Using Graph Databases for Fraud Detection in Ride‑Hailing Platforms

In ride‑hailing platforms, users and drivers can collude to abuse subsidies, a behavior often referred to as “羊毛党” (wool‑pulling). The article classifies such fraudsters into individual users, who can be detected with simple blacklist rules, and organized groups, which require more sophisticated analysis.

The technical background emphasizes the limitations of single‑dimensional data and proposes constructing a social‑network‑style knowledge graph that links users, drivers, devices, IPs, and other attributes. Graph databases such as Neo4j are chosen because they handle multi‑hop (2‑3 degree) queries far more efficiently than relational databases and allow flexible schema evolution.

By ingesting historical order data, SDK‑collected recent behavior, and blacklist information, two node types—users and drivers—are created, and various relationship types (shared device, same contact, similar IP, etc.) are established in Neo4j. Additional edges are added when recent behavior indicates a connection.

Detection rules are then applied: (1) if a user’s one‑ or two‑hop neighbors include known malicious entities, the user is flagged; (2) if the user belongs to a large connected sub‑graph with many nodes and edges, the user is considered high‑risk due to clustering of suspicious activity.

The solution demonstrates clear benefits: it surfaces clusters of subsidy‑abusing drivers and users, enables rapid identification of collusive behavior, and improves the platform’s ability to prevent financial loss.