August 25, 2010 Updated: August 27, 2010 Market Overview: Fraud Management Solutions

Transcription

1 August 25, 2010 Updated: August 27, 2010 Market Overview: Fraud Management Solutions by Andras Cser for Security & Risk Professionals Making Leaders Successful Every Day

2 August 25, 2010 Updated: August 27, 2010 Market Overview: Fraud Management Solutions Seven Tenets Of Effectively Combating Fraud Costs by Andras Cser with Stephanie Balaouras and Lindsey Coit Executive Summary Fraud causes companies to lose money in many ways: They face losses due to chargebacks, unrecoverable transfers, and unnecessary shipping costs; and spend extensive time and resources investigating many transactions. Fraud can impact a company s goodwill. With fraud rings expanding operations beyond the online channel to ATM, POS, branch, and call center, financial services and other organizations need effective ways to protect against cross-channel fraud. Forrester s interviews with IT end users highlighted the following tenets as being important in fraud management products: 1) Use a statistical, vertical model to assess risk scores; 2) use rules to respond to emerging threats; 3) monitor transactions and entities across channels; 4) interdict near real time; 5) use entity and link analytics to see how fraud rings operate; 6) integrate disparate fraud management systems case-management interfaces in order to navigate between fraud cases and cross line of business boundaries; and 7) integrate with adaptive authentication s monitoring of the login context. We looked at how vendors satisfy these tenets and also provide detailed information on vendors market presence. table of Contents 2 Fraud Is Eating Your Revenue And Profits 2 How Fraud Management Solutions Prevent Fraud 4 The Seven Tenets Of Effectively Combating Fraud Cost 7 Fraud Management Grows To A $1.3B Market In Fraud Vendors Cater To Diverse Verticals 14 Traditional Market Area Boundaries Blur In Fraud Management recommendations 17 Move Beyond Rules And Transactions For Core Applications 18 Supplemental Material NOTES & RESOURCES Forrester interviewed 12 vendor and 15 user companies: 41st Parameter, Accertify, Actimize, Arcot, CyberSource, FICO, Fiserv, Intellinx, Memento, Norkom, Oracle, and SAS. Related Research Documents Case Study On Fraud Management: An eretailer Reduces Order Reviews By 83% April 9, 2010 Shift Happened In The Strong Authentication Market In 2009 February 1, , Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best available resources. Opinions reflect judgment at the time and are subject to change. Forrester, Technographics, Forrester Wave, RoleView, TechRadar, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. To purchase reprints of this document, please clientsupport@forrester.com. For additional information, go to

3 2 Market Overview: Fraud Management Solutions fraud is eating your revenue and profits Fraud is a significant problem at enterprises during good times and bad. Based on IT client and vendor reference conversations, Forrester estimates that financial services companies lose about 5% to 8% of revenue to fraud each year, and the Merchant Risk Council estimates that online merchants lose 1.4% of annual revenues to fraud. Not surprisingly, companies have dedicated significant internal resources to combating fraud. Typically, a department reporting to a chief risk officer or chief compliance officer owns fraud management. Some larger organizations have entire departments dedicated to fraud management. Forrester has also seen the chief information security officer (CISO) or a department reporting to the CTO owning fraud management. Regardless of which organization ultimately owns fraud management, finding cost-effective ways to combat fraud is critical to protecting profits and staying competitive. And as fraud becomes increasingly more sophisticated, risk professionals will need to turn to increasingly more sophisticated and automated solutions. Since fraud is committed more and more by fraud rings that quickly attack your business from various channels (Web, call center, branch, ATM, POS, etc.), you will have to protect your business from fraud by moving beyond transactions to entities, looking across multiple channels in near real time. HOW Fraud Management Solutions prevent fraud Fraud management solutions allow you to identify potential fraudulent transactions based on suspicious activities or patterns (see Figure 1). For example: opening a joint account on an existing checking account, changing the home address of the account holder, ordering new checks, and then writing checks to deposit funds from the original account to the new joint account is a set of suspicious activities. Similarly, enrolling in online banking, changing the customer profile (phone number, address, mailing address) online, ordering a new debit card, transferring all funds to demand deposit account (DDA) or checking account, then draining the account with a new debit card are also fraudulent patterns of transactions. Obviously, with the increase of fraud, new patterns continuously emerge in this cat and mouse game. Reliably identifying suspicious transactions and entities (persons, phone numbers, home addresses, addresses, computers, mobile phones, and other devices) associated with transactions at an acceptable speed are key to detecting, managing, and reducing fraud. Traditionally, fraud management solutions have been split into adaptive and risk-based fraud management (which covers the authentication context) and enterprise fraud management (which includes the application specific, cross-channel model); however, Forrester client interviews reveal that unifying these two areas is increasingly important in formulating an effective fraud management strategy. Tracking the login context fraud is essential to managing subsequent potentially fraudulent activity in sessions. August 25, 2010 Updated: August 27, , Forrester Research, Inc. Reproduction Prohibited

