SAS Forum. Transactional Fraud. Filip Verbeke, Sales Manager Fraud Solutions South West Europe. Copyright 2015, SAS Institute Inc. All right reserved.

Transcription

1 SAS Forum Transactional Fraud Filip Verbeke, Sales Manager Fraud Solutions South West Europe

2 Digital channels are under attack. Key Business drivers A need for multi-layer, analytics-driven & real time detection Increase organisational efficiency Reduce fraud losses and false positives and improves value detection rates Tackling money mules Improve customer experience and bank s reputation

3 Cyber Security CYBER THREAT LANDSCAPE FOR BANKS An ever-changing myriad of attack vectors Mules Pre-pay Debit cards Threat hits people or IT, outcome is fraud or denial of service Business Customers Tamper with payment files Online Retail Customers Phishing / social engineering for credentials Man-in-themiddle attack Account take-over Phone Fax Cards Account teams Payments Payee setup Account creation IT Teams Time-bombed destructive patches False Tx Merchants Stolen cards Weak 3 rd parties with card data Collect CC data Sell CC data Collect CC data Infect machine / execute Tx Spear phishing & infection

4 Cyber Security CYBER FRAUD Data Sources Data Integration / Analytics / Kill chain analysis End user services Logs and alerts Bank Business Tx Enhance data / Networked data Detection and Alerting Prioritised alerts Reporting / explore & search data Firewalls / IDS / SIEM Anti-Virus Pre-filter IT activity Machine logs Web logs External bad lists Pre-filter Pre-filter Business Tx activity Internet activity Hybrid Analytics Model Case Management

5 Cyber Security CYBER SECURITY Data Sources Data Integration / Analytics / Fraud models End user services Logs and alerts Accounts Enhance data / Networked data Detection and Alerting Prioritised alerts Reporting / explore & search data Financial Tx Nonfinancial Tx Pre-filter Tx Staff activity Cyber alerts External bad lists DQ Aggregate Entity Network Hybrid Analytics Model Case Management

6 The technology response CYBER CRIME IS A BIG DATA STORY USER EXPERIENCE & MANAGEMENT Data Input Build Scenarios Simulation / Deployment (Simulation available in GA Release) Alert Generation / Case Management Monitor & Report SAS LASR ANALYTIC SERVER BATCH/ IN-DATABASE SAS DEPLOYMENT ENVIRONMENTS IN-MEMORY REAL-TIME & STREAMING Copyr i g ht 2012, SAS Ins titut e Inc. All rights res er ve d.

7 Event Stream Processor

8 SAS SECURITY INTELLIGENCE LAYERED APPROACH Companies are reevaluating how they tackle security since a fragmented approach is consistently leaving organizations at greater risks of attack. A more holistic approach to security ensures all layers of protection function together. Avivah Litan, VP Distinguished Gartner Analyst Copyr i g ht 2012, SAS Ins titut e Inc. All rights res er ve d.

9 ONLINE BANKING PAYMENTS FRAUD

10 SAS Fraud Framework POINTS OF VULNERABILITY FOR ONLINE FRAUD OPEN BOX SOLUTION COVERING ALL AREAS Point of compromise Score incoming transactions for: Anomalous behaviour Change of details Drain of funds from savings account (me2me transfers) Customer behaviour Score customers over their lifetimes for: Possible mule accounts Victim propensity Appearance on a watch-list Unusual behaviour Point of exit New beneficiaries Velocity of transactions Suspicious session activity Create alerts!

11 Real time, in memory

12 High performance analytics UNIQUE HYBRID APPROACH TO ANALYTICS SNA (example): Links to mule account such as a shared mobile number Predictive modelling (example): Model based on variables such payment amount and balance Anomaly detection (example): The client is accessing their account from a new channel Business rule (example): Transaction above $xx to a new beneficiary Database Searches (example): Looking for matches across the Black-lists Database Searches (example): Looking for matches across the Black-lists Text mining (example): Transaction narrative showing suspicious payments

13 Real Time Decisioning

14 CASE STUDY

15 What was the problem?

16 FMF Project POTENTIAL PHASE I IMPACT AS-IS Average alerts per day 50% detection rate 0,01% of alerts are fraud PHASE I* Average +-40 alerts per day 90% Detection rate 2,5% of alerts are fraud * Indicated by an analysis on historical data no guarantees towards future performance

17 MULE SCORECARD ASSESSMENT ROC CHART ROC on Validation = The ROC chart shows how well the model is able to be specific (catch only bads ) and sensitive (catch all bads simultaneously). Sensitivity and 1-Specificity are displayed for various cutoff values. The more the chart bends to the top left, the better. The ROC measures the area under the curve. The bigger the area, the better the model. A perfect model will have a ROC close from 1. ROC >0.9 very good model ROC > 0.8 good model ROC > 0.7 ok model Sensitivity = True Positive Rate = TP / (TP + FN) Specificity = True Negative Rate = TN / (FP + TN)

18 SCORECARD PAYMENTS EXAMPLE TRANSACTION SCORED Transaction Amount: 3499 eur Beneficiary has a very high mule probability Benef is BNP Customer and Nationality is Belgian Preceding transaction is MetoMe Preceding transaction is in last 15 min Originator has more than 63 year old Originator is french speaking Transaction time is 4pm on friday Communication Field is not blank = = 421 points > CUT-OFF Alert

19 FRAUD ARCHITECTURE OVERVIEW Data Treatment Analytical environment Discovery (Ad-Hoc) Modelling & Scorecards Rule Authoring Simulation Performance Monitoring Analytics DB Detection Fraud Treatment Recurrent Batch Offline Detection Near real-time Alert & Case Management Detection DB Real-Time Real-time Detection Reporting Copyri ght 2013, S A S I nst i t ut e I nc. A l l ri ght s reserved.

