Keeping up with Fraud Sophistication SAS Fraud Framework Looking for more information? www.sas.com/fraudframework Join webinar at: http://tinyurl.com/qcbtfw

Robust and flexible framework capabilities Support for real-time, intra-day, batch execution Ability to use existing data infrastructure Ability to use existing fraud alert output from any LOB / 3 rd party Business intelligence for all levels of users Support for business functions Provide strategic insight into threats, trends, risks Enterprise view of fraudulent behavior Rapidly test , simulate, and deploy models/rules without dependence on IT Ability to provide single view for investigators Phased approach to support tactical & strategic initiatives Innovation in detection driven by industry Addressing the Banking Industry’s Problem

Robust and flexible framework capabilities

Support for real-time, intra-day, batch execution

Ability to use existing data infrastructure

Ability to use existing fraud alert output from any LOB / 3 rd party

Business intelligence for all levels of users

Support for business functions

Provide strategic insight into threats, trends, risks

Enterprise view of fraudulent behavior

Rapidly test , simulate, and deploy models/rules without dependence on IT

Ability to provide single view for investigators

Phased approach to support tactical & strategic initiatives

Advanced Analytics are Required Using a Hybrid Approach for Fraud Detection Customer Account Trans- action Appli- cations Internal Bad Lists Employee Enterprise Data 3 rd Party Flags Call Center Logs Proactively applies combination of all 4 approaches at account, customer, and network levels Hybrid Approach Suitable for known patterns Suitable for unknown patterns Suitable for complex patterns Suitable for associative link patterns Rules Rules to filter fraudulent transactions and behaviors Examples: Txns in different time zones within short period of time 1 st Txn outside US Cash cycling event Anomaly Detection Detect individual and aggregated abnormal patterns Example: Wire transactions on account exceed norm # unsecured loans on network exceed norm Accounts per address exceed norm Predictive Models Predictive assessment against known fraud cases Example: Like wire transaction patterns Like account opening & closure patterns Like network growth rate (velocity) Social Network Analysis Knowledge discovery through associative link analysis Example: Association to known fraud Identity manipulation Transactions to suspicious counterparties

Rules to filter fraudulent transactions and behaviors

Examples:

Txns in different time zones within short period of time

1 st Txn outside US

Cash cycling event

Detect individual and aggregated abnormal patterns

Example:

Wire transactions on account exceed norm

# unsecured loans on network exceed norm

Accounts per address exceed norm

Predictive assessment against known fraud cases

Example:

Like wire transaction patterns

Like account opening & closure patterns

Like network growth rate (velocity)

Knowledge discovery through associative link analysis

Example:

Association to known fraud

Identity manipulation

Transactions to suspicious counterparties

SAS ® Fraud Framework – a sample approach Integrated Process Flow for Maximum Detection Alert Generation Process SAS ® Social Network Analysis Network Rules Network Analytics Alert Administration Business Rules Analytics Anomaly Detection Predictive Modeling Fraud Data Staging Intelligent Fraud Repository Exploratory Data Analysis & Transformation Operational Data Sources Customers Transactions Accounts Case Management Alert Management & Reporting Learn and Improve Cycle

Benefits of an Integrated Analytics Solution More fraud/actionable cases identified Including both previously undetected accounts and networks and extensions to already identified cases Reduction in false positive rates SNA reduces false positives by up to 10+ times over traditional rules-based approaches Improved analyst / investigation efficiency Referrals take 1/2 – 1/3 the time to investigate due to visualization and data aggergation Significant increase in ROI per analyst / investigator

More fraud/actionable cases identified

Including both previously undetected accounts and networks and extensions to already identified cases

Reduction in false positive rates

SNA reduces false positives by up to 10+ times over traditional rules-based approaches

Improved analyst / investigation efficiency

Referrals take 1/2 – 1/3 the time to investigate due to visualization and data aggergation

Significant increase in ROI per analyst / investigator

Copyright © 2009, SAS Institute Inc. All rights reserved.

Starting with the SAS Fraud Framework Fraudsters Far more sophisticated – organized crime, patient, sharing of rules Engaging insiders to understand detection environment High velocity of attacks – disappear after 2-3 transactions Hitting multiple channels and industries at the same time Continuously evolving fraud strategies Current Fraud Systems Systems are silo’d by line of business Current systems act on transaction or customer Rules and predictive models have limitations No sharing of data Rely on 3 rd party systems No real proactive steps taken to combat 1 st Party Fraud Evidence insufficient to act upon Increasing Fraud - The Business Problem

Fraudsters

Far more sophisticated – organized crime, patient, sharing of rules

Engaging insiders to understand detection environment

High velocity of attacks – disappear after 2-3 transactions

Hitting multiple channels and industries at the same time

Continuously evolving fraud strategies

Current Fraud Systems

Systems are silo’d by line of business

Current systems act on transaction or customer

Rules and predictive models have limitations

No sharing of data

Rely on 3 rd party systems

No real proactive steps taken to combat 1 st Party Fraud

Evidence insufficient to act upon

SAS Social Network Analysis Business problem Growing levels of fraud and sophistication (organized crime, patient, knowledge of rules) Fraudsters are leveraging multiple real and fictitious identities Activity is spread across multiple products and channels to avoid detection Data and detection systems are silo’d by line of business Result Banks struggle to aggregate data in a meaningful way to obtain a holistic view of organized fraud Fraudsters are able to share static contact data and transact with each other to increase extent of fraud Solution Rules and advanced analytics run on networked data to proactively detect associations and patterns that otherwise would go undetected Addressing the Network Fraud Problem

Business problem

Growing levels of fraud and sophistication (organized crime, patient, knowledge of rules)

Fraudsters are leveraging multiple real and fictitious identities

Activity is spread across multiple products and channels to avoid detection

Data and detection systems are silo’d by line of business

Result

Banks struggle to aggregate data in a meaningful way to obtain a holistic view of organized fraud

Fraudsters are able to share static contact data and transact with each other to increase extent of fraud

Solution

Rules and advanced analytics run on networked data to proactively detect associations and patterns that otherwise would go undetected