4 Market Overview: Fraud Management Solutions 3 Figure 1 Anatomy Of Fraud Management Solutions IP address Device identity Authentication (login) Context data 4. Real-time transaction data Fraud information network 1. Statistical risk model POSITIVES Outsourced transactions Really fraudulent transactions (true positives) Nonfraudulent transactions (false positives) End user Session speed Time of day Batch-based transaction data 2. Rulesbased model 5. Entity analytics Uncaught fraud (false negatives) User identity Training data NEGATIVES Nonoutsourced transactions Nonfraudulent transactions (true negatives) 7. Context-based, adaptive, and risk-based authentication 3. Cross-channel data and applications Model 6. Case management Model administrator Fraud analyst Source: Forrester Research, Inc. 2010, Forrester Research, Inc. Reproduction Prohibited August 25, 2010 Updated: August 27, 2010

5 4 Market Overview: Fraud Management Solutions The Seven Tenets of effectively combating Fraud costs In conversations with financial services, airlines, online retailers, healthcare, and telecommunications companies, Forrester identified seven tenets of fraud management that play a key role in detecting, managing, and preventing fraud economically. They are: 1. Statistical Risk Models Identify Fraud More Quickly And Accurately Statistical models in fraud management work similarly to spam models. They predict how likely certain entities (phone number, person s name, mailing address, etc.) are likely to be tied to fraudulent transactions. Spam filters work much the same way they predict how likely a message is spam based on the occurrence of certain words in the message like online pharmacy, satellite dish receiver, etc. Statistical models are vertical-specific, usually provided and updated annually by the vendor of the solution. Most vendors provide a statistical model, with certain outputs that fraud analysts can channel into a rules-based afterburner for handling tactical and company-specific fraud issues. Statistical models also have a benefit of reducing the need for rules in general and selflearning. Forrester estimates that statistical models also have the benefit of performing about 30% to 35% faster at the same false positive rate. 2. Rules-Based Risk Models Adapt Quickly To Changing Fraud Threats Statistical models are great from a performance perspective, but they cannot always adequately respond to new or broad-based fraud threats. 1 Vendors need to update or tune the model to account for these types of threats. In our interviews, customers across all verticals indicated that solutions with purely analytical, black box, and closed models drift quickly in their effectiveness (which is also hard to detect) and generally speaking, it is neither easy nor quick to add new features to them. Because of this, fraud analysts should funnel the risk score output from the statistical model into a rules-based model that then further refines the risk score to meet the tactical requirements of the company. It is also important to be able to control the overgrowth of the rules: Excessive rules cause performance problems and are costly to maintain and debug. 3. Cross-Channel Intelligence Shoots Down Fraudsters Everywhere Companies offer their customers and partners the convenience of doing business with them across multiple channels. These channels include online/web, telephone/call center, branch or store, point of sale (POS debit and credit card signature and PIN transactions, card not present [CNP]), ATM, and employees. Organizations are generally well equipped to detect fraud that happens through one channel. Imagine that a fraudster compromises a victim s ID and password and uses online banking to change the victim s address, opens a new joint account, transfers all funds from the checking account to the new joint account, and then finally makes an online payment to a newly added fraudulent payee. This seemingly complex fraud transaction is actually easy for a fraud analyst or fraud management solution to detect because it all occurs through one channel online banking. Organizations are often poorly prepared to detect fraud that is composed of seemingly harmless transactions when the fraud occurs across multiple channels. Now imagine that the same August 25, 2010 Updated: August 27, , Forrester Research, Inc. Reproduction Prohibited

