PRISM is a real-time early-warning system for insider fraud at Union Bank of India, built for the PSBs' IDEA 2.0 Hackathon. Two employees colluding never trip a single-user rule; a compromised login looks identical to a real one until it's too late; slow, gradual privilege creep rarely crosses any static threshold. PRISM cross-references relationship, behavioral, and session-level evidence and only alerts when multiple independent signals agree — cutting false positives by 60-70% and mean investigation time from 4-6 hours to 12 minutes.
The pipeline runs as two independent detection layers fused into one verdict. Layer 1 is a graph attention network that scores the bank's entire employee/customer/account relationship graph — cached in memory so every read is instant — paired with Louvain community detection to surface collusion rings and hidden beneficiaries that look clean in isolation. Layer 2 is a stacking ensemble (XGBoost + LightGBM + Isolation Forest into a logistic-regression meta-learner) over 30+ engineered behavioral features per employee — off-hours activity, transaction velocity, dormant-account access, privilege changes, new-device logins — trained with SMOTE to handle a fraud rate under 1%.
A Dempster-Shafer fusion engine combines the two layers' belief masses rather than averaging their scores: it preserves uncertainty instead of hiding it, and a conflict score surfaces disagreement for human review instead of guessing. When both layers independently flag the same employee the combined score amplifies well past either one alone — in one worked case, individual scores of 0.72 and 0.83 fused to 0.947 with a conflict score of just 0.097, a confident, low-conflict CRITICAL alert.
Every alert explains itself. SHAP ranks each prediction's feature contributions and a narrative generator turns them into a plain-English causal chain — "3 off-hours transactions, 2 transfers to a dependent account, cross-branch access from 2 new IPs, transaction count 4.2x above average" — plus 15 boolean risk signals (premature FD breaks, limit overrides, bulk data exports, repeated failed logins, and more) investigators can act on directly instead of reverse-engineering a black-box score.
Dataset
A synthetic Union Bank dataset was built for training and demo: 73,669 records across 7 MongoDB collections — 400 employees, 2,000 customers, 3,837 accounts, 21,785 transactions, 45,382 activity logs, and 665 dependents over a 6-month window — with 12 injected fraud scenario types (collusion rings, FD premature-breaks, dormant-account activity, bulk data exports, repeated failed logins, and more) fully labelled for supervised training and evaluation.
Product
Three role-aware dashboards — Admin/Fraud Analyst, Branch Manager, and Employee self-service — are built in Next.js with a live alert feed, a relationship graph, a What-If simulator, JWT/RBAC access control, and the UI localized into 10 Indian languages. All three ML services — the graph network, the behavioral ensemble, and the fusion orchestrator — run as independently scaled FastAPI microservices on Google Cloud Run against a shared MongoDB store, so every model sees exactly the data the app writes.