Financial Fraud Detection and Prevention with Data Mining Techniques Professor Hui Xiong Rutgers Business School

Transcription

1 Financial Fraud Detection and Prevention with Data Mining Techniques Professor Hui Xiong Rutgers Business School

2 What is Financial Fraud General Violation of Good Behavior in regards to Financial Issues Accounting Manipulation Fraud or Manipulation in the Annual Financial Report Non Compliance with Internal Controls and Procedures Misappropriation of Assets Fraudulent Statement Corruption

3 Types of Financial Fraud External Threats Investment Fraud, Credit Card Fraud, Identity Theft Internal Threats Financial Theft, False Accounting, Fraudulent Trading, Money Laundering, Mortgage Fraud, Inside Trading, Market Manipulation Almost 75% of frauds were perpetrated internally

4 What is Data Mining

5 Why Data Mining for Financial Fraud Detection Large-scale financial data are being collected and warehoused Financial Transaction Data Financial Report Bank/Credit Card transactions Computers have become cheaper and more powerful Competitive Pressure is Strong Provide automatic, customized services for an edge, e.g. automatic trading machine.

6 Data Mining Process for Fraud Detection

7 Who commits fraud? How to estimate risk probability? Source : 2008 report to the Nation on Occupational Fraud and Abuse, Association of Certified Fraud Examiners

8 Identify and Evaluate Fraud Risk Factors Identify fraud risk factors at the entity level and business process level. Consider whether each fraud risk factor indicates the existence of an incentive or pressure, opportunity or attitude and rationalisation. Identify incentives / pressures to commit fraud, opportunities to commit fraud, or attitudes / rationalizations to justify fraud. Personnel from various levels of the organization should be involved in the process. Where could the fraud occur? What would the fraud look like? What type of fraud is the area susceptible to? What are the effects on the books and records? When could the fraud occur? Consider internal and external (e.g., regulatory, industry) influences.

9 Financial Reports Annual Report Financial Statements Chairman's report CEO's report Mission statement Auditor's report on corporate governance Statement of directors' responsibilities Invitation to the company's AGM Corporate governance statement of compliance US:10-K SEC: Security and Exchange Commission

10 Financial Statements Also Include: Auditor's report on the financial statements Notes to the financial statements Accounting policies

11 Data Collection Sample Firms Type Details Sources Target (484) Bankruptcy Companies Trading Suspension Companies UCLA bankruptcy research database (BRD) US SEC trading suspension Normal (902) Matched Pair Design with Target Companies similar size, industry, lifecycle Google finance, Yahoo finance, Major financial journals Time Period:

12 Data Collection Raw Data: 10 years financial statements for each firms 126 attributes for each instance Data Source: COMPUSTAT database from WRDS (Wharton Research Data Service) Identifier (4) Company Information (10) Account Information (111) Label(2) gvkey cusip state, comn stko, exchg ACT,CEQ EBIT,COGS Target (Y) tic cik date, fyr,fyear,currtr sic, naics DlCCH, CAPX, AOLOCH EMP Normal (N)

13 Enron Network

14 Business & Economic Networks Example: ebay bidding vertices: ebay users, links: represent bidder-seller or buyer-seller fraud detection: bidding rings Example: corporate boards vertices: corporations links: between companies that share a board member Example: corporate partnerships vertices: corporations links: represent formal joint ventures Example: goods exchange networks vertices: buyers and sellers of commodities links: represent permissible transactions

15 Data Mining Process for Fraud Detection

16 Detection - Fraud indicators Receipt of tip-offs High staff turnover Low morale amongst staff Lifestyle of employees not commensurate with salary Unusual, irrational or inconsistent behaviour Holiday not taken Key financial indicators starting to slip Does the business accounting make sense and do you understand it? Dominant line management

17 A typical perpetrator: Semantic Information Gender larger and higher volume of frauds committed by men Age typically middle aged Education as the level of education rises so do the losses caused Criminal history majority of perpetrators are first time offenders Time with the company the longer employed the bigger the loss

18 Feature Transformation: Case Study Missing Value Handle eliminate data objects or attributes estimate missing values methods: based on accounting knowledge ignore the missing value during analysis Feature Construction(Domain Knowledge) extract or creation valuable attributes from original data Feature Selection( Technique Knowledge) Pearson s Correlation Classifier-based feature ranking

19 Feature Construction Identifiers (4 attributes) Financial Ratios (32 attributes) Class Label (1 attribute) Z-Score: predict a company s probability of failure ROA: indicate whether to start a project EBIT: indicate company s profitability SOLVENCY RATIO: measure company s ability to meet its long-term obligations. >20% financially healthy ACID-TEST: whether enough short-time assets to cover liabilities. <1 viewed with caution

