Identity Fraud Protection Using Big Data Analytics - StampedeCon 2015
•
9 likes•2,095 views
ID Analytics provides identity fraud protection services using big data analytics. It analyzes billions of records in near real-time to power fraud detection solutions for over 300 enterprise customers. The document describes different types of identity fraud such as identity theft, identity manipulation, and synthetic identity fraud. Examples of fraud rings are provided to illustrate how identities are linked across applications. The company's technology stack and machine learning algorithms are also summarized.
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (14)
Similar to Identity Fraud Protection Using Big Data Analytics - StampedeCon 2015
Similar to Identity Fraud Protection Using Big Data Analytics - StampedeCon 2015 (20)
More from StampedeCon
More from StampedeCon (20)
Recently uploaded
Recently uploaded (20)
Identity Fraud Protection Using Big Data Analytics - StampedeCon 2015
- 1. © 2015 ID Analytics, Inc. Confidential Identity Fraud Protection Using Big Data Analytics Stephen Coggeshall July 16, 2015
- 2. © 2015 ID Analytics, Inc. Confidential • Who am I? • Who is ID Analytics? • Everything you ever wanted to know about identity fraud • Our technology stack: billions of records examined in near real time Outline 2
- 3. © 2015 ID Analytics, Inc. Confidential ID Analytics Overview • Founded in San Diego, CA in 2002 • Powered by analytics, differentiated by data • Focused on empowering leading organizations to make better fraud, credit and identity risk decisions • Over 300 leading U.S. enterprises rely on ID Analytics solutions every day… - 4 of the top 6 financial institutions - 4 of the top 5 wireless carriers - Government agencies: Social Security Administration and Veterans Affairs 3 ID Analytics applies advanced analytics to a unique source of U.S. Identity data, solving critical fraud, identity and credit challenges to help enterprises grow safely
- 4. © 2015 ID Analytics, Inc. Confidential Identity Fraud is the act of misrepresenting which person you are Why is it done? • To improperly get products or services (financial services, consumer products…) • To stay “unidentified” while behaving badly (money laundering, terrorists…) What Is Identity Fraud 4
- 5. © 2015 ID Analytics, Inc. Confidential Ways to Classify Identity Fraud • Financial identity fraud ̶ Account openings ̶ Account takeover • Health care id fraud • Tax id fraud • Money laundering • Terrorist activity Classify by Industry/Target • Identity Theft • Identity Manipulation • Synthetic Identity Classify by Method Used 5
- 6. © 2015 ID Analytics, Inc. Confidential Three Types of Identity Fraud Who is the victim? Nature of the misrepresentation Identity Theft Core identity: Victim • Owner of misused identity • The company providing product/service • SSN, name and date of birth belong to the victim • Address, phone, and/or email belong to fraudster Identity Manipulation Core identity: Fraudster • Fraudster • The company providing product/service • SSN, date of birth and/or name vary slightly from the fraudster’s own, correct information Synthetic Identity Core identity: None • No direct consumer victim • The company providing product/service • SSN, name and date of birth are fabricated or chosen randomly 6
- 7. © 2015 ID Analytics, Inc. Confidential • Fraudster improperly uses another person’s identity information – New account origination (name, SSN, DOB) – Account takeover (name, account number) • Fraudster frequently uses his own contact information – (Phone, address, email) We All Know About Identity Theft 7
- 8. © 2015 ID Analytics, Inc. Confidential Example of Severe Identity Manipulator 9 different first names 5 different last names 24 different SSNs 11 different DOBs Suspicious address variation 8
- 9. © 2015 ID Analytics, Inc. Confidential Description of Synthetic Identity Fraud SSN “Charles Smith” DOBAddress Seen 1x Phone John Trufante Seen 10xs Address DOB Phone 9
- 10. © 2015 ID Analytics, Inc. Confidential Example Identity Fraud Ring • 85 phone & credit card applications from these 6 people from one address (close to Anacostia Park) in Washington, DC over 3 years. Sharing of SSNs, DOBs, names. • An additional 5 ID theft victims; 2 victims are deceased (ID theft of the dead). Ring is still active in September 2014. PII has been changed 10 Six People, Identity Manipulation and Identity Theft 1 Gerald Smith 24 yrs 2 FNs 10 apps 2 Corona Jones 24 yrs 2 SSNs, 2 LNs 12 apps 3 Corona Jones 52 yrs 3 SSNs, 2 DOBs, 2 FNs 5 apps 4 Monique Jones 43 yrs 2 SSNs, 3 LNs 9 apps 5 Latasha Jones 21 yrs 3 SSNs, 2 DOBs 26 apps 6 Angel Jones 21 yrs No identity manipulation 12 apps
- 11. © 2015 ID Analytics, Inc. Confidential Example Identity Fraud Ring Moved 11/2011 • 345 credit card apps, 1 payday loan from these 4 fraudsters from 2 addresses. Frank uses his college email (retired professor). • Started with Frank & Hatti, then Dottie. Later Freida joined. PII has been changed Indianapolis, IN area 11 Four People, Identity Manipulation Fraud 1 Hatti Smith 48 yrs 12 SSNs, 3 DOBs, 2 FNs, 3 LNs 194 apps 2 Frank Smith 75 yrs 7 SSNs, 5 DOBs, 2 FNs, 2 LNs 117 apps 3 Dottie Smith 71 yrs 2 SSNs, 3 DOBs, 4 FNs, 2 LNs 10 apps 4 Freida Jones 48 yrs 2 SSNs, 2 LNs 24 apps
- 12. © 2015 ID Analytics, Inc. Confidential Identity Fraud Ring Locations 12
- 13. © 2015 ID Analytics, Inc. Confidential • Receive the application (SNAPD: SSN, Name, Address, Phone, DOB) • Build the PII-linked graph • Translate this graph into numbers • These features are the inputs to machine learning algorithms • Calculate the score • Return the score and reason codes What’s Behind The ID Score? 13 All this is done in ~200 ms. Our products are real time delivered and near real time aware.
