"named entity resolution" often gets used to mean two related but different jobs: finding named things in text, and deciding which records point to the same real-world actor. In this piece, threat-intelligence and trust-and-safety analysts will get a clear distinction, practical examples, and a framework for using both together in scam investigations, grounded in Active Defense workflows, weekly scam briefings, and monthly scam data reports.
In abuse and fraud work, mixing up the terms can lead to weak data models, noisy linking, or missed connections across conversations. The core idea is simple: extraction identifies candidate indicators such as wallets, bank details, phone numbers, messenger accounts, links, gift cards, payment handles, and file or photo hashes. Resolution then links related observations to one actor when the evidence supports it.
What people usually mean by named entity resolution
Online, “named entity resolution” is often used loosely. In practice, analysts usually need to separate two different jobs:
- recognizing entities in text or media
- resolving whether two mentions, records, or chats refer to the same thing
A named entity is simply a reference to something identifiable in the domain you care about. Depending on the workflow, that can mean a person, organization, place, account, wallet, phone number, domain, or bank detail. In scam analysis, many of the most useful entities are not classical proper names at all, but operational identifiers that can be observed, scored, and compared.
That is why it helps to keep the questions separate. Extraction asks: what is in this message? Resolution asks: which observations belong together?
The difference matters because the outputs are different. Extraction turns raw content into structured fields that analysts can search, filter, and export. Resolution adds relationships across messages, chats, and actors, so repeated activity can be grouped instead of treated as isolated events.
A simple threat-intelligence example shows the split. One message may contain a wallet address and a Telegram handle. Another may include the same wallet written in a different format, or a forwarded account that points back to the same operation. The first task is to detect those values correctly. The second is to decide whether they support a link.
Resolution can also happen at more than one level:
- mention-to-mention
- record-to-record
- actor-level clustering
That matters when evaluating tools. The same phrase may be used in vendor marketing for extraction, matching, deduplication, or full actor clustering. Analysts should look past the label and inspect the actual method and output: what gets extracted, what gets linked, at what level, and with what evidence.
Extraction first: turning messy scam chats into structured data
Extraction is the step where unstructured scam content becomes machine-usable observations. Analysts are not starting with neat forms or normalized records. They are starting with chat text, photos, voice messages, and files that may contain fragments of operational data in inconsistent formats.
In this domain, the useful entities often include:
- crypto wallets
- bank details
- phone numbers
- messenger accounts
- links
- gift cards
- payment handles
- file and photo hashes
That sounds straightforward until you look at the source material. Scam conversations are usually short, informal, and repetitive. They may switch languages mid-thread, reuse copied scripts, or push key details into attachments instead of plain text. A system built for polished business documents will miss a lot of what matters here.
It also helps to be precise about terminology. Not every entity in scam analysis is a proper name in the classical NLP sense. A wallet address, payment handle, forwarded account, or image hash is still an entity for operational purposes, even if it does not look like a person, place, or organization. That is one reason the phrase “named entity resolution” can be misleading for analysts working on fraud and abuse.
A practical quality rule is to score each extracted indicator. Some values are structurally clear, such as a well-formed wallet or bank detail. Others depend more heavily on surrounding context, formatting noise, or how the value appears in media. Scoring keeps extraction useful without pretending every observation carries the same weight.
That is the model Active Defense applies when it turns what scammers send on Telegram and by e-mail into a threat-intelligence feed. Each indicator carries a confidence score, giving analysts a way to separate strong signals from weaker ones.
Just as important, every message is stored the moment it arrives. If a scammer later uses "delete for everyone," the original evidence remains available. That gives analysts a stable history for rebuilding timelines, re-running extraction logic, and comparing current findings against earlier observations.
Entity resolution: deciding what belongs to the same actor
Entity resolution is the process of linking records that refer to the same real-world thing or actor, even when the evidence arrives with variation, duplication, or missing pieces. In scam investigations, that usually does not mean proving a legal identity. More often, the practical target is an operational actor: a scammer, crew, or account set that shows up across multiple conversations.
Analysts typically resolve entities from patterns such as:
- shared indicators
- reused images
- repeated payment destinations
- overlapping contact points
- forwarding patterns
Those patterns matter because scam operations rarely stay fully consistent. A handle may change while a wallet stays the same. A payment route may repeat across otherwise different chats. An image may reappear after being resized or recompressed. Resolution is the step where those observations are compared and grouped into something operationally useful.
In Active Defense, chats that share an indicator, a reused photo, or a forwarded account are linked to one actor. That framing is important because the link is based on observed evidence, not on a claim of certainty. Analysts should think in terms of confidence, competing hypotheses, and cluster quality rather than a simple yes-or-no identity match.
