1. Can You Think Like a Fraudster?
How Big Data and Advanced Analytics Help Investigators Proactively Fight Fraud and
Money Laundering
Insights from the Association of Certified Fraud Examiners (ACFE) Hosted Webinar
› Conclusions Paper
Featuring:
Dennis M. Lormel, President and CEO of DML Associates LLC
Dan Barta, Industry Consultant for Enterprise Fraud Strategy, SAS
2. Contents
Introduction....................................................................... 1
Inside the Mind of the Fraudster.................................. 1
The Anatomy of a $6 Million Embezzlement Scheme.. 1
Trends in Terror, Crime and Fraud................................ 2
Unveiling an Insider Trading Scheme.............................. 3
Using Technology, Big Data, and Advanced Analytics
to Fight Fraud.................................................................... 3
Big Data.................................................................................. 3
The Role of Advanced Analytics................................... 4
How Analytics Facilitates Fraud Investigations............... 5
Challenges in Taking Advantage of Big Data and
Analytics.................................................................................. 5
Conclusion......................................................................... 5
About the Presenters....................................................... 6
3. 1
Introduction
In the cat-and-mouse game of catching criminals, terrorists and
other fraudsters, the bad guys have long held the upper hand.
After all, fraud is nothing if not deception. It’s about exploiting
systemic vulnerabilities – for example, by using financial
institutions to facilitate illegal activities. And it’s about coming
up with creative new schemes limited only by the fraudsters’
imaginations.
In contrast, fraud detection has been reactive. Law enforcement
and other organizations charged with catching fraudsters have
been unable to prevent nefarious activity. They’ve had to wait
for it to occur and then nab the perpetrators after the fact.
Finding and stopping the fraudulent activity has meant
searching through millions of transactions to locate the
suspicious few. Often by the time the good guys have caught
on, the bad guys were long gone.
But now the paradigm is shifting. We’re gaining a better
understanding of what makes fraudsters tick. More importantly,
law enforcement and investigators have access to big data and
advanced analytics that allow them to look at previous patterns
of fraud to accurately predict current and future fraudulent
activity. They can also use data to determine relationships
between conspirators. Rather than passively waiting,
investigators are increasingly able to use these new tools to nip
fraud in the bud.
In this conclusions paper, Dennis M. Lormel, President and CEO
of DML Associates LLC, provides perspective on how fraudsters
view the world, as well as the latest criminal trends. Dan Barta,
Industry Consultant for Enterprise Fraud Strategy at SAS,
discusses how big data, advanced analytics and associated
technologies are helping law enforcement and regulatory
agencies become more proactive in tracking down fraudsters.
Inside the Mind of the Fraudster
The first step in fraud detection is to get inside the mind of the
perpetrator. Once investigators understand how to think like a
bad guy, they can better identify and investigate fraud schemes
by looking beyond the spin and deception.
Although various types of fraud have different characteristics
and warning signs, they’re all contingent on five common
elements: opportunity, incentive, rationalization, capability – and
integrity. Explained Lormel, “Opportunity is the chance to
commit fraud. Incentive represents the motivation and is usually
driven by financial demands. Rationalization is the self-
justification that makes the fraudulent act acceptable to the
perpetrator. Capability is being in the right position at the right
time and possessing the right skill sets to perpetrate the fraud.
But most important is integrity. If a person’s integrity is
questionable, they’re more inclined to commit a fraud.”
To understand how these elements of fraud work together, let’s
look at an example.
The Anatomy of a $6 Million Embezzlement
Scheme
A classic tale of fraud is how Walter Pavlo Jr. initiated a $6 million
embezzlement scheme as part of the MCI WorldCom scandal.
