Team Rocket

Inspiration

Online gambling platforms process millions of transactions daily, yet investigators still rely on basic alert queues and manual spreadsheet triage. OLG's challenge highlighted a real gap: investigators need tools that explain why someone is flagged, not just that they were flagged. We were inspired by how copilot-style AI is transforming other compliance domains (banking AML, cybersecurity SOCs) and wanted to bring that same paradigm to player protection — where the stakes are both financial and deeply personal, since problem gambling affects real lives.

What it does

VIGIL is an AI-powered investigation copilot for OLG that brings together four capabilities in one interface:

Risk Dashboard — A real-time overview of all monitored players, with composite risk scores (0–100) computed from six weighted factors: income consistency, behavioral velocity, geographic anomalies, session patterns, network risk, and account age. A boost mechanism ensures no single critical signal gets diluted by low averages.
Player Deep Dive — Click any player to see their full profile, radar chart of risk factors, transaction history, and a one-click AI-generated case brief that summarizes the evidence in investigator-ready language.
Network Graph — A force-directed visualization that maps connections between players via shared IPs, referral chains, device fingerprints, and behavioral similarity. Node size reflects risk score; edge color encodes connection type. This is how we surface fraud rings that individual alerts would miss.
AI Investigation Chat — Investigators can ask questions in plain English ("Which players have deposits exceeding 3x their monthly income?" or "Show me everyone connected to David Okafor") and get data-backed answers with specific numbers, dates, and risk scores cited.

Five realistic fraud scenarios are built into the demo: income inconsistency, behavioral shift, a coordinated fraud ring, geographic anomalies, and a self-exclusion bypass.

How we built it

Next.js 16 (App Router) as the full-stack framework, with server components for data-heavy pages and client components for interactive visualizations
TypeScript end-to-end for type safety across the risk engine, API routes, and UI
Custom risk scoring engine — We wrote a deterministic scoring algorithm from scratch with six factor calculators, each tuned with threshold curves (not simple if/else). The overall score uses weighted aggregation plus a boost mechanism that elevates the composite when any single factor is critically high or multiple factors are elevated simultaneously.
Synthetic data generator — A seeded PRNG produces 50 players with realistic Ontario demographics, 1,000+ transactions over 6 months, and five intentionally planted fraud scenarios. Deterministic seeding means every demo run shows the same data.
react-force-graph-2d for the network visualization with custom canvas rendering (glow effects, dynamic node sizing)
Recharts for dashboard charts, radar plots, and bar charts
OpenAI GPT-4o with streaming responses for the investigation chat and one-click case brief generation. The system prompt injects the full player database so the model can cite real numbers.
Tailwind CSS v4 + shadcn/ui for a cohesive dark-themed investigator interface

Challenges we ran into

Tuning the risk engine was harder than expected. Early versions either flagged everyone (too aggressive) or missed obvious fraud (too lenient). We iterated on the threshold curves and added the boost mechanism after realizing that a weighted average alone could hide a single critically high factor behind five low ones.
Network risk creates a circular dependency — you need risk scores to compute network risk, but network risk is part of the score. We solved this with a two-pass computation: calculate individual factors first, then inject network risk in a second pass.
Balancing synthetic data realism — The demo needed to be convincing enough for judges while keeping the fraud patterns clearly detectable. We hand-crafted five scenario players with specific transaction patterns, then generated 36 normal players and 6 borderline players to populate the risk distribution naturally.
Force-directed graph performance — Rendering 50 nodes with multiple connection types, animated particles, and custom canvas objects required careful optimization of the cooldown, particle count, and node rendering pipeline.

Accomplishments that we're proud of

The risk engine is genuinely sophisticated — Six weighted factors with continuous threshold curves, a multi-condition boost mechanism, and a two-pass network-aware computation. It's not a toy scoring system.
The fraud ring detection actually works — The Okafor network (P-003, P-004, P-005) lights up immediately on the graph with shared IPs, referral chains, and coordinated deposit timing all visible at a glance.
Case briefs in one click — An investigator can go from a flagged player to a written, evidence-backed case summary in seconds. That's a workflow that typically takes hours.
Self-exclusion bypass detection — The system catches "R. Thomson" as a likely alias for the self-excluded "Robert Thompson" through shared IP, similar name, matching city, and near-identical date of birth — the kind of subtle pattern that's easy to miss manually.
Everything runs in a single Next.js app — No microservices, no external databases, no infrastructure setup. Clone, add an API key, and you have a working investigation platform.

What we learned

Domain modeling matters more than flashy UI — The hours spent understanding how AML investigators actually work (alert triage, evidence gathering, case documentation) paid off more than any visual polish. Building the right risk factors and threshold curves required reading FINTRAC guidelines and understanding structuring patterns.
AI is most useful when it has context — The chat feature isn't just GPT in a box. It works because we inject the full player database, risk scores, alerts, and connections into the system prompt. Generic AI without domain context would give generic answers.
Composite scoring is deceptively hard — A simple weighted average sounds straightforward, but edge cases (one extreme factor, multiple moderate factors, new accounts with sparse data) all require special handling. The boost mechanism was a key insight.
Synthetic data is an underrated skill — Creating data that tells a compelling story while remaining statistically plausible took significant effort. Every scenario player has a backstory embedded in their data.

What's next for VIGIL

Real-time streaming ingestion — Replace the static synthetic dataset with a live transaction pipeline (Kafka or WebSocket) so investigators see alerts as they happen, not on refresh.
Graph-based anomaly detection — Use community detection algorithms (Louvain, label propagation) to automatically identify fraud clusters instead of relying on predefined connection types.
Case management workflow — Add assignment, status tracking, notes, and audit trails so VIGIL becomes a full investigation platform, not just a detection tool.
Explainable AI reports — Generate PDF-ready investigation reports with evidence chains, timeline visualizations, and regulatory citations (FINTRAC STR requirements) that compliance teams can file directly.
Player behavior forecasting — Use historical patterns to predict which currently-medium-risk players are likely to escalate, allowing proactive intervention before harm occurs.
Integration with OLG systems — Connect to real KYC/identity verification, self-exclusion registries (iGO), and payment processors to move from demo to production.