INCREASING INVESTIGATOR EFFICIENCY USING NETWORK …€¦ · •Multiple payments in same day at...

Copyr i g ht © 2012, SAS Ins t i tu t e Inc . A l l r ights reser ve d .

INCREASING INVESTIGATOR EFFICIENCY

USING NETWORK ANALYTICS

ACFE ANNUAL CONFERENCE

ORLANDO, FL

JUNE 20, 2012

DAN BARTA CPA, CFE

DAVID STEWART CAMS

Fraud & Financial Crimes Practice


TOPICS INCREASING INVESTIGATOR EFFICIENCY

• Fraud Trends and Investigator Challenges

• Layered Approach to Fraud Detection

• Using Network Analysis

• Credit Card Bust-Out Case Study

• Additional Applications

• Questions & Answers


FRAUD TRENDS AND

INVESTIGATOR CHALLENGES


FINANCIAL

CRIMES FRAUD TRENDS

• Highly sophisticated

• Organized and agile

• De-centralized

• High velocity attacks

• Test and attack multiple channels

• Faster Payments

• Global Economy Executed corporate

account takeover in

amount of $20M

without ever meeting

face to face


2011 IPSOS MORI

SURVEY

Criminal Groups

and Employees top

list of fraud risks!


FINANCIAL

CRIMES SYSTEMS CURRENT CHALLENGES FOR INVESTIGATORS

• Monitoring and detection systems fail to keep pace

with new products / offerings and new schemes

• Systems exist in product and channel silos

• Existing systems act on a transaction or account

• Lack cross-channel view of subject’s behavior

• Few systems block transactions at point-of-service


LAYERED APPROACH TO FRAUD DETECTION

INVESTIGATOR IMPACT


LAYERED

APPROACH TO

ENTERPRISE

FRAUD & MISUSE

MANAGEMENT

GARTNER GROUP, AVIVAH LITAN

“There are two

classes of EFM

solutions — one

detects fraudulent

transactions or

unauthorized

activities as they

occur, and one

detects organized

crime and collusive

activities using offline

entity link analysis”


LAYER 2:

NAVIGATION

CENTRIC

INDUSTRY BEST PRACTICE

• Real-time Dynamic Data Capture of Customer and

Account web behavior activity

• Builds customer profile for behavior analysis to

determine normal vs. abnormal online activity

• Profile forms foundation for real-time decision using

analytics

• Provides rich data store with an enhanced customer

and account view

Moving beyond the

realm of web

analytics to

understand customer

web behaviors


LAYER 3:

CHANNEL

CENTRIC


End-to-end

enterprise platform

that can address a

specific channel

and provide

extensibility across

channels

ACH

Wire

Models

Account

Customer

Profiles


LAYER 4:

CROSS-PRODUCT

CROSS-CHANNEL


Leveraging a

Hybrid approach to

score transactions

and entities across

multiple accounts,

claims & channels

according to the

propensity of fraud

Analytic Decisioning

Engine

Automated Business

Rules

Anomaly Detection

Predictive Modeling

Text Mining

Database Searches

Social Network Analysis


LARGE

INTERNATIONAL

BANK

ENTERPRISE FRAUD DETECTION

CHALLENGES

• Enterprise detection on single

platform Decision 100% of

transactions in real-time

• Leverage cross-channel data

for detection

SOLUTIONS (SAS Enterprise

Fraud Management)

• Real-time decisioning for all

channels

• Deployment of custom /

consortium models

• Cross channel “signatures”

RESULTS / BENEFITS

47% better detection

(at 20:1 AFPR)

Real-time scoring on

multiple entities

Reduction in IT

costs

Highest % of

accounts closed

with zero fraud loss

SAS Fraud Management


LAYER 5:

ENTITY LINK

ANALYSIS


LINKING ATTRIBUTES

• Demographic –address, phone #, employer, etc.

