INCREASING INVESTIGATOR EFFICIENCY USING NETWORK ANALYTICS

INCREASING INVESTIGATOR EFFICIENCY USING NETWORK ANALYTICS ACFE ANNUAL CONFERENCE ORLANDO, FL JUNE 20, 2012 DAN BARTA CPA, CFE DAVID STEWART CAMS Fraud & Financial Crimes Practice

TOPICS INCREASING INVESTIGATOR EFFICIENCY Fraud Trends and Investigator Challenges Layered Approach to Fraud Detection Using Network Analysis Credit Card Bust-Out Case Study Additional Applications Questions & Answers

FRAUD TRENDS AND INVESTIGATOR CHALLENGES

FINANCIAL CRIMES FRAUD TRENDS Executed corporate account takeover in amount of $20M without ever meeting face to face Highly sophisticated Organized and agile De-centralized High velocity attacks Test and attack multiple channels Faster Payments Global Economy

2011 IPSOS MORI SURVEY Criminal Groups and Employees top list of fraud risks!

FINANCIAL CRIMES SYSTEMS CURRENT CHALLENGES FOR INVESTIGATORS Monitoring and detection systems fail to keep pace with new products / offerings and new schemes Systems exist in product and channel silos Existing systems act on a transaction or account Lack cross-channel view of subject s behavior Few systems block transactions at point-of-service

LAYERED APPROACH TO FRAUD DETECTION INVESTIGATOR IMPACT

LAYERED APPROACH TO ENTERPRISE FRAUD & MISUSE MANAGEMENT GARTNER GROUP, AVIVAH LITAN There are two classes of EFM solutions one detects fraudulent transactions or unauthorized activities as they occur, and one detects organized crime and collusive activities using offline entity link analysis

LAYER 2: NAVIGATION CENTRIC INDUSTRY BEST PRACTICE Real-time Dynamic Data Capture of Customer and Account web behavior activity Moving beyond the realm of web analytics to understand customer web behaviors Builds customer profile for behavior analysis to determine normal vs. abnormal online activity Profile forms foundation for real-time decision using analytics Provides rich data store with an enhanced customer and account view

LAYER 3: CHANNEL CENTRIC INDUSTRY BEST PRACTICE End-to-end enterprise platform that can address a specific channel and provide extensibility across channels ACH Wire Account Customer Profiles Models

LAYER 4: CROSS-PRODUCT CROSS-CHANNEL INDUSTRY BEST PRACTICE Leveraging a Hybrid approach to score transactions Social Network Analysis Automated Business Rules Anomaly Detection and entities across multiple accounts, Analytic Decisioning Engine claims & channels according to the Database Searches Predictive Modeling propensity of fraud Text Mining

LARGE INTERNATIONAL BANK ENTERPRISE FRAUD DETECTION RESULTS / BENEFITS CHALLENGES Enterprise detection on single platform Decision 100% of transactions in real-time Leverage cross-channel data for detection SOLUTIONS (SAS Enterprise Fraud Management) Real-time decisioning for all channels Deployment of custom / consortium models Cross channel signatures SAS Fraud Management 47% better detection (at 20:1 AFPR) Real-time scoring on multiple entities Reduction in IT costs Highest % of accounts closed with zero fraud loss

LAYER 5: ENTITY LINK ANALYSIS INDUSTRY BEST PRACTICE Automated linking of entities to facilitate detection and/or investigation at a network level LINKING ATTRIBUTES Demographic address, phone #, employer, etc. IP address, device id Payments and money transfers Behavioral links ITERATIVE NETWORK BUILD Statistical binding of entities Network Visualization NETWORK SCORING & EVALUATION Bottom-up Top-down Rule and analytic-based scoring Configurable prioritization

USING NETWORK ANALYSIS TO IDENTIFY AND INVESTIGATE ORGANIZED FRAUD RINGS

FIRST PARTY AND ORGANIZED FRAUD RINGS CHARACTERISTICS Perpetrators are patient Establish normal pattern of behavior Exploit unsecured credit Rings use elaborate scams Losses are significant and damage brand reputation CHALLENGE Difficult to detect with siloed detection tools Important to connect the dots to see relationships Combine credit exposures with known fraud losses for holistic view

ORGANIZED FRAUD RING CREDIT CARD BUST-OUT CASE STUDY

CASE STUDY CREDIT CARD BUST-OUT 1 2/13/2007 CL$7500 Legend New Account Opening Credit Card Payments Cash Advances 2 6/4/2008 CL$7700 3 6/18/2008 CL$20,000 4 9/2/2008 CL$7000 MAY JUN JUL AUG SEP OCT NOV DEC JAN FEB MAR APR MAY JUN JUL AUG 2008 2009 5 9/16/2008 CL$10,000 6 11/21/2008 CL$2000 7 1/22/2009 CL$7000

