Fraud Ring Explorer is the Dashboard investigation surface for fraud rings that TrustGraph discovers across your organization's sessions. Rings are groups of sessions linked by shared attributes such as face, document, device, name, IP address, and email, exposing the structure behind sessions that look unrelated one at a time.
Fraud Ring Explorer is available in the left menu when the feature is enabled for your organization. If you don't see the Fraud Ring Explorer, contact your Incode representative for more information about TrustGraph.
Fraud rings appear in two places:
- Real-time signal. During verification, a session's attributes are evaluated against the rings already discovered in your history. If the session connects to one, the Fraud Rings Detection category returns
AT_RISKand the reason codes on the match explain why. This is a TrustGraph detection category like any other. The signal is visible in the single Session view. - Fraud Ring Explorer. The investigation surface documented on this page. An analyst uses Fraud Ring Explorer to see the rings TrustGraph has discovered across your organization's sessions, work out what holds each one together, and decide what to do about it.
The two surfaces feed each other. Rings discovered in your history sharpen the real-time signal on new sessions, and a session flagged in real time is a doorway into the ring it belongs to.
The rings list
The Fraud Ring Explorer landing view is a sortable table of every ring discovered in your organization's history. On this page, you can:
- Search rings... for finding a ring by name or ID.
- Use the filter drop-down to find rings by status.
- Learn how fraud rings work, which opens a short in-product walkthrough of the rings list and the ring detail view.
The table has the following columns:
| Column | What it shows |
|---|---|
| Ring name | An editable name for the ring, defaulting to an auto-generated identifier based on the ring type (for example, identity_theft, document_reuse, duplicate_biometrics). Rename rings to reflect your team's own investigation language. |
| Ring ID | The ring's UUID with a copy control. Use it when referencing the ring in your own case management or ticketing systems. |
| Status | The ring's current status. Set by analysts from the ring's deep dive view. Under Review means the ring is awaiting analyst review; Validated means an analyst has reviewed the ring and confirmed it as a genuine ring for your team's records.. |
| First seen | The date the ring first appeared in your data. Distinguishes long-running operations from new activity. |
| Last active | Relative time since the most recent session in the ring (for example, "3d ago", "2mo ago"). Separates live threats from historical ones. |
Every column is sortable. Sort by Last active to see what is happening right now. Sort by First seen to find operations that have been running quietly for months. Filter by Under review to work the review queue.
Ring detail view
Clicking a ring name in the list opens its detail view: a deep dive into the ring's identity, evidence, and structure. The detail view is where you assess what's actually going on in the ring, investigate individual sessions and attributes, and record what you found. Use the All rings link in the top-left to return to the list.
Assess the ring
The sidebar on the left summarizes what TrustGraph knows about the ring as a whole and gives you the evidence you need to judge it.
- Read the Passed sessions count (for example, "0 / 347 Passed sessions") to gauge the ring's shape. A ring dominated by failed sessions is likely already being caught by your existing checks; a ring dominated by passed sessions is a different kind of risk that made it through.
- Use the More info expander to reveal additional metadata about the ring and check the last-updated timestamp to see whether new sessions have joined since your team last reviewed it.
- Use the Most reused tab to identify the backbone of the ring. The attributes at the top of the list carry the most sessions and are usually what actually binds the ring, whether that's a single document, a device, or a face on ID.
- Switch to the By type tab when you want to categorize the ring by attribute kind (Document, Device, Name, Face, Face on ID, IP Address) rather than by volume. This is faster when you already suspect a specific vector.
Explore the graph
The graph canvas on the right shows the ring's structure. Labelled hub nodes represent shared attributes; the sessions that reuse each attribute radiate out as dots, with green dots for passed sessions and red dots for failed sessions. The graph is interactive; click any node to open a detail panel and pivot into it.
- Use the canvas controls at the bottom to navigate: pan, fit to view, reset, zoom in and out, export, and toggle the hover behavior.
- Follow the largest hubs first. A hub with many red dots points to a rejected pattern; a hub with many green dots points to sessions that got through despite reusing the same attribute.
- Click an attribute hub node (Device, IP Address, Document, Face, Name, Face on ID) to open its Node Detail panel on the right. The panel shows the node's identifier (with a copy control), a summary of its Fail rate, Countries, and Peak 24h, and the full list of Linked sessions that use it. Click Open session on any session to open its Session Detail panel.
- Click a session dot to open its Session Detail panel. The panel shows the person's identity summary (session ID, country, date of birth, session status), the count of Linked attributes for that session, and the list itself. Click Open node on any attribute to jump to that node's detail panel, or Open session to open the full session in Dashboard.
- Use the Session Detail and Node Detail panels together to pivot through the ring: from a suspicious session to the attributes it shares, from a shared attribute to every other session that carries it, and back again. This is how you build the case for why a ring is what you think it is.
Record what you found
Open the Notes workspace from the top-right of the sidebar to capture your reasoning: why you reached your conclusion, what you checked, what you ruled out. Notes stay with the ring so the next analyst, the next shift, or a later audit doesn't repeat work that has already been done.
Move the ring through its lifecycle
Click the status badge at the top of the sidebar to open the dropdown and set the ring's status. This is how work is handed between analysts and how your team signals that a ring has been dealt with.
A typical investigation
Investigations vary, but Fraud Ring Explorer supports an investigation workflow along the following shape:
- Start from the queue or from a session. Open a ring from the rings list or click through from the Fraud Rings card on a session flagged in real time in the single Session view.
- Assess the ring's shape in the sidebar (passed / failed split, backbone attribute).
- Investigate in the graph by pivoting through Session Detail and Node Detail panels to build the case.
- Record your reasoning in Notes.
- Set the ring's status to signal the outcome to the rest of the team.
- Action the connected sessions under your own policy, then report confirmed fraud back. TrustGraph returns signals and structure; the decision to block, freeze, review, or leave alone is always yours.
- TrustGraph (Feature Deep Dive): What TrustGraph is, its detection categories, and how the Fraud Rings category fits into the overall status.
- TrustGraph module configuration: How to enable Fraud Rings Detection in your Flows and Workflows.
- TrustGraph Reason Codes: The reason codes emitted by Fraud Rings Detection.
- Single Session View, Trust Graph tab: Reading Fraud Rings results for an individual session in Dashboard.