Last year the world lost $4 trillion to fraud according to Forrester Research. This very second, financial fraud is being committed around you, and you don’t have a clue! In this talk, you will learn how to play Sherlock in this complex and ever changing fraud landscape, using batch, real-time and predictive analysis capabilities of the WSO2 Analytics Platform. Come and watch how we unravel the mystery piece by piece. But more importantly, learn how to nip it in the bud by putting in place a powerful and effective fraud detection system, using WSO2 Middleware.

1. Catch them in the Act
Fraud Detec+on with
WSO2 Analy+cs Pla:orm
Seshika Fernando
Technical Lead
WSO2

2. $4 Trillion in Global Fraud Losses
Analysts predict Businesses are losing 5% of business revenues
to Fraud each year

4. Many Ways
• Generic Rules
• Fraud Scoring
• Machine Learning
• Markov Models

5. Capturing Domain Exper+se
Fraudsters
• Use stolen cards
• Buy expensive stuff
• In large quan++es
• Very quickly
• At odd hours
• Ship to many places
• Provide weird email addresses

6. Complex Event Processing
No#fy if there is a 10% increase in overall trading ac#vity AND the average price of commodi#es has
fallen 2% in the last 4 hours

7. Moving Averages
from Transac+onStream#window.+me(60 min)
select itemNo, avg(qty), stdev(qty)
group by itemNo
update AvgTbl as a
on itemNo == a.itemNo
from Transac+onStream[itemNo == a.itemNo and qty>(a.avg +3*a.stdev) in AvgTbl as a]
select *
insert into FraudStream

8. Transac+on Velocity
from e1 = Transac+onStream ->
e2 = Transac+onStream[e1.cardNo==e2.cardNo]<2:>
within 5 min
select e1.cardNo, e1.txnID, e2[0].txnID, e2[1].txnID
insert into FraudStream

9. The False Posi+ve Trap
So what if I buy expensive stuff
Very quickly
At odd hours
Ship to many places
Rich guy
Impulse Shopper
Night owl
Many girlfriends?
Blocking genuine customers could be
counterproduc+ve and costly

10. Avoid False Posi+ves with Scoring
Use combina+on of rules
Give weights to each rule
Single number that reflects mul+ple fraud indicators
Use a threshold to reject transac+ons
• You just bought a diamond ring
• You bought 20 diamond rings, within 15 minutes at
3am and shipped it to 4 global loca+ons?

11. How to score
Score = 0.001 * itemPrice
+ 0.1 * itemQuan+ty
+ 2.5 * isFreeEmail
+ 5 * riskyCountry
+ 8 * suspicousIPRange
+ 5 * suspicousUsername
+ 3 * highTransac+onVelocity

12. Known devil is bemer than an unknown angel...

13. Machine Learning
U+lize Machine Learning techniques to iden+fy ‘unknown’ types
of fraud

14. Is organized crime that simple?

15. Markov Models
• Model randomly changing systems
• Detect rare ac+vity sequences using
– Classifica+on
– Probability Calcula+on
– Metric Calcula+on

16. Markov Models for Fraud Detec+on

17. One true inference
invariably suggests
others
- Sherlock Holmes

18. Dig deeper using Interac+ve Analy+cs
• Provide access to historical data to dig deeper
• Make querying and filtering easy and intui+ve
• Provide useful visualiza+ons to isolate incidents and
unearth connec+ons

19. Curious?
hmp://wso2.com/analy+cs/solu+ons/fraud-and-
anomaly-detec+on-solu+on/

20. Payment Fraud

21. An+ Money Laundering

22. Iden+ty Fraud

24. Thank You