- 14. © 2015 ID Analytics, Inc. Confidential • ~2 billion applications for credit cards, mobile phones, retail credit, other loans… • U.S. white pages, (NAP*) ~100 million records monthly over ~10 years • Header files (SNAPD*), ~200 million records monthly over ~10 years • ~3 million labeled output records of various frauds • Account performance data, ~100 million/month • Account changes, ~10 million/month • Many other smaller files (SSA DMF, OFAC, census…) • > trillion data elements • Data is time stamped – can “roll back the clock” Data 14 *SNAPD – SSN, Name, Address, Phone, Date of birth
- 15. © 2015 ID Analytics, Inc. Confidential • Support Vector Machines (SVM) • Traditional Neural Nets • Boosted Trees • Random Forests • Convolutional (Deep) Neural Nets • K-Means Clustering • Others – linear, logistic regressions, CART/CHAID, radial basis functions, KNN… Machine Learning/Modeling Algorithms 15
- 16. © 2015 ID Analytics, Inc. Confidential • Identity Risk Scores – requires near real time assembly of near real time data for near real time score delivery • Identity Resolution – look back through all data over time and people to resolve an identity when presented with fragmented information. Needs knowledge of complete PII history. • Find fraud rings – examine multiple fuzzy linkings across billions of records. Can be batch. Services That Need Specialized Technology 16 These require very special data organization and systems
- 17. © 2015 ID Analytics, Inc. Confidential • The core of what we observe is events, like applications for products and services • Look across the flow of events for – anomalous interconnections – connections of known bad events • Fraud scores find events with anomalous connections • Gather known bad events, connect by address, phone number, email • Remove false positives (business, organization…) • Remainder are candidates for fraud rings Systematically Find Thousands of Fraud Rings 17
- 18. © 2015 ID Analytics, Inc. Confidential 18 Lambda Architecture Real Time Data Flow Batch Data Flow Speed Layer Batch Layer Serving Layer Reporting, BI RDBs RDB (RO, RW) Flat files Real time services N+1 redundancy Batch processing Analysis R&D Near real time synchronization Real time service delivery ~200 ms response time RDB (RO, RW) Flat files Hadoop, Spark, Hive Real time services N+1 redundancy
- 19. © 2015 ID Analytics, Inc. Confidential We have identified three methods of identity fraud • Identity Theft, Identity Manipulation and Synthetic Identity Real time fraud detection and awareness requires very careful system architecture • Data ingestion, storage, retrieval • Separation of real time, batch and BI/reporting • Optimization of data layout Summary 19
Editor's Notes
- The table above summarizes eh characteristics of 3 distinct identity fraud types that are often confused Ultimately, the difference between identity fraud, identity manipulation, and synthetic identity fraud manifests in how the fraudster obtains or creates the asserted PII, including the SSN, and the resulting indicator of fraud.
- The table above summarizes eh characteristics of 3 distinct identity fraud types that are often confused Ultimately, the difference between identity fraud, identity manipulation, and synthetic identity fraud manifests in how the fraudster obtains or creates the asserted PII, including the SSN, and the resulting indicator of fraud.
- “Charles Smith” applied for a credit card for the first time in 2010, prior to this he was never seen before “Charles Smith used a valid SSN to apply, however, that same SSN was used to apply for two retail cards for a completely different identity: John Trufante John and Charles have different names, dates of birth, addresses, and phone numbers. In fact, the addresses they used to apply were nearly 100 miles apart “Charles Smith” fulfills the algorithm for identifying a synthetic identity. He ahs never been seen before this application and the SSN he is asserting appears to belong to a completely different person As further evidence of fraud, John Trufante again applied for credit from another credit card company three months after “Charles Smith” appeared This strongly suggests that “Charles Smith” used John Trufante’s SSN to open a new account with a major lender, but because the new account uses fabricated, unshared, credentials, it is synthetic fraud, not identity theft
- “Charles Smith” applied for a credit card for the first time in 2010, prior to this he was never seen before “Charles Smith used a valid SSN to apply, however, that same SSN was used to apply for two retail cards for a completely different identity: John Trufante John and Charles have different names, dates of birth, addresses, and phone numbers. In fact, the addresses they used to apply were nearly 100 miles apart “Charles Smith” fulfills the algorithm for identifying a synthetic identity. He ahs never been seen before this application and the SSN he is asserting appears to belong to a completely different person As further evidence of fraud, John Trufante again applied for credit from another credit card company three months after “Charles Smith” appeared This strongly suggests that “Charles Smith” used John Trufante’s SSN to open a new account with a major lender, but because the new account uses fabricated, unshared, credentials, it is synthetic fraud, not identity theft
- “Charles Smith” applied for a credit card for the first time in 2010, prior to this he was never seen before “Charles Smith used a valid SSN to apply, however, that same SSN was used to apply for two retail cards for a completely different identity: John Trufante John and Charles have different names, dates of birth, addresses, and phone numbers. In fact, the addresses they used to apply were nearly 100 miles apart “Charles Smith” fulfills the algorithm for identifying a synthetic identity. He ahs never been seen before this application and the SSN he is asserting appears to belong to a completely different person As further evidence of fraud, John Trufante again applied for credit from another credit card company three months after “Charles Smith” appeared This strongly suggests that “Charles Smith” used John Trufante’s SSN to open a new account with a major lender, but because the new account uses fabricated, unshared, credentials, it is synthetic fraud, not identity theft