Detection, Attribution, Narration: An End-to-End Pipeline for Explainable Money Mule Identification

Financial institutions struggle to detect money mule accounts because these accounts often mimic legitimate behavior. Traditional rule-based systems are either too rigid, leading to high false-positive rates, or too permissive, allowing sophisticated fraud to go undetected. Furthermore, these systems often lack the explainability required for human analysts to quickly triage alerts. The authors propose an end-to-end pipeline consisting of three stages: a LightGBM classifier to score accounts, a TreeSHAP layer to identify which features drove the score, and a self-hosted LLM to translate those technical attributions into natural-language narratives for analysts.

The model was trained on 280 engineered features covering transaction patterns, account demographics, network topology, and temporal behavior. To handle the rarity of money mule cases, the researchers used negative sampling to create a 1:5 positive-to-negative ratio during training. Once the LightGBM model generates a risk score, the system uses TreeSHAP to decompose the prediction into the top 10 contributing features. These features are then fed into an on-premise LLM, which is constrained by a strict prompt template to generate a concise, evidence-based narrative. This ensures that the explanation is grounded in the model's actual decision-making process while minimizing the risk of hallucinations.

In a live production deployment, the new system significantly outperformed the incumbent rule-based approach. The yield rate—the percentage of flagged accounts confirmed as actual money mules—increased from 61% to 89%. Additionally, the system enabled a 60% increase in the detection of adverse cases. Qualitative feedback from analysts indicated that the LLM-generated narratives were highly effective at reducing the cognitive load required to review alerts, as they replaced complex statistical visualizations with clear, actionable summaries.