CASE STUDY CREDIT CARD BUST-OUT Legend New Account Opening 1 2/13/2007 CL$7500 Open Credit Card Payments Cash Advances 8/22/2008 2 6/4/2008 3 x $6500 8/29/2008 9/9/2008 2 x $6500 1 x $6500 CL$7700 8/22/2008 2 x $4776 1 x $4776 Closed 2 x $6500 3 6/18/2008 CL$20,000 4 9/2/2008 CL$7000 MAY JUN JUL AUG SEP OCT NOV DEC JAN FEB MAR APR MAY JUN JUL AUG 2008 2009 5 9/16/2008 CL$10,000 6 11/21/2008 CL$2000 7 1/22/2009 CL$7000

CASE STUDY CREDIT CARD BUST-OUT Legend New Account Opening 1 2/13/2007 CL$7500 Credit Card Payments Cash Advances 2 6/4/2008 CL$7700 3 6/18/2008 CL$20,000 9/11/2008 1 x $6700 9/11/2008 2 x $8600 1 x $8500 1 x $8400 1 x $7400 Closed 4 9/2/2008 CL$7000 12/31/2008 1 x $6700 12/31/2008 1 x $6500 2 x $6950 1 x $6000 2 x $6900 1 x $6800 Closed MAY JUN JUL AUG SEP OCT NOV DEC JAN FEB MAR APR MAY JUN JUL AUG 2008 2009 5 9/16/2008 CL$10,000 6 11/21/2008 CL$2000 7 1/22/2009 CL$7000

CASE STUDY CREDIT CARD BUST-OUT 1 2/13/2007 CL$7500 Legend New Account Opening Credit Card Payments Cash Advances 2 6/4/2008 CL$7700 3 6/18/2008 CL$20,000 4 9/2/2008 CL$7000 MAY JUN JUL AUG SEP OCT NOV DEC JAN FEB MAR APR MAY JUN JUL AUG 2008 2009 5 9/16/2008 CL$10,000 10/24/2008 1 x $1400 11/5/2008 1 x $2700 11/10/2008 1 x $2750 11/13/2008 1 x $8700 11/14/2008 4 x $3800 2 x $3600 11/14/2008 2 x $3800 1 x $3700 1 x $3600 Closed 5/2009 6 11/21/2008 CL$2000 11/24/2008 1 x $1800 Open 7 1/22/2009 CL$7000 7/13/2009 1 x $1100 7/17/2009 1 x $6400 1 x $6300 Closed 12/2009

CASE STUDY CREDIT CARD BUST-OUT Legend New Account Opening 1 2/13/2007 CL$7500 Open Credit Card Payments Cash Advances 8/22/2008 2 6/4/2008 3 x $6500 8/29/2008 9/9/2008 2 x $6500 1 x $6500 CL$7700 8/22/2008 2 x $4776 1 x $4776 Closed 2 x $6500 3 6/18/2008 CL$20,000 9/11/2008 1 x $6700 9/11/2008 2 x $8600 1 x $8500 1 x $8400 1 x $7400 Closed 4 9/2/2008 CL$7000 12/31/2008 1 x $6700 12/31/2008 1 x $6500 2 x $6950 1 x $6000 2 x $6900 1 x $6800 Closed MAY JUN JUL AUG SEP OCT NOV DEC JAN FEB MAR APR MAY JUN JUL AUG 2008 2009 5 9/16/2008 CL$10,000 10/24/2008 1 x $1400 11/5/2008 1 x $2700 11/10/2008 1 x $2750 11/13/2008 1 x $8700 11/14/2008 4 x $3800 2 x $3600 11/14/2008 2 x $3800 1 x $3700 1 x $3600 Closed 5/2009 6 11/21/2008 CL$2000 11/24/2008 1 x $1800 Open 7 1/22/2009 CL$7000 7/13/2009 1 x $1100 7/17/2009 1 x $6400 1 x $6300 Closed 12/2009

CASE STUDY CREDIT CARD BUST-OUT COMMON CHARACTERISTICS Minimal merchant activity Payments exceeding balance or credit limit Multiple payments in same day at one or more branches Large and multiple cash advances on same day Payment reversals ACTIONS Monitor for: Multiple payments in same day Payments exceeding balance and/or credit limit Cash advances on same or following day of payments Cash advances as significant % of card activity Payment reversals

CASE STUDY CREDIT CARD BUST-OUT NETWORK ANALYTICS REVEALED Common employer phone number FURTHER INVESTIGATION REVEALED Google search granite and tile company Employer company had no website presence Street view of Google maps indicated a strip shopping center for a building supply company And this was all found without leaving the desk OTHER INVESTIGATIVE STEPS Corporate records search Credit reports Drive-by of address Interview of neighboring tenants Search for additional banking relationships Contact other bank representatives

