PRO HAWK - Holistic, Proactive, Real-time, Integrated Approach of Fraud & Risk Management system. The same methodology can replicate or implement in any domains like Telecom, Banking, Financial, Non Financial, Payment Gateway, Point of Sale (PoS), Anti Money Laundering (AML), E-commerce, M-Commerce, Mobile Money, E-wallet, Cashless & Regular mode of payments.

1. Holistic, Proactive, Real-time, Integrated
Approach of
Fraud & Risk Management system
Project Proposed & Developed By: Jerome Salecious J
Fraud & Risk Management Professional ,Expert & Domain Architect

2. PRO HAWK Highlights
Current Fraud & Risk Trend
3
4
5
Contents
2
1
Fraud & Risk Opportunities
PRO HAWK – Working Structure
Process Re-engineering

3. PRO HAWK - Highlights
Project Proposed & Developed By: Jerome Salecious J
Fraud & Risk Management Professional ,Expert & Domain Architect

4. PRO HAWK
Evolving the Fraud & Risk opportunity landscape around
the Banking, Financial, Non Financial & E-Commerce
Industries. And increase in Fraud & Risk related damages
and impacts requires Holistic Proactive Real-time
Integrated automated detection systems and Robust the
fraud defense processes & Mechanisms.
PRO HAWK linked and integrated with required sources
and apply dynamic profiling techniques for every
transactions, based on Fraud and Risk scoring
methodology.
PRO HAWK is full pack detection system , its developed
based on most effective technical paraphernalia and
strategic methods to deal with Fraud & Risk . Selecting the
right frame work and seamless integration on
Bank/Financial systems to safeguard the business and
customer interests.
Reputation of
Risk
Regulatory
Compliance
Loss Protection
Proactive &
Real-time
Monitoring
Process
Reengineering

5. Current Fraud & Risk Trend

6. Who Is Fraudster?
A fraudster is one that commits fraud. It might be a person or an organization. However, it is very practicable to
profile the fraudster personal characteristics and features of the organization environment that fraudsters thrive.
What KPMG Survey Says:
The perpetrator of the fraud trends to be male between the ages 36 and 55, working with the victim organization
more than 6 years and holding an executive position in operation, finance or general management .
It means there is no limit & level for the fraudster.
Fraudster
Outside the
Organization
Internal
Employee
Vendor /
Business
Partner
Customer
Merchant

7. Fraudster HooksFraudster Sources
Non Effective KYC
Non Validating
Documents
Non update of
customer profile
Inadequate
Dedupe /
Precheck Process
Failure in Blacklist
Management
Bio Metric
identity
Twin / Siblings /
Marital status info
No Address
Verification
No Customer
Background
Verification
Customer
personal Info
Mobile, & Digital
Devices
Computer &
Laptops
Personal Dairy /
Notes
Account details
Physical Survey
Copies of
document
Failure of InfoSec
Hacking the
Server
Password Sharing
Password Hacking
Loose Password
Unauthorized
Access
Data Leakage –
Integrity
Delay in Response
Non Monitor -
Interaction
Management
Ineffective
Communication
Un availability
contact Info
Wrong Contact
Info
Partial Contact
Info
Mismatch
Information
Manual Error –
Contact Info
Delay in
communication
Social Media Info
E-Commerce &
Online Shopping
LinkedIn,
Facebook, Twitter
etc..
Matrimony & Job
Portals
Chat & Dating
Games
Black Market
Solutions
Bug Apps
Phishing Website
Inefficient FRM
tool
Outdated
Configurations
Limited
Configuration
Delay in
Identification
Process
Loopholes
Non Effective
Rule
Management
Atomistic FRM
tool
Telecalling,
Phishing Emails &
SMS
Job Offer –
Resume
Collection
Lottery
Reward
Donation
Online Survey
Honey Trap
Internal
Resources
Internal Employee
Business Partner
Vendors