20 Dataset 3 year statement (4620 instances 37 attributes)

21 Data Mining Process for Fraud Detection

22 Report Mining A Low-cost and High-impact Alternative USERS OF INFORMATION Hardcopy Reports Report Mining Data Mining Real-time Data Mining Report Files Data Warehouse Report Generators Report Generators OPERATIONAL DATA

23 Report Mining for Fraud Detection Test 1 Test 2 Test 3 Test 4 Test 5 Match payments against authorized suppliers list Match suppliers against employee surnames Match vendor bank account numbers to employee bank account numbers Match delivery addresses to employee addresses Identify large variances from prior years

24 Data Mining Profiling The matching or «cross-checking data»! Find your «missing traders» Know where they are buying from Indicators about fraud (activity, places, ) Evaluate the fraud The profiling (data mining) Identify quickly : Buffers, profit takers, crossed invoicers and conduit companies to put on monitoring

25 Data Mining: Confluence of Multiple Disciplines? 20x20 ~ 2^400 10^120 patterns

26 10 Data Mining Tasks Data Tid Refund Marital Status Taxable Income Cheat 1 Yes Single 125K No 2 No Married 100K No 3 No Single 70K No 4 Yes Married 120K No 5 No Divorced 95K Yes 6 No Married 60K No 7 Yes Divorced 220K No 8 No Single 85K Yes 9 No Married 75K No 10 No Single 90K Yes 11 No Married 60K No 12 Yes Divorced 220K No 13 No Single 85K Yes 14 No Married 75K No 15 No Single 90K Yes Milk

27 10 Predictive Modeling: Classification Find a model for class attribute as a function of the values of other attributes Tid Employed Level of Education # years at present address Class Credit Worthy 1 Yes Graduate 5 Yes 2 Yes High School 2 No 3 No Undergrad 1 No 4 Yes High School 10 Yes Model for predicting credit worthiness No No Employed Yes Education Graduate { High school, Undergrad } Number of years > 3 yr < 3 yr Number of years > 7 yrs < 7 yrs Yes No Yes No

28 10 10 Classification Example Tid Employed Level of Education # years at present address Credit Worthy 1 Yes Graduate 5 Yes 2 Yes High School 2 No 3 No Undergrad 1 No 4 Yes High School 10 Yes Tid Employed Level of Education # years at present address Credit Worthy 1 Yes Undergrad 7? 2 No Graduate 3? 3 Yes High School 2? Test Set Training Set Learn Classifier Model

29 Classification: Financial Application Credit Fraud Detection Goal: Predict fraudulent cases in credit card transactions. Approach: Use credit card transactions and the information on its account-holder as attributes. When does a customer buy, what does he buy, how often he pays on time, etc Label past transactions as fraud or fair transactions. This forms the class attribute. Learn a model for the class of the transactions. Use this model to detect fraud by observing credit card transactions on an account.

30 Financial Statement Analysis Top Rules Derived by Ripper ROA <= LTA >= QACL<= COSAL<= ROA <= SOLVENCY RATIO<= ROS <= ROE >= LOGDEBT >= SOLVENCY RATIO <= z-score <= EBIT <= z-score <= GM11 = 1 Label=Y

31 Clustering Finding groups of objects such that the objects in a group will be similar (or related) to one another and different from (or unrelated to) the objects in other groups Intra-cluster distances are minimized Inter-cluster distances are maximized

32 Applications of Cluster Analysis Understanding Group related documents for browsing Group genes and proteins that have similar functionality Group stocks with similar price fluctuations Discovered Clusters Applied-Matl-DOWN,Bay-Network-Down,3-COM-DOWN, Cabletron-Sys-DOWN,CISCO-DOWN,HP-DOWN, DSC-Comm-DOWN,INTEL-DOWN,LSI-Logic-DOWN, Micron-Tech-DOWN,Texas-Inst-Down,Tellabs-Inc-Down, Natl-Semiconduct-DOWN,Oracl-DOWN,SGI-DOWN, Sun-DOWN Apple-Comp-DOWN,Autodesk-DOWN,DEC-DOWN, ADV-Micro-Device-DOWN,Andrew-Corp-DOWN, Computer-Assoc-DOWN,Circuit-City-DOWN, Compaq-DOWN, EMC-Corp-DOWN, Gen-Inst-DOWN, Motorola-DOWN,Microsoft-DOWN,Scientific-Atl-DOWN Fannie-Mae-DOWN,Fed-Home-Loan-DOWN, MBNA-Corp-DOWN,Morgan-Stanley-DOWN Baker-Hughes-UP,Dresser-Inds-UP,Halliburton-HLD-UP, Louisiana-Land-UP,Phillips-Petro-UP,Unocal-UP, Schlumberger-UP Industry Group Technology1-DOWN Technology2-DOWN Financial-DOWN Oil-UP Summarization Reduce the size of large data sets