• IP address, device id

• Payments and money transfers

• Behavioral links

ITERATIVE NETWORK BUILD

• Statistical binding of entities

• Network Visualization

NETWORK SCORING & EVALUATION

• Bottom-up

• Top-down

• Rule and analytic-based scoring

• Configurable prioritization

Automated linking

of entities to

facilitate detection

and/or

investigation at a

network level


USING NETWORK ANALYSIS TO IDENTIFY AND

INVESTIGATE ORGANIZED FRAUD RINGS


FIRST PARTY AND

ORGANIZED

FRAUD RINGS

CHARACTERISTICS

• Perpetrators are patient

• Establish “normal pattern” of behavior

• Exploit unsecured credit

• Rings use elaborate scams

• Losses are significant and damage brand reputation

CHALLENGE

• Difficult to detect with siloed detection tools

• Important to “connect the dots” to see relationships

• Combine credit exposures with known fraud losses

for holistic view


ORGANIZED FRAUD RING

CREDIT CARD BUST-OUT CASE STUDY


CASE STUDY CREDIT CARD BUST-OUT

MAY JUN JUL AUG SEP OCT NOV DEC JAN FEB MAR APR MAY JUN JUL AUG

2008 2009

6/4/2008

CL$7700

6/18/2008

CL$20,000

9/2/2008

CL$7000

9/16/2008

CL$10,000

11/21/2008

CL$2000

1/22/2009

CL$7000

New Account Opening

Credit Card Payments

Cash Advances

Legend

2/13/2007

CL$7500 1

3

4

5

6

7

2




2008 2009

6/4/2008

CL$7700

8/22/2008

3 x $6500

8/22/2008

2 x $6500

8/29/2008

2 x $6500

2 x $4776

9/9/2008

1 x $6500

1 x $4776

6/18/2008

CL$20,000

9/2/2008

CL$7000

9/16/2008

CL$10,000

11/21/2008

CL$2000

1/22/2009

CL$7000

New Account Opening


Cash Advances

Legend

2/13/2007

CL$7500 1

3

4

5

6

7

2 Closed

Open




2008 2009

6/4/2008

CL$7700

6/18/2008

CL$20,000

9/11/2008

2 x $8600

1 x $8500

1 x $8400

1 x $7400

9/11/2008

1 x $6700

9/2/2008

CL$7000

12/31/2008

1 x $6500

2 x $6950

1 x $6000

2 x $6900

1 x $6800

12/31/2008

1 x $6700

9/16/2008

CL$10,000

11/21/2008

CL$2000

1/22/2009

CL$7000

New Account Opening


Cash Advances

Legend

2/13/2007

CL$7500 1

3

4

5

6

7

2

Closed

Closed




2008 2009

6/4/2008

CL$7700

6/18/2008

CL$20,000

9/2/2008

CL$7000

9/16/2008

CL$10,000

10/24/2008

1 x $1400

11/5/2008

1 x $2700

11/10/2008

1 x $2750

11/13/2008

1 x $8700

11/14/2008

4 x $3800

2 x $3600

11/14/2008

2 x $3800

1 x $3700

1 x $3600

11/21/2008

CL$2000

11/24/2008

1 x $1800

1/22/2009

CL$7000

7/13/2009

1 x $1100

7/17/2009

1 x $6400

1 x $6300

New Account Opening


Cash Advances

Legend

2/13/2007

CL$7500 1

3

4

5

6

7

2

Open

Closed

5/2009

Closed

12/2009




2008 2009

6/4/2008

CL$7700

8/22/2008

3 x $6500

8/22/2008

2 x $6500

8/29/2008

2 x $6500

2 x $4776

9/9/2008

1 x $6500

1 x $4776

6/18/2008

CL$20,000

9/11/2008

2 x $8600

1 x $8500

1 x $8400

1 x $7400

9/11/2008

1 x $6700

9/2/2008

CL$7000

12/31/2008

1 x $6500

2 x $6950

1 x $6000

2 x $6900

1 x $6800

12/31/2008

1 x $6700

9/16/2008

CL$10,000

10/24/2008

1 x $1400

11/5/2008

1 x $2700

11/10/2008

1 x $2750

11/13/2008

1 x $8700

11/14/2008

4 x $3800

2 x $3600

11/14/2008

2 x $3800

1 x $3700

1 x $3600

11/21/2008

CL$2000

11/24/2008

1 x $1800

1/22/2009

CL$7000

7/13/2009

1 x $1100

7/17/2009

1 x $6400

1 x $6300

New Account Opening


Cash Advances

Legend

2/13/2007

CL$7500 1

3

4

5

6

7

2 Closed

Open

Open

Closed

Closed

Closed

5/2009

Closed

12/2009



COMMON CHARACTERISTICS

• Minimal merchant activity

• Payments exceeding balance or credit limit

• Multiple payments in same day at one or more branches

• Large and multiple cash advances on same day

• Payment reversals

ACTIONS

• Monitor for:

• Multiple payments in same day

• Payments exceeding balance and/or credit limit

• Cash advances on same or following day of payments

• Cash advances as significant % of card activity

• Payment reversals



NETWORK ANALYTICS REVEALED…

• Common employer phone number

FURTHER INVESTIGATION REVEALED…

• Google search – granite and tile company

• Employer company had no website presence

• Street view of Google maps indicated a strip shopping center for a building supply

company And this was all found without leaving the desk…

OTHER INVESTIGATIVE STEPS

• Corporate records search

• Credit reports

• Drive-by of address

• Interview of neighboring tenants

• Search for additional banking relationships

• Contact other bank representatives




2008 2009

6/4/2008

CL$7700

8/22/2008

3 x $6500

8/22/2008

2 x $6500

8/29/2008

2 x $6500

2 x $4776

9/9/2008

1 x $6500

1 x $4776

6/18/2008

CL$20,000

9/11/2008

2 x $8600

1 x $8500

1 x $8400

1 x $7400

9/11/2008

1 x $6700

9/2/2008

CL$7000

12/31/2008

1 x $6500

2 x $6950

1 x $6000

2 x $6900

1 x $6800

12/31/2008

1 x $6700

9/16/2008

CL$10,000

10/24/2008

1 x $1400

11/5/2008

1 x $2700

11/10/2008

1 x $2750

11/13/2008

1 x $8700

11/14/2008

4 x $3800

2 x $3600

11/14/2008

2 x $3800

1 x $3700

1 x $3600

11/21/2008

CL$2000

11/24/2008

1 x $1800

1/22/2009

CL$7000

7/13/2009

1 x $1100

7/17/2009

1 x $6400

1 x $6300

New Account Opening


Cash Advances

Legend

2/13/2007

CL$7500 1

3

4

5

6

7

2 Closed

Open

Open

Closed

Closed

Closed

5/2009

Closed

12/2009

Would you have opened

accounts #6 and #7?

