1. Leveraging Technology in the Battle against Financial Fraud
Maria Loughlin
April, 2012
© Memento, Inc – All Rights Reserved

2. Exploring fraud and fraud management
Through the lens of a Financial Institution (FI)
What are the threats, emerging channels and evolving risks?
How to respond?
Through the lens of a technologist
How can technology help?
What lies ahead?

3. Sure, you’ve heard about Bernie and Jerome…

4. … but can you pick out the fraudster here?
Amy Lynette Sanders Grand Rapids, Michigan
Ray Van Norman
Omaha, Nebraska
Jane Wolff
Yarmouth, Massachusetts
Branch Manager. Transferred funds from customer accounts into her own – for over 3½ years.
Chairman and CEO.
Stole $5.7 million by creating fictitious lines of credit over a 10-year period.
Husband and wife pair Benjamin Wolff (79) and Jane (72) wrote fraudulent checks for hotels, inns, and stores in Concord, Newburyport, Rockport, and Andover. .

5. Sobering bank fraud statistics5
As much as 35% of operational loss in financial services is fraud – that’s $20B annually
A mid-size US bank loses $50M to check fraud annually
A top 10 credit card issuer loses $ M to first party credit card fraud annually
60% of bank fraud involves an insider
Identity theft cost the US $48B in 2008
40% of ID theft is committed by collusive criminal networks
Sources:
KPMG, Celent, ABA, Tower Group, Javelin Research, CIMIP

6. Is Fraud A Trillion Dollar Problem Globally?6
Banking
$20B
Healthcare
$125B
Brokerage/Securities
$150B
$502 billion
US fraud losses
Mortgage
$10B
Insurance
$100B
Retail
$42B
Telecom
$55B
Sources: TowerGroup, Stanford Law School, Cornerstone Research, The Prieston Group , U.S. Dept. of Health & Human Services, U.S. Dept. of Justice, National Retail Federation, FIINA

7. Why does bank fraud continue to be a problem?
New products and channels expose new schemes
Defenses usually come long after new schemes are hatched
Fraud is a business
Highly leveraged schemes
Increased role of organized crime
Weak defenses
Low efficiency, increasing cost
Complex problem, disconnected data and systems, limited innovation
Failure to comprehensively monitor accounts, account touch points

8. Top 5 fraud threats (2012) Source: 2012 Faces of Fraud survey
Banks were asked to list their top 5 threats
Credit and Debit Fraud: % rank card fraud as their top threat
Check Fraud : Despite declines in the volume of checks processed annually, 76% say check fraud remains an issue
Phishing and Vishing (Socially Engineered Schemes): 50% rank these schemes among the top five threats
ACH and Wire Fraud (Account Takeover): 43% ranked ACH and wire fraud among the top threats
ATM Fraud (Skimming and Ram Raids): 35% rank ATM fraud as a top threat
Source: Faces of Fraud survey
Sponsored by Authentify, Guardian Analytics, i2, RSA Security, Wolters Kluwer Financial Svcs

9. Payments trends that affect fraud
Emerging technologies and rapid innovation
Increase in # of players involved in the payments supply chain
Increase in # of payment options for consumers
Shift from Credit/Debit to ACH via Payment Services
Evolving fraud
Cross channel fraud
International organized crime rings
Increased speed of use from compromise to fraud
Shift in target
From mega data breaches to smaller merchants
Filtering down to rural areas
Changing consumer views
More open to alternative payments
More conscious of security, yet willing to share personal information with “friends”

10. Losses continue to grow: SAR by the numbers
© Memento, Inc – All Rights Reserved
Losses continue to grow: SAR by the numbers
SARs Submitted
Total: 5,549,559
Check Fraud: 1,141,498
Money Laundering: 3,013,569
%of total SARs for check and ML: range Avg. 74.4

11. Through the Lens of a Financial Institution

12. Why do banks care about fraud?
Fraud losses go straight to the bottom line
Perceptions of insecurity leads to
Reputational risk
Customer retention challenges
Operational expense
Regulatory oversight/fines
Calls for more regulation

13. “Stop them from stealing”
How do banks respond?
“Keep the bad guys out”
IT/network security
Online authentication
Applicant screening
Focused on protecting the perimeter
“Stop them from stealing”
Transaction monitoring
Employee monitoring
List checking
Focused on protecting customer accounts
“Break the cycle”
Investigate cases
Prosecute criminals
Report to FINCen
Focused on preventing future attacks
TowerGroup estimates that for each $1 spent on fraud management, fraud losses will be reduced by $8

14. Implement comprehensive approach across all channels and products
Deposit Account
Check
ACH
(Origination)
Wire
Debit
On-Us (incl. ACH Conversions)
Kiting
Deposit
Online
ATM
Call Center
Branch

15. Regulation also drives FI action
Layered Security FFIEC Guidance
2005: The Federal Financial Institutions Examination Council (FFIEC) issued guidance to banks on standards for Internet banking
2007: Banks responsible for compliance
Of 200+ respondents:
58% say their institutions will increase fraud spend in 2012
Only 11% believe the guidance will significantly reduce fraud