6 Market Overview: Fraud Management Solutions 5 fraudster signs up for online banking on the phone, then changes the victim s mailing address online, orders new ATM cards online, resets the PIN online, and uses the ATM card to make a fraudulent withdrawal from the victim s account. To defend against cross-channel fraud effectively, fraud management solutions must: 1) support multiple data and transaction types (e.g., wire transfer, deposit, ACH, bill payment, orders, etc.); 2) collect information from all relevant channels; 3) analyze each channel; and 4) correlate the analysis results across multiple channels to formulate a risk score. 4. Near Real-Time Performance Stops Fraud Before It Happens The ability to prevent fraudulent transactions before they cause financial harm (chargebacks, etc.) is ideal. Therefore, a fraud management solution that provides real-time processing and analysis is a key requirement. There are a few use cases when near real-time analysis is not a strict requirement (for example, at an eretailer, you may have 6 hours to sort through laptop orders before they need to be shipped at the end of the day), but otherwise, you should strive to stop or limit online fraud transactions as early as possible. It s important that you find the right balance for your company. You want the fraud management solution to return a decision about a transaction quickly (typically under a second), but you also want to be sure that you re not hampering the ability of users to conduct legitimate online transactions by blocking their transactions unnecessarily. For some transactions that are not processed in real time, such as bill pay, it may be OK to process this later in a batch. 5. Entity And Link Analytics Elevates Point Of View Above Transactions If you only look at fraud scores at the transaction level, you will almost certainly miss those situations when certain entities (i.e., computers, mobile phones, phone numbers, or mailing addresses) are linked to several known fraudulent transactions. To highlight the relationships forming fraud rings, the product should support entity and link analytics. Entity and link analytics is usually a dynamically changing, time-based, visual diagram of how entities link to each other in transactions. Oftentimes a thicker line between entity nodes indicates multiple relationships between those entities a warning sign of higher fraud risk. To help fraud analysts quickly focus on fraud, they can rotate the graph, zoom into it, filter on entities, etc. Many vendors will allow fraud network integration with their solution to allow clients to tap into white lists and blacklists based on information gathered securely from other similar client organizations (see Figure 2). 2010, Forrester Research, Inc. Reproduction Prohibited August 25, 2010 Updated: August 27, 2010

7 6 Market Overview: Fraud Management Solutions Figure 2 Example Of Entity And Link Analytics In Action Source: SAS Source: Forrester Research, Inc. 6. Unified And Integrated Case Management Reduces Personnel Costs Today, all lines of business (LOB) use their own fraud solution with its own case management system. Most case management systems provide fraud analysts with a Web-based user interface where they can inspect, quarantine, manage, release, and report on transactions sorted out by the solution s analytical and rules-based engine based on risk score. Banks, however, typically use several vendors solutions across their business units (wholesale, retail, lending, etc.), making correlation of cases a manual, error-prone, and lengthy process. Forrester sees many financial services, eretailer, and transportation companies attempting to create at least a unified view of or reporting of cases. In order to accomplish this, the case management system must support calls from Web services. August 25, 2010 Updated: August 27, , Forrester Research, Inc. Reproduction Prohibited

8 Market Overview: Fraud Management Solutions 7 7. Context Sensitivity Monitors The Entire Transaction Stack For Fraud To provide context sensitivity, the fraud management solution should look at the entire transaction path. This includes the login and authentication context (IP address and geographical location and change of IP address of the machine, device fingerprint, time and day of login, session click-through speed, etc.). It also includes integration with identity and access management solutions (Web single sign-on, multifactor authentication, out of band and strong authentication, user account provisioning, etc.) for supporting Web and other login, enrollment, identity vetting and proofing services. Fraud MAnagement grows to a $1.3B market in 2009 Given the requirements described above, coupled with the fact that vendors no longer cater to a pure vertical market, Forrester sees Web fraud management (including device identification) and traditional financial services and nonfinancial services fraud management sectors converging (see Figure 3-1). Forrester currently estimates the total market at approximately $1.3 billion (see Figure 3-2). Given the convergence, the continued demand for this offering, together with vendor historical growth, Forrester estimates the compound year over year annual growth of the market in 2009 at 25%. 2 Financial services enterprise fraud management products typically have their own statistical and rules-based models that are specifically targeted at the financial services (banking and insurance) verticals. These products focus on transactions analysis across a wide range of channels, such as Web, POS/ATM, branch, call center, and employees. Nonfinancial services fraud management products usually have a rules-based fraud prevention engine and are targeted toward eretail, travel, healthcare, and services industries. These products focus largely on the Web and the call center channels. Web fraud management and device identification vendors are used across all verticals and focus almost exclusively on the Web channel. They often bundle device identification capabilities to generate risk scores based on the authentication context and integrate with multifactor authentication (knowledge-based authentication, one type password, etc.) mechanisms. 2010, Forrester Research, Inc. Reproduction Prohibited August 25, 2010 Updated: August 27, 2010