Would you have managed the relationship

of Customer #1 and #6 more intently?

How would you have changed the

relationship with Customer #4 and #5?


NETWORK

ANALYSIS VISUAL CREDIT CARD BUST - OUT EXAMPLE

Network

Visualization


NETWORK

ANALYTICS THINGS TO CONSIDER

DATA IS KING

• Volume

• Sources

• Internal and External

• Beginning/end dates

• Known fraud experiences

ORGANIZATION SIZE

• Larger size/Increased opportunity

• Cross organization

RUN FREQUENCY

• Daily > Weekly > Monthly

• Level of analysis and alert generation

• What are you trying to detect?


ADDITIONAL APPLICATION OF ANALYTICS TO

ADDRESS FRAUD


LOS ANGELES COUNTY DEPT OF SOCIAL SERVICES

SAS Approach

SAS subjected 6 years of historical data from 5 different source systems (including claims,

payments, application, 3rd party, and fraud case data) to the predictive capabilities of the SAS

Fraud Framework. Client investigators evaluated the solution results during a 3 week

validation period against 3 main categories of cost avoidance: investigative efficiency,

earlier detection of fraudulent providers & participants, and incremental detection of

fraudulent providers & participants.

Highlights

• 32 times increase in # of fraud

rings detected annually

• Incremental estimated save of

$31.1M annually

• 83% correct hit rate on provider

fraud

• 40% correct hit rate on

participant fraud

• 6 years of historical data from 5

data source systems

Business Problem

The Department of Social Services of a large US County was being hit by fraud, waste, and

abuse across their public assistance programs. The County engaged SAS to pilot the SAS

Fraud Framework to determine if the data analytics and visualization solution could assist in

proactively detecting both opportunistic and organized fraud in the Childcare program.

Results

The pilot resulted in a business case and deployment roadmap for full implementation,

• Investigative Efficiency: $3.0M (saved across 40 investigators)

• Earlier Detection: $1.6M

• Incremental Detection: $26.5M


WASHINGTON STATE LABOR & INDUSTRIES

SAS Approach

The solution will be used to detect unregistered employers that are not paying workers

compensation taxes for their employees. SAS Fraud Framework for Government will be a

part of the Department’s fraud solution for workers compensation premium evasion. The SAS

Fraud Framework solution was developed out of the successful proof of concepts of several

other state fraud detection implementations.

Business Problem

L&I is the eighth largest workers‘ compensation insurance company in the country providing

coverage for more than 2.5 million workers employed by 171,000 employers. Employer

fraud and abuse occurs when employers underreport hours, report hours in an improper risk

class with lower premium rates, or don‘t register or pay at all. L&I audits employers‘ business

records to make sure they report accurately and pay the premiums owed. The audit function is

core to determining where abusive or fraudulent behavior is taking place across a workers‘

compensation system that collects premiums and pays out over $1.4 B annually.

Results

SAS Solutions OnDemand is working to consolidate 30 different data sources and create a

single view of employers to better analyze, detect and combat workers‘ compensation fraud.

The Department conservatively estimates a savings of $11 million to $14 million in the

first year of recovered premiums.

Highlights

• SFF results in 8x ROI within

first year of production

• 57% lift over current process

• Incremental estimated save of

$11M - $14M annually

• Foundational platform for

expansion across state

programs

• 30 disparate data sources

integrated and analyzed


LEADING

INSURANCE

PROVIDER

PROPERTY & CASUALTY CLAIMS

CHALLENGES

• Proactive detection of fraudulent medical provider

networks

• Analytic driven approach to assist claims adjustors

• Reduction of false positive rates

SOLUTION (SAS Fraud Framework for Insurance)

• Hybrid approach deployed with text mining

• Integrated FNOL processing with Accenture Claims

Management System

• Integrated with NICB and industry alerts

RESULTS / BENEFITS

98% hit rate on

medical provider

networks

70% reduction of

false positive rates

95% lift over current

process

Copyr i g ht © 2012, SAS Ins t i tu t e Inc . A l l r ights reser ve d . www.SAS.com

http://www.sas.com/

“Association of Certified Fraud Examiners,”

“Certified Fraud Examiner,” “CFE,” “ACFE,” and

the ACFE Logo are trademarks owned by the

Association of Certified Fraud Examiners, Inc.

The contents of this paper may not be

transmitted, re-published, modified, reproduced,

distributed, copied, or sold without the prior

consent of the author.

Date post:	07-Jul-2020
Category:	Documents
Upload:	others
View:	0 times
Download:	0 times

INCREASING INVESTIGATOR EFFICIENCY USING NETWORK …€¦ · •Multiple payments in same day at...

Documents