Detect fraud events and extract PII

Problem Statement

You are provided with a list of transaction events, where each event is a dictionary containing a unique event_id, a user_id, and a list of metadata objects. Each metadata object may contain sensitive fields like email, phone, or ip_address.

Your task is to identify potentially fraudulent transactions by finding "connected" events. Two events are connected if they share at least one PII field (e.g., the same email, same phone, or same IP).

Write a function detect_fraud_clusters(events) that:

1. Extracts all unique PII values from each event.
2. Groups all event_ids into clusters where each event in a cluster is connected to at least one other event in the same cluster via a shared PII value.
3. Returns a list of lists, where each inner list contains the event_ids belonging to a single connected cluster.

Input

events: A list of dictionaries. Each dictionary has:

• event_id (string)
• metadata (list of dictionaries, e.g., {'type': 'email', 'value': '[email protected]'})

Output

List[List[str]]: A list of lists containing grouped event_ids.

Example

events = [
    {"event_id": "A", "metadata": [{"type": "email", "value": "[email protected]"}]},
    {"event_id": "B", "metadata": [{"type": "email", "value": "[email protected]"}, {"type": "ip", "value": "1.1.1.1"}]},
    {"event_id": "C", "metadata": [{"type": "ip", "value": "1.1.1.1"}]},
    {"event_id": "D", "metadata": [{"type": "email", "value": "[email protected]"}]}
]
# Output: [["A", "B", "C"], ["D"]]

Constraints

• Number of events: up to 10,000.
• Number of metadata entries per event: up to 50.
• Time complexity should be better than O(N^2) where N is the number of events.