Detecting Fraud and AML Violations In Real-Time for Banking, Telecom and eCommerce

Detecting Fraud & Anti-
Money Laundering (AML)
Violations In Real-Time
Victor Lee & Gaurav Deshpande
for Banking, Telecom, and eCommerce

© 2018 TigerGraph. All Rights Reserved
Speaking Today
2
Victor Lee
Director of Product Management
TigerGraph
victor@tigergraph.com
Graph Data Mining Expert
Gaurav Deshpande
Vice President of Marketing
TigerGraph
gaurav@tigergraph.com, +1 510 388 2360
Big Data Analytics Veteran

Agenda
3
Fraud and Money Laundering –
Scale and Complexity
Addressing Fraud and Money Laundering –
Traditional Approach
Addressing Fraud and AML Violations
in Real-Time with Deep Link Analytics
Getting Started on your own journey
to a more secure and compliant organization
3
2
1
4

Fraud Impacts Multiple Industries
4
The 2018 Global Fraud and Identity Report, Jan 2018
63% of businesses have experienced the same or
more fraud losses in the past 12 months
Online fraud alone costs consumers $16 Billion
per year (bank and merchant costs are higher)
Fraud cost consumers more than $16 billion, Feb 2018
Telecoms operators face $300bn global loss, Jan 2016
$300 Billion in global loss across Telecom from
uncollected revenue and fraud in 2016

Impact of Money Laundering on Global Banking
5
Reuters News, Sept 27, 2017
$342 Billion - total US & EU fines on banks’ misconduct
including anti-money laundering violations since 2009
Regulators fined US Bank $613 Million due to
lax anti-money laundering controls
US Bank fined over $600 Million, Feb 15, 2018
Compliance doesn’t pay, Bloomberg, April 11 2018
5% of transactions which firms identify as suspicious
is reported to the authorities, of which 10% leads to
further investigation (Just 0.5% of suspicious
transactions investigated)

Traditional Approach to Fraud Prevention & AML
Compliance
6
Transactions
(Payments, Orders, calls)
Customers
Merchants, Drivers, ..
Devices, Locations, ..
Input Data
Fraud Analytics Solution
+ Rules Engine
Analysts Suspicious Activity
Report (SAR)
Queries for
additional
information
Investigators
BI /
Investigation
workflow tool
Suspicious activities
False positives
Machine
Learning
Models
Training Data

So What’s Missing?
Current Approach
• Data: features of entities, e.g., users,
accounts, locations. Examples:
• Phone-based fraud detection: frequency and
duration of one-directional calls
• Money laundering:
size and frequency of the payment transactions,
transactions with immediate neighbors
• Detection: Analysts manually write rules
regarding features of nodes or their
immediate neighbors (1 to 2 hops).
7
Attributes/
features for
a phone
Abnormal
model
Ads
model
Harassment
rule
Scam
model
Good
phone
Ads
Harassment
Scam
candidateScam
• Performance:
• False positives: too many cases to investigate, block legitimate business
• False negatives: Fail to catch many fraud cases

Consider an Example - Phone Scam
Illegally acquiring money from
victims, or failing to pay a telecom
company
• $4.96 Billion – Compromised
PBX/Voicemail Systems
• $4.32 Billion – Subscription/Identity Theft
• $3.84 Billion – International Revenue
Share Fraud
• $2.88 Billion – By-Pass Fraud
• $2.40 Billion – Credit Card Fraud
8

Detecting Phone-Based Fraud by Analyzing Network or
Graph Relationship Features
9
Good Phone
Features
Bad Phone
Features
(1) Short term call
duration
(2) Empty stable group
(3) No call back phone
(4) Many rejected calls
(5) Average distance > 3
Empty stable group
Many rejected
calls
Average distance
> 3
(1) High call back phone
(2) Stable group
(3) Long term phone
(4) Many in-group
connections
(5) 3-step friend relation
Stable group
Many in-group
connections
Good Phone
Features
3-step friend
relation
///
Good phone Bad phone
X
X
X

Generating New Training Data for Machine Learning to
Detect Phone-Based Scam
Graph with 500 Million phones and 10 Billion calls,1000s of new calls per second.
Feed Machine Learning with new training data with 118 features per phone every 2 hours
10
Phone 2 Features
Machine
Learning Solution
Phone 1 Features
(1) High call back phone
(2) Stable group
(3) Long term phone
(4) Many in-group
connections
(5) 3-step friend relation
(1) Short term call
duration
(2) Empty stable group
(3) No call back phone
(4) Many rejected calls
(5) Avg. distance > 3
Training Data
Tens – Hundreds of Billions of calls

Evolution of Graph Technology
11
Graph 1.0
• Storage and Visualization
focused
• No built-in parallel
computation model
• Very slow loading large
datasets
• Cannot scale out
• Not designed for real-time
graph updates or queries
for large datasets
• Limited multi-hop analytics
capabilities on large
graphs (2 hops)
Example – Neo4j
Graph 3.0
• Better scale-out, but
speed and updates are
still an issue
• Built on top of NoSQL
repository such as Apache
Cassandra
• Not designed for real-time
graph updates or queries
for large datasets
• Limited multi-hop analytics
capabilities on large
graphs (2 hops)
• Scalability for massive
datasets
• Supports real-time graph
updates and queries for
enterprise scale
• Provides deep link analytics
(3-10+ hops) traversing
millions of nodes and
performing complex
calculations
• Privacy for sensitive data
• Ease of use for development
& deployment
Graph 2.0
Example – DataStax

