Chapter 5 — Linking

Five hundred people are defrauded by the same operation. Each of them, separately, walks into a station or opens a website and files a report. The system now holds five hundred cases.

It should hold one.

The gap between those two sentences is the largest single inefficiency in the enforcement of online fraud anywhere in the world, and closing it is the one task in this book where a machine is unambiguously better than more staff. This chapter is the mathematics of closing it, and the mathematics turns out to be fifty-seven years old.

The criminal's structural weakness

Start with why this is possible at all.

Fraud at industrial scale requires reuse. The same mule account receives from many victims. The same phone number is dialled from. The same LINE identifier, the same wallet, the same landing page, the same script — because writing a new script for every victim costs money, and the entire business model is volume at low unit cost.

The formal description of exploiting that: entity resolution works precisely because organised fraud recycles identity information, and it proceeds by federated matching across exact and approximate — fuzzy — comparisons of that recycled data. [ESTABLISHED]

The criminal's efficiency is the investigator's handle. Everything below is machinery for gripping it.

Fellegi and Sunter, 1969

In 1969 Ivan Fellegi and Alan Sunter published the formal theory of probabilistic record linkage, and it remains the foundation of every automated linking system in use.

The setup: take two records and compare them field by field — name agrees or not, date of birth agrees or not, address agrees or not. That pattern of agreements and disagreements could have arisen in one of two ways. It could be a true match, in which case each field agrees with some probability (the m-probabilities: real matches still disagree sometimes, because people misspell names and transpose digits). Or it could be a true non-match, in which case each field agrees with some other probability (the u-probabilities: unrelated records still agree sometimes, because plenty of people share a birthday).

Their fundamental theorem: the optimal linkage rule is a likelihood ratio test on the comparison vector. Compute how much more probable this exact pattern of agreements is under "match" than under "non-match," and that ratio is the whole of the evidence. Bayes' rule then converts it into a posterior probability of matching, using the prior prevalence of matches in the data. [ESTABLISHED] (Splink documentation, UK Ministry of Justice; Linacre, the mathematics)

Now look back at Chapter 3.

The modern standard for reporting forensic evidence is that the expert gives a likelihood ratio: the probability of the observations under the prosecution's hypothesis divided by the probability under the defence's. Not a probability of guilt. A ratio between two explanations. The format exists specifically to block the prosecutor's fallacy and its mirror image. [ESTABLISHED] (arXiv 2502.03217)

It is the same object. A fingerprint examiner evaluating a mark and an algorithm deciding whether two fraud reports describe one operation are performing the identical mathematical act: comparing how well two competing explanations account for what was observed. Fifty years and two disciplines apart, one structure.

That is not a pleasing coincidence. It is the reason the discipline of Chapter 3 transfers directly to the machinery of Chapter 5 — including the discipline about what a likelihood ratio may not do.

What a likelihood ratio may not do

The forensic literature is strict about this and the strictness must come across into linking work.

There is a hierarchy of propositions, formalised by Cook, Evett and colleagues, running from narrowest to broadest: sub-source (the DNA came from this person), source (the semen came from this person), activity (this person had intercourse with the complainant), offence (this person committed rape). A likelihood ratio is only meaningful once you fix which level you are addressing, and reporting a source-level ratio as though it answered the offence-level question is a known and serious interpretive error. [ESTABLISHED] (Cook et al. 1998; Evett et al. 2000)

Translate the hierarchy into fraud linking, because it is exactly as necessary here:

A clustering algorithm answers the top row. It is routinely reported as though it answered the bottom. A mule account can be resold. A phone number can be recycled. A scam script can be copied by an unrelated gang who found it in a Telegram channel. Every step down that table is an additional inference the model did not make and cannot support.

Write the level on the output. If a system reports "these 340 cases are one network," it has stated an offence-level conclusion from sub-source evidence, and the person who wrote it does not know what they built.

There is a second thing that must be written alongside the level, and it is a different kind of thing from either the level or the ratio: the status of the link. A likelihood ratio expresses how strongly the evidence favours one explanation over another. It cannot express that there is no evidence — a low ratio and an absent one are not the same claim, and a system with one number for both will report ignorance as innocence. That distinction has a formal history going back to Łukasiewicz and Belnap, at least one documented disaster attached to it, and a schema decision that follows from it. It is worked out in the appendices.

