acumen insight ideas Forensic Data Mining Finding Needles in the Haystack Presented by Angela Morelock, CPA, CFE, CFF, ABV, Certified Forensic Accountant BKD, LLP attention reach expertise depth agility talent Bank Fraud Investigations Kickbacks on loans Data center manager online entries to move money to personal accounts CFO walking transactions to proof moving money to personal account Fictitious loans recorded by bank presidents & chief lending officers Fictitious financial statements submitted by business customers SBA loan fraud
Bank Fraud Investigations Undisclosed ownership interests in loan customers & conflicts of interest Host of schemes to manipulate past due loans &/or payment dates or roll loans over & over Variety of purchasing schemes generally amounting to paying personal expenses Schemes by bank customers to abscond with various types of loan collateral (often in bankruptcies) Trust officers misusing customer funds Straw Loans & Reg O Violations acumen insight ideas attention reach expertise depth agility talent 2008 by the Association of Certified Fraud Examiners, Inc.
Cost of Fraud & Abuse $994 billion annually 7% of revenues 42% recover nothing after fraud is discovered Victim Organizations 2008 by the Association of Certified Fraud Examiners, Inc. 6
Victim Organizations Occupational Fraud Schemes in Banking & Financial Services Industry (132 cases) 11 11 The sum of percentages in this chart exceeds 100 percent because several cases involved multiple schemes from more than one category. 7 2008 by the Association of Certified Fraud Examiners, Inc. Profile of Fraud Perpetrator Male or female No prior criminal history (<8%) Well liked by co-workers Likes to give gifts/compulsive shopper Gambling problems not unusual Long-term employee Rationalizes: Starts small or borrows Lifestyle clues
Bank Specific Characteristics Credit problems NSF in personal accounts Unusual transactions in personal accounts Management override of internal controls Less experienced employees unknowingly aid Second person signs off on transaction based on trust Why Forensic Data Mining? 30% of all frauds are found by analysis vs. tips, accidental discovery & disclosure (David Coderre, Fraud Detection: A Revealing Look at Fraud ) More efficient & effective than traditional sampling Can help find needle in a haystack 100% analysis is the most effective way to analyze for fraud (Dr. Conan Albrecht, BYU)
Data Cleansing 417-865-8701, (417)865-8701, 8658701, 417-8658710 Missoura, MO, Mis, Miss, MZ, MS, Miz, Mizz 507-02-4567, 507024567, 507 02 4567 PO Box 34, P.O. Box 34, Box 34, Bx 34, P.O Box 34 Mallery, Malery, Mallrey, Mallory, Malory Common Data Mining Areas Employees & Payroll Vendors & Accounts Payable Expense Reimbursement Loans (for financial institutions only) Sales Inventory
Vendor Trending Analysis Time Series Analysis: Acceleration Vendor: JLM Plumbing Authorized: Janice L. McPhearson Acceleration as confidence builds Getting Greedy Test phase Name Mining Anagrams
Name Mining Anagrams Address Mining Maildrops Fictitious Vendor with UPS Store Address
Name & Address Mining Name & ID analysis Direct matching Phonetic matching (Double Metaphone Hybrid) Compare to known name dictionaries Anagram search Duplicate Employee ID / SSN, Invalid SSNs Address analysis Direct matching No address, invalid address, PO/RR address Proximity by latitude/longitude lookup Address is known mailbox service (FedEx Kinkos, UPS Store, etc.) Visual Map Analysis Address Matching Address match example
Employee Vendor Proximity Benford s Law Analysis
Benford s Law Payroll Normal Pattern Benford s Law Payroll Abnormal Pattern?
Benford s Law A/P Benford s Law A/P
Check Sequence Analysis Accounts Payable Mining AP: Fictitious vendors, duplicate payments, etc. Benford s analysis Acronym search on employee name Acceleration (systematic spending increases) via time series analysis Duplicate invoices Duplicate payments Identify invoices in excess of n% of vendor average Compare PO/invoice amount to check amount Identify transactions ending in 5 or 0 Baseline vendor activity against overall activity Classify transactions by clerk/approver Compare multiple vendor master files over 3 years Identify statistical outliers (Z-score method)
Payroll Mining Payroll detail Employees with no deductions PR activity subsequent to termination Employee vs department baselines ($ & hrs) Department vs company baselines ($ & hrs) Benford's analysis of gross / net payroll Time series analysis Employee with no sick/vacation/time off Computed pay rate vs. Employee master rate Compare actual pay rates to rate schedule Other analysis Duplicate phone number(s) Duplicate direct deposit accounts Short duration of hire/termination Loan Master & Maintenance Fictitious loans Straw loans Unknown relationships Subprime lending Multiple renewals Slow or no amortization Manipulation of past due loans Manipulation of due dates
Loan Maintenance File Interest rate manipulations Past due manipulations Maintenance by user Be Alert To PO boxes Unusual items being passed at teller line Suspense accounts do not reconcile Trust activity w/o proper authorization TIN used on accounts with different names No phone Business account w/ no business phone
Be Alert To Transactions brought directly to proof Loans to employees not meeting requirements Insiders loaning personal funds to customers or borrowing from customers Insiders appear to give or receive favors to (from) customers Insiders involved in business that borrows from bank Be Alert To Insider with heavy debt that appears to require most or all of salary Financing of insider sale of personal assets to third party Insider relationship with shady characters or high rollers Insider keeps unusual number of customer files at their desk
Be Alert To Insider making payments on another borrower s loans Insider frequently takes documents outside bank for customer signature Insider processes transactions in absence of customer as special favors Changes to loan master file due dates Detection of Fraud Schemes Initial Detection of Occupational Frauds 4 4 The sum of percentages in this chart exceeds 100 percent because in some cases respondents identified more than one detection method. 2008 by the Association of Certified Fraud Examiners, Inc.
Five Things to Remember 1. Review personal accounts of employees & officers 2. Perform data mining of loan master & maintenance files 3. Train tellers not to accept unusual transactions from insiders 4. Encourage questioning & reporting unusual transactions have confidential hotline 5. Be aware of relationships between insiders & loan customers Questions?
Contact Information Angela Morelock, CPA, CFE, CFF, ABV, Certified Forensic Accountant BKD, LLP 901 E. St. Louis Street Springfield, MO 65801-1190 Phone: 417.865.8701 Fax: 417.865.0682 Email: amorelock@bkd.com