Real-time payment transfer fraud detection

Transcription

1 Real-time payment transfer fraud detection Wim Bartsoen Head of Information Security Governance, Norms, Monitoring & Control BNP Paribas Fortis 14/10/2014 1

2 Electronic Transfer Fraud: FMF Project Problem Statement 14/10/2014 2

3 Electronic Transfer Fraud: Prevalent Modus Operandi Victim Mules Cash-out Current Account 15:11 15:13 15: ATM POS ATM POS ATM :08 15:14 15:45 16: Saving Account 15:18 15:39 15:42 16: :11 17: S 1 S 2 8 POS ATM ATM POS ATM POS ATM POS transfert /10/

4 Electronic Transfer Fraud Figures Sector Level But Needles in a Haystack: In 2013 approx. 1 fraud case per e banking sessions Febelfin Press Releases 14/10/2014 4

5 Challenges : Rapidly changing Modus Operandi Malware Malware/Phishing Phishing/Vishing Modus Operandi changes very rapidly, detection based on technical logs is easily worked around by fraudsters 14/10/2014 5

6 Challenges : Existing Fraud Detection System Manual Batch-based Automated Payment Processing tends to zero, the moneygone time as well : Fraud detection must be realtime and should keep false positives to a minimum 14/10/2014 6

7 The Fraud Management Foundation (FMF) project Objectives Tooling and organization Properly detect payment transfer related fraud Reduce operational losses Provide a solid foundation for the future Key requirements for a solid foundation Include analytics and profiling capability Support end to end management of fraud Modus Operandi agnostic 14/10/2014 7

8 HL Solution Channels logging Technical log (real time) Clients Accounts Cards Referential information... Payments ETL Engineering Tool Payment Engines Filtering Transactions in scope ETL Detection Engine Scoring engine Fraud Case Management Anti Fraud Modeling team Suspect? No Yes No Case management Real Fraud? Fraud investigation team Yes Fraud Management Foundation (FMF) 14/10/2014 8

9 HL Phase 1 Planning Phase 1 scope: detect on us electronic transfer fraud by means of mule profiling; Initial Baseline Plan vs. Current Exception Plan: July /11/ /01/ /02/ /04/ /05/ /06/ /10/2014 July /10/2014 Main Reason for Delay: Initial aggressive baseline plan pushed quality risks (mainly related to performance) of the solution into the test phase; SC Decision to postpone UAT to allow for rework in order to fix quality issues. 14/10/2014 9

10 A Word About Vendor Selection Logic 14/10/

11 Phase 1 Detection Logic Current system vs Phase I Detection logic KPI s Test Data: December 2013 till February 2014 Average alerts per day Average 97 alerts per day 52,78 % fraud cases detection rate 90.28% fraud cases detection rate 3 out of alerts are fraud 3 out of 397 alerts are fraud In phase 1 detection logic is based only on PE input and DWH information; channel info is not yet used (as opposed to FRDB) 14/10/

12 Further Evolutions In scope of project phase 2: In bound credit transfers: to detect if we are on the receiving end of a fraudulent transaction; External Beneficiaries: detect on other fraud; Engineering Tool (VSD) & Process; Leveraging Channel Logs (aka. technical logs); Case Mgmt improvements; Ideas for Later: Consolidate other fraud case mgmt. tools; 14/10/

13 But then What other measures contributed to the drop of fraud figures observed for 2014? Delay of booking at beneficiary side of transfer: frustrates fraudster coordination with mules; Arrests in February 2014 of members of the criminal gang behind phishing fraud; Returns on Intensive awareness campaigns among both clients (Febelfin Campaigns) and internal employees (elearning; etc.); Efficiency gains from sector level intelligence sharing; Etc Note though that this does not invalidate the business case for FMF: in the mean time new MO s have appeared that require a sustained focus on building a comprehensive and performant payment fraud detection capability. 14/10/

14 Conclusions Payment Transfer Fraud is dynamic and assymetrical Counteract with a mix of operational, tactical and strategic countermeasures; Real time, channel independent fraud detection is at tactical/strategic level; Deployment lead times are important; Consider data privacy regulation (legitimate purpose; need to know); 14/10/

15 TWITTER CONTEST 3. What was the most observed practice for comitting credit transfer fraud in 2013? A. Malware B. Phishing and vishing C. Malware and then phishing Tweet your answer: 3 A Start of your tweet Question # Your answer 14/10/