Link analysis in fraud detection: from single events to fraud rings
Link analysis in fraud detection connects events that share an identifier, such as a device, email, phone, card, address or IP. Single payments can look clean while the network around them shows a ring of fake accounts or repeat disputers. Turning those links into risk signals lets you score new events by who and what they are connected to.
Updated · RiskCogs team
Key facts
- Link analysis treats accounts, devices, cards and addresses as nodes joined by shared use.
- Fraud rings often reuse a small set of devices, payment methods or addresses.
- Links are signals, not proof; shared Wi-Fi or family devices are normal.
- Graph features work best inside a score, next to device and velocity signals.
What link analysis is
Link analysis maps relationships. Each account, device, card, email, phone, address and IP is a node, and a shared use creates a link. Clusters of links reveal groups acting together.
In payments and account security it is used to find multi-accounting, promo farming, mule networks and repeat chargeback abusers.
Useful links to track
- Device ID shared across accounts.
- Card or BIN plus last four digits shared across accounts.
- Delivery address or phone reused with different names.
- Email patterns such as plus-addressing or numbered variants.
- IP or subnet shared by many new signups in a short time.
Turning links into decisions
- Count links per entity, for example accounts per device.
- Mark entities connected to confirmed fraud or chargebacks.
- Score new events higher when they connect to marked entities.
- Review clusters manually before bulk actions.
- Test thresholds in shadow mode against real outcomes.
Common pitfalls
- Treating shared household devices as fraud.
- Blocking whole carrier or corporate IP ranges.
- Building graphs that nobody reviews.
- Keeping data longer than your privacy policy allows.
From a link to a rule you can defend
Shared devices can be a household, a workplace, or a fraud ring. Link analysis should feed review queues and shadow rules — not instant global blocks on every match. Start with observe shared device across N new accounts in 7 days, measure precision, then promote.
RiskCogs links events by device, account, card BIN and IP and shows those connections next to the score reasons. It does not claim SEON/Sift-scale proprietary network graphs. For buyer framing see the SEON alternatives and Sift alternatives comparison pages on this site.
How RiskCogs uses links
RiskCogs links events by device, account, card BIN and IP, and uses those links as reasons inside each risk score. Linked accounts with earlier chargebacks or abuse raise the score so you can review or step up.
Rules built on links can run in shadow mode first. RiskCogs is a risk scoring layer next to your payment provider. It does not process payments and does not file or fight disputes for you. See the pricing page for plans.
See what you would have blocked — free shadow modeFrequently asked questions
What is link analysis in fraud detection?
It is a method that connects accounts, devices, cards, emails, addresses and IPs through shared use, then looks for clusters. A group of accounts sharing one device and card, for example, can reveal a fraud ring that single-event checks miss.
What data do you need for link analysis?
Stable identifiers collected with consent: device IDs, hashed emails and phones, card fingerprints or BIN plus last four, normalised addresses and IPs. Consistent formats matter more than volume, because a link only works if the same value is recognised each time.
Is a shared device always a sign of fraud?
No. Families, shared computers, offices and public networks create normal links. Treat links as risk signals inside a score, look at what the linked accounts did, and review clusters before taking bulk action.
How is link analysis different from device fingerprinting?
Device fingerprinting creates a stable identifier for a device. Link analysis uses that identifier, along with emails, cards and addresses, to connect accounts and events. Fingerprinting supplies a node; link analysis studies the network between nodes.
Sources and related reading
- Ahrefs Keywords Explorer, United States, 2026-11-05 (queries: link analysis fraud; link analysis fraud detection).