Built for commission-agent networks like SalesMesh

Spot fraud in your agent network early

LEAF checks every commission agent’s signups, devices and customer activity. When something looks like fraud, it flags the agent and shows you the evidence, so your team can review it with confidence.

Open the dashboard

See how it works

Alert queue

Scoring period ending 21 Oct · illustrative data

5 open

Agent	Region	Risk	Contributing layers	Quality window
AG-4821	Nairobi	0.94	collusionanomaly	matured
AG-1307	Mombasa	0.88	rulesanomaly	matured
AG-5512	Kisumu	0.71	collusion	matured
AG-2290	Nakuru	0.63	anomalyquality	pending
AG-0876	Eldoret	0.52	quality	pending

The problem

Commission rewards volume, so some agents fake it

Mobile-money and telecom platforms pay agents per customer onboarded. The fraud that follows takes three shapes, and each one hides from a different detector.

Individual fraud

One agent inflates their numbers alone, using recycled identity documents, reused devices, recycled KYC photos and signup bursts that stay just under the daily cap.

Collusion

Groups of agents share devices, customers and addresses so that no single agent looks unusual on their own.

Paid-for activations

Real customers are paid to sign up and never use the service. Every signup looks genuine; only what happens afterwards gives it away.

How it works

Four layers, each covering what the others miss

Every scoring period, each layer measures one kind of evidence. The four signals are fused into one risk score per agent; a layer that cannot be measured yet is left out rather than counted as clean.

Rules

Did a hard constraint break?

Deterministic checks such as one identity document presented for several customers, impossible travel between signups, and blacklisted devices.

Evidence shown: The constraint, the observed value and the threshold.

Behavioural anomaly

Is this agent behaving unlike their peers?

Per-agent rates over a trailing window (signups per day, device reuse, recycled KYC photos and missing GPS), each compared against the whole agent population.

Evidence shown: Each rate, how rare it is, and its exact share of the score.

Collusion graph

Is this agent part of a ring?

Agents are linked through the devices, customers and addresses they share, then Louvain community detection and pair scoring surface dense groups.

Evidence shown: The shared devices, customers and addresses behind each link.

Activation quality

Do the customers ever come back?

Each onboarded customer is followed for a fixed window: do they log in again, transact, and pass consistency checks?

Evidence shown: The conditions each activation failed.

Explainable by design

No alert is a bare number

Every alert opens to the evidence behind it. The behavioural score is a sum, so each indicator’s share is exact rather than approximated after the fact.

AG-4821 · anomaly evidence

Trailing 30 days · illustrative data

Recycled KYC photo31% of signups

rarer than 99.6% of agents · 46% of this agent’s anomaly score

Device reused across customers27% of signups

rarer than 98.9% of agents · 34% of this agent’s anomaly score

Signups per day6.4

rarer than 91% of agents · 15% of this agent’s anomaly score

Missing GPS4% of signups

typical · 5% of this agent’s anomaly score

Detects and explains. Never enforces.

LEAF raises alerts for a human reviewer. It never suspends an agent, withholds a commission or takes automated action. An administrator’s decision is recorded for audit, not executed.