Money‑mule networks move illicit funds through many tiny transfers, each of which looks ordinary in isolation. What truly identifies a mule account lies beyond any single transfer—it is the set of counterparties, shared addresses, and the temporal shape of its activity. Production systems are largely rule‑based and miss these global cues; most research classifies transactions and only later aggregates risk to the account level. We score accounts directly by treating the bank's relational schema as a heterogeneous graph where rows become nodes and foreign keys become edges. Each account receives a score from its multi‑hop neighbourhood using per‑column encoders, a relative‑time encoding, and HeteroGraphSAGE message passing. The neighbourhood is limited to rows predating the account's pre‑flag cutoff, ensuring the model never sees evidence recorded after the flagging event. Experiments on a five‑year RBIH retail‑banking dataset comprising 400 million transactions and 94,063 labelled accounts (2.6% confirmed mules) compare our detector against RelGNN, XGBoost, LightGBM and CatBoost trained on identical labels, splits and cutoffs. Our model recovers nine out of ten held‑out mules at 83% precision with a 0.5% false‑alarm rate, uncovering 115 more mules than the strongest tree ensemble given the same evidence. At tuned thresholds the gap is mainly in recall: XGBoost and LightGBM lead in the first hundred alerts, but only the graph models maintain precision deep into the queue. Because the graph is the schema itself and each score is timestamped per account, the approach can be deployed on a bank's existing database without building a custom feature graph.
Review