Fraud ring

A coordinated group running the same attack across many accounts.

The accounts look unrelated one by one, but the people behind them share tools, details, and tactics, and they act together.

A cluster of linked fraudulent identities sharing devices, attributes, or behavioral patterns. A behavioral pattern is a repeated way of acting, such as the same sequence of steps or the same timing.

Fraud rings are usually found through the links between accounts:

• Shared devices, where the same device appears behind many accounts.
• Shared details, such as phone numbers, addresses, emails, or document numbers reused across applications.
• Shared behavior, such as identical typing patterns, timing, or navigation paths.
• Shared networks, such as accounts that all connect through the same addresses.

Detection typically works like this:

1. The system records attributes for every account.
2. It links accounts that share an attribute.
3. It looks for dense clusters of links that honest customers rarely produce.
4. Analysts review the cluster and act on the accounts together.

Fraud rings sit next to terms that are easy to mix up:

• Identity graph is the tool that maps the links between accounts.
• Device fingerprinting supplies the device identifiers that connect accounts.
• Duplicate detection finds repeat applicants, which can be one piece of a ring.