TrustCircles FraudShield (Mindrops ML) · How GNN catches what row-by-row ML misses
Multi-hop shell layering — 4 hops
Why traditional ML fails
Each shell-to-shell transfer looks like a normal inter-company payment. Individually: clean. But the GNN sees the 4-hop chain and recognises the layering topology.
GNN feature importance (SHAP)
Traditional ML score: 0.07 (missed)
GNN score: 0.89 (HIGH — escalated to Compliance Officer)
Circular transactions — money carousel
Why traditional ML fails
Each transaction is between existing account pairs with history. Row-by-row models see legitimate-looking bilateral activity. The GNN detects the cyclic graph topology — money returning to origin is the signal.
GNN feature importance (SHAP)
Traditional ML score: 0.12 (missed)
GNN score: 0.94 (HIGH — escalated to Compliance Officer)
Fan-out rapid dispersion — 1 source → 6 mules in 8 min
Why traditional ML fails
Each mule receives one payment that falls below thresholds. No single transaction is unusual. The GNN links all 6 via a shared device fingerprint edge — an attribute that isn't even a transaction.
GNN feature importance (SHAP)
Traditional ML score: 0.19 (missed)
GNN score: 0.97 (HIGH — account frozen immediately)
Smurfing — 5 feeders, all below €5k threshold → mule → offshore
Why traditional ML fails
Every feeder sends an amount individually below the €5,000 STR threshold. Five separate transactions — each clean. Traditional ML sees five low-risk payments. The GNN sees the star topology converging on one mule and the shared IP subnet linking all feeders as co-ordinated nodes.
GNN feature importance (SHAP)
Traditional ML score: 0.08 per txn (all missed)
GNN score: 0.91 (HIGH — EDD questionnaire triggered, SAR drafted)
PEP proximity clustering — funds reach politician via 3 proxies
Why traditional ML fails
The PEP (Politically Exposed Person) does not appear directly in any transaction. Traditional KYC only checks direct counterparties. The GNN computes PEP proximity distance across the graph — flagging any account within 3 hops of a known PEP node as elevated risk.
GNN feature importance (SHAP)
Traditional KYC/ML: PEP not found (missed)
GNN score: 0.93 (HIGH — EDD triggered, PEP declared, SAR filed)
Trade-based money laundering — invoice fraud across 3 entities
Why traditional ML fails
The bank only sees a legitimate trade payment — a large SWIFT transfer for an import invoice. There's no structuring, no velocity issue. The GNN links the exporter and freight company through a shared UBO (Ultimate Beneficial Owner) node in the entity graph, exposing the circular over-invoicing scheme.
GNN feature importance (SHAP)
Traditional ML score: 0.11 (missed — looked like trade)
GNN score: 0.88 (HIGH — TBML typology, SAR filed under AMLR Art.74)