9 8 Market Overview: Fraud Management Solutions Figure 3 Fraud Management Market And Market Shares 3-1 Consolidation of fraud management markets Financial services enterprise fraud management Nonfinancial services fraud management Web fraud management and device identification 3-2 Fraud management market size and forecast Forrester s fraud management 2009 license and hosting revenue estimates, excluding services (US$ millions) Enterprise fraud management (finanical services) Web fraud and device identification Oracle (Mantas) 4% Norkom 2% Others 34% SAS 2% Memento 2% Intellinx 1% Actimize 13% ACI 4% Fiserv 25% Total market: $789 Total known vendors: $521 FICO 13% 41st Parameter 3% Others 50% ThreatMetrix <1% Enterprise fraud management (nonfinancial services) Accertify 11% Arcot 5% RSA 28% Total market: $360 Total known vendors: $180 iovation 3% Entrust 7% Oracle (OAAM) 4% Others 40% CyberSource 31% Retail Decisions 18% Total market: $95 Total known vendors: $57 Source: Forrester Research, Inc. August 25, 2010 Updated: August 27, , Forrester Research, Inc. Reproduction Prohibited

10 Market Overview: Fraud Management Solutions 9 FRaud Vendors cater to Diverse verticals Forrester interviewed 12 enterprise fraud management (EFM) vendors for this report. Each of the vendors that participated in this research responded to a detailed Forrester questionnaire and provided customer references. Readers should be aware that ACI did not respond to Forrester s invitation to participate in this research, and Entrust and RSA declined Forrester s invitation to participate in this research. Because we could not obtain detailed information or customer references from these vendors, we could not fully feature them in the report. Readers should also be aware that some EFM vendors participating in the report provide true, 100% real-time capabilities, while other vendors offer near real time-responses (up to 30 seconds). Vendors With A Focus On Financial Services Today, these vendors focus almost exclusively on financial services. Most vendors expressed interest in expanding their solutions to other verticals such as healthcare, travel industry, and services: Actimize is an established player in account origination and payments. Focusing on the Web, mobile, and phone/kiosk channels with a combination of Bayesian statistical and rules-based fraud risk model, Actimize is a leading player in the EFM marketplace. It can provide real-time responses to all transactions it monitors. While the current link analytics interface is mainly textual, with the technology it gained through the Syfact acquisition, Actimize is developing a graphical link analysis interface. Customers we interviewed have generally been satisfied with the case management interface. The queue performance overview dashboard conveniently highlights false positive rates and savings for each transaction type. Actimize provides its own device-fingerprinting module and has an integration partnership with Corillian for Web-based challenge questions and with Authentify for out-of-band Web-based authentication. ACI protects against several fraud types: payment card, wire transfer, deposit, and employee. ACI is one of the largest companies in the EFM space, and its link analytics capabilities elevate the product above the competition. Some customers expressed concerns with clumsiness of the case management user interface. In addition, its model is considered largely black box; tuning of the model can be challenging to a customer s fraud analyst resources. FICO (Fair Isaac) specializes in credit, debit card, and ACH transactions. Another EFM specialist in financial services, the company s pedigree is a neural network-based, cross-channel modular model. With Falcon 6, the application also provides adaptive analytic scores. These scores are updated in real time based on analyst dispositions of fraud and not fraud. These scores are provided in addition to the supervised neural network scores on each transaction that is processed through the scoring engine/model. Today the company provides more than 100 different neural network models for different use cases. Adding new, emerging features (e.g., a merchant ZIP code) to the neural network can require retraining or addition of customerwritten rules. By using Falcon with its neural network-based analytics and the rule engine, customers were able to reduce fraud-related loss from 0.18% to 0.06% of revenue. 2010, Forrester Research, Inc. Reproduction Prohibited August 25, 2010 Updated: August 27, 2010

