Forensic Data Mining Finding Needles in the Haystack. Bank Fraud Investigations

Size: px

Start display at page:

Download "Forensic Data Mining Finding Needles in the Haystack. Bank Fraud Investigations"

Wilfrid Austin
5 years ago
Views:

1 acumen insight ideas Forensic Data Mining Finding Needles in the Haystack Presented by Angela Morelock, CPA, CFE, CFF, ABV, Certified Forensic Accountant BKD, LLP attention reach expertise depth agility talent Bank Fraud Investigations Kickbacks on loans Data center manager online entries to move money to personal accounts CFO walking transactions to proof moving money to personal account Fictitious loans recorded by bank presidents & chief lending officers Fictitious financial statements submitted by business customers SBA loan fraud

Bank Fraud Investigations Undisclosed ownership interests in loan customers & conflicts of interest Host of schemes to manipulate past due loans &/or payment dates or roll loans over & over Variety

2 Bank Fraud Investigations Undisclosed ownership interests in loan customers & conflicts of interest Host of schemes to manipulate past due loans &/or payment dates or roll loans over & over Variety of purchasing schemes generally amounting to paying personal expenses Schemes by bank customers to abscond with various types of loan collateral (often in bankruptcies) Trust officers misusing customer funds Straw Loans & Reg O Violations acumen insight ideas attention reach expertise depth agility talent 2008 by the Association of Certified Fraud Examiners, Inc.

3 Cost of Fraud & Abuse $994 billion annually 7% of revenues 42% recover nothing after fraud is discovered Victim Organizations 2008 by the Association of Certified Fraud Examiners, Inc. 6

Victim Organizations Occupational Fraud Schemes in Banking & Financial Services Industry (132 cases) 11 11 The sum of percentages in this chart exceeds 100 percent because several cases involved

4 Victim Organizations Occupational Fraud Schemes in Banking & Financial Services Industry (132 cases) The sum of percentages in this chart exceeds 100 percent because several cases involved multiple schemes from more than one category by the Association of Certified Fraud Examiners, Inc. Profile of Fraud Perpetrator Male or female No prior criminal history (<8%) Well liked by co-workers Likes to give gifts/compulsive shopper Gambling problems not unusual Long-term employee Rationalizes: Starts small or borrows Lifestyle clues

5 Bank Specific Characteristics Credit problems NSF in personal accounts Unusual transactions in personal accounts Management override of internal controls Less experienced employees unknowingly aid Second person signs off on transaction based on trust Why Forensic Data Mining? 30% of all frauds are found by analysis vs. tips, accidental discovery & disclosure (David Coderre, Fraud Detection: A Revealing Look at Fraud ) More efficient & effective than traditional sampling Can help find needle in a haystack 100% analysis is the most effective way to analyze for fraud (Dr. Conan Albrecht, BYU)

6 Data Cleansing , (417) , , Missoura, MO, Mis, Miss, MZ, MS, Miz, Mizz , , PO Box 34, P.O. Box 34, Box 34, Bx 34, P.O Box 34 Mallery, Malery, Mallrey, Mallory, Malory Common Data Mining Areas Employees & Payroll Vendors & Accounts Payable Expense Reimbursement Loans (for financial institutions only) Sales Inventory

7 Vendor Trending Analysis Time Series Analysis: Acceleration Vendor: JLM Plumbing Authorized: Janice L. McPhearson Acceleration as confidence builds Getting Greedy Test phase Name Mining Anagrams

8 Name Mining Anagrams Address Mining Maildrops Fictitious Vendor with UPS Store Address

9 Name & Address Mining Name & ID analysis Direct matching Phonetic matching (Double Metaphone Hybrid) Compare to known name dictionaries Anagram search Duplicate Employee ID / SSN, Invalid SSNs Address analysis Direct matching No address, invalid address, PO/RR address Proximity by latitude/longitude lookup Address is known mailbox service (FedEx Kinkos, UPS Store, etc.) Visual Map Analysis Address Matching Address match example

10 Employee Vendor Proximity Benford s Law Analysis

11 Benford s Law Payroll Normal Pattern Benford s Law Payroll Abnormal Pattern?

12 Benford s Law A/P Benford s Law A/P

Duplicate payments Identify invoices in excess of n% of vendor average Compare PO/invoice amount to check amount Identify transactions ending

13 Check Sequence Analysis Accounts Payable Mining AP: Fictitious vendors, duplicate payments, etc. Benford s analysis Acronym search on employee name Acceleration (systematic spending increases) via time series analysis Duplicate invoices Duplicate payments Identify invoices in excess of n% of vendor average Compare PO/invoice amount to check amount Identify transactions ending in 5 or 0 Baseline vendor activity against overall activity Classify transactions by clerk/approver Compare multiple vendor master files over 3 years Identify statistical outliers (Z-score method)

14 Payroll Mining Payroll detail Employees with no deductions PR activity subsequent to termination Employee vs department baselines ($ & hrs) Department vs company baselines ($ & hrs) Benford's analysis of gross / net payroll Time series analysis Employee with no sick/vacation/time off Computed pay rate vs. Employee master rate Compare actual pay rates to rate schedule Other analysis Duplicate phone number(s) Duplicate direct deposit accounts Short duration of hire/termination Loan Master & Maintenance Fictitious loans Straw loans Unknown relationships Subprime lending Multiple renewals Slow or no amortization Manipulation of past due loans Manipulation of due dates

15 Loan Maintenance File Interest rate manipulations Past due manipulations Maintenance by user Be Alert To PO boxes Unusual items being passed at teller line Suspense accounts do not reconcile Trust activity w/o proper authorization TIN used on accounts with different names No phone Business account w/ no business phone

16 Be Alert To Transactions brought directly to proof Loans to employees not meeting requirements Insiders loaning personal funds to customers or borrowing from customers Insiders appear to give or receive favors to (from) customers Insiders involved in business that borrows from bank Be Alert To Insider with heavy debt that appears to require most or all of salary Financing of insider sale of personal assets to third party Insider relationship with shady characters or high rollers Insider keeps unusual number of customer files at their desk

Be Alert To Insider making payments on another borrower s loans Insider frequently takes documents outside bank for customer signature Insider processes transactions in absence of customer as special

17 Be Alert To Insider making payments on another borrower s loans Insider frequently takes documents outside bank for customer signature Insider processes transactions in absence of customer as special favors Changes to loan master file due dates Detection of Fraud Schemes Initial Detection of Occupational Frauds 4 4 The sum of percentages in this chart exceeds 100 percent because in some cases respondents identified more than one detection method by the Association of Certified Fraud Examiners, Inc.

18 Five Things to Remember 1. Review personal accounts of employees & officers 2. Perform data mining of loan master & maintenance files 3. Train tellers not to accept unusual transactions from insiders 4. Encourage questioning & reporting unusual transactions have confidential hotline 5. Be aware of relationships between insiders & loan customers Questions?

19 Contact Information Angela Morelock, CPA, CFE, CFF, ABV, Certified Forensic Accountant BKD, LLP 901 E. St. Louis Street Springfield, MO Phone: Fax:

Internal Bank Fraud Schemes & Scams in an Economic Downturn. Fictitious Loans. Bank Fraud Investigations. Tracking spreadsheet Affidavit 1 Affidavit 2

acumen Internal Bank Fraud Schemes & Scams in an Economic Downturn Presented by Angela Morelock, CPA, CFE, CFF, ABV, Certified Forensic Accountant insight ideas attention reach expertise depth agility