Using Grab’s Trust Counter Service to Detect Fraud Successfully

Summary

Grab's Trust Platform team built the Counter service to detect fraud across business verticals like transportation, food, and payments. The platform replaces manual, multi-week engineering cycles with a self-service UI where data analysts can define and experiment with counters independently. Operating on an asynchronous ingestion and synchronous transaction model, the architecture evaluates incoming stream data, enriches it via internal services, and persists aggregated signals to ScyllaDB through Grab-Stats. A multi-bucket strategy partitions queries into fifteen-minute, hourly, and daily granularities to maintain low-latency query aggregations across wide time ranges under strict SLAs.

Context

Conventional fraud rule creation required manual code changes, stream additions, and service redeployments taking two or more weeks per iteration, while lacking data consistency between offline machine learning models and real-time streams.

Approach / What changed

Grab built a self-service Counter service featuring a UI rule editor, stream-processing counter engines, an SDK communicating over gRPC, and ScyllaDB-backed storage utilizing pre-aggregated multi-granularity time buckets (15-minute, 1-hour, and 1-day).

Takeaways

• ScyllaDB was selected over in-memory stores like AWS ElastiCache because it was ten times cheaper, maintained equivalent stability, and achieved p99 read latencies under 150ms.
• Pre-aggregating event metrics into 15-minute, 1-hour, and 1-day buckets enables scalable querying across diverse time ranges without performing heavy on-the-fly database aggregations.
• The Counter service provides counter replay features across historical payloads to allow data scientists to evaluate and simulate new fraud features for machine learning pipelines.

Related reading

• Grab · Apr 28, 2022

  Graph Networks - Striking fraud syndicates in the dark

  Grab's Integrity team faced escalating threats from organized fraud syndicates operating device farms and GPS spoofing tools that mimic normal user behavior. To overcome the limitations of traditional rule-based systems, Grab built a Graph-based Prediction Platform that links entities across shared attributes to expose hidden network structures. The architecture includes a scalable graph database platform holding over one billion nodes, powering real-time graph visualization for analysts alongside a configurable network feature extraction system. In addition, the team deployed Graph Neural Networks to capture structural correlations across transaction networks. These systems collectively help detect coordinated promo abuse, payment fraud, and complex money laundering schemes.

  Muqi Li

• Grab · Jun 30, 2022

  Graph Networks - 10X investigation with Graph Visualisations

  Fraud detection traditionally required investigators to manually combine large datasets from disparate anti-fraud systems using statistical methods, which proved slow and inefficient. Grab built an interactive Graph Visualisation platform to transform raw records into connected visual maps without requiring manual queries or switching tools. The platform manages over three billion nodes and edges, allowing investigators to selectively expand data points and replay chronological events using temporal filters. Visual relationship mapping helps teams verify account appeals, uncover device-sharing rings, and spot anti-money laundering behavior through transaction density patterns.

  Fujiao Liu

• Grab · Nov 24, 2022

  Graph for fraud detection

  Rapid expansion across multiple business verticals introduced diverse, evolving fraud patterns at Grab, making traditional rule engines and decision trees inadequate due to their heavy reliance on extensive feature engineering and labeled data. To address cold starts and detect unknown fraud, the engineering team implemented a semi-supervised Relational Graph Convolutional Network (RGCN) across millions of connected ecosystem entities. The model propagates information along neighborhood nodes through graph convolutional layers to produce node embeddings and output fraud probabilities. Trained on graphs where only a small percentage of nodes are labeled, the RGCN achieved an AUROC close to 1 and distinctly separated fraudulent embeddings from genuine ones. The approach also offers high explainability by surfacing dense clusters of shared physical devices and addresses ongoing challenges in real-time prediction and noisy connections.

  Min Chen

• Grab · Jan 5, 2023

  Graph service platform

  Grab's GrabDefence team required a dedicated graph infrastructure to proactively identify mobile fraud patterns, such as multiple accounts operating on shared physical devices and suspicious financial loops. To address this, the team built a four-layer Platform as a Service that encapsulates graph database operations behind uniform RESTful APIs for OLTP search and OLAP analysis. The architecture utilizes Amazon S3 for raw data files, Amazon Neptune for graph storage, DynamoDB for schema and metadata configurations, and Kafka for streaming ingestion. When users trigger data loading tasks, the service validates entity attributes against schemas stored in DynamoDB before importing records into Neptune. This infrastructure allows investigators to traverse adjacent account IDs and visualize complex entity relationships without managing underlying database runtimes.

  Wenxiang Lu