MCI WorldCom was the nation’s second-largest long-distance
phone company when it filed for Chapter 11 bankruptcy
protection in July 2002 after it revealed that it had improperly
booked $3.8 billion in expenses. The admission propelled MCI
WorldCom into the top tier of scandal-ridden companies of the
time, alongside Tyco International, Global Crossing, Adelphia
Communications and Enron. Verizon Communications
purchased the company in 2006. A full account can be found in
Pavlo’s book, Stolen Without a Gun: Confessions From Inside
History’s Biggest Accounting Fraud – the Collapse of MCI
WorldCom.
4. 2
Figure 1: The Fraud Diamond
“Walter Pavlo was hired by Bernie Ebbers, the CEO of MCI
WorldCom,” said Lormel. “When the top man at an organization
is a crook who’s benefiting from fraud and misappropriation of
funds, that sets the tone for the entire company. Now when Pavlo
started at MCI WorldCom, he was well-intentioned. He was a
junior financial executive earning $62,000 a year. MCI
WorldCom had unrealistic financial goals that it had to hit to
generate bonuses and other compensation for top executives.
Pavlo was forced to change the corporate financial numbers to
meet these objectives.”
Lormel continued, “Pavlo’s incentive for the fraud was that he
had to cook the books. Pavlo had the capability because he had
the skill set to embezzle. He had the opportunity because Bernie
Ebbers had neutered the internal accounting function, internal
audits and internal controls. Lax control mechanisms gave Pavlo
the capability to commit fraud. And finally, there’s rationalization.
Pavlo got jaded over time because he wasn’t benefiting from the
fraud. He watched Ebbers and others around him raking in big
money. He believed that he was taking the risk and wasn’t
getting any of the benefits. He felt underpaid. And because
everyone else was cheating, he felt entitled to do the same. So
he initiated his embezzlement scheme. Unfortunately for Pavlo,
the larger fraud came to light and he was caught in the middle.”
Trends in Terror, Crime and Fraud
Current trends also play an important role in fraud and criminal
activity. “We’re currently seeing two trends,” said Lormel.
“Convergence and diversification. Convergence means that
criminal organizations and terrorist groups have determined that
they can benefit tremendously by working together. We’re
seeing the creation of hybrid organized crime/terrorist groups.
Transnational organizations also represent an increasing threat to
US security and interests both domestically and internationally.
These groups are located in countries with a weaker rule of law
– such as Yemen, Pakistan and Afghanistan – and carry out
criminal activities across international boundaries. These groups
are incredibly dangerous because of their greed and profit
motive, and they act with impunity.
“Diversification occurs,” Lormel continued, “when these
organizations mature. They branch into any number of activities,
such as drug trafficking, human smuggling, counterfeit goods/
currency, stolen goods, violent crimes, kidnapping, extortion and
cyberfraud.
“Central to the success of any of these activities is fraud and the
ability to launder money,” Lormel stressed. Tools that facilitate
money laundering include the Internet, credit/debit cards, stored
value cards, nongovernment organizations (NGOs) and charities,
illegal money remitters, informal value transfer systems, shell
companies, offshore tax havens, correspondent banking, wire
transfers and electronic mechanisms. Lormel noted that “The
illegal money remitters pose the biggest vulnerability in our
5. 3
financial services industry because they’re unregistered and
unlicensed, and they operate unknown.”
Fraud reduction starts with governmental regulations that
address money laundering and other activities.These include the
Bank Secrecy Act, the Patriot Act, know your customer (KYC) laws,
blacklist monitoring, suspicious activity reports (SARs) and so on.
Unveiling an Insider Trading Scheme
One example of how existing financial regulations help counter
financial crimes is the story of the unraveling of an insider stock
trading scheme. Explained Lormel, “The story begins with three
businessmen who crossed the line of integrity and seized the
opportunity to trade insider information. In a conspiracy that ran
from 2006 until 2011, these men were ultimately charged with
investing more than $109 million in the scheme and netting
more than $32 million in illicit profits.”
