Question

Design a system to detect account-takeover and collusion fraud rings on a P2P payments app (40M users). Signals include device fingerprints shared across accounts, login from new geos, sudden P2P cash-out patterns, and clusters of accounts that funnel money to one mule. Detection is partly near-real-time (block a suspicious cash-out) and partly batch (discover rings overnight). Describe the architecture, how you model the account/device/transaction graph, and the latency/accuracy trade-offs.