FIGHTING AGAINST CRIME IN A DIGITAL WORLD DAVID HARTLEY DIRECTOR, SAS FRAUD & FINANCIAL CRIME BUSINESS UNIT

Transcription

1 FIGHTING AGAINST CRIME IN A DIGITAL WORLD DAVID HARTLEY DIRECTOR, SAS FRAUD & FINANCIAL CRIME BUSINESS UNIT

2 AGENDA Fraudsters love digital Fighting back Social Network Analysis

3 BACKGROUND THE DIGITAL BUSINESS Many businesses are embarking on digital transformation programs to fundamentally change their business Successful digital programs need to move across siloed departments and technology to address fundamental business issues and bottle necks Map out and manage the customer journey ( enriching the customer experience, or an outside-in or customer centric view of the organisation ) Move beyond just a distribution channel to incorporate a range of digital technologies Seeking new opportunities outside the confines of the traditional business model

4

5 THE DIGITAL BUSINESS AND FRAUDSTERS LOVE IT Adoption of some technologies, such as telematics will have a positive impact on detecting some traditional insurance fraud claims schemes But the adoption of digital significantly removes the ability for human interaction both at new business stage and during the claims process

6 FINDING THE FRAUD 100 MOTOR CLAIMS

7 FINDING THE FRAUD 100 MOTOR CLAIMS THERE MAY BE 10 POTENTIAL FRAUDS CASES

8 THE DIGITAL INSURER AND FRAUDSTERS LOVE IT So for 90% of customers we want to give a great service both in terms of New business application smooth, quick, transparent Claims fast track, STP, minimal checks But lets not forget the 1 in 10

9 THE DIGITAL BUSINESS KEEPING BAD OUT Real time fraud analytics can help automatically identify potential fraudsters at all stages of their customer lifecycle Allowing the business to automatically route the potential bads into a work stream for more thorough investigation most likely by a human

10 FRAUD ANALYTICS A VARIETY OF TECHNIQUES Unstructured Patterns Complex Patterns Unknown Patterns Anomaly Detection Predictive Modeling Text Mining Database Searches Known Fraud Known Patterns Automated Business Rules Analytic Decisioning Engine Social Network Analysis Unexplained Relationships

11 THE DIGITAL INSURER SUMMARY Don t forget the 1 in 10 in your digital programs Lets not make it easier for fraudsters Real time analytics can act as a first line of defence in digital programs Without impacting the 90% - analytics will make it easier to identify them

12 AGENDA Fraudsters love digital Fighting back Social Network Analysis

13 SNA FOR FRAUD DETECTION WHAT DO I MEAN BY SOCIAL NETWORK ANALYSIS (SNA)? SNA is not the same as Social Media We are identifying the links within the business own data SNA identifies relevant groups of connected customers SNA is not in itself a fraud detection technique We apply analytics to these networks SNA is high volume and automated Covers 100% of customers Occurs before risk assessment - allows SNA Groups to be used for Business Rules, Anomalies and Models Is not the same as manually performed investigator link analysis

14 WALK THROUGH OF A SOCIAL NETWORK

15 LET S START WITH AN ACCIDENT 3 rd party Insured vehicle 1 and vehicle 3 collide V3 Claim 1 st Feb V1 1 st party 1 st party Insured driver claims for bodily injury Injured passenger claims for bodily injury Claim total 14000

16 1 WEEK BEFORE Insured vehicle 2 and vehicle 4 collide Insured driver claims for bodily injury 1 st party 3 rd party Injured passenger claims for bodily injury V2 V4 Claim total st party Claim 25 th Jan

17 3 rd party 3 rd party 1 st party V3 V4 V1 V2 Claim 1 st Feb 1 st party Claim 25 th Jan

18 3 rd party 1 st party P rd party V3 V4 V1 V2 Claim 1 st Feb 1 st party Claim 25 th Jan P1 2013

19 3 rd party 1 st party P rd party V3 V4 V1 V2 Claim 1 st Feb 1 st party Claim 25 th Jan P Both claims on the network have high injury / damage ratio

20 3 rd party 3 rd party and V2 claimant have same family name coincidence? 1 st party P rd party V3 V4 V1 V2 Claim 1 st Feb 1 st party Claim 25 th Jan P1 2013

21 3 rd party 1 st party P rd party V3 V4 V1 V2 Claim 1 st Feb P1 and P2 were paid for by the same credit card strengthens the connection? P st party Claim 25 th Jan

22 3 rd party 1 st party P rd party V3 V4 V1 V2 Claim 1 st Feb 1 st party Claim 25 th Jan P V2 and V4 were both repaired at the same small garage coincidence?

