Alex Katzdobler, Neo4j

1. Neo4j, Inc. All rights reserved 2021
Neo4j, Inc. All rights reserved 2021
1
Herzlich Willkommen!
Neo4j im Einsatz gegen
Geldwäsche und Finanzbetrug -
Teil 2
Alexander.Katzdobler@neo4j.com
Heiko.Schoenfelder@neo4j.com

2. Neo4j, Inc. All rights reserved 2021
2
Organisatorisches
○ Fragen während des Webinars werden zum Schluss behandelt und können
gerne währenddessen per Chat gestellt werden.
○ Informationen zum Webinar werden im Nachgang an alle Teilnehmer
versendet

3. Neo4j, Inc. All rights reserved 2021
3
Neo4j Property Graph Model
● Nodes
● Relationships
● Properties
● Labels

4. Neo4j, Inc. All rights reserved 2021
Organized in
groups
Synthetic
Identities
Stolen
Identities
Hijacked
Devices
Who Are Today’s Fraudsters?
4

5. Neo4j, Inc. All rights reserved 2021
Types of Fraud
•Credit Card Fraud
•Rogue Merchants
•Fraud Rings
•Insurance Fraud
•eCommerce Fraud
•Fraud we don’t know about yet…
5

6. Neo4j, Inc. All rights reserved 2021
Fraud Detection
data-perspective
6

7. Neo4j, Inc. All rights reserved 2021
Relational
Database
Choosing Underlying
Technology
7

8. Neo4j, Inc. All rights reserved 2021
Data Modelled as a Graph!
Graph
Database
8

9. Neo4j, Inc. All rights reserved 2021
Fraud Detection
methods
9

10. Neo4j, Inc. All rights reserved 2021
Endpoint-Centric
Analysis of users and
their end-points
1
.
Navigation Centric
Analysis of navigation
behavior and suspect
patterns
2
.
Account-Centric
Analysis of anomaly
behavior by channel
3
.
PC:s
Mobile Phones
IP-addresses
User ID:s
Comparing Transaction
Identity Vetting
Traditional Fraud Detection Methods
10

11. Neo4j, Inc. All rights reserved 2021
Unable to detect
• Fraud rings
• Fake IP-adresses
• Hijacked devices
• Synthetic Identities
• Stolen Identities
• And more…
Weaknesses
DISCRETE ANALYSIS
Endpoint-Centric
Analysis of users and
their end-points
1
.
Navigation Centric
Analysis of navigation
behavior and suspect
patterns
2
.
Account-Centric
Analysis of anomaly
behavior by channel
3
.
Traditional Fraud Detection Methods
11

12. Neo4j, Inc. All rights reserved 2021
INVESTIGATE
Revolving Debt
Number of Accounts
INVESTIGATE
Normal behavior
Fraud Detection with Discrete Analysis
12

13. Neo4j, Inc. All rights reserved 2021
Revolving Debt
Number of Accounts
Normal behavior
Fraudulent pattern
Fraud Detection with Connected Analysis
13

14. Neo4j, Inc. All rights reserved 2021
CONNECTED ANALYSIS
Endpoint-Centri
c
Analysis of users and
their end-points
Navigation
Centric
Analysis of navigation
behavior and suspect
patterns
Account-Centric
Analysis of anomaly
behavior by channel
DISCRETE ANALYSIS
1
.
2
.
3
.
Cross Channel
Analysis of anomaly
behavior correlated
across channels
4
.
Entity Linking
Analysis of relationships
to detect organized crime
and collusion
5
.
Augmented Fraud Detection
14

15. Neo4j, Inc. All rights reserved 2021
Fraud Rings
15

16. Neo4j, Inc. All rights reserved 2021
ACCOUNT
HOLDER 2
ACCOUNT
HOLDER 3
CREDIT
CARD
BANK
ACCOUNT
BANK
ACCOUNT
BANK
ACCOUNT
ADDRESS
PHONE
NUMBER
PHONE
NUMBER
SSN 2
UNSECURED
LOAN
SSN 2
UNSECURED
LOAN
Modeling a fraud ring as a graph
ACCOUNT
HOLDER 1
16

17. Neo4j, Inc. All rights reserved 2021
Credit Card
Fraud
17

18. Neo4j, Inc. All rights reserved 2021
Example #1
“Credit Card Testing”
18

19. Neo4j, Inc. All rights reserved 2021
USE
ISSUES
Terminal
ATM-skimming
Data Breach
Card
Holder
Card
Issuer
Fraudster
USE MAKES $4000
AT
$5
MAKES
$1
0
MAKES
$2
MAKES
Testing
Merchants
AT
MAKES Tx
19

20. Neo4j, Inc. All rights reserved 2021
Example #2
“Fraud Origination and
Assessing Loss Magnitude”
20

21. Neo4j, Inc. All rights reserved 2021
Tx
Tx Tx Tx
Tx Tx Tx Tx
Tx
Tx Tx
John
21

22. Neo4j, Inc. All rights reserved 2021
Tx
$2000
Tx
Tx Tx Tx Tx
Tx
Tx
Tx Tx Tx
Computer
Store
John
22

23. Neo4j, Inc. All rights reserved 2021
Tx
$2000
Tx Tx
$25
$10
$4
Tx
Tx Tx Tx Tx
Tx
Tx
Computer
Store
John
Gas Station
23

