Fraud never stops at one account: Use AI to find the hidden connections between your customers

We’ve spent years fighting fraud across the world, and one thing never changes: you catch one fraudulent account, and it’s connected to five more.

Most fraud and engineering teams know this firsthand. When they investigate, they often spend days of technical resources pulling data to find connected accounts, through data requests, log queries, and one-off scripts. But even the best teams have limited engineering time, so they usually just block the one or two initially fraudulent accounts and move on.

Often they don’t even know which connections to chase or what data to ask for. The ways accounts link to each other are a set of unknown unknowns: an email here, a device there, a bank account two hops away. You can’t query for a pattern you haven’t imagined yet.

And once you do have all the information and all the suspicious data points, it can take even more time just to make sense of them all and know the patterns. Archer’s AI doesn’t just find the patterns, it explains them in real time.

Visualize customer connections with cluster analysis

Cluster View maps it for you. Every connected account sits on one graph, with no data pulls and no engineering tickets. You see what links each account, and how, at a glance.

The connections aren’t limited to one or two signals. Accounts can be linked by:

• Shared personal information: email, national ID, next of kin, bank account, device
• Money moving between them
• Ultimately, any behavior or data point you collect on a customer

Here’s the cluster view. Your user is purple in the middle and is connected to your other users in green.

In one view you go from what looks like a single bad actor to a visible cluster of related accounts.

Data is different in emerging markets, and full of noise

Not every connection is signal. Take a shared IP address. In many emerging markets a shared IP can mean a coordinated fraud ring, or it can mean nothing at all. Whole neighborhoods, offices, and mobile networks sit behind a single IP: one ISP gateway, a shared router, or a public wifi network can put thousands of unrelated people on the same address. Treat that as a fraud signal on its own and you’ll drown in false positives.

The data itself behaves differently here. Even something as standardized as a national ID number is issued and obtained in ways that vary widely from one market to the next. A phone number isn’t always registered to the person who actually uses it. Each of these is a useful breadcrumb, but each carries noise.

That’s why Cluster View lets you filter. Deselect the connection types that are noisy for your market, and the real pattern sharpens.

Let AI explain the cluster and tell you what to do about it

The hardest clusters are the ones with the most connections. The worst fraud often hides in a web so dense that clicking through every node to understand it takes serious time and effort, exactly the work most teams don’t have the hours for.

That’s where Archer’s AI agent comes in. It reads the whole cluster and gives you an overview in seconds. It uses the full context of every account in the cluster to tell you what’s actually happening, whether that’s multi-accounting, identity reuse, or money laundering, and what to do about it.

Go beyond simply blocking shared devices

Most tools will already surface the obvious connections, like two accounts sharing a device, and many fintechs run rules to block multiple accounts on one device. That’s the tip of the iceberg.

Real fraud links accounts across far more than a device:

• Email, including fuzzy and near matches, not just exact ones
• National ID. The same ID number showing up on accounts opened under slightly different names is a deliberate trail, not a coincidence.
• Next of kin
• Bank account details

For business customers, the connections run deeper still. You can link companies through:

• Shared ultimate beneficial owners across supposedly unrelated businesses
• The name on a company’s bank account, and whether it matches another business in the cluster, or matches someone who received money from one of these businesses, a common laundering pattern
• References reused across multiple company accounts

Any one of these signals can look weak on its own. A single shared phone, one fuzzy email match, one shared next of kin, each is explainable in isolation. But the same few links connecting five accounts isn’t a coincidence, it’s one operation. Cluster View combines weak signals into one strong case.

When you’re not sure what a connection means, ask the agent about it. Click a node and it tells you what the connection is and whether it matches a known fraud pattern, so you don’t have to interpret every breadcrumb yourself.

Follow the flow of money

In general, connections by identity tell you accounts are related. Money movement shows you what they’re doing.

In Cluster View, the transactions between accounts are part of the same graph, and certain shapes give the fraud away.

The shared source. Several accounts that look unrelated are all funded from the same bank account, a pattern we see constantly with coordinated sign-ups.

The funnel. The reverse: a set of unrelated-looking accounts all sending money to a single bank account, concentrating funds that started out dispersed.

Cycling funds. Accounts cycling funds between themselves, paying each other in loops to manufacture the appearance of real activity and make fabricated accounts look like genuine customers.

A cluster can be stitched together by either thread. Sometimes accounts are linked by shared PII, sometimes by money moving between them. Often it’s both: half the cluster connected by PII, the other half by a bank transfer, until a string of seemingly unrelated accounts resolves into one operation. Each connection type pulls more of the picture together.

This is where the agent does its most valuable work. Ask it to summarize the cluster and it ties the connections and the money together, names the pattern, and tells you what to do next, for example freeze the destination account and escalate to a SAR.

Archer customers are already investigating clusters like this every day, turning what used to be days of manual data pulls into a few minutes on a single screen.

The AI agent inside Cluster View is one of several AI investigation tools we’re building to take the manual work out of fraud investigation.

If your team still investigates fraud manually today, see how Cluster View works on your own data. Book a demo.