11 10 Market Overview: Fraud Management Solutions Fiserv protects bill payment, payment card, and check fraud transactions. Fiserv is one of the largest players in the fraud space and offers its products primarily to financial services, insurance, retail, and government verticals with a focus on financial crime risk management. Fiserv s financial crime risk management platform comprises three main elements. Fraud Risk Manager and AML Manager are used for fraud prevention, anti-money laundering, trade surveillance, and employee fraud protection. FraudLink provides check, deposit, kiting, and ACH (echeck) fraud mitigation. FraudGuard provides digital check imaging protection against forgery, counterfeits, and alterations. Fiserv does not disclose how its statistical model is updated and trained; the solution uses behavioral profiling, peer group analysis to complement rules. Fiserv also has image-based analysis capabilities, device fingerprinting, and entity analytics. Intellinx shines in employee fraud management and prevention. Intellinx focuses on the financial services, insurance, government, and healthcare verticals. According to the Association of Certified Fraud Examiners (ACFE) 2008 survey, 60% of all fraud involves employees in some capacity, and the median cost of an employee fraud is $175, Although it is marketed also as a cross-channel EFM solution and has customers utilizing this feature, Intellinx focuses on employee fraud and uses a real-time, agentless collection mechanism to snoop the corporate network. Fraud analysts can view a replay of user screen activity, define data as facts, entities, and measures. Facts, measures, and conditions can trigger rules in policies, and each rule can have actions or an associated workflow. Analysts can define entities (names, mailing addresses, phone numbers, addresses, etc.) in the product and visually represent all entities in the link analytics window. The case management in the product is Web-based, while the policy and rule design are thick client this can be a hindrance for large organizations where many analysts need to define policies simultaneously. While Intellinx does not currently have a predictive statistical model, it is on the firm s development road map for Memento looks primarily at employee fraud, ACH, wire, and check/deposit/kiting. Memento aggregates information from multiple sources into a proprietary, consolidated data cache and analyzes the data cache to identify fraudulent activity. Memento does not disclose the mathematical model for its statistical risk engine, but Forrester surmises that it uses a Bayesian model or other models depending on the type of fraud. Memento s reports indicate the relative success and efficiency of rules, thus enabling fraud analysts to add parameters or alter or retire rules as appropriate. Memento incorporates a leading complex event processing engine for real-time data analysis, which allows fraud analysts to perform analysis of the data in flight. Memento uses IBM s Global Name Recognition software to identify common names, even though they may be orthographically different. The product presents a network diagram for proactive link analysis. The solution publishes alerts into the product s case management system where analysts can perform workflow-based alerts triage, reporting, and forensic investigation. August 25, 2010 Updated: August 27, , Forrester Research, Inc. Reproduction Prohibited

12 Market Overview: Fraud Management Solutions 11 Norkom offers a solution for check deposits, cash, and ATM/POS/CNP transactions. Norkom s Multi-Channel Fraud Management Solution provides cross-channel customer/ account profiling and uses predictive analytics to detect fraud across channels. It aggregates alerts across channels and integrates with non-norkom detection engines. Norkom s solution uses profile groups, which allows easy comparison between behaviors of the same peer group (e.g., online Web banking customers). Norkom provides a unique rule induction engine to automatically suggest and create rules based on current trends. The solution can receive and interdict real-time transactions inside the Norkom detection engine s loop. Norkom provides a visual Link Analysis application which, in conjunction with the Link Analysis engine, is capable of making connections based on arbitrary user-defined criteria (e.g., transactional relationship, geographical relationship, IP address, etc.). Case management alerts are displayed in Norkom s Enterprise Investigation Management application. Alert information is integrated with customer, account, employee, transaction, and event information to provide a complete picture of behavior across products and channels. Norkom can ingest alerts from multiple detection engines, including existing bank proprietary systems, as well as other off-the-shelf detection engines. SAS evolves from compliance to EFM. For more than 20 years, SAS has provided solutions for anti-money laundering and know your customer compliance requirements. It has used this accumulated expertise to build an EFM platform. Today, customers use SAS s EFM solution with card fraud, employee fraud, ACH, wire, check, cash, and account opening on real-time, POS, online, ATM, branch, and call center channels. Forrester customer references report that they use a combination of the SAS EFM platform and in-house SAS programs to provide a highly customized fraud management solution. SAS uses its data warehouse platform to collect data from all customer products, channels, and lines of business to monitor transactions, accounts, and customers for patterns of suspicious behavior. The system supports the generation of alerts for fraud investigation for suspicious transactions. SAS provides a hybrid modeling approach including Bayesian, neural network, and logistical regression methods to perform risk analytics that fraud analysts can recursively apply at multiple levels. The SAS solution has a relatively high 1-to-1 services-to-licenses cost ratio which can mean higher than usual cost for clients. To offset this, SAS introduced pricing based also on the size of the institution. The SAS link analytics has a time scale that allows the fraud analyst to see how the fraud ring evolved with time. The solution uses its own device identification modules. Vendors With A Vertical Focus On Industries Other Than Financial Services These vendors focus on transportation, services, retail, telecommunications, and ecommerce. Forrester s interviews revealed that these vendors are planning to provide solutions for the midsize and small banks segment of the market as well. Accertify prevents fraud with payments, eretailer orders, chargebacks, refunds, and returns. With a pedigree of supporting online travel agencies (the solution is based on the Orbitz fraud prevention system), Accertify focuses on Web, phone, and POS channels and provides services 2010, Forrester Research, Inc. Reproduction Prohibited August 25, 2010 Updated: August 27, 2010