24. Neo4j, Inc. All rights reserved 2021
Tx
Tx
$2000
Tx Tx
$25
$10
$4
Tx
Tx Tx Tx Tx
Tx
Tx
Computer
Store
John
Gas Station
Sheila Tx
$2
Tx
Tx
Sheila Tx
Tx
Tx Tx Tx Tx
Tx
$3000
Tx
Jewelry
Store
Tx
$3
24

25. Neo4j, Inc. All rights reserved 2021
Tx
Tx
$2000
Tx Tx
$25
$10
$4
Tx
Tx Tx Tx Tx
Tx
Tx
Computer
Store
John
Gas Station
Sheila Tx
$2
Tx
Tx
Sheila Tx
Tx
Tx Tx Tx Tx
Tx
$3000
Tx
Jewelry
Store
Tx
$3
Robert Tx
Tx
Tx Tx Tx
Tx Tx
Tx
Tx Tx Tx
25

26. Neo4j, Inc. All rights reserved 2021
Tx
Tx
$2
Tx
Tx
Tx
$2000
Tx Tx
$25
$10
$4
Tx
Tx Tx Tx Tx
Tx
Tx
Computer
Store
John
Gas Station
Sheila
Robert
$3
Karen
Tx
Tx
Tx Tx Tx Tx
Tx
$3000
Tx
Jewelry
Store
Tx
$3
Tx
Tx
Tx Tx Tx Tx
Tx Tx
Tx
Tx
Tx Tx
Tx Tx Tx Tx
Tx
$8 $12
Tx
$1500
Furniture
Store
Tx Tx Tx
26

27. Neo4j, Inc. All rights reserved 2021
Anti Money
Laundering
27

28. Neo4j, Inc. All rights reserved 2021
How It Occurs
• Placement
◦ Illegal sums are “placed” in a
bank
• Layering
◦ Complex sequence of banking
transfers or commercial
transactions
◦ Money laundering is hard to
detect because of the
sophisticated layering
techniques used to mask parties
and transactions
• Integration
◦ Money returned to the launderer
in an obscure and indirect way
• Conceals the origins of illegally obtained
money
• Underlying crimes include: Insider trading,
drug trafficking, kickbacks, and extortion
• All require laundering large sums of money
by principals through their agents
What is Money Laundering
28

29. Neo4j, Inc. All rights reserved 2021
Anti Money Laundering
• Seeking for deep patterns (who
sends money to who)
• Using also shared attributes like
in Fraud Rings:
◦ Names
◦ Email
◦ Phone
◦ Address
◦ SSN
◦ IDNO....
• Transaction Context
29

30. Neo4j, Inc. All rights reserved 2021
Why Use Neo4j to Fight Money Laundering
Neo4j detects previously undiscovered
relationships between entities to produce
a more accurate score that combines
graph and text analytics
Neo4j unlocks the wealth of insights
found by pattern matching on connected
people, companies, financial institutions,
places, and time in a financial network
30

31. Neo4j, Inc. All rights reserved 2021
Suspicious Behavior
Small Deposits - Concentration
• Cash transactions (deposits) to an account, transfer to
central account, followed by wire to bank outside of the U.S.
• Identify parties and largest aggregate amounts
• Show accounts involved and largest aggregate amounts (n
hops, aggregating only when pattern matches)
• Account receives high number of incoming deposits and then
sends a few large transactions to one or more high risk parties
Small Deposits - Velocity
• Customer makes several deposits cash just under $10,000
over an x day period
• Cash transactions or greater for under $10,000 over Y days
to one account
• Customer received a large wire followed by withdrawal of
most of it as cash via multiple ATM debits within a short period
of time
• Behavior change - business customer whose cash deposit
activity goes from $50,000/wk to $250,000/wk over the course
of a month
Small Deposits - Accumulation
• Consecutive days of deposits with minimal withdrawals of
deposits in the same period.
• Identify parties and accounts involved and largest aggregate
amounts (n hops, aggregating only when pattern matches)
Layering
• Party A sends to party B and then sends to party C, where $
amount >= $X between A and B and within Y % in from B to C
• Among the nodes in the transactions, which one has the
highest incoming amount and little or no outgoing transactions
• Large aggregated set of deposits by a customer followed by
a large ACH transaction or a transfer to another account
31

32. Neo4j, Inc. All rights reserved 2021
Suspicious Structure
Entity Resolution
• Shared Attributes can be used for Entity
Resolution
Payment Chain
• Payment chain between two suspicious parties
32

33. Neo4j, Inc. All rights reserved 2021
33
DEMO

34. Neo4j, Inc. All rights reserved 2021
34
GraphGists - Bank Fraud Detection

35. Neo4j, Inc. All rights reserved 2021
35
https://neo4j.com/use-cases/fraud-detection/
Neo4j - Fraud Detection

36. Neo4j, Inc. All rights reserved 2021
36
Neo4j - Graph Academy

37. Neo4j, Inc. All rights reserved 2021
37

38. Neo4j, Inc. All rights reserved 2021
38