Lormel continued, “The group included Matthew Kluger, an
attorney who worked on mergers and acquisitions; Kenneth
Robinson, a onetime trader and mortgage broker who acted as
a middleman; and Garrett Bauer, a stock trader who executed
the trades. Kluger accessed nonpublic information from files in
his law firm. To avoid being traced, he scanned the case
management system in his firm without ever opening the files,
relying on his expert knowledge of these types of cases. Kluger
passed the information to Robinson, who in turn gave it to
Bauer to execute the trades.
“While the front end of the fraud scheme was well-conceived,
the conspirators acted like amateurs on the back end,” said
Lormel. “Bauer paid Robinson in cash to prevent detection.
After the trades, Bauer would go to ATM machines and, over a
six-day period, withdraw cash from different accounts in
amounts ranging from about $200,000 up to about $12 million.
If going to an ATM and withdrawing excessive sums of money
in a short period isn’t a red flag, I don’t know what is. And now
Robinson and Kluger had cash and had to get it back into the
banks. So there were numerous red flags for cash activities that
the banking institutions could have deemed suspicious.
“Ultimately, the FBI and IRS were likely alerted by suspicious
activity reporting (as required by the Bank Secrecy Act) and
began investigating the case,” said Lormel. “Law enforcement
identified Robinson and executed a search warrant at his
residence. Robinson rolled over and was wired up against
Bauer and Kluger. They spilled their guts about what they were
doing to Robinson on tape. All three were charged and went to
jail. Bauer forfeited a New York condo worth almost a million
dollars and a Boca Raton home worth $900,000.
“Now the situation might have been different if instead of cash
withdrawals, which are a blatant red flag, they set up an
investment club,” said Lormel. “Three well-off and prominent
businessmen wouldn’t have been questioned, and they could
have gotten away with their scheme for a heck of a lot longer.”
Using Technology, Big Data,
and Advanced Analytics to Fight
Fraud
Existing regulations, such as SAR filing requirements, provide a
starting point for identifying fraudsters. But investigators also
need to take advantage of new approaches to help understand,
identify, disrupt and minimize threats. They’re increasingly using
state-of-the-art technology to combine big data with advanced
analytics to better identify and predict criminal activity.
Big Data
More and more daily activity is captured as big data. That data is
streaming constantly – from Facebook, Twitter, text messaging
and so on. Said Barta, “That means people know more about us.
And that’s true of fraudsters.”
So what is big data?
While the term “big data” has been around for at least a half-
dozen years, the definition has evolved to incorporate three V’s:
volume, velocity and variety.
Volume. Volume is the amount of data available to be examined.
Said Barta, “An Aberdeen study found that data growth is
averaging 42 percent year over year. Twenty-two percent of
respondents said that data was growing 75 percent year over
year. The challenge facing law enforcement and intelligence
organizations is how to determine what data is critical and to
understand the interrelationships among the data.”1
Velocity. Data is being created faster and faster. “The ability to
constantly integrate new data with existing data and to utilize it
in analysis is critical to addressing new and ever-changing fraud
schemes,” Barta said. “For example, having the capability to
ingest information about terrorists – including results of Title III
conversations, surveillance activities, travel information and so
on – and to analyze it quickly in real time or near-real time can
mean the difference between preventing a terrorist act and
investigating after the fact.”
1
Aberdeen Group, The State of Big Data, Sept. 7, 2012.
6. 4
Variety. Law enforcement and investigators are challenged with
managing data of different types from numerous sources and
locations, both from within a particular organization and from
external sources. Explained Barta, “We have transaction data –
date, time, amount, payment method, payee and payer.
“We also have unstructured data that’s unique with no set fields
or context for each data point,” Barta continued. “Fraud and
terrorist financing are not just about money. They’re also about
relationships between people and organizations and how they
utilize funds. Unstructured data includes information that law
enforcement can glean about how individuals and organizations
are related to each other.”