Both major error types cause problems. A false merge pulls unrelated activity into one case, which can distort reporting, inflate the apparent scope of an actor, and send investigators in the wrong direction. A missed merge does the opposite: it leaves connected activity split apart, hiding persistence, reuse, and scale.
Hashes play a specific role here. File hashes are useful for exact matching, because they show when the same binary file appears again. Perceptual photo hashes help with a different problem: spotting reused images even when the file itself is not identical.
A useful resolution system also keeps the underlying observations intact. That way, clusters can be reviewed, challenged, and rebuilt as new messages arrive, new indicators are scored, or an earlier link turns out to be weaker than it first appeared.
How the two work together in threat intelligence and trust and safety
The easiest way to think about the relationship is as a pipeline. Extraction creates candidate observations from raw conversations and media. Scoring ranks how reliable those observations look. Resolution then uses them to connect chats, records, and actors when the evidence is strong enough.
That sequence maps directly to analyst goals. Structured extraction helps teams deduplicate reports, search for repeated infrastructure, and compare one case with another. Resolution adds the broader view: which conversations are part of the same operation, what patterns keep recurring, and which clusters deserve attention first.
A simple workflow makes the handoff clear:
- a new conversation produces a wallet
- the same chat includes a contact account
- a photo in the thread yields a photo hash
- later conversations share one or more of those observations
- those conversations can then be grouped for analyst review
This is where judgment matters. A shared indicator may be a strong link, a weak link, or a coincidence depending on the context. Good systems therefore keep humans in the loop at the points where decisions carry the most weight: how to engage, how much confidence to place in a suggested link, and when a cluster is ready to treat as one actor.
That is also why continued engagement can improve analysis. Active Defense uses AI decoy personas to keep scammers talking on Telegram and by e-mail, but replies are drafted by AI and approved by a human operator by default. As more scammer messages arrive, extraction has more chances to surface wallets, accounts, links, hashes, and other indicators. Resolution also gets more evidence to work with, including reuse patterns across chats.
The result is not just a set of isolated fields, but linked observations that can move into existing workflows. Each customer gets their own feed, including STIX 2.1 export. Console and API run on Azure in Germany.
Questions analysts ask about named entity resolution
Is named entity resolution the same as named entity recognition?
No. Named entity recognition is the extraction step: finding and labeling useful things in text or media. Entity resolution is the linking step: deciding whether separate observations point to the same actor, account set, or record.
In analyst terms, recognition tells you what was seen. Resolution tells you what belongs together.
That distinction matters because one can work well while the other still fails. A pipeline may extract a wallet, phone number, or messenger account correctly, yet still merge the wrong chats. It can also miss an entity at extraction time and never create the evidence needed for linking.
What is the difference between entity resolution and deduplication?
Deduplication usually means removing exact or near-exact repeats. Entity resolution is broader. It asks whether different-looking records still refer to the same operational actor.
A few examples make the split clearer:
- duplicate file, same hash: deduplication problem
- reused photo with a perceptual match: possible resolution signal
- different chats sharing a payment destination: resolution problem
- repeated copy of the same message: deduplication first
So deduplication reduces noise, while resolution builds relationships.
Why does confidence scoring matter for extracted indicators?
Not every extracted indicator deserves the same trust. Some values are easy to check structurally. Others depend more on context, formatting, or media quality. Confidence scoring helps analysts sort strong observations from weak ones and avoids treating every field as equally reliable.
At Active Defense, each extracted indicator carries a confidence score in the threat-intelligence feed.
Can entity resolution work with photos, files, and forwarded accounts, not just text fields?
Yes. Resolution should use whatever evidence is operationally useful. Text indicators are only one part of the picture. Exact file hashes can show binary reuse. Perceptual photo hashes can support image reuse analysis. Forwarded accounts can also connect conversations that would look unrelated if you only compared plain text.
That is why a good resolution model is not limited to names or text strings alone.
The practical takeaway
Named entities are the things you extract; entity resolution is the work of deciding which observations point to the same actor.
For threat-intelligence and trust-and-safety analysts, that split is practical, not academic. Better extraction improves coverage: more useful indicators make it into the dataset. Better resolution improves context and actionability: separate observations become cases, patterns, and actor clusters that can support decisions.
A simple rule helps when assessing tools or designing internal workflows:
- build extraction and resolution as one pipeline
- evaluate them as separate tasks
- inspect the evidence behind each suggested link
That approach keeps data models cleaner, makes errors easier to diagnose, and gives analysts a better basis for review, escalation, and downstream intelligence use.