CASE STUDY CREDIT CARD BUST-OUT Legend New Account Opening 1 2/13/2007 CL$7500 Open Credit Card Payments Cash Advances 8/22/2008 2 6/4/2008 3 x $6500 8/29/2008 9/9/2008 Would you have managed the relationship 2 x $6500 1 x $6500 CL$7700 8/22/2008 2 x $4776 1 x $4776 of Customer #1 and #6 more intently? Closed 2 x $6500 3 6/18/2008 CL$20,000 9/11/2008 1 x $6700 9/11/2008 2 x $8600 1 x $8500 1 x $8400 1 x $7400 Closed 4 9/2/2008 CL$7000 12/31/2008 1 x $6700 12/31/2008 1 x $6500 2 x $6950 1 x $6000 2 x $6900 1 x $6800 How would you have changed the relationship with Customer #4 and #5? Closed MAY JUN JUL AUG SEP OCT NOV DEC JAN FEB MAR APR MAY JUN JUL AUG 2008 2009 5 9/16/2008 CL$10,000 10/24/2008 1 x $1400 11/5/2008 1 x $2700 11/10/2008 1 x $2750 11/13/2008 1 x $8700 11/14/2008 4 x $3800 2 x $3600 11/14/2008 2 x $3800 1 x $3700 1 x $3600 Closed 5/2009 6 7 11/21/2008 CL$2000 11/24/2008 1 x $1800 1/22/2009 CL$7000 Would you have opened accounts #6 and #7? 7/13/2009 1 x $1100 7/17/2009 1 x $6400 1 x $6300 Open Closed 12/2009

NETWORK ANALYSIS VISUAL CREDIT CARD BUST - OUT EXAMPLE Network Visualization

NETWORK ANALYTICS THINGS TO CONSIDER DATA IS KING Volume Sources Internal and External Beginning/end dates Known fraud experiences ORGANIZATION SIZE Larger size/increased opportunity Cross organization RUN FREQUENCY Daily > Weekly > Monthly Level of analysis and alert generation What are you trying to detect?

ADDITIONAL APPLICATION OF ANALYTICS TO ADDRESS FRAUD

LOS ANGELES COUNTY DEPT OF SOCIAL SERVICES Business Problem The Department of Social Services of a large US County was being hit by fraud, waste, and abuse across their public assistance programs. The County engaged SAS to pilot the SAS Fraud Framework to determine if the data analytics and visualization solution could assist in proactively detecting both opportunistic and organized fraud in the Childcare program. Highlights 32 times increase in # of fraud rings detected annually Incremental estimated save of $31.1M annually 83% correct hit rate on provider fraud 40% correct hit rate on participant fraud 6 years of historical data from 5 data source systems SAS Approach SAS subjected 6 years of historical data from 5 different source systems (including claims, payments, application, 3 rd party, and fraud case data) to the predictive capabilities of the SAS Fraud Framework. Client investigators evaluated the solution results during a 3 week validation period against 3 main categories of cost avoidance: investigative efficiency, earlier detection of fraudulent providers & participants, and incremental detection of fraudulent providers & participants. Results The pilot resulted in a business case and deployment roadmap for full implementation, Investigative Efficiency: $3.0M (saved across 40 investigators) Earlier Detection: $1.6M Incremental Detection: $26.5M

WASHINGTON STATE LABOR & INDUSTRIES Business Problem Highlights SFF results in 8x ROI within first year of production 57% lift over current process Incremental estimated save of $11M - $14M annually Foundational platform for expansion across state programs 30 disparate data sources integrated and analyzed L&I is the eighth largest workers compensation insurance company in the country providing coverage for more than 2.5 million workers employed by 171,000 employers. Employer fraud and abuse occurs when employers underreport hours, report hours in an improper risk class with lower premium rates, or don t register or pay at all. L&I audits employers business records to make sure they report accurately and pay the premiums owed. The audit function is core to determining where abusive or fraudulent behavior is taking place across a workers compensation system that collects premiums and pays out over $1.4 B annually. SAS Approach The solution will be used to detect unregistered employers that are not paying workers compensation taxes for their employees. SAS Fraud Framework for Government will be a part of the Department s fraud solution for workers compensation premium evasion. The SAS Fraud Framework solution was developed out of the successful proof of concepts of several other state fraud detection implementations. Results SAS Solutions OnDemand is working to consolidate 30 different data sources and create a single view of employers to better analyze, detect and combat workers compensation fraud. The Department conservatively estimates a savings of $11 million to $14 million in the first year of recovered premiums.

LEADING INSURANCE PROVIDER PROPERTY & CASUALTY CLAIMS RESULTS / BENEFITS CHALLENGES Proactive detection of fraudulent medical provider networks Analytic driven approach to assist claims adjustors Reduction of false positive rates SOLUTION (SAS Fraud Framework for Insurance) Hybrid approach deployed with text mining Integrated FNOL processing with Accenture Claims Management System Integrated with NICB and industry alerts 98% hit rate on medical provider networks 70% reduction of false positive rates 95% lift over current process

www.sas.com

Association of Certified Fraud Examiners, Certified Fraud Examiner, CFE, ACFE, and the ACFE Logo are trademarks owned by the Association of Certified Fraud Examiners, Inc. The contents of this paper may not be transmitted, re-published, modified, reproduced, distributed, copied, or sold without the prior consent of the author.