"title": "SYNAPSE: Autonomous Money Mule Investigation Agent", "overview": "Financial fraud rarely looks suspicious from a single transaction. A small transfer can look completely normal on its own, but when money moves rapidly through several accounts, a much bigger pattern can appear. That was the idea behind SYNAPSE. We wanted to build something that doesn't just say "this transaction looks suspicious," but actually helps an investigator understand what is happening, how the money is moving, and why an account deserves attention. We were especially interested in money mule networks because they can involve many ordinary-looking transactions spread across multiple accounts. We thought an AI agent could help connect these individual signals and turn them into an understandable investigation. Our goal became simple: Don't just detect suspicious activity. Investigate it.", "what_it_does": "SYNAPSE is an autonomous money mule investigation agent. A user can provide a transaction dataset and start an investigation. Instead of manually running different analyses, SYNAPSE coordinates the investigation and brings together several sources of evidence. It can analyze transaction behavior and account activity, use a machine learning model to identify high-risk accounts, build and analyze transaction networks, detect suspicious money-flow patterns and multi-hop transfers, use Benford's Law as an additional statistical anomaly signal, combine different risk signals into an explainable assessment, identify suspicious accounts and networks for further investigation, use Gemini to reason over the collected evidence, and generate an investigation summary and report. The important part is that Gemini isn't being used as a replacement for the underlying analysis. It acts as the investigator and orchestrator, while the ML, graph, and statistical components provide the actual evidence.", "how_we_built_it": "We started with transaction-level analysis and a Random Forest model for risk prediction. We then expanded the system so that suspicious activity could be viewed as a network rather than isolated transactions. The architecture is built around an investigation agent that can use specialized tools: Gemini coordinates the Investigation Agent, which interacts with the ML Risk Tool, Graph Analysis, and Benford Analysis. These feed into Evidence Fusion to produce the Investigation Report. The ML component looks at behavioral features such as transaction frequency, transaction amounts, counterparties, and money movement patterns. The graph engine represents accounts as nodes and transactions as directed edges, allowing SYNAPSE to look for patterns that are difficult to see in a normal table. We also incorporated Benford's Law as an additional anomaly signal. Gemini then coordinates these capabilities, interprets the structured results, and produces an investigation that is easier for a human to understand. We also designed the system around Google Cloud infrastructure so that the agent can operate as a deployable application rather than just a local prototype.", "challenges": "One of our biggest challenges was figuring out how to make the project genuinely agentic. It would have been easy to put a chatbot on top of our existing ML model and call it an AI agent, but we wanted the agent to actually do things. That meant creating separate tools, giving the agent access to those tools, maintaining investigation state, handling failures, and making sure the final explanation was based on actual results rather than something the model simply invented. Another challenge was combining different types of analysis while keeping the final risk assessment explainable. We also had to think carefully about responsible AI: a high-risk score should never mean "this person is guilty." SYNAPSE is designed to identify patterns that require further investigation, not make accusations. Finally, turning everything into a clean, reliable product instead of a collection of separate ML experiments was a challenge in itself.", "accomplishments": "We're most proud of turning a traditional fraud-detection pipeline into an autonomous investigation workflow, moving seamlessly from transactions to risk analysis, graph investigation, anomaly detection, evidence fusion, and the final investigation report. We're also proud of the network-analysis component, which makes patterns much easier to understand than looking at thousands of rows in a spreadsheet. Another accomplishment is the explainability of the system, showing the specific signals that contributed to an account's risk assessment and giving investigators clear context. Most importantly, we built the project with the idea that AI should assist investigators, not replace their judgment.", "what_we_learned": "This project taught us that building an agent is very different from simply adding an LLM to an application. The hardest part isn't getting a model to generate text; it is designing what the model can do, what information it can trust, which tools it should use, and how its decisions can be verified. We also learned how powerful graph-based thinking can be for financial data, turning ordinary-looking transactions into revealing networks. On the ML side, we learned that a model's prediction becomes much more useful when combined with independent signals. And perhaps the biggest lesson was that a good AI system needs boundaries, especially in a sensitive domain like financial crime where accuracy and explainability matter just as much as intelligence.", "whats_next": "SYNAPSE is currently focused on transaction-based money mule investigation, but we see it becoming a much broader financial intelligence platform. Next, we would like to explore real-time transaction monitoring, streaming investigation with event-driven architecture, more advanced graph-based money-flow detection, temporal analysis of suspicious networks, investigator feedback loops, better case management and collaboration, integration with additional financial-risk signals, and continuous learning from confirmed investigation outcomes. Our long-term vision is for SYNAPSE to become an intelligent investigation assistant that can continuously monitor financial activity, connect weak signals across large transaction networks, and help investigators focus their attention where it matters most. SYNAPSE isn't trying to replace the investigator. It's trying to help the investigator see the connections that are easy to miss."

Built With

• adk
• agentic
• agents
• ai
• analysis
• cloud
• data
• fastapi
• financial
• firestore
• fraud
• gemini
• generative
• google
• graph
• javascript
• machine
• networkx
• python
• react
• run
• vertex