The document summarizes recent upgrades to the Lynx Fraud Management System between 2016-2017. It implemented predictive analytics scoring models using SAS to enhance fraud detection capabilities. Rules were combined with fraud scores to improve fraud detection rates and lower false positives. Additional upgrades included automated card blocking, a fraud notification service via SMS, improved user experience, and ongoing data quality improvements and analytics strategy.

1. Grozdana Marić, Fraud Product Manager
Ljubljana, 1st June 2017
WHAT ARE THE MOST RECENT
LYNX FRAUD MANAGEMENT SYSTEM UPGRADES?

2. ROADMAP Q2 2016 – Q2 2017
ENHACEMENTS

3. DETECTING FRAUD USING PREDICTIVE ANALYTICS – SCORING MODELS
• Implemented statistical models for fraud detection developed using SAS technology in order to enhance
Lynx Fraud Management System detection capabilities.
• Different scorecards implemented by type of transaction: ATM, POS CP, POS CNP.
• Enables detection and score the probability of fraud in cardholders’ transactions and in addition to
custom business rules define the appropriate action to be performed.
• Historical data (genuine and fraud transactions) are analyzed in order to discover patterns and predict the
future → future behavior reflects the past behavior.
• The scorecard module changes in parameters, variables, and other can be very easily and quickly done,
changes can be made by issuer, market, transaction type.
• The fraud score is easily combined with other business rules in the fraud detection process.
• Implementation completed for all Banks in Jan,2017.
2NORMAL

4. PRACTICAL APPROACH OF APPLYING RULES AND ADVANCED MODELS TOGETHER
• On-going analysis customized for each Bank tell how best to combine the score (anomaly detection) with other
variables available in fraud rules (known scenarios) to improve fraud detection / prevention performance.
• Analysis results with two main types of proposals that support following goals:
• To improve Fraud Detection Rate: Create new rules that detect fraud, previously not detected by
business rules only;
• To lower False - Positives: Create new rules that by adding score to existing fraud rules decrease FPR.
• Score thresholds to create alerts or to decline transactions (via On-line plus functionality) are determined with
each Banks based on:
• Fraud risk appetite, fraud tolerance, policies and procedures;
• Expected impact on the customer experience / preferences for customer satisfaction and aggressiveness
towards fraud prevention;
• Available resources (Fraud Operations, Call Centre etc.).
• The activity is completed for PBZ Card and VUB and is on-going for BIB and Activa Banks. Remaining Banks
follows.
3NORMAL

5. Are data consistent?
Do duplicate records exist?
Are relations within tables
consistent? Between
entities and attributes?
Are data available at
needed time?
Are data from verifiable
sources?
Are all data within
specified domains?
Data
quality
Timelines
Are all necessary
data present?
Accuracy Completeness
IntegrityValidity
NORMAL
Consistency
ANALYTICS STRATEGY – DATA MANAGEMENT
• Data quality challenges
• Better data enables better detection
• Introduce new data assets (session data, device data, location based information)
• Better flagging of fraud transactions  better input for statistical models
4

6. FRAUD SYSTEM AUTOMATED CARD BLOCKING (ONLINE PLUS)
• Integrated functionality / special fraud rules that enables automatic card blocking for AC/VS/AX products by:
• Automatic card blocking directly from FCM, triggered by special fraud rules. ISP Card Fraud team based
on a detailed historical data analysis and best practices proposed a set of High Risk rules which should
recognize fraud, while minimizing false positive ratio.
• Manual card blocking/unblocking directly through the Fraud Case Manager is as well enabled with
automatic sending blocking info to Back-office and Authorisation systems. This improves efficiency in
Fraud operations as there is no need to open another (Back-office) applications in order to block card.
• Possibility to enable Email Notification for these rule: After rule is triggered, in milliseconds, email is sent
to group of emails that you choose.
• Implementation completed for all Banks in Dec, 2016.
• Monitoring of usage of online plus rules (efficiency analysis, upgrades of existing rules to on-line plus node);
alert notifications.
NORMAL
5

7. FRAUD NOTIFICATION SERVICE (I)
• An upgrade of FMS, which enables sending SMS directly from Lynx, initialized by the analyst and brings the
following benefits:
• Helps Banks to improve the timeliness and effectiveness of their communication strategies in fraud
operations. Establishing fast contact is crucial in order to prevent potential fraud, which by itself brings
certain added value.
• Reduces the time it takes to successfully contact the customer and resolve case (instant deliverability,
high open rate in comparison to email, reliable, less disturbing than phone call).
• Eliminates false positive engaging customers on their preferred contact channel.
• Available for all Banks. In production for PBZ Card, Banka Intesa Slovenia, Activa Banks and private Banking
London.
6NORMAL