8. Information's
Sources
Mobile & Digital Device Computer & Laptop Dairies & Personal Note BUG APP Survey Resume Email
Customer Address Proof     
Customer Identity Proof     
Family Information       
Personal Information       
Contact Information       
Account Number      
Customer ID     
User ID's     
PIN Numbers    
Passwords    
User ID's    
Operation Procedures      
Operation Updates      
Social Media Accounts       
Customer Queries     
Resume     
Email    
SMS  
Fraudster Information Source

9. 9 of 94
PRO HAWK – Working Structure

10. PRO HAWK
Blacklist
Data
Pattern /
Behavior
Data
Simswap /
Clone,
Mobile
number
change Data
Geotag Data
Amount
Deposit Data
Unused
Account/
Unclaimed
Amount
Data
Unauthorized
Status
Change
Unauthorized
Access
Customer
Information
Access Data
Dispute /
Refund Data
Failure
Attempt
Data
PRO HAWK System Integration

11. PRO HAWK
Blacklist Data
Pattern / Behavior Data
Simswap/Clone, Mobile number change Data
Geotag Data
Amount Deposit Data
Unused Account / Unclaimed Amount Data
Unauthorized Status Change Data
Unauthorized Access– Info Sec
Customer Information Access Data
Dispute / Refund Data
Failure Attempt Data
Customer
POS / PG
Acquirer Bank
Association
Issuer Bank
PRO HAWK – How it work?
1
2
3
45
6
7
8
1A
4A
6A
F&R Avenues

12. PRO HAWK – Fraud & Risk Score
Transaction Initiation
PRO HAWK Validate the
transaction
PRO HAWK generate the F&R
score
Transaction will Approve /
Reject Or Additional
confirmation need to approve
• Transaction Count slightly high
• Transaction value slightly increased
Risk Score – 0 to 20 - Approve
• Previous transaction is failed due to wrong pin
• Customer called Customer care but call disconnected
Risk Score 21 to 35 - Approve
• MAC address is differ – OTP or customer need to confirm the
identity
• High value amount deposited in customer account.
Risk Score 36 to 50 – Additional
Confirmation Required from customer
• Previous and current transaction initiated location are differ and
distance between two location is huge and it very difficult to
cover the distance with in short time.
Risk Score 51 to 60 - Reject
• Transaction initiated from blacklisted MAC address.
• With in the short time previously two more transaction initiated
from same customer
Risk Score greater than 60 – Reject
Raise the fraud protocol

13. 13 of 94
Fraud & Risk Avenues

14. Fraud Customer Profile
Fraud Impact
Information
Name, Account &
Location
Email & Contact
numbers
Social Media accounts
Cards and Account
transfer information's
Fraud Merchant Profile
Fraud Impact
Information
Name & Location
Email & Contact
numbers
Social Media accounts
Cards and Account
transfer information's
Digital Fingerprint
IP & Geo Tag
information
MAC address
IMEI number
Mobile /SIM Number
PoS / Electronic device
Unique device number
Blacklist Data
• Every new fraud or suspected details will be add in blacklisted base.
• Refreshed blacklisted base help to stop, reduce & control the fraud impact & damage
• Blacklisted base will be refresh multiple times in a day.

15. Pattern / Behavior Data
Sequential patterns Data is one of data mining technique that seeks to discover or
identify analogous patterns, progressions and general trends in transactions and
mode of transaction over a business period. Data leads to discovery of various
hidden trends, which is highly predictive of future events.
Account / Transaction Pattern
• Rule Alert Mechanism
• Customer Threshold and
categorization
• Merchant Threshold and
categorization
• Customer account management
• Multi Frequency - Transaction count
and value
• Multi Frequency - Mode of
transaction
• Device & location Information
Fraud Behavior Pattern - Dynamic
• Transaction initiated similar to
previous Modus operandi of fraud.
• Changes in customer profile
information
• Changes in customer contact
information
• Changes in customer location
• Abnormal Transaction trend
• Opportunity on split transaction

16. SIMswap/clone, Mobile number change Data
• Fraudster not allow the any information to reach customer during the fraud attack.
• Fraudster change or disconnect the customer communication purposely from the institute.
• RBI & TRAI should come to work collaboratively.
• Bank or Institute share the customer mobile number details to mobile operators.
• There is any changes in Mobile number or SIM, mobile operator not allow any incoming SMS service for 24 hours.
• And mobile operator share the report to Bank / Institute on regular frequencies.
Transaction Initiation
• Transaction initiated after
Mobile or SIM change
• Mobile operator share
the details to Bank /
Institute
Pro Hawk
• Dual Confirmation
required
• Validating other Risk
opportunity
• Arriving Risk Scores
F&R Risk Score
• Approve Transaction –
Low Risk
• Dual Confirmation –
Medium Risk
• Reject – High Risk & raise
the fraud protocol.

