- Collusion fraud hides in the links between accounts, so a model that scores each account alone misses it.
- H2O Driverless AI combines link features, such as shared devices, addresses and counterparties, with your own expert features in one model.
- Every flagged group comes with reason codes your investigators and model risk team can read.
- The scoring layer runs beside your existing fraud engine, so your rules and case process stay in place.
Each account looks normal on its own
A colluding buyer and seller can each pass every check your rules apply. The fraud only shows when you see that they share a device, pay each other in a loop, or were opened from the same address in the same week.
Transaction volumes and thresholds vary by market and season, so fixed limits either fire too often or not at all, and your investigators spend their time joining the dots by hand. When you act on a ring, you close several accounts at once, and you need evidence you can show to a customer, a regulator and your own model risk team.
How collusion fraud detection works
Step 1: Map who is connected to whom
Start with activity, accounts, addresses, device IDs, location data and payment counterparties. Build the links between them: shared devices, shared addresses, repeated counterparties and circular payment paths.
Step 2: Turn the links into features
Link counts, cluster sizes and how fast a group formed become model inputs. H2O Driverless AI adds automatic feature engineering on top, and custom recipes let your team bring its own connection-based features into the same experiment.
Step 3: Score accounts and groups
Classification models score each account in the context of its group, and clustering and anomaly detection surface groups that behave unlike your customer base. Reason codes show which links drove the score.
Step 4: Deploy, monitor and learn
H2O MLOps deploys the scoring pipeline, tracks drift and keeps an audit trail. Confirmed cases go back into training, so the model learns new ring patterns.
Where this fits your fraud program
Much of this fraud moves through accounts that look ordinary one by one, which is where link features help. The scoring layer sits underneath the fraud engine you already run, so your rules and case process do not change.