33 Bankruptcy Company Bankruptcy Bank in 2009

34 Unemployment

35 Foreclosures

36 Bankruptcy Company Bankruptcy Bank Not in 2009

37 Association Analysis Given a set of records each of which contain some number of items from a given collection Produce dependency rules which will predict occurrence of an item based on occurrences of other items. TID Items 1 Bread, Coke, Milk 2 Beer, Bread 3 Beer, Coke, Diaper, Milk 4 Beer, Bread, Diaper, Milk 5 Coke, Diaper, Milk Rules Discovered: {Milk} --> {Coke} {Diaper, Milk} --> {Beer}

38 Association Analysis: Applications Market-basket analysis Rules are used for sales promotion, shelf management, and inventory management Telecommunication alarm diagnosis Rules are used to find combination of alarms that occur together frequently in the same time period Financial Fraud Indicators Rules are used to find combination of events and observations associated with certain financial fraud

39 Deviation/Anomaly Detection Detect significant deviations from normal behavior Applications: Credit Card Fraud Detection Network Intrusion Detection

40 Anomaly Detection Challenges How many outliers are there in the data? Method is unsupervised Validation can be quite challenging (just like for clustering) Finding needle in a haystack Working assumption: There are considerably more normal observations than abnormal observations (outliers/anomalies) in the data

41 Enron Case James Chanos, the President of Kynikos Associates specializing in short selling, managing over 1 billion Kynikos Assocates manages a portfolio of overvalued securities Three Indicators Materially overstated earnings An unsustainable or operationally flawed business plan And/or engaged in outright fraud

42 Enron Case Early alert: 1999 Form 10-K, Form 10-Qs in 2000 Enron s return on capital, 7 percent before tax 7 percent is low for this type of firm (outlier) Enron s cost of capital should be close to 9% (not earning any money) Company s initiative in the telecom field not a sustainable plan Shorting Enron in Nov. of 2000 (~ $80 per share) In the spring of 2001, a number of senior executives were departing from the company, the insider selling of Enron stock continued unabated.

43 Data Mining for Financial Fraud Detection: Challenges Scalability Dimensionality Complex and Heterogeneous Data Data Quality Data Ownership and Distribution Privacy Preservation Streaming Data Data from Multi-Sources

44 Privacy and Security Issues Privacy Preserving Data Mining The main difficulty in finding a solution to the problem of privacy is the contradicting requirement of hiding sensitive data while still providing useful information content. Transaction Hiding Hiding the origin, location, movement or actual rights on a financial operation or a property transaction

45 Distributed Data Mining Multi-source Joint Learning Detecting Cross-account collaborative fraud

46 Graph Mining: Challenging Problems In- and Out- degree distributions Fraud Risk Propagation in Corporation Networks Cross-Account Collaborative Fraud Detection

47 Example: Fraud Detection In forecasting markets with prizes for the best traders as incentive, two types of fraud (behavior not consistent with market regulations) can be expected: Money transfer (ring of traders, multiple accounts) Price manipulations (in or outgoing stars, potentially with losses) (Examples by courtesy of Jan Schröder, FSM (Forecasting Strategy Markets))

48 Blackhole Patterns Detect cross-account collaborative fraud

49 Money Transfer The 2006 State Parliament Elections in Baden-Württemberg in Germany Market opening :23:44 Market close :00:00 Number of traders (at least one sell or buy transaction) 306 traders Number of traders (at least one sell transaction) 190 traders Number of traders (at least one buy transaction) 291 traders Number of transactions transactions Number of shares 7 shares Average volume per trade shares Average moneyflow per trade 2,462.1 MU Moneyflow in total 26,556,378 MU Shareflow in total 2,314,197 shares

50 And the Winners are First 8 highest ranks in the highscore for the market for the 2006 state parliament elections in Baden-Württemberg in Germany 1 elfriede herrrtie gruener MarcEichler potato joe Maio\_Shan Ritvars henning

51 Are they honest No, elfriede (#1) used 4 accounts

52 And henning (#8) used two!

53 Similarities Between Data Miners and Doctors Data Characteristics Data Mining Techniques Medical Devices

54 Literature Markus Franke, Andreas Geyer-Schulz and Bettina Hoser. Analyszing trading behaviour in transaction data of electronic election markets. Data Analysis and Decision Support. P , Springer studies in classification, data analysis and knowledge organization Pang-Ning Tan, Michael Steinbach, Vipin Kumar, Introduction to Data Mining, Addison-Wesley, ISBN: Junjie Wu, Hui Xiong, Wu Peng, Jian Chen, Local Decomposition for Rare Class Analysis, the 13th ACM SIGKDD Int'l Conf. on Knowledge Discovery and Data Mining (KDD 2007), pp , 2007.

55 Thank You!

56 Personal Knowledge Value Technical Knowledge Domain Knowledge Personal Knowledge Value

57 Life: A Data Mining Process Personal Knowledge Set Family Knowledge Set Decision Power The Knowledge Set of Other people you know