23 LOOK BEYOND THE SINGLE CLAIM Investigators cannot typically achieve this view By analysing the single claim in silo, the potential fraud risk is not immediately clear.

24 SOFTWARE OVERVIEW EXAMPLE INSURANCE FRAUD NETWORK

25 NETWORK GENERATION COMPETING APPROACHES There are three typical network analysis that are taken to tackle fraud: 1. Manual searching The user starts with a lead or a hypothesis and during the course of the investigation they manually build networks or explore connections within the data. Most simple, lowest value Manual Network Manual Investigation Building & Fraud Search Visualisation 2. Using a scorecard to drive an investigation The investigator starts their analysis due to a scorecard / analytical mode. From here they investigate outwards manually to see who else is connected to their known bad. More complex but more valuable Analytic Scorecard Investigation Manual Network Building & Visualisation 3. Automatically build entities and networks and use in the analytics The networks are built automatically on every customer in the data. The outputs from this process can then be used in the analytic scorecard. This delivers significantly more accurate models. During investigation the pre-built networks are simply opened. Extremely complex and hard to horizontally scale but extremely valuable Fraud Automatic Entity & Network generation Analytic Scorecard Investigation Network visualisation Fraud

26 WHERE SNA TYPICALLY DRIVES ADDITIONAL VALUE Visual Scoring Capability Visual representation of data from multiple systems in one single environment Enhanced scoring model with network attributes and scores incorporated Outcome Increased efficiency during fraud investigations Increase in volume of fraud detected Benefit $ Increased operational saving Increased fraud saving

27 PART II: HOW TO USE SNA FIRST FIND YOUR COMMUNITY

28 BUILDING FRAUD NETWORKS Must have DATA FOR INSURANCE CLAIMS FRAUD NETWORKS People Could have Claims Policies Investigations Watchlists Other data: Suppliers Employees / agents 3 rd party, etc Names Dates of birth National IDs Customer IDs Contact details Address Phone numbers s Bank Accounts Organisations Name Reference IDs Tax IDs Policy holders Claimants including 3 rd parties Employees of the ins co Others including witnesses Policy holders, Suppliers

29 SOCIAL NETWORK ANALYSIS LINKS & NODES Links & Nodes Communities Scoring Within SNA we are representing the data by a series of links and nodes Node Node Node The definition of these links and nodes is critical to both the formation of the network and the ease of use for an investigator The appropriate model definition is not always obvious, and must depend upon business context rather than the data format provided. Where SNA projects have failed it is frequently due to not applying an appropriate model

30 SOCIAL NETWORK ANALYSIS LINKS & NODES Links & Nodes Communities Scoring Document entity networks Challenge: Generating accurate real world entities can be complex and time consuming Input record Input record Benefits Time spent up front provides a powerful model for analytics throughout the project This will be the most intuitive way for most investigators to work with the data

31 SOCIAL NETWORK ANALYSIS DOCUMENTS & ELEMENTS Documents Often best thought of as what you might find on a piece of paper these contain all of the data relate to a business understood concept. e.g: Elements Fields within the incoming data that partially or completely identify an entity. e.g: Forename Surname Date of Birth Social security number Telephone number(s) House Number Street Name Zip Code Forename Surname DoB Zip code Doc Social Street name Tel # House number

32 CREATING LINKS AND ENTITIES We link data whenever we have a strong enough match: John Doe is not a strong link John Doe 23 Main Street, Little Town, Texas, may be a strong link There are usually a large number of link types and these combine to form a complex picture: (e.g. for a recent project we used 44 types of link) Name + DOB SSN Claim A Customer ID Address Claim B Phone