13 12 Market Overview: Fraud Management Solutions to ecommerce merchants, airlines, and services companies to prevent fraud. The solution allows submission of information from multiple channels. It also provides the ability to set security, reporting, and access settings, as well as the parameters that drive rules execution, screen display, queuing, filtering, sorting, transaction resolution, and reporting. The solution supports real-time integration via HTTPS, including synchronous/asynchronous response, but can also act in batch or hybrid modes based on requirements. The solution is rules-based, and the vendor does provide a set of starting rules that clients can use as a basis to build out their own rule set. The solution does not have its own statistical model but can call out to other models for statistical modeling. The solution has extensive integration with more than 20 service providers, including iovation, Experian, TARGUSinfo, Lexis NexisAccurint, ID insight, and ThreatMetrix. It integrates with the RapLeaf solution for checking addresses across social networking sites like Facebook, Flickr, and Plaxo. CyberSource protects card, ACH, PayPal, and bank transfers for retail, travel, and media. CyberSource offers statistical/analytical models for geographies (US, Canada, rest of the world) and offers custom risk models for the verticals it serves; its hosted-only solutions provide transactional linking. Transactional linking compares the characteristics of the current transaction with all past transactions recursively. Information codes are returned indicating linkages/data correlations. Its Decision Manager processes transactions in real time, applies dynamically weighted, customer-created rules to determine transaction risk scores in near real time (about 2 seconds). The product s case management does not provide alerts but has review and reject queues. It integrates with 192.com, Accurint, Telcordia, Quova, SAP, Attus, ThreatMetrix, Spaatmarker, and TARGUSinfo and has an open API for integration. Vendors That Provide Web Fraud And Device Identification Forrester clients often ask about Web fraud and device identification solutions, as catching fraud early on the Web channel is the best protection and prevention against frauds in almost any other vertical. Forrester repeatedly gets asked by utility and higher education companies on how they can improve the strength of their Web-based systems authentication without imposing inconvenient multifactor authentication devices on their users: 41st Parameter uses its pedigree device identification to a fraud management solution. 41st Parameter protects account origination (credit and debit cards and checking accounts), detects account takeover, authentication, and wire transactions and is most active on Web, mobile device, and phone/kiosk channels. The solution does not have a statistical model. In its nonbehavioral, rules-based risk engine, it tracks individual rule hits as well as overall system performance in terms of fraud detection and false positive rates. The solution leverages the flexibility of tunable thresholds, actions, and scores for each rule, with full control provided to the risk management group via user interface. It also provides scores for velocities, geographical inconsistencies, suspicious configurations, time and time zone inconsistencies, hits on negative lists, and online form-filling behavior. For risk-based authentication, results are in real time. August 25, 2010 Updated: August 27, , Forrester Research, Inc. Reproduction Prohibited

14 Market Overview: Fraud Management Solutions 13 For account opening, takeover, and transactions, the solution processes them in near real time (about 30 to 90 seconds). With Web services, the solution can take real-time feeds, but responses are near real-time. Data Spider and Sketch Match tools perform link analysis and evaluate a match on any field it risks against, including device prints. Some clients mentioned that because of inefficient architectural design, they had problems reaching the desired performance with the product to meet high performance requirements and initially had to use too much processing hardware to run the 41st Parameter risk engine for a simple deployment with high authentication volumes. Arcot approaches fraud management with Web-based, adaptive authentication. The product protects Web- and phone-based home banking and other portals in financial services, biotech, and other verticals. It employs an open and tunable statistical model based on multivariate regression analysis to determine which features contribute to fraud. Fraud analysts can build rules using any element those available in the session and those that are passed by an application. The product labels each element fraud analysts write rules using labels instantiated for each transaction. Fraud analysts can define new rules. Arcot plans to add rule conflict detection, listing of rules for a variable, and a rule overgrowth analyzer. For crosschannel analysis, the product maps aliases for each user and aggregates activities across multiple channels, while rules and predictive models look for anomalies across channels. The solution offers all functionality in real time only rule/model setup and validation is performed offline. The product today has no graphical interface for entity analytics. For link analysis, Arcot builds profiles based on devices, IP, users, and beneficiaries (merchant, ACH recipient). The product then uses these risk profiles to fine-tune the risk factors on specific transactions. Although there is a way to quarantine transactions, fraud analysts will use alerts to manage potential fraud. The product displays alerts in a Case Management console and prioritizes them using a configurable criteria set. Analysts can view the alert, click on it to view details and related cases, before taking action on the case. The product offers integration with one-time text messages with one-time passwords. It integrates with CA SiteMinder, IBM TAM, Oracle Access Manager, Novell Sun Access Manager, and Idology Identity Proofing. It also integrates with VPN vendors, including Cisco, Check Point, Juniper, and others. Oracle Adaptive Access Manager offers integration with identity and access management. Protecting wire transfer, credit card, and POS transactions mainly on Web and mobile applications, Oracle Adaptive Access Manager (OAAM) is an in-line, real-time solution with roots in Web fraud detection and adaptive access management. OAAM, in its current release, does not rely on statistical models but profiles actual user behavior in real time using a form of bucketing. Oracle plans to offer a predictive, statistical model based on Oracle Data Mining s statistical models algorithms (such as Logistic Regression, Naive Bayes, Support Vector Machines, Enhanced K-means, and Apriori). The product does not provide a way to avoid rule overgrowth but it is scalable and can support near real-time risk score generation and interdiction, subsecond response with a large number of rules. The product does not offer a 2010, Forrester Research, Inc. Reproduction Prohibited August 25, 2010 Updated: August 27, 2010