16. FFIEC compliance – Layered security
Entity Link Analysis
Layer 5
Enables analysis of relationships among internal and external entities and their attributes (e.g., users, accounts, machines)
User / Acct. Centric Multi Channel & Product
Layer 4
Monitors and analyzes user and account behavior across channels, and correlates alerts across channels and products
User / Acct. Centric Specific Channel
Monitors and analyzes user and account behavior, and identifies anomalous behavior using rules or statistical models
Layer 3
Navigation Centric
Layer 2
Analyzes session behavior and points out anomalies
Analyzes mobile device location
Layer 1
Secure browsing, OOB authentication and transaction verification
Endpoint device identification, location data
Endpoint Centric
Source: Gartner
© Memento, Inc – All Rights Reserved

17. How Can Technology Help?

18. Enterprise Fraud Management Systems
Case Management
Workflow and reporting
Alerts and incidents
Proactive Monitoring & Analytics
Identify suspicious behavior
Business user control
Forensic Research & Investigations
Queries and analysis
Collaborative research
Data Aggregation & Management
Multiple sources
Different data types

19. Enterprise Fraud Management Data
Single enterprise data store for financial crime and ops risk mgt
Rich repository of cross-channel transaction & reference data
Source system agnostic
Customer Data
Name, address, phone, …
Employee Data
name, ID, branch, job code, contact info …
Account Data
Status, open date, balance …
Transaction Data
check, deposits, ACH, wire, other debits, RDI, returns …
Maintenance/Inquiry Data
contact info changes, service changes, balance lookups …
Analytics Output
profiles, risk scores, alerts …
3rd Party Lists
black lists, white lists, OFAC …
Other Detection Systems
alerts , other data as required…

20. Multiple Approaches to Fraud Analytics
Patterns/Rules
Advanced business rules and statistical techniques
Profiling
Contextual history of customer, employee and peer group behavior
Adaptive Analytics
Fraud is discovered through a combination of risk indicators
Link Analysis
Uncover risky relationships between people, accounts, alerts, etc.

21. Example: Employee Fraud Detection
Fraud Type
Example Scenarios
Theft from institution
Self-dealing (e.g., fee reversals increasing overdraft limits)
Inappropriate account maintenance on own or close associate account (e.g. check hold policy override)
Incentive compensation schemes
GL theft (debit to cash offset to employee acct)
Theft from customer
Debits from dormant, elder, out-of-region, high net worth accts
Inappropriate acct maintenance (e.g., changing phone #, , address); followed by unauthorized or unusual transactions
Inappropriate acct inquiries, often out-of-region or business unit
Inappropriate access to reports
Screen capture, print screen

22. Example: ACH Fraud Detection
Combine Advanced Analytics and Business Rules
Fraud Indicators: Unusual access (IP, device ID, time of day, etc.), account maintenance, fund consolidation, negative balance, unusual amount, routing, timing, known bad receiver
Business Rules: White/black lists, institution defined rules
Customer and Account Profile
Transaction Details
Amount
Timing
Receivers
Type
Channels
Credits
Debits
Routing
Customer and Account Data
Name, address, phone, acct status, daily balance… +
Originator Information
Contact details, funding account, …
Maintenance / Inquiry Activity
Address or service changes, balance lookups …
ACH Activity
Historical activity across all channels
Statistically-driven risk score for every transaction

23. Example: Check Fraud Detection
Multi-dimensional pattern analysis
Check serial number sequences
Book detection, distance out of sequence
Amounts
Quasi-periodic amounts, non-quasi periodic amounts
Likely amounts, intimate amounts
Velocity analysis
Account velocity (balances), book velocity
Account relationships
Serial #
Velocity
Multiple checkbooks
Timing
Acct Profile
$ Amount
Acct Intimacy

24. New Technologies

25. Emerging and enabling technologies
Big Data
Cloud Computing
Mobile

26. Cloud computing Reduced costs Risks:
Some aspects of payments are moving to the cloud
Risks:
Assuring proper data protection and compliance with security and privacy regulations
Inadequate controls at third party service providers
Authentication and reliance on passwords

27. The mobile revolution
Nearly half (46%) of American adults are smartphone owners as of February 2012, an increase of 11% over last May
Source: Pew Research Center’s Internet & American Life Project, March 2012
Use of mobile banking expected to grow rapidly: expanding to 38M households by 2015
Source: FDIC Supervisory Insights - Winter 2011

28. Mobile financial services
4 usage patterns expected:
Mobile Banking – Mobilization of existing online capabilities (e.g., balance checks, transfers of funds between customer accounts, bill payment to pre-authorized recipients)
Alerting – Providing a convenient channel to alert customers of account activity
Services Replacement – Replacement of select services that require physical customer presence (e.g., remote deposit capture)
Mobile Payments – Including contactless payments, person-to-person payments, and substitution of mobile device for credit card, debit card or checks

29. Who Consumers Trust with Mobile Payments

30. Evolving payment landscape

31. Wrap up

32. Parting words…
Fraud attempts and fraud losses continue to grow. Yet, there is opportunity to fight back harder and smarter.
Customer education
New tools and new technologies
Information protection
Fraud detection and management
Increased collaboration
Engage customers in fraud management
Share information across banks
Collaborate with regulators, government, employees and third parties

33. Fraud management is a collaboration
© Memento, Inc – All Rights Reserved