Catch them in the Act Fraud Detection in Real-time Seshika Fernando - PowerPoint PPT Presentation

Catch them in the Act Fraud Detection in Real-time Seshika Fernando Technical Lead

Fraud: A Trillion Dollar Problem Survey results ๏ $ 3.5 – 4 Trillion in Global Losses per year (5% of Global GDP) Payment Fraud Only ๏ Merchants are losing around $ 250B globally ๏ Cost of Fraud is around 0.68% of Revenue for Retailers (2014) ๏ Steep rise in Fraud in eCommerce (0.85% of Revenue) and mCommerce (1.36% of Revenue) with a movement of payments to newer channels

Why WSO2 Analytics Platform? Fraud Detection Toolkit Batch Real-time Analytics Analytics Domain Knowledge Predictive Interactive Analytics Analytics 3

Solution: Many Ways Fraud = Anomaly We provide many methods of Anomaly Detection in order to capture known and unknown types of fraudulent behavior ๏ Generic Rules ๏ Fraud Scoring ๏ Advanced Techniques Capturing anomalous behavior using mathematical modelling

Capturing Domain Expertise An example from Payment Fraud Domain Fraudsters… ๏ Use stolen cards ๏ Buy Expensive stuff ๏ In Large Quantities CEP Queries ๏ Very quickly ๏ At odd hours ๏ Ship to many places ๏ Provide weird email addresses 5

Generic Rules Convert all pre-existing knowledge about Fraudulent Behavior within a domain to Generic Rules ๏ Blacklists/Whitelists ๏ Moving Averages ๏ Known Patterns ๏ Outliers

Queries for Expensive Purchases define table PremiumProducts (itemNo string); from TransactionStream[(itemNo== PremiumProducts.itemNo) in PremiumProducts ] select * insert into FraudStream; 7

Queries for Large Quantities define table QuantityAverages (itemNo string, avgQty int, stdevQty int); from TransactionStream [(itemNo== av.itemNo and qty > (av.avgQty + 3 * av.stdevQty)) in QuantityAverages as av] select * insert into FraudStream; 8

Queries for Large Quantities (Learning) define table QuantityAverages (itemNo string, avgQty int, stdevQty int); from TransactionStream#window.time(8 hours) select itemNo, avg(qty) as avg, stdev(qty) as stdev group by itemNo update QuantityAverages as av on itemNo == av.itemNo; from TransactionStream [(itemNo== av.itemNo and qty > (av.avgQty + 3 * av.stdevQty)) in QuantityAverages as av] select * insert into FraudStream; 9

Queries for Transaction Velocity from e1 = TransactionStream -> e2 = TransactionStream[e1.cardNo == e2.cardNo] <3:> within 5 min select e1.cardNo, e1.txnID, e2[0].txnID, e2[1].txnID, e2[2].txnID insert into FraudStream; 10 2:20

The False Positive Trap ๏ So what if I buy Expensive stuff Rich guy ๏ And why can’t I buy a lot Gift giver ๏ Very Quickly Busy man ๏ At odd hours Night owl ๏ Ship to many places Many girlfriends? Blocking genuine customers could be counter productive and costly 11

Fraud Scoring ๏ Use combinations of rules ๏ Give weights to each rule ๏ Derive a single number that reflects many fraud indicators ๏ Use a threshold to reject transactions ๏ You just bought a Diamond Ring? ๏ You bought 20 Diamond Rings, in 15 minutes at 3am from a blacklisted IP address? 12

Fraud Scoring Score = 0.001 * itemPrice + 0.1 * itemQuantity + 2.5 * isFreeEmail + 5 * riskyCountry + 8 * suspicousIPRange + 5 * suspicousUsername + 3 * highTransactionVelocity 13 2:27

Learn from Data Utilize Machine Learning Techniques to identify ‘ unknown ’ point anomalies K-means Clustering

Markov Models for Fraud Detection Use Markov Models to discover fraudulent behavior through rare activity sequences Markov Models are stochastic models used to model randomly changing systems 15

Markov Modelling: Process Update Compare Alerts Classify Events Probability Incoming Events Matrix Sequences Probability Matrix 16

Markov Model: Classification Example : Each transaction is classified under the following three qualities and expressed as a 3 letter token, e.g., HNN ๏ Amount spent: L ow, N ormal and H igh ๏ Whether the transaction includes high price ticket item: N ormal and H igh ๏ Time elapsed since the last transaction: L arge, N ormal and S mall 17

Markov Models: Probability Matrix ๏ Create a State Transition Probability Matrix LNL LNH LNS LHL HHL HHS HNS LNL 0.976788 0.542152 0.20706 0.095459 0.007166 0.569172 0.335481 LNH 0.806876 0.609425 0.188628 0.651126 0.113801 0.630711 0.099825 LNS 0.07419 0.83973 0.951471 0.156532 0.12045 0.201713 0.970792 LHL 0.452885 0.634071 0.328956 0.786087 0.676753 0.063064 0.225353 HHL 0.386206 0.255719 0.451524 0.469597 0.810013 0.444638 0.612242 HHS 0.204606 0.832722 0.043194 0.459342 0.960486 0.796382 0.34544 HNS 0.757737 0.371359 0.326846 0.970243 0.771326 0.015835 0.574333 18

Markov Models: Probability Comparison ๏ Compare the probabilities of incoming transaction sequences with thresholds and flag fraud as appropriate ๏ Can use direct probabilities or more complex metrics ๏ Miss Rate Metric ๏ Miss Probability Metric ๏ Entropy Reduction Metric ๏ Update Markov Probability table with incoming transactions 19 2:35

Dig Deeper Access historical data using ๏ expressive querying ๏ easy filtering ๏ useful visualizations to isolate incidents and unearth connections

Usecase: Payment Fraud Transactions Batch Real-time Analytics Analytics Transactions Payment Dashboard Alerts System Transactions Predictive Interactive Analytics Analytics Transactions 21

Usecase: Anti Money Laundering Bank Txns Batch Real-time Analytics Analytics Core Bank Txns Dashboard Alerts Banking System Bank Txns Predictive Interactive Analytics Analytics Bank Txns 22

Usecase: Identity Fraud Batch Real-time Analytics Analytics Events Dashboard Alerts Events Predictive Interactive Analytics Analytics 23 2:40

References WSO2 Whitepaper on Fraud Detection: http://wso2.com/whitepapers/fraud- o detection-and-prevention-a-data-analytics-approach/ True Cost of Fraud 2014 http://www.lexisnexis.com/risk/downloads/assets/true-cost- o fraud-2014.pdf Stop Billions in Fraud Losses using Machine Learning o https://www.forrester.com/Stop+Billions+In+Fraud+Losses+With+Machine+Learning/fullte xt/-/E-res120912 Big Data In Fraud Management: Variety Leads To Value And Improved Customer o Experience https://www.forrester.com/Big+Data+In+Fraud+Management+Variety+Leads+To+Value+A nd+Improved+Customer+Experience/fulltext/-/E-RES103841 Predictions 2015: Identity Management, Fraud Management, And Cybersecurity o Converge https://www.forrester.com/Predictions+2015+Identity+Management+Fraud+Management +And+Cybersecurity+Converge/fulltext/-/E-RES120014 Markov Modelling for Fraud Detection o https://pkghosh.wordpress.com/2013/10/21/real-time-fraud-detection-with- sequence-mining/

Contact us !