8. FRAUD NOTIFICATION SERVICE (II)
7NORMAL

9. ROADMAP Q2 2016 – Q2 2017
OPERATIONAL EFFICIENCY IMPROVEMENTS/
IMPROVED USER EXPERIENCE

10. IMPROVED USER EXPERIENCE / OPERATIONAL EFFICIENCY IMPROVEMENTS
Done
• Card limit information;
• Last 24h expenditure added to Card Profile;
• Family fraud type;
• Mouse over for all fields where it is applicable;
• Additional fields (expanding b24 feeder) requested by clients and Mercury PSI Fraud team;
• Upon clicking on “Apply status” button, user is redirected to Case list screen, which eliminates the need to click on
“Back to alerts” after applying status;
• Manual case checkboxes – depending on a level (PAN/PLM/MID/TID), checkboxes for transactions which can be
checked need to be shown/hidden.
Ongoing
• Case prioritization by coloring cases in the case list, depending on rule’s risk level. Degree of risk for each rule will
be set by the Bank;
• Possibility to create multiple manual cases;
• Multiple case closing with an option to close all marked cases as Confirmed fraud or False alert;
• Case lock to prevent closing of the same case by several analysts simultaneously;
• Additional information in history box;
• MID statistical module optimizing existing code and workflow.
9NORMAL

11. CARD LIMIT INFORMATION
Done
Card limit information (eXact back office)
10NORMAL

12. CARD LIMIT INFORMATION (II)
Done
Card limit information (CMS back office)
11NORMAL

13. SPENDING INFO
Done
Card limit information
Last 24h expenditure added to Card Profile
12NORMAL

14. IMPROVED USER EXPERIENCE
Done
Card limit information
Last 24h expenditure added to Card Profile
Family Fraud type
13NORMAL

15. LYNX VERSIONING

16. By the end of 2014 all ISBD banks were using Lynx FMS 1.0, finishing a great milestone in Fraud product stream – migrating
from off-shelf solution to an in-house solution -> Lynx Fraud Management System (Lynx FMS).
Functionalities that uplifted Lynx FMS above previous fraud solution:
• All in one access
• Multibanking solution
• Flexible rule engine - limitless number of rules
• Extensive reporting suite - operational, statistical, performance and customized reports
• Integrated transaction viewer (up to six month back; over 20 different filters) and manual case creation
• Hotlist management - analysts have full control over hotlists updates (insert/edit/activate/deactivate records)
• Suppression list - Full and Grey suppression
• Security check functionality
• Enhanced acquiring module: 4 levels (MID/TID/PLM/MID STAT)
• Fraud forum pinboard for sharing all fraud related information on recent fraud trends
VERSIONING (I)
Lynx FMS 1.0
2014
15NORMAL

17. At the very beginning of 2015, before any upgrades were considered, an overall optimization was done in Lynx Manager
resulting much faster responsiveness of the GUI module.
After development of approved upgrades, version Lynx FMS 2.0 was deployed with following functionalities that needs to be
highlighted:
• Deployment of Online Plus module in production (version changing functionality)
• Case reactivation functionality
• Improvements in History grid - CH contacted, Comments
VERSIONING (II)
Lynx FMS 1.0
Lynx FMS 2.0
2014 2015
16NORMAL

18. In version Lynx FMS 3.0 following functionalities needs to be highlighted:
• Deployment of Fraud Score Card module in production (version changing
functionality)
• Expanding feeders with additional authorization fields
• Information about card limits, additional cardholder info and card information
is added
• SMS functionality implemented in Lynx Manager
VERSIONING (III)
Lynx FMS 1.0
Lynx FMS 2.0
Lynx FMS 3.0
2014 2015 2016
17NORMAL

19. In version Lynx FMS 4.0 planned functionalities that to be highlighted:
• Prioritizing cases in the case list (e.g., high risk cases colored in red)
• Common Point of Purchase (CPP) module (version changing functionality)
• Dashboard
• Import of Issuing and Acquiring Force-Posted Transactions from target BO
• Multiple case creating
• Multiple case closing
• RT
VERSIONING (IV)
Lynx FMS 1.0
Lynx FMS 2.0
Lynx FMS 3.0
Lynx FMS 4.0
Lynx FMS X.0
2014 2015 2016 2017
18NORMAL

20. THANK YOU!
Any questions?