Financial fraud, credit card theft.
When people think of fraud, likely the first thing they think of is banking, and rightly so – it's the most visible face of the crime. Yet the Interac Association reports that debit card fraud losses in Canada were actually down 62 per cent, year over year, in 2013, thanks in part to the increased security offered by chip and PIN technology, and to more sophisticated fraud-detection mechanisms. Those mechanisms let companies catch the fraud as it's happening, increasing the chances that the bad guys will be caught in the act.
That's the good news. The bad news is two-fold: the number isn't zero, and likely never will be, and there are many other methods fraudsters employ to part individuals and businesses from money and assets.
Fortunately, thanks to the amount of data collected about everything these days, analytics can often detect scams-in-the-making and allow companies and law enforcement to head them off at the pass. Dan Nagle, practice lead for SAS Canada's security intelligence practice, told us about four areas in which analytics are getting better at detecting fraudulent behaviour. And while he couldn't always mention company names (customers in the security realm are often understandably circumspect about revealing their defenses), the stories are telling.
Health care
There's a huge business in fake prescriptions for restricted drugs such as Oxycontin, said Mr. Nagle. Organized crime coerces vulnerable people into filling those prescriptions, and then resells the drugs.
SAS worked with its client, a major Canadian healthcare organization whose mandate is to ensure legitimate behaviour by pharmacies and others, to build a system that can separate the good scrips from the bad. It needed to examine what is prescribed, where it's purchased and to determine the potential for fraud in each transaction. The analytics software uses sophisticated algorithms to detect patterns indicating illegal activity, so law enforcement can step in while the trail is still warm.
The resulting system provides system admins real-time alerts to monitors of suspected abuse – by complicit practitioners (doctors or pharmacies, for example), by the "patients," who may be victims of blackmail being forced to fill fake prescriptions, and by criminal elements.
"It's a sad reality," Mr. Nagle said, "what you have is people who come into Canada with new visas, have no means of getting money, are approached by these gangs, and are given a prescription for an opiate. They get the prescription filled at a pharmacy that may or may not be involved, and the drugs go on the market."
Power
Believe it or not, power utilities also suffer from losses due to fraud. Illegal (and some legal) entities try to avoid electricity bills by various means such as stealing power from someone else, or bypassing meters and hooking up directly to feeder lines.
Providers have to measure, in real-time, how each customer is using power, so they can more accurately predict demand and adjust capacity. Buried in that data is the evidence they need to catch the power thieves. Their challenge is the amount of data they have to sift through to find it, and the fact that the data can't be retained for long; there's just too much to store. That means fraud must be detected in real-time, before the evidence disappears.
The solution: a smart meter-based analytical system that finds irregularities in power fluctuations, using a combination of analytics and signals from the engineering systems. The most interesting result, Mr. Nagle said, was that, while developing the system, SAS also found a new way of determining where marijuana grow-ops are located.
Credit cards
Flipping back to the financial world, credit and debit card fraud, although declining, is still an issue that two Canadian banks, HSBC and Laurentian, have turned to analytics to solve.
HSBC's focus is on scoring the risk of every credit card transaction. Denying a legitimate user is just as bad as allowing illicit use, so its analytics are aimed at ensuring, in real-time, that you are, indeed, who you claim to be. That way customers aren't embarrassed by having legitimate transactions declined, yet are protected from fraudulent use of their cards; an embarrassed customer is one likely to change banks.
Laurentian's system, on the other hand, hunts for periodic fraud such as money laundering. To do that, it has merged its fraud and compliance systems so it gets a full picture of each customer's transactions, and of links and interactions between customers. It really does follow the money, no matter how convoluted its path, allowing the bank to determine through analytics whether the transactions are legitimate or not.
Casinos
Despite what we saw in Oceans 11, online and offline casinos are at more risk from subtle frauds through account takeovers. Mr. Nagle explained that crooks hack into legitimate gamers' accounts (much as they'd hack someone's Facebook account) and use them for theft or money laundering.
The analytics system here builds a profile of each gambler, looking at what games he or she plays, betting patterns, activity times, and other items that provide a fingerprint of that individual. Then, if it notices anomalies, it immediately alerts the casino.
An added benefit of the system, said Mr. Nagle, is that it also helps casinos and law enforcement build profiles of criminal groups.
These pro-active attacks on fraud are the opposite of traditional methods, which rely on forensics after the fact. And with the growth in cyber-crime, catching crooks in the act and stopping them has to be the way of the future.