iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
CaseGuard is a hackathon project proposing a fraud-investigation workflow built around TigerGraph and GSQL: graph queries produce structured evidence, while an agentic layer assesses uncertainty, seeks more evidence when needed, and recommends actions subject to human approval controls. Its authors describe an architecture and report benchmark results; the available accounts do not establish that it is a proven production fraud platform.
What CaseGuard is—and what it is not
Kanhaiya Kumar’s September 23, 2026 project account presents CaseGuard as a fraud investigation agent using TigerGraph, GSQL analytics, and a cyclic LangGraph state machine. A second account by Sanskreeti Meshram, posted September 24, 2026, describes the project’s broader alert-to-action flow. Both are project-authored descriptions, not independent evaluations.
The project’s central reframing is not simply “Is this transaction fraud?” but “What evidence do we have, what don’t we know, and what should we do next?” Kumar describes the goal as “An investigator that knows what it doesn’t know.” Meshram states the principle as “If the system isn’t confident, it shouldn’t guess.” These are the authors’ design aims, not evidence of improved fraud outcomes.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How the proposed investigation flow works
The accounts describe an iterative process: an alert is analyzed against graph data, patterns are detected, uncertainty is assessed, and the system either recommends an action or seeks more evidence. Kumar’s account gives the more detailed state sequence; Meshram’s account adds GraphRAG policy grounding and SAR generation to its summary.
#1 Best Overall
- Triage the alert. The agent frames graph-backed hypotheses about the transaction or account.
- Query and detect patterns. GSQL performs graph traversal and pattern detection, returning structured results for the agent to interpret.
- Assess confidence and contradictions. A multi-factor score is used to decide whether the current evidence is sufficient.
- Gather additional evidence if needed. Kumar’s account describes mock step-up authentication or customer transaction pings, followed by a score recalculation after validation.
- Recommend an action and apply approval controls. The workflow distinguishes non-invasive steps from higher-impact actions routed to people for approval.
- Persist closed cases. The design links resolved cases to similar prior cases in TigerGraph, creating case memory for later investigations.
The architecture described by Kumar includes a Streamlit dashboard with a case timeline, evidence lineage, and approval queue; a LangGraph loop for triage, evidence gathering, pattern detection, case memory, and action recommendation; and TigerGraph stores for transaction topology, GSQL detectors, case memory, and a GraphRAG policy store. These are elements in the submission’s architecture description, not independently inspected implementation artifacts.
Where graph analysis ends and the agent begins
The authors assign deterministic graph analysis to GSQL and interpretation of its structured evidence to the agentic layer. Kumar says GSQL performs all graph traversal and pattern detection. The LLM is therefore described as reasoning over query results rather than replacing the graph-query layer.
The second project account describes graph entities including customers, cards, transactions, device profiles, billing regions, closed cases, and investigation cases. Edges such as OWNS, MADE, FROM_DEVICE, BILLED_IN, and INVOLVES connect these entities. This structure is intended to expose relationships that are difficult to assess from a transaction record in isolation.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #2
What kinds of patterns the project targets
The two accounts name overlapping but not identical detectors. Kumar lists GSQL query files and their described behaviors; Meshram names additional detection patterns and examples.
| Detector or example | Behavior described by the project | Account |
|---|---|---|
detect_device_sharing.gsql |
Finds device fingerprints associated with multiple cards or identities. | Kumar, September 23, 2026 |
detect_velocity_burst.gsql |
Aggregates transaction velocity to identify bursts. | Kumar, September 23, 2026 |
detect_mule_chain.gsql |
Traces multi-hop pass-through accounts. | Kumar, September 23, 2026 |
detect_addr_mismatch.gsql |
Compares billing or shipping address and device signals. | Kumar, September 23, 2026 |
card_window |
Looks for rapid micro-authorizations followed by larger spending. | Meshram, September 24, 2026 |
device_neighbors |
Examines shared-device relationships. | Meshram, September 24, 2026 |
region_burst |
Looks for activity outside a cardholder’s historical geography. | Meshram, September 24, 2026 |
Meshram also cites a benchmark-case example in which 52 customer cards were linked to one Android device in case HHG-014. That is an example reported by the project author, not independently corroborated benchmark evidence.
How the uncertainty gate is described
Kumar gives the following confidence formula:
Confidence = w1 · GraphSupport + w2 · HistoricalRate + w3 · SignalStrength + w4 · EvidenceCoverage − Penalty_contradiction
Rank #3
- Used Book in Good Condition
The stated weights are 0.35 for graph support, 0.25 for historical rate, 0.25 for signal strength, and 0.15 for evidence coverage. The contradiction penalty is intended to account for signals resembling previously cleared legitimate cases. Although the account calls the formula calibrated, it does not provide calibration data or validation details.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesIn Kumar’s account, a score below 0.60 triggers an initial next-best action such as monitor_account plus request_step_up_auth, a mock evidence-gathering step, and recalculation after user validation. Meshram separately gives examples of pre-evidence recommendations such as ALLOW + VERIFY_WITH_CUSTOMER or DECLINE + STEP_UP_AUTH, and post-evidence actions such as BLOCK_CARD, CREATE_CASE, and FILE_REPORT. These are descriptions from separate project accounts, not a single verified policy specification.
Human approval and proposed safeguards
Kumar’s account says the project automatically handles non-invasive actions—request_step_up_auth, warn_customer, and monitor_account—while routing block_transaction, block_account, and file_SAR as pending approvals for L1/L2 analysts or compliance officers. This is the project’s stated governance logic, not a guarantee of effective oversight or regulatory compliance.
The same account says SAR narratives follow FinCEN standard formatting when transaction volume exceeds $5,000 or mule-laundering patterns are detected. That is an implementation claim from the project account, not a general legal reporting rule or a substitute for an institution’s regulated reporting procedures.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the reported scale and benchmark establish
Kumar’s 2026 submission reports a dataset of approximately 590,000 transactions and 13,500 customers. The counts are attributed to that project account and are not independently audited. The submission also describes precompiled GSQL queries as running in “sub-millisecond” time; this is an unverified project claim, not a general TigerGraph performance result.
Meshram’s 2026 account says CaseGuard was evaluated against 20 official Hacker House Goa benchmark cases and reports 100% schema and policy compliance. The reviewed project accounts do not provide independent test reports, reproducible benchmark methods, an external audit, or production deployment measurements. They also do not report measured false-positive or false-negative rates. The benchmark figure should therefore be read as a project-reported result, not independent proof of accuracy or operational effectiveness.
Case memory and proposed future work
The project describes persisting closed cases in TigerGraph and linking them to similar earlier cases to build a historical audit trail. Meshram gives an example in which prior legitimate travel history helped clear an out-of-region alert. These are design descriptions and an illustrative case, not measured evidence that case memory reduces error rates.
Future additions named in the accounts include automated Louvain community detection, real-time streaming with Kafka or Redpanda, community detection using Louvain or WCC, and an interactive analyst copilot. The authors describe these as future work rather than established capabilities.
How to assess the design
CaseGuard’s proposal is most usefully assessed as a set of architectural choices, not as a demonstrated fraud product. When comparing it with another investigation system, examine:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
- Whether graph traversal and pattern detection are deterministic queries or left to a language model.
- How uncertainty is represented, and whether low confidence triggers evidence gathering rather than a forced decision.
- Whether evidence is traceable from source data through analysis to the recommended action.
- Which actions may execute automatically and which require analyst or compliance approval.
- Whether closed-case history is linked into later investigations, and how conflicting or outdated cases are handled.
- Whether reported outcomes have independent validation, reproducible test methods, and production evidence.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