15 14 Market Overview: Fraud Management Solutions visual link analysis tool but has identity resolution capabilities based on behavioral similarities (Bill and William have an identical user behavior profile, including the IP address and device fingerprint they use, locations they access from, times of day they access, etc.). The solution supports integration with Oracle Access Manager and Oracle Entitlements Server and Oracle Identity Manager for dynamic knowledge-based authentication. Traditional Market AREA Boundaries BLUR in Fraud Management As users have begun to recognize the importance of integrating fraud management capabilities from various verticals and customers segment across multiple channels, traditional product categories such as enterprise fraud management, adaptive authentication, device identification, and Web SSO will blur rapidly (see Figure 4). Forrester expects that vendors today anchored in a specific vertical (financial services or travel) will penetrate other verticals with novel offerings and aggressive pricing. August 25, 2010 Updated: August 27, , Forrester Research, Inc. Reproduction Prohibited

16 Market Overview: Fraud Management Solutions 15 Figure 4 EFM Market Insight A spreadsheet with additional data is available online. Question/ description Solution s name Vendor 41st Parameter Accertify Actimize FraudNet with DeviceInsight clientless device intelligence (CDI) technology Interceptas InterceptNOW InterceptSHARE Remote Banking Fraud Employee Fraud Card Fraud Deposit Fraud Wire & ACH Fraud Employee Trading Fraud Enterprise Risk Case Manager Top three channels Top three transaction types Solution offering (license, subscription on-premise, or subscription hosted) Top three most successful-selling verticals Web, mobile, phone/kiosk Account origination (card, DDA), authentication, and transactions/wires Subscription on-premise and subscription-hosted Financial services, travel, retail ecommerce (50% of revenues) Web, phone, POS Payments, orders, chargebacks Subscription-hosted Retail ecommerce/ electronics, travel and entertainment, event ticketing ATM, POS, Web PIN debit, signature debit and credit, interbank transfers Both license and subscription on-premise deployment, as well as a subscription-hosted option Banking, brokerage, technology/processors/ service providers to the financial services market Solution s name Arcot RiskFort Fraud Detection and risk-based authentication CyberSource CyberSource Decision Manager FICO FICO Falcon Fraud Manager FICO Fraud Predictor with Merchant Profiles FICO Card Alert Service Top three channels Top three transaction types Solution offering (license, subscription on-premise, or subscription hosted) Top three most successful-selling verticals Web, phone, mobile Card (credit/debit), portal access, and admin activity Subscription-hosted and subscription on-premise Financial services, biotech Web, phone, IP-based txn channels Credit/debit card, ACH, PayPal Subscription-hosted Media/ entertainment/ telecom, retail, travel POS/ATM, Web, phone Credit auth transaction, debit auth transaction, ACH Recurring license and maintenance on-premise or hosted at a partner environment or payment processor Financial services, insurance, retail, government Source: Forrester Research, Inc. 2010, Forrester Research, Inc. Reproduction Prohibited August 25, 2010 Updated: August 27, 2010

