlations across transaction graphs to identify multi-stage money laundering and coordinated syndicate activity.

Related reading

• Grab · Apr 17, 2023

  Message Center - Redesigning the messaging experience on the Grab superapp

  Grab redesigned its messaging infrastructure from GrabChat to Message Center to overcome two-party chat limitations and support complex superapp requirements like group conversations and varied user roles. The architecture separates core processing logic from message delivery by splitting the system into a backend processor and an independently scalable postman service. Communication relies on an in-house TCP gateway named Hermes that proxies client payloads via gRPC, alongside Apache Kafka streams and Amazon SQS delay queues. Custom client-server acknowledgements and a DynamoDB event store ensure reliable message delivery even across dropped mobile TCP connections and offline reconnects.

  Jonathan Lee

• Grab · Nov 17, 2023

  Road localisation in GrabMaps

  Grab needed to localise nearly 30 million road segments across more than 10,000 area boundaries in Southeast Asia to attach hyperlocal attributes like language, driving side, and vehicle access rules. Testing direct geometric inclusion between complex road polylines and boundary polygons proved computationally prohibitive for daily map generation pipelines. To optimize this process, Grab introduced geohashes as rectangular proxies, precomputing geohash coverage across borders and road segments before joining the datasets in parallel. To resolve misclassification errors near borders without sacrificing performance, the team evaluated geohash coverage percentages and refined boundary-touching geohashes with polygon clipping. A laptop benchmark on a subset of data reduced runtime from 38 minutes with geometric intersection to 78 seconds using the geohash approximation.

  Roxana Crisan

• Grab · Jun 1, 2023

  PII masking for privacy-grade machine learning

  Data engineers at Grab require real-world streaming data to tune machine learning models, but user personal data cannot be exposed in non-production environments. To solve this, the data streaming team implemented an automated masking pipeline between production and staging Kafka clusters. Developers explicitly tag Personally Identifiable Information (PII) types in Protocol Buffers schemas, which a CI script validates against a keyword list before packaging the schemas into Scala JARs. An in-house Apache Flink application running in production consumes the unmasked streams, applies dynamic and consistent transformations like keyed HMACs or seeded random values, and produces sanitised records to staging. Untagged new fields in schema updates are automatically dropped by the deserialiser until the masking application is redeployed, preventing accidental data leaks.

  Fabrice Harbulot

• Grab · Oct 21, 2019

  Using Grab’s Trust Counter Service to Detect Fraud Successfully

  Grab's Trust Platform team built the Counter service to detect fraud across business verticals like transportation, food, and payments. The platform replaces manual, multi-week engineering cycles with a self-service UI where data analysts can define and experiment with counters independently. Operating on an asynchronous ingestion and synchronous transaction model, the architecture evaluates incoming stream data, enriches it via internal services, and persists aggregated signals to ScyllaDB through Grab-Stats. A multi-bucket strategy partitions queries into fifteen-minute, hourly, and daily granularities to maintain low-latency query aggregations across wide time ranges under strict SLAs.

  Chao Wang