Barta continued, “When we talk about financial crimes, we
naturally think about monetary transactions. But there’s a great
deal of related information, including wire instructions, SWIFT
messages, geolocations and device IDs.
“Mobile phone data tells law enforcement who’s talking to whom
and who has a relationship with whom. Phones can provide
geolocation data as well as photos and video,” said Barta.
“Social networks like Facebook and Twitter make a whole new
set of unstructured data available that can be very valuable in
understanding fraud rings, organized crime and the like,” added
Barta. “Not only do you get data from a person’s profile, but they
also upload photos and video and tell people what they’re
doing and where they’re at. Data from social networks is hugely
valuable in helping us understand how individuals are
associated with other individuals, their thoughts and their
opinions.”
Law enforcement and intelligence agencies gather data from
numerous sources to execute their mission. It can come from any
number of organizations, including telecom companies, financial
institutions, stock brokerage firms and even travel providers –
who can tell you who’s boarding what plane, where they’re
coming from and where they’re going.
Each agency must then manage and share the information with
other federal, state, local and regulatory agencies – even with
agencies from foreign nations. Moreover, these entities have to
control and manage what they can and cannot share for grand
jury or other legal reasons.
The challenge for law enforcement is that there’s too much
information, and most of it’s in disparate locations that make it
difficult to gather and integrate. Determining what data is
valuable and what isn’t requires forward thinking.
This means that despite the quantity of data available, agencies
have been hard-pressed to utilize data fully. One survey
indicated that 26 percent of all data available is currently being
accessed for analysis, while users would like to use 52 percent of
the available data for analysis. 2
Overall, said Barta, “Bringing in all this data and being able to
utilize it is a challenge. When the volume, velocity or variety of
data exceeds the organization’s capacity to store it or compute
timely and accurate results, it becomes useless.”
The Role of Advanced Analytics
Technology and advanced analytics allow law enforcement and
investigators to harness big data and turn it into useful
information. Advanced analytics helps investigators identify the
information out of the millions of transactions and data points
that needs special attention.
The following are some of the different analytic methodologies
that are available. Each of these, alone or in combination, lends
itself to identifying specific data challenges. The key is to
understand which one or combination works best in which
situations.
• Rules. Rules are the most basic analytic method.A rule is either
broken or not – yes or no.
• Anomaly detection.Anomaly detection is useful for identifying
outlier or unique activity in situations where little past fraud infor-
mation is available. In many instances, investigators don’t know
the specific nature of the financial crime being perpetrated by
an individual, fraud ring or terrorist cell.They may not even know
that an organization exists.Anomaly detection enables investi-
gators to surface information they may not be aware of.
• Predictive modeling. Useful when historical data is available,
predictive models allow early identification of fraud that is simi-
lar to previous fraudulent activity.This is the ultimate learning
approach.
• Network or link analysis.Addressing terrorism and organized
criminal activity requires more than understanding funding;
it also requires identifying and understanding the organiza-
tion itself and the individuals who make up the organization.
Network or link analysis enables investigators to understand
how individuals are associated and how they work together to
execute the terrorism and fraudulent criminal activity.
2
Aberdeen Group, Fighting Fraud With Big Data Visibility and
Intelligence, Sept. 24, 2012.
7. 5
the traditional way criminals have laundered money. “Now
organizations are using more informal methods for generating
and moving money,” said Barta, “including hawala, cash couriers
and digital currency.These alternative banking systems maintain
financial data manually.This makes it more difficult to investigate
these transactions and to integrate the information into the
larger data pool.”
These challenges are driving investigators on the front lines in
the fight against financial crimes, organized fraud rings and
terror cells to request additional capabilities from vendors:
• Quicker data integration. Business leaders say they need to inte-
grate new data into their existing environment far more quickly.
They often need information from their data within an hour of a
business event.
• Data quality.The process of ensuring data quality needs to be
automated.
• One-hundred percent data inclusion. Organizations increasingly
want to analyze all of their data, rather than simply looking at
samples.
