Detection, Attribution, Narration: An End-to-End Pipeline for Explainable Money Mule Identification
2026-07-20 • Cryptography and Security
Cryptography and SecurityArtificial IntelligenceMachine Learning
AI summaryⓘ
The authors developed a method to detect money mule accounts, which help criminals commit financial fraud. Their system uses a machine learning model with many features from transaction data and account details, then explains its decisions using a way to show which factors mattered most. They also use a language model to turn these explanations into easy-to-understand summaries for human analysts. This new system found more fraud cases than older rule-based methods and helped reduce the analysts' workload. The authors also discuss how adding such explainability tools works in regulated financial settings.
money mule accountsfinancial fraud detectionLightGBMTreeSHAPlarge language modelsfeature attributionmachine learning explainabilityrule-based systemfinancial regulationalert triage
Authors
Yuge Zhang, Yuanxing Zhang, Yichao Jin, Khairul Amsyar Mohd Razis, Nicholas Qi An Choo, Kai Yin Anders Wong, Xinyan Tang, Kenneth Zhu Ke, Wee Keong Dennis Lee, Jingyuan Zhao
Abstract
Money mule accounts are critical facilitators of financial fraud, yet detecting them at scale remains challenging due to the heterogeneous nature of transactional and behavioural data. We present an end-to-end pipeline for customer-level mule detection comprising three stages: (1) a LightGBM classifier trained on 280 engineered features spanning transaction patterns, account demographics, network topology, and temporal behaviour; (2) a TreeSHAP attribution layer that decomposes each prediction into feature contributions; and (3) a large language model (LLM) module that converts SHAP attributions into analyst-facing natural-language narratives. We evaluate across three open-weight LLM families and assess explanation quality through analyst feedback. In a live production deployment, the system achieves a yield rate of 89%, up from 61% under the incumbent rule-based system, with monthly alert volume expanding from 211 to 302, reflecting broader true-positive coverage rather than increased noise. This corresponds to a 60% incremental adverse detection beyond existing review workflows, substantially outperforming the rule-based approach. Qualitative feedback from analysts indicates that LLM-generated narratives reduce cognitive load during alert triage. We further discuss implications of deploying LLM-augmented explainability in regulated financial environments.