Mule Account Detection with Graph Machine Learning for Mobile Wallets
Build a simulator of a mobile wallet payment network with realistic scam and mule account patterns, then train and compare graph machine learning models that flag accounts used to collect and move stolen money. Scam proceeds in Pakistan often pass through chains of wallet accounts opened with borrowed or bought identities. Rules catch known patterns; the project tests whether learning from the shape of the money flow catches more, and explains each flag to an analyst.
Intermediate
A small team, or one strong student willing to learn something new.1 semester · 2 students
7 to ship
4 optional extrasSuggested stack
What you should ship
- A transaction simulator with normal customers, merchants, salary and remittance flows, and injected scam patterns such as fan-in, rapid pass-through and cash-out chains
- Baselines: hand-written rules and a gradient boosted model on per-account features
- A graph neural network that uses the transaction graph, trained over time windows
- The same models run on the public Elliptic dataset to check that results are not an artefact of your simulator
- Explanations for each flagged account: the transactions and neighbours that drove the score
- An analyst screen showing the flagged account, its money flow graph and the explanation
- An evaluation of precision at a fixed alert budget and detection delay
If you have time left
- Simulating how criminals adapt when one pattern is blocked
- Combining device and sign-up signals with the graph
- Running the model incrementally as new transactions arrive
- A fairness check that flags do not concentrate on a region or customer type without cause
The problem: money that moves too fast to follow
When someone is scammed in Pakistan, the money usually goes into a mobile wallet or bank account that is not the scammer's own. These mule accounts, opened with borrowed, bought or stolen identities, receive money from many victims and pass it on within minutes through other accounts until it is withdrawn. By the time a complaint arrives, the trail runs through several accounts.
Each transaction on its own looks ordinary. The pattern only shows in the network: many unrelated senders paying into a new account, which immediately forwards everything onward. Fraud teams at small fintechs and wallets have rules for known patterns, but criminals adjust quickly. Tighten one rule and the mules spread money across more accounts, wait longer before forwarding or mix in ordinary-looking payments. A useful model has to recognise the shape of the network, not one threshold, and it has to explain itself to the analyst who must decide whether to freeze an account.
What already exists and the gap
- Transaction monitoring systems sold to banks combine rules and machine learning, priced and built for large institutions.
- Rules engines inside fintechs catch known patterns, such as many incoming payments followed by a quick cash-out.
- Research on graph learning for financial crime uses public datasets, mostly from cryptocurrency, because real bank data is private.
The gap for a student team is not data access, which you will not get, but a careful, reproducible study: a realistic simulated wallet network, rules and models compared honestly, and explanations an analyst can act on.
Inspiration
"Anti-Money Laundering in Bitcoin: Experimenting with Graph Convolutional Networks for Financial Forensics" by Mark Weber, Giacomo Domeniconi, Jie Chen and colleagues, presented at the KDD 2019 Workshop on Anomaly Detection in Finance, released the Elliptic dataset of over 200,000 Bitcoin transactions with labels, and compared graph convolutional networks with classic models. Your project applies the same comparison to a simulated mobile wallet network and checks results on Elliptic.
What you build
- Fraud analysts at a wallet or small bank see a ranked list of suspicious accounts, each with a money flow graph and a plain explanation.
- Data scientists get an open simulator and benchmark to test their own models.
- Students and researchers learn graph machine learning on a problem that matters locally.
The analyst screen matters as much as the model. An alert that says "score 0.93" is ignored; an alert that shows "received from 41 unrelated senders in 2 hours, forwarded 98 percent within 10 minutes to 3 accounts" gets investigated.
The technically interesting part
- Building a believable simulator. Normal behaviour must be varied: salaries, family transfers, shop payments, bill payments, remittances. Scam patterns must be varied too, and adapt. Document every assumption.
- Time. Train on earlier windows and test on later ones. Random splits leak future information and inflate results.
- Class imbalance and alert budgets. Fraud teams can review only so many alerts a day. Measure precision within that budget rather than overall accuracy.
- Explanations. Use graph explanation methods or simple feature attributions, and check by hand that explanations match the injected pattern.
How to evaluate it
- Precision at a fixed number of alerts per day for rules, the feature-based model and the graph model.
- Detection delay: how many transactions a mule account makes before it is flagged.
- Generalisation: train on some scam patterns, test on a held-out pattern.
- External check: results on the Elliptic dataset compared with the published paper.
- Explanation quality: share of explanations that point to the real injected behaviour.
- Adaptation test: after changing a scam pattern slightly, such as slower forwarding, how much each method's precision drops.
Suggested plan
- Weeks 1 to 3: read the paper, run the Elliptic baselines.
- Weeks 4 to 7: the simulator and its documentation.
- Weeks 8 to 10: rules, feature model and graph model with time-based splits.
- Weeks 11 to 13: explanations, the analyst screen and evaluation.
- Weeks 14 to 15: report and demo.
Path to a product
Wallets, microfinance banks and payment companies all face mule accounts and many cannot afford large monitoring systems. A model and analyst tool they can run on their own data, with the simulator for testing, is a credible offering. The project is a strong portfolio piece for fraud, risk and data science roles in fintech.
Scope warning
Do not try to obtain real customer transaction data. Do not claim results from simulated data will transfer directly to a real wallet; say what would need to be checked. Keep the model's role to ranking alerts for human review, never blocking accounts automatically.
Learn what you need on Sefism
- Machine learning roadmap: imbalanced classification and time-based evaluation.
- Data science roadmap: simulation, features and honest analysis.
- PyTorch: Learn the Basics: the base for graph neural network libraries.
- scikit-learn User Guide: baselines and evaluation metrics.
- Streamlit Documentation: the analyst screen.
Get help with this idea
The risk is a simulator so simple that any model wins. Tauseef can help you design realistic patterns, set up time-based evaluation and present results honestly. If you are new here, create a free account first.
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
Not sure this one fits you?
I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
Follow along
New writing, resources and project ideas land here first.