The document discusses how to detect and prevent same day ACH BEC fraud. It provides an agenda that includes an introduction, why this matters, dissecting the fraud scheme, and why the company is unique in analyzing this type of fraud. It then describes the fraud scheme, including how hackers target executive emails, validate the emails, and fingerprint the victim's digital profile. It outlines the process from the BEC scam to fraudulent same day ACH batches. It discusses key risk factors the company looks for and how it uses machine learning and behavioral analytics to automatically establish baselines and risk score ACH batches.

1. How to Detect and Prevent
Same Day ACH BEC

2. 3© 2018 Guardian Analytics. All Rights Reserved
1. Introduction
2. Why It Matters?
3. Dissecting the Fraud Scheme
4. Why We Are Unique?
5. Q&A
AGENDA

3. Introduction

4. 5© 2018 Guardian Analytics. All Rights Reserved
Behavioral Analytics Approach to Fraud Prevention
Collect user data
from online activity
and transactions
Compare to known
user ‘behavior’
Flag behavior that is
statistically anomalous for
that user
Create action to
mitigate risk
Results:
• Fewer false positives
• Higher fraud capture rate
• Improved operational efficiency

5. 6© 2018 Guardian Analytics. All Rights Reserved
Financial
institutions
Commercial & retail
account holders
Banking
activities
450 40M 5B
Guardian Analytics at a Glance

6. Why We Are Unique in
Dissecting a Same Day BEC
ACH Fraud

7. 8© 2018 Guardian Analytics. All Rights Reserved
Targeting High Level Executives Emails
Understanding the BEC Hacker Methods

8. 9© 2018 Guardian Analytics. All Rights Reserved
Understanding the BEC Hacker Methods
https://www.blackhat.com/docs/us-17/wednesday/us-17-Singh-Wire-Me-Through-Machine-Learning.pdf
Validating the Emails

9. 10© 2018 Guardian Analytics. All Rights Reserved
A Day in a Life of a BEC Hacker
https://www.blackhat.com/docs/us-17/wednesday/us-17-Singh-Wire-Me-Through-Machine-Learning.pdf
Fingerprinting the Victim Digital Profile

10. 11© 2018 Guardian Analytics. All Rights Reserved
From BEC Scam to Same Day ACH Batches
Manipulation
1.Via Social Engineering
Fraudster access to an
Executive Email and Address,
Username, Pwd
2.Fraudster poses as originator
& sends BEC email to change
ACH Debit recipients “mule
accounts”
3.Fraudster posing as
originator originates $ Batch
Debit Amount to “mule
accounts” as recipients
4.The True originator’s account
is debited for the hacked
origination file
5.Fraudster empties “mule
accounts” & bust out
6.Funds cannot be recovered
Social
Engineering
Account
Compromised
BEC Email with
Fraudulent
Instructions
Suspicious Batch
Amount
Suspicious Batch
Amount
Suspicious $ Batch
Amount
Suspicious
Batch Amount
Suspicious
Batch Amount
Originator
Account
Debited
Suspicious
Batch Amount
Suspicious
Batch Amount
Originator
Account
Debited
Suspicious
Batch Amount
Suspicious
Batch Amount
Originator
Account
Debited
Timeline
Suspicious Batch
Amount
Suspicious Batch
Amount
Suspicious $ Batch
Amount
Suspicious Batch
Amount
Suspicious Batch
Amount
Suspicious $ Batch
Amount
8:30
am
9:30
am
10:30
am
1:30
pm
2:30
pm
3:30
pm
4:30
pm
5:30
pm
Day 1 Day 2 Day 3
You Can Still Detect & Block
Fraudulent ACH Instructions
with Guardian Analytics
11:30
am
12:30
pm
11:30
am
12:30
pm
8:30
am
9:30
am
10:30
am
1:30
pm
2:30
pm

11. 12© 2018 Guardian Analytics. All Rights Reserved
Key ACH Behavior Risk Factors
Key Risk Factors:
New Recipient
New Beneficiary Location
New Beneficiary FI
Batch SEC Code
Transaction Code
Batch Amount
Batch Count
Timeline
Day 1 Day 2 Day 3
With Machine Learning & Behavioral
Analytics We Will Automatically
Established a Baseline and Risk
Scored Each ACH Batches

12. 13© 2018 Guardian Analytics. All Rights Reserved
Detect Fraud with Behavioral Analytics
Batch Velocity
Change
Transaction
Amount Change
Early Warnings
Retained in the
Behavioral
Analytics Mode

13. 14© 2018 Guardian Analytics. All Rights Reserved
Create Case and Investigate
Easily Create Cases
with Key Pieces of
information
automatically filled
out
Track the results of your
investigation such as
customer calls, etc.

14. 15© 2018 Guardian Analytics. All Rights Reserved
Analyze & Gain Insights with Fraud Analytics

15. 16© 2018 Guardian Analytics. All Rights Reserved
Executive Level Dashboards
SharableMultiple Views
Customizable per Channel
Multiple Views
Customizable per Analyst

16. 17© 2018 Guardian Analytics. All Rights Reserved
Comprehensive OOB Reports & Dashboards
Available
• Alert Volume
• High & Medium Risk Alerts
• Case Categories
• Alert Status
• Case Status
• Total Sessions
• High Risk Alerts
• Total Opened Cases
• Confirmed Fraud
On The Roadmap
• Application/Source
• Low Risk Cases
• Business Rules Alerts with
Transactional Data

17. 18© 2018 Guardian Analytics. All Rights Reserved
Learn More
Introduction to Fraud Cockpit
Detecting Business Email Compromise
Fraud - Alert in the Life Series
Detect suspicious or fraudulent
payments in originated ACH files
Meet New Submissions

18. Q&A

19. 20© 2018 Guardian Analytics. All Rights Reserved
Contact Us
success@guardiananalytics.com
www.linkedin.com/company/guardiananalytics
www.youtube.com/user/GuardianAnalytics
@GuardAnalytics