• User self-sufficiency. Organizations don’t want to rely on IT to
benefit from data and analytics.
• Timely results. Organizations are demanding real-time or near-
real time results from their analytics.
Conclusion
Once investigators understand how to think like a fraudster,
they’re in a better position to understand fraud schemes and
how to outflank and outsmart fraudsters. But they’ll need to be
able to harness vast (and exponentially increasing) amounts of
data to truly understand illicit activities – and if they can’t, they’ll
lose the race.
But the more data and variety available, the more complex it
becomes to make sense of it. Law enforcement and investigators
can use advanced analytics to tame big data and turn it into
meaningful information for fighting fraudsters – including
criminals and terrorists. With these tools, investigators can better
understand relationships among criminal and terrorist groups
and better predict where they’ll strike next.
Said Barta, “We talk about how analytics provides a competitive
advantage in many situations. But there’s nowhere that
competitive advantage is more important than in the fight
against fraud, terrorism and money laundering – all of which
threaten our safety and our freedom.”
• Text mining and text analytics.Text mining and analytics are
becoming increasingly critical in the fight against fraud and
financial crimes.The proliferation of fraud rings and terrorist
organizations makes identifying and understanding relation-
ships a critical piece of the puzzle. Identifying these relationships
requires not only traditional structured data with dates, amounts,
addresses, times, etc., but also the analysis of blogs, social
network postings and conversations (including telephone, email
and text).
How Analytics Facilitates Fraud Investigations
Investigators can use analytics in fraud investigations to more
successfully separate low- and high-risk activities, which
improves productivity. Barta cited Santam as an example.
“Santam is a property and casualty insurer in South Africa that
uses investigations and legal actions to recover losses from
fraudulent claims. The company initially addressed all fraudulent
claims without triage. These investigations were after the fact,
costly and had a low probability of recovery.
“After Santam started using analytics, it was able to classify claims
by risk, placing them into one of five risk categories, which
allowed it to resolve low-risk claims very quickly and pay more
attention to the riskiest claims. Because it had the time to focus on
the high-risk claims rather than working on every claim without a
priority, it was able to identify a large fraud ring,” said Barta.
Challenges in Taking Advantage of Big Data
and Analytics
Before investigators can take advantage of these new big data
and advanced analytics capabilities, however, they’ll need to
overcome several challenges:
• Access to data. Using big data requires organizations to have
access to the data. Said Barta, “This can be a challenge when
organizations face privacy restrictions or when governments
face restrictions on sharing data.”
• Organizational structure.Terrorist and criminal organizations are
not necessarily organized in the types of hierarchical structures
we’re accustomed to with corporations.For example,said Barta,
“Al-Qaida isn’t a single organization with a single leader but rather
a number of smaller,semi-independent organizations.This makes
understanding the threat more complex and challenging.”
• New types of financing. Large financial institutions have been
8. 6
About the Presenters
Dennis M. Lormel, President and CEO of DML Associates LLC,
retired from the FBI in December 2003 after more than 30 years
of government service and almost 28 years as a Special Agent in
the FBI. Over the last 10 years Lormel has provided risk advisory
consulting services. He is the founder and President of DML
Associates LLC, a full-service investigative consultancy. Lormel
provides consulting services and training related to terrorist
financing, money laundering, fraud, financial crimes, suspicious
activity and due diligence. He also offers financial intelligence
services through case studies and trend analysis.
Dan Barta, Industry Consultant for Enterprise Fraud Strategy at
SAS, is a member of SAS’ Global Fraud and Financial Crimes
Practice responsible for the development and deployment of
SAS’ various fraud solutions – SAS® Fraud Network Analysis, SAS
Enterprise Case Management and SAS Fraud Management –
solutions that provide data analytics, alert management, case
management and social network analysis. Barta has more than
25 years of experience in fraud investigation, detection and
prevention.