33 CREATING LINKS AND ENTITIES To simplify this we use the concept of Entities We combine all links which relate to the same real world object, eg: Person Address Business Phone Vehicle These composite links are effective for building network, for analytics and for visualisation Name + DOB SSN Claim A Customer ID Address Claim B Phone

34 CREATING LINKS AND ENTITIES Not all links are good links, some may represent data quality issues or abnormally common values John Smith or Jo Smythe may live at 2 addresses in the same street is not a valid phone number We need to include functionality to ignore, or obtain more evidence, for links made through values such as these Claim A Claim B

35 ENG METHODOLOGY EXCLUDING OR SOFT DELETING LINKS Valid but overly common information E.g address for student hall of residence Soft delete Invalid data E.g default value (dob = 01/01/1900) Exclude

36 BOUNDING NETWORKS

37 BUILDING FRAUD NETWORKS BOUNDED NETWORKS Now we have our nodes (e.g. Claims, Policies and Entities) and links we can identify our groups The first issue we will find is that all of our data links together into a supercluster Super clusters always happen in densely linked data:

38 SOCIAL NETWORK ANALYSIS BOUNDED NETWORKS Links & Nodes Bounded Communities Networks Scoring However, super-clusters do not represent meaningful communities and must be broken down. A combination of the following methods avoids spurious linking: 1. Rule-based 2. Risk-based 3. Network-Structure 4. Ego-Centric or Seed networks Rules alone often resolve up to 90% of the super-cluster problem

39 SOCIAL NETWORK ANALYSIS BOUNDED NETWORKS SOFT DELETE LINKS Links & Nodes Bounded Communities Networks Scoring Links which are ignored for network building may still be important. In example: Can t connect using staff member Can analyse resulting networks by staff

40 SOCIAL NETWORK ANALYSIS BOUNDED NETWORKS SOFT DELETE LINKS It is critical investigators can chose to expand through obscured nodes. Allowing investigators to explore data in this way can significantly increase value from case

41 SOCIAL NETWORK ANALYSIS SNA METHODOLOGY SUMMARY The high level process for producing social networks is as follows: Documents Documents: Often best thought of as what you might find on a piece of paper these contain all of the data relate to a business understood concept. E.g. Insurance Claim / Policy Banking application Tax return Elements Compounds Entities Networks Elements: fields within the incoming data that partially or completely identify an entity. E.g. Forename Surname Date of Birth Social Telephone number Compounds: An understanding of the real world is used to combine elements into combinations that represent real-world items within the data. E.g: Fore+Sur+DoB Fore+Sur+Hse#+Street+Zip Social Entities: The realworld items that we are trying to model within our fraud solution. E.g. Individual Address Landline Bank Account Address Networks: Groups of strongly connected documents and entities

42 LEVERAGING SNA IN YOUR DETECTION

43 SOCIAL NETWORK ANALYSIS NETWORK SCORING TO FIND FRAUD Once the entities and social networks have been generated, they can (and should) be used within the scoring model There are three levels of scoring: 1. Transaction : The information in the records being considered 2. Entity : Historical view of the behaviour of each entity connected to the document 3. Network : Behaviour across the social network

44 SCORING USING FRAUD NETWORKS EFFECTIVE NETWORK CHARACTERISTICS Once we have effective networks we can apply all other aspects of the hybrid methods to create powerful scores. For example: Basic characteristics of the network Number of claims. Total number of frauds. Shape of the network Prevalence of single supplier Connection between 1 st and 3 rd party SNA characteristics Aggregated risks from the network Ratio of high risk claims Soft Links Similar text used throughout network

45 SCORING USING FRAUD NETWORKS YOU HAVEN T MENTIONED CENTRALITY YET? None of the methods addressed so far have referred to any of the classic SNA methods or measures. The vast majority of SNA theory is based on Homogeneous networks (ie just one node type) Complete networks (ie no information is hidden). This should be applied with caution to our fraud networks which do not meet those assumptions. Our experience is that the basic statistics we ve described are highly effective at finding fraud and more involved methods usually overcomplicate. Once we have strong working solutions this are a promising area for future focus but are not advised for initial phases of a project.

46 KEY TAKEAWAYS Don t forget the 1 in 10 in your digital transformation programs Do embrace SNA as a key technique to identify potential organised fraud

47