Eneba 20M+ Marketplace Fraud Forensics System
Project Overview
As a Corporate Fraud Analyst at Eneba (Finance, Legal & Operations / Payments & Risk), I design and operate fraud mitigation systems for Europe's leading gaming marketplace, serving over 20 Million active users worldwide.
The system applies real-time transaction telemetry, graph clustering algorithms, and behavioral risk rule sets to detect multi-accounting syndicates, mitigate chargebacks, intercept card testing attacks, and ensure rigorous AML/KYC compliance.
What This System Gives To The User & Business
Protection for 20M+ Marketplace Gamers
Defends genuine buyers and sellers from account takeover attacks, fraudulent key claims, and malicious transactions.
Sub-Second Transaction Risk Evaluation
Analyzes payment risk in real time, granting instant access to legitimate users while halting fraudulent activity.
Graph Clustering for Syndicate Detection
Links malicious accounts using shared payment instruments, device fingerprints, and suspicious IP footprints.
Drastic Chargeback Mitigation
Protects marketplace revenue by identifying stolen credit card attempts and automated card-testing bots.
AML & European Regulatory Compliance
Ensures continuous adherence to European cross-border financial laws and sanction lists.
Languages & Codebase Breakdown
High-volume transactional query analytics, payment pattern correlation, audit pipelines
Automated risk scorecards, graph clustering algorithms, velocity threshold daemons
Entity resolution models, shared device fingerprint linking, anomaly detection
⚠ The Challenge
Evaluating thousands of high-velocity digital game key purchases per minute with sub-second decision latency while maintaining a frictionless checkout experience for legitimate global gamers.
✓ The Solution
Developed automated risk scorecards, device fingerprinting correlation pipelines, and velocity thresholding rules. Collaborated across Payments & Risk engineering to build automated refund/dispute resolution workflows.
-- High-Velocity Multi-Accounting Graph Clustering Query
WITH suspicious_clusters AS (
SELECT
device_fingerprint,
COUNT(DISTINCT user_id) AS distinct_accounts,
COUNT(DISTINCT payment_card_hash) AS distinct_cards,
SUM(transaction_amount_eur) AS total_volume_eur
FROM `eneba_analytics.transaction_telemetry`
WHERE event_timestamp >= TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 24 HOUR)
GROUP BY device_fingerprint
HAVING distinct_accounts > 3 OR distinct_cards > 4
)
SELECT
t.user_id,
t.transaction_id,
t.risk_score,
c.distinct_accounts AS cluster_size
FROM `eneba_analytics.transaction_telemetry` t
JOIN suspicious_clusters c ON t.device_fingerprint = c.device_fingerprint
WHERE t.status = 'PENDING_REVIEW'
ORDER BY t.risk_score DESC;