20 SAS Fraud Framework SOLUTION BENEFITS More suspicious cases identified Including both previously undetected fraudulent networks and extensions to already identified fraud Reduction in false positive rates Significant improvement in quality of suspicious cases past for investigation Improved investigation efficiency Each referral taking 1/2 1/3 the time to investigate using SAS link analysis visualization One consistent, end to end, underlying platform Platform can also be leveraged for credit risk, card risk, AML and FATCA

21 CARD FRAUD

22 trends CARD FRAUD Unlimited Operation Targeted 2 Payments Processors RAKBANK (United Arab Emirates) Bank of Muscat (Oman) 10 hours 24 countries 36,000 transactions $40 million USD

23 ADVANCED ANALYTICS Advanced patent analytics to detect risk exposure and fraud with less customer inconvenience. Multi-entity Statures Hybrid Model Technology (Custom) Enhanced API Enterprise Platform Single Platform processing for all Products & Channels; Deposit, ACH, Wire, Cards, Payments, Acquirer, Mobile Banking, Online, etc. Copyright 2012, SAS Institute Inc. All rights reserved. SAS Fraud Management Solution Integration Integration with other fraud/risk solutions (Link Analysis, AML, etc.) Fraud Management Operation Multi-Org structure to manage multiclient (Processor) or Silo environment. Separation of data, cases and rules control per business requirements 100% Real-Time Decision Ability to score and decision 100% of all transaction types in real-time, all LOBs.

24 NEURAL NETWORK MODEL COMPONENTS Input Signatures Transaction Geographic data Neural Network Model OUTPUT Score with Reason Codes

25 HSBC Case Study Enterprise Fraud Detection Highlights Ability to decision 100% of ALL transactions in real-time Enhanced signature approach that incorporates cross-product / cross channel data Ability to leverage additional data in fraud decision process (expanded API to include non-monetary, e-banking, mobile channel, etc ) Incremental fraud detection over incumbent SAS detects 47% more fraud at 20:1 AFPR. Enterprise Solution Establish platform for transaction decisioning across all bank products and channels

26 CLIENT EXAMPLE ONE OF AMERICA S LARGEST BANKS Challenges Source data once and use across many different business purposes Modernize analytics approach for banks largest credit cad portfolio Generate more revenue from enhanced risk based approach to credit & fraud decisioning Enterprise analytical approach: s Striking balance between customer experience and fraud losses Real time credit & fraud decisions Replacing home grown system ROI: 100 million $ in Y1, of which 60 million $ from new revenue and 40 million $ from fraud loss reduction. Operational cost reduction: from 3000 rules to 100 rules and a single model Credit and fraud : credit decisioning + fraud decisioning single data source

27 CYBER SECURITY

28 Cyber Security MANY POTENTIAL DATA SOURCES ENTERPRISE STORAGE Netflow / IP traffic Door swipe Web Proxy Business Tx External hotlist HP ArcSight IBM Q1 Labs Quest Software Splunk SIEM ACTIVE DIRECTORY DATABASE INTERNET ROUTER FIREWALL IPS/IDS WORKSTATION APPLICATON SERVER Cisco CheckPoint Cisco Juniper Networks McAfee Kapersky Labs MS SCOM SAP ERM Palo Alto Networks Fortinet Tipping Point SourceFire Trend Micro Semantec SNMP VMWARE

29 SAS solution Current Environment: Hundreds/Thousands of alerts per day Ad-hoc and reactive Rules & Signature based Future State: SAS Advanced Analytics High Performance Analytics + Real Time Decisioning Hybrid Analytics to derive contextual awareness & risk prioritization Identify patterns of behaviors, compromised accounts & high risk activity Ability to identify the threat before the data loss Copyr i g ht 2014, SAS Ins titut e Inc. All rights res er ve d.

30 New release NETFLOW ANALYTICS FEATURES Contextual data enrichment. Augments network flow with business information and external threat data to detect cyberrisks based on your specific business workflows "Right-timed," multilayered analytics. Optimizes the speed and complexity of analytics across the real-time, near-time and "any-time" continuum for faster and deeper situational awareness Visual data exploration. Enables risk exploration without requiring previous analytics knowledge or expertise Continuously updated intelligence. Behavioral analytics automatically evolve cyberanalytic models based on new events, new data and new context. Cost-efficient, optimized data storage. Reduces your storage footprint by saving only the relevant data for analysis on commodity hardware.

31 SAS Forum