Addressing Fraud Prevention and AML compliance with
Real-time Deep Link Analytics
12
Real-time Multi-Hop Performance
Sub-second response for queries
touching tens of millions of
entities/relationships
Transactional (Mutable) Graph
Hundreds of thousands of updates per
second, Billions of transactions per day
Scalability for Massive Datasets
100 B+ entities, 1 Trillion+ relationships
Ease of Development & Deployment
Easy to use query language (GSQL) for rapidly
developing & deploying complex analytics
Privacy for Sensitive Data
Control access based on user role,
data type, or department
Deep Link Analytics
Queries traverse 3 to 10+ hops deep into
the graph performing complex calculations

Different Types of Financial Fraud
• Phone Scam
• Credit Card Chargeback
Fraud
• Advertising/Camouflage
Fraud
• Money Laundering
13

Credit Card Chargeback Fraud
• Fraudsters use stolen credit card
and phone to buy product/service
from a merchant
• Fraudsters receive and resell
product/service
• Card owner realizes and cancels
the stolen credit card
• Fraudster walks away with the
money, while bank and merchant
selling the product/service bear
the loss
14

Detecting Credit Card
Chargeback Fraud
• Analyze complex network of
payment transactions,
devices/phones and linked
accounts
• Find accounts that are connected
to fraudulent transactions and/or
devices
• If connection is strong enough à
shut down account to prevent
further loss
15
1
2
1
2
Account 1 Account 2
Account 3
7. Chargeback
4. Unsettled
5. Settled
6. Unsettled
3. Chargeback1. Chargeback
2. Unsettled
Active Account
Active Account Neighbor Info
• Total chargeback $
• Total Unsettled $
• Total Settled $
• # of transactions
• # of settled transactions
• # of unsettled transactions
• # of banned credit card
• #of active credit card
• # of banned device
• # of normal device

Advertising/Recommendation Fraud
• Click/Impression Fraud
• Pay-per-click
• Pay-per-impression
• Recommendation
Fraud
• Fake reviews or follows
• Use camouflage or
hijacked accounts
16

Detecting Advertising/Recommendation Fraud
Looks like many users, but really controlled by one
17
• Use machine learning to find the
difference between organic
reviews/follows vs. fake
• Example Features used in analytics:
# common products/brands
followed/purchased
# products/brands not
followed/purchased together
# hops between accounts
# timing between events
# devices shared
# payment instruments shared
Fraudster

Money Laundering
Transforming the profits from illegal activities
and corruption into apparently “legitimate”
assets.
• Structuring: many small cash deposits, to
avoid anti-money laundering report
requirements
• Bulk cash smuggling: smuggling cash to
offshore financial institutions
• Cash-intensive business: restaurants,
casinos, etc.
• Round-tripping: money deposited
offshore, brought back as investment to
avoid taxation
18

Detecting Money Laundering Violations/
Anti-Money Laundering (AML)
19

Detecting Money Laundering Violations/
Anti-Money Laundering (AML)
1. Start from a few initial suspicious accounts/transactions.
2. Probe upstream and downstream of money flow.
3. Ignore normal accounts.
4. Add in more “participating” accounts that may be involved in money
laundering
5. Converge when the algorithm finds the “source” account and the
“target” account.
20
Algorithm to Discover Money Laundering Subgraph

AML—Initial Suspicious Accounts
21
1. Start from a few initial
suspicious accounts.

AML—Upstream Probe 1
22
2. Probe upstream…

AML—Upstream Probe 2
23
2. Probe upstream…

AML—Downstream Probe 1
24
2. … and downstream

AML—Downstream Probe 2
25
2. … and downstream

AML— Final Subgraph Is Returned
26
• Converge when the
algorithm finds
“source” account(s) and
“target” account(s).

Detecting Various Types of Fraud with
TigerGraph
• Graph Features to the rescue
• Integrate multiple data sources into one graph
• Real-time updates
• GSQL helps easily collect complex, deep-link, aggregate graph features
• Feed Machine Learning algorithm with new training data
• Deep Link Analytics to the rescue
• GSQL easily describes graph traversal and compute patterns
• Massive parallel processing for speed and efficiency
• Visualization shows evidence right on the spot
27
Real-time Deep Link Analytics at Massive Scale

Real-Time Graph Analytics Platform
28
User Interface:
• GSQL language for
schema/loading/
queries/updates
• REST API for connecting to
other applications
• GraphStudio GUI for human
interaction
Output:
• JSON or visual graph

#1 e-payment company in the
world, 100M daily active users
#1 US payment company
#1 Mobile E-commerce
#1 Mobile global supply-chain
#1 Power-grid company
The largest transaction graph in
production in the world (100B+ vertices,
2B+ daily real time updates)
Business Graph
Real-time Personalized Recommendation
Supply-chain logistics
Electrical Power Grid
#1 Ride sharing company Risk and Compliance
Customers
29

Getting Started with your own journey to a more
secure and compliant organization
• Download the Fraud Prevention & AML brief
https://info.tigergraph.com/aml-solution-brief
• Read the benchmark report comparing
TigerGraph with older generation graph
solutions -
https://info.tigergraph.com/benchmark
• See TigerGraph in action – take the test drive:
https://www.tigergraph.com/try-tigergraph/
30

Thank You
Check us out on social media!
31
@TigerGraphDB Youtube.com/tigergraph Facebook.com/Tiger
GraphDB
Linkedin.com/company/Ti
gerGraph

Detecting Fraud and AML Violations In Real-Time for Banking, Telecom and eCommerce

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Detecting Fraud and AML Violations In Real-Time for Banking, Telecom and eCommerce

Similar to Detecting Fraud and AML Violations In Real-Time for Banking, Telecom and eCommerce (20)

More from TigerGraph

More from TigerGraph (20)

Recently uploaded

Recently uploaded (20)

Detecting Fraud and AML Violations In Real-Time for Banking, Telecom and eCommerce