Return Fraud Detection at Scale

How the system actually runs.

Each stage below is a real component in the deployed pipeline. Stages outlined in teal are control points: the places where the architecture constrains what the model can receive or emit.

What it runs on.

How it is wired.

1. Fully cloud-native on Google Cloud with no on-premises footprint.
2. The GNN endpoint is called synchronously through Eventarc at return authorization. High-confidence decisions complete without any LLM involvement, which keeps latency down.
3. Gray-zone GNN scores, meaning those inside a defined confidence ambiguity band, route automatically to a secondary Gemini Pro call for narrative risk assessment.
4. The hybrid design is deliberate: the GNN handles speed-sensitive high-confidence cases, the LLM handles nuanced edge cases that need contextual reasoning.
5. VPC Service Controls create a hard organizational perimeter. No data exits to the public internet across any service in the pipeline.
6. The GNN training pipeline applies differential privacy guarantees to prevent model inversion attacks from recovering individual customer records from model weights.

What keeps it inside its contract.

Guardrails were designed in from the start, not added after the fact. Where the system touches untrusted input, a control sits between that input and the model.

• All PII, including names, addresses, and payment tokens, is pseudonymized before the Gemini Pro call. The model never receives raw customer PII.
• Differential privacy is applied during GNN training to prevent membership inference and model inversion attacks on training data.
• Gemini Pro output parsing enforces a strict JSON risk decision schema. The model cannot produce free-form output or reproduce input data in its response.
• VPC Service Controls enforce a hard organizational boundary. No data can egress to endpoints outside the defined perimeter.
• A data processing addendum was negotiated with Google confirming zero retention on all Vertex AI API calls.

What we still track.

No production AI system is finished. These are the live risks carried by this architecture, documented for the operating team rather than buried.

• Sophisticated fraud rings could probe and learn the GNN's decision boundary through repeated low-value return attempts.
• Graph structure assumptions may degrade as fraud networks adopt new coordination patterns, such as rotating device fingerprints through mobile emulators.
• Gray-zone routing to Gemini Pro adds latency at the point of return authorization, which could create customer experience friction at scale.
• Pseudonymization must be cryptographically stable across pipeline runs, or cross-session account linking silently breaks.

What changed.

• Coordinated fraud ring activity became detectable through graph-level relationship patterns that are invisible to per-account rule systems.
• Refund abuse through fake account networks declined as the GNN identified shared device and address graph clusters.
• The hybrid GNN plus LLM architecture reduced false positive friction on legitimate high-value returns compared to pure rule-based blocking.
• The differential privacy guarantee gave the legal team a defensible position on training data handling for regulatory and audit purposes.

On numbers. Client identity and any identifying detail are withheld under NDA. Outcomes are stated as direction and materiality rather than as figures we are not free to publish.