The courts have already pushed back once

In 2010 the England and Wales Court of Appeal considered a footwear-mark analyst who had used a standardised likelihood-ratio scale to express a "moderate degree of scientific evidence" that a particular pair of Nike trainers made the marks. The court held the testimony should not have been admitted, and said forensic scientists should not use mathematical formulae such as likelihood ratios where no firm statistical database exists to underpin the numbers.

The judgment explicitly preserved probabilistic reporting in DNA, where the population-frequency databases are robust. Its scope is narrow on its face. It has nonetheless been widely cited as a general judicial rejection of Bayesian reasoning, and the forensic-statistics community's published response argues the court's language outran its intent. [CONTESTED] (R v T position statement; bibliography of responses; Kaye, Likelihoodism, Bayesianism, and a Pair of Shoes)

The operational lesson for anyone building a linking system is direct: your m- and u-probabilities are the statistical database. If you cannot say where they came from — estimated from labelled data, derived from observed frequencies, or guessed — you are in exactly the position the court objected to. A number with no provenance is not more scientific than an opinion; it is an opinion that has been made harder to challenge.

Crime linkage as an existing discipline

None of this is new to policing, which is the good news and the news that punctures any pitch built on novelty.

The field is called crime linkage or case linkage; in the United Kingdom it is comparative case analysis. It has decades of behavioural-science literature behind it, distinguishing proactive linking — trawling a database of unsolved crimes for series nobody has noticed — from reactive linking, testing whether specific unsolved crimes attach to one case of interest. [ESTABLISHED] (literature review, ScienceDirect)

It also has an honest problem. Human agreement on linkage judgements is poor: one study of Canadian police officers coding linkage scenarios found only 38% agreement for homicide and 25% for sexual assault. [ESTABLISHED] (same review)

That figure is the strongest argument for automation in this book. Not that machines are clever — that the human baseline being replaced is barely better than noise.

The state of the automated art, honestly reported:

• The standard method has been logistic regression on modus-operandi features. A 2025 paper tests

regression, sampling and machine-learning alternatives explicitly against the UK policing AI Covenant's explainability and transparency requirements, demonstrating a more explainable model on a 361-victim romance-fraud dataset in which the true linkage status is unknown. [ESTABLISHED] that the work exists; it is an arXiv preprint and I did not confirm peer review. (arXiv 2510.03730)

• Separate work proposes a Siamese autoencoder for high-dimensional, sparse crime data, tested

against the National Crime Agency's ViCLAS violent-crime linkage system. A methods paper, not a deployed evaluated tool. [ESTABLISHED] as research. (arXiv 2511.07651)

• **No published field evaluation showing that automated case linkage improves clearance, conviction

or recovery outcomes in fraud.** [ABSENT]

Note the last line carefully, because it applies to any proposal you make. The mathematics is sound, the human baseline is weak, the research is active — and nobody has yet demonstrated the outcome.

The other kind of linking, which is already running

There is a system in Thailand that performs linkage at national scale today, and it is financial rather than investigative.

The Central Fraud Registry is a shared interbank database: a person flagged at one institution has accounts suspended across all of them and is blocked from opening new ones. Built through cooperation between the ministry, the central bank, the anti-money-laundering office and the bankers' association. [ESTABLISHED] (Nation Thailand)

That is entity resolution deployed in production, on the money rather than on the narrative. The gap it leaves is precise and worth naming, because it is where work remains: the registry links accounts. Nothing yet links the stories — the free-text account of what the victim was told, who contacted them, what the script was. Those narratives are the only record of the human operation behind the accounts, and they are sitting in prose, unstructured, unsearched.

That is the opening. Not a replacement for anything that exists. The layer nobody has built on top of the layer that already works.

The Move — Write the proposition level on every link. Whenever a system or a person asserts that two cases are connected, record which row of the hierarchy the evidence supports: shared string, shared account, shared operator, shared network. One line, in the file. It costs nothing and it prevents the single most consequential error in linkage work — carrying a sub-source finding into an offence-level claim, which is how a resold mule account becomes an accusation of running a syndicate.

What would change my mind: a field evaluation showing automated linkage improved case outcomes would move this chapter from mathematics to evidence. Equally, a study showing that machine linkage agreement is no better than the 38%/25% human baseline would gut it. Neither exists. This chapter currently rests on a sound formalism and a weak comparison class, and I would rather say so than imply more.