17. Geotag Data
• Geotag must be capture for all transaction initiations and enquiries over the phone or direct.
• Geotag helps to arrive the customer transaction pattern.
• Customer information hacked by the fraudster then fraud abuse can initiate from any global location.
• And the transaction initiated from two different location , within short time period.
• Even the distance not covered by fasted mode of travel it should be triggered in Pro Hawk.
• F&R score derived based on customer categorization and frequent travel mode.
• Geotag information can collected from PoS device and IP location.
Transaction Initiated
• Within short time or consecutive transaction initiated from different
locations.
• Fraudster creating or created the impact, Geotag information
required for further investigation.
Pro Hawk
• Dual Confirmation required
• Validating other Risk opportunity
• Arriving Risk Scores
F&R Risk Score
• Approve Transaction – Low Risk
• Dual Confirmation – Medium Risk
• Reject – High Risk & raise the fraud protocol

18. Amount deposit
• High Value
Amount deposit
• Amount
Transferred
from some
other accounts.
Transaction
Initiation
• Failure attempts
of ATM PIN /
Net Banking PIN
/ OTP / GRID
• Transaction
Initiated within
short time.
• Transaction
initiated from
different
location
• Change in
Customer
profile and
communication.
PRO HAWK
• Validate the
transaction with
other channel
reports.
• Validating the
risk opportunity
• Arriving the F&R
Score
F&R Score
• Approve
Transaction –
Low Risk
• Dual
Confirmation –
Medium Risk
• Reject – High
Risk & raise the
fraud protocol.
• After cash deposit or amount transfer most of the fraud attempts are happening to
transfer the amount to other accounts.
• Fraudster will wait for the right moment with available resource & information.
• Fraudster purposely do some changes in customer communication information.
Amount Deposit Data

19. Unused Account & Unclaimed Amount Data
• Unused Account: If any active account not used for long time for any transaction purpose, with or without balance of amount.
• Unclaimed Amount: If amount not claimed or not utilized for any transaction for a longtime from a customer or Bank /
Institute suspense account.
• Mostly these type of fraud abuse done by Internal employees or vendors who have access to customer account information.
• Internal employees and Vendors know the process and loophole to claim the amount or use the account.
• Unused customer active account or old account may be used for fraud abuse, illegal money deposit / transfer without
customer knowledge.
Transaction Initiation
Transaction initiated
after long time
Any customer service
request raised
Changes in profile and
communication info
Repeated interaction
Failure attempts
Pro Hawk
Dual Confirmation
required
Validating other Risk
opportunity
Arriving Risk Scores
F&R Score
Approve Transaction –
Low Risk
Dual Confirmation –
Medium Risk
Reject – High Risk &
raise the fraud
protocol.

20. Unauthorized Status Change Data
Unauthorized Status Change: Bank or Institute maintain “N” number of processes status to categorize the customer and account .
If there is any status changes happened unauthorized manner its called Unauthorized status change.
 Mostly these type of fraud abuse & non compliance done by Internal employees or vendors who have access to customer account
information.
 Otherwise fraudster may hack the Bank or institute system from outside and do the unauthorized access.
 For example due to risk prospective or proactive manner the customer account status tagged under Block, Closed, Inactive or
Freeze.
 If any one change the status to active in unauthorized way and initiated any transaction it will be capture in PRO HAWK.
Transaction Initiation
• If there is any transaction
initiated status changed account
PRO HAWK
• Validate the transaction with
other channel reports.
• Validating the risk opportunity
• Arriving the F&R Score
F&R Score
• Approve Transaction – Low Risk
• Dual Confirmation – Medium
Risk
• Reject – High Risk & raise the
fraud protocol.

21. Unauthorized Access Data
Unauthorized Access: To create the fraud impact, if there is any repeated interaction on any customer account by single user id or
multiple user id in same or different location.
 Mostly these type of fraud abuse & non compliance done by Internal employees or vendors who have access to customer account
information.
 Otherwise fraudster may hack the Bank or institute system from outside and do the unauthorized access.
• If there is any of the transaction initiated from those accounts it will be captured in PRO HAWK.
F&RScore
PROHAWK
TransactionInitiationMultiple
interaction in
single account
by single ID
and
transaction
initiated on
the account
Multiple
interaction in
single account
by multiple ID
and
transaction
initiated on
the account
Validate the
transaction
with other
channel
reports.
Validating the
risk
opportunity
Arriving the
F&R Score
Approve
Transaction –
Low Risk
Dual
Confirmation –
Medium Risk
Reject – High
Risk & raise
the fraud
protocol.

22. Customer Information access Data
Transaction
Initiation
• Transaction initiated fraud enquiry account.
PRO HAWK
• Validate the transaction with other channel reports.
• Validating the risk opportunity
• Arriving the F&R Score
F&R Score
• Approve Transaction – Low Risk
• Dual Confirmation – Medium Risk
• Reject – High Risk & raise the fraud protocol.
Customer Information Access Data: Fraudster call customer care or visit the Bank / Institute directly with limited or without
information about customer and to get more information about customer or customer account.
• Employee or customer care unit tagged information about the enquiry on respective account.
• Transaction initiated from these accounts it will be capture in PRO HAWK

23. Dispute / Refund Data
If any fraudster or customer aware about the benefit of chargeback
dispute or other dispute or refund, and initiated the any transaction
to get one more benefit from the institute. it will be triggered and
alerted in PRO HAWK.
• Duplicate Dispute / Refund
Request
• Same Merchant
• Less value transaction
• From same failure network
& device
Transaction Initiation
• Validate the transaction
information
• Validating other Risk
opportunity
• Arriving Risk Scores
PRO HAWK
• Approve Transaction – Low
Risk
• Dual Confirmation –
Medium Risk
• Reject – High Risk & raise
the fraud protocol.
F&R Score

24. Failure attempt Data
• Every failure alerts are warning sign to the institute.
• Failure attempts are leads to the Fraud and Risk Management team.
• User ID failed to login and there is changes happened in customer
account / profile or raising the service request.
• All failure attempts to be rigorously monitored.
Failure Attempts
• ATM / IPIN attempt
• Net banking password
• Grid / OTP attempt
• Failure to confirm
identity – Bank
• Failure to confirm
identity – customer
care
Transaction Initiation
• Transaction initiated
after failure attempt
• Transaction Initiated
within short time.
• Transaction initiated
from different location
• Changes in Customer
profile and
communication
PRO HAWK
• Validate the transaction
with other channel
reports.
• Validating the risk
opportunity
• Arriving the F&R Score
F&R Score
• Approve Transaction –
Low Risk
• Dual Confirmation –
Medium Risk
• Reject – High Risk &
raise the fraud
protocol.

25. Process Reengineering

26. Fraud & Risk Process Reengineering
• Fraud & Risk control mechanism is not a standard one, it’s a dynamic and it can change over the period.
• Fraud & Risk take different dimension based on process effectiveness & control of the system, New Technology and Knowledge of
the fraudster.
• The process reengineering is most important for Fraud & Risk Management team and process.
• Process Reengineering involves the radical redesign of the processes to achieve dramatic improvements in control the fraud
attack and reducing the fraud impact with in short time.
Control the Fraud
& Take Action
Collect –
Fraud Impact
Info
Root Cause
AnalysisIdentify the
Fraud
Derive – Modus
Operandi
Process
Reengineering
Risk
Assessment
Validating Existing
Controls

27. Thank You
Project Proposed & Developed By: Jerome Salecious J
Fraud & Risk Management Professional ,Expert & Domain Architect