17 16 Market Overview: Fraud Management Solutions Figure 4 EFM Market Insight (Cont.) Question/ description Fiserv Vendor Intellinx Memento Solution s name Financial Crime Risk Management Intellinx Memento Security Top three channels Top three transaction types Retail banking, wholesale banking, private banking Bill payments, credit card, check fraud Branch, Web, phone Employee fraud, cash, check POS, Web, branch Employee fraud, ACH and wire, check Solution offering (license, subscription on-premise, or subscription hosted) Top three most successful-selling verticals License, subscription on-premise, subscription hosted, SaaS Banking, insurance, and pre-pay card Licensed with annual maintenance Retail banking, insurance, government Typically three-year-term license, on-premise. Retail banking, credit card issuers, healthcare Solution s name Norkom Technologies Oracle SAS Norkom Multi Channel Fraud Management Oracle Adaptive Access Manager SAS Fraud and Financial Crimes Framework (FF) SAS Anti-Money Laundering (AML) SAS Social Network Analysis (SNA) SAS Fraud Management (Real-Time) SAS Enterprise Case Management (ECM) Top three channels Top three transaction types Solution offering (license, subscription on-premise, or subscription hosted) Top three most successful-selling verticals ATM, POS/CNP, Web Card transactions, checks/ deposits, cash transactions Licensed on-premise solution, subscription-hosted Banking, insurance, capital markets firms Web and mobile, POS, phone Wire transfer, credit card, self-service password reset Licensed on-premise or subscription based hosted at partner (BT) Financial services, healthcare, government POS, Web, ATM Card transactions, employee fraud, ACH Licensed on-premise, subscription-hosted Financial services, insurance, government Source: Forrester Research, Inc. August 25, 2010 Updated: August 27, , Forrester Research, Inc. Reproduction Prohibited

18 Market Overview: Fraud Management Solutions 17 Recommendations Move beyond rules and Transactions for core applications As a result of fraud rapidly becoming more sophisticated, Forrester sees definite convergence trends in the fraud management market vendors recognize that a versatile and well-rounded solution requires not only generating and examining risk scores in their comfort-zone verticals and channels but also reaching out to areas in which they have not yet had products. As you begin to develop your enterprise fraud management strategy, Forrester makes these recommendations: Start with device identification and grow into other areas of fraud. Device identification provides a great way to begin finding out which devices, phone numbers, mailing addresses, and people are involved with fraudulent transactions. These solutions allow you to monitor traffic and transactions, identify patterns, and perform a manual setup of rules to identify fraud as needed. It s not enough to combat today s ever-changing, multi-channel fraud transactions, but it s a great place to start building knowledge and expertise. Don t impact the performance of legitimate users transactions in your quest to stop fraud. You can set up special rules or handling for new users transactions that will minimally impact their user experience. It s very important to balance the cost of fraud detection with the cost of losing legitimate customers. Using products with statistical models in fraud detection not only allows for faster detection (typically) at the same false positive rate as other solutions but also enables your organization to adaptively monitor fraud based on emerging patterns. Think of interactive link analytics as a must-have. Looking at a dynamically changing network diagram is a lot more beneficial for a fraud analyst than peering over tabular reports. Fraudsters and their methods change dynamically, and you need to be able to at least follow them. Pay attention to features such as time machines for link analysis and identity resolution. The ability to consolidate or collapse nodes in the link network graph is very important in improving accuracy and reducing the cost of fraud detection. Integrate with identity and access management. Products in this space have not traditionally integrated with identity administration, user account provisioning, and Web single sign-on products. Forrester s interviewees clearly expressed the need for the fraud department to own security and fraud management of at least the Web transaction channel as much as possible. Coordinating Web identity vetting, registration, single sign-on, adaptive authentication, and backend transactional monitoring and fraud prevention models and rules is key. 2010, Forrester Research, Inc. Reproduction Prohibited August 25, 2010 Updated: August 27, 2010

19 18 Market Overview: Fraud Management Solutions Supplemental Material Methodology Forrester interviewed 12 vendors and 15 customers for this report. Forrester identified leading vendors in enterprise fraud management based on client inquiries, client consulting engagements, vendor briefings, and secondary research. Invited vendors were then asked to complete a detailed questionnaire and provide three customer references. Endnotes 1 Forrester expects that deterministic fraud (such as insider fraud) management and AML, KYC, and compliance is suited better for rules-based and deterministic models. 2 Forrester s market growth estimate is based on vendors revenue growth rate average, based on IT client inquiries. 3 Source: 2008 Report to the Nation on Occupational Fraud and Abuse, Association of Certified Fraud Examiners ( August 25, 2010 Updated: August 27, , Forrester Research, Inc. Reproduction Prohibited

20 Making Leaders Successful Every Day Headquarters Forrester Research, Inc. 400 Technology Square Cambridge, MA USA Tel: Fax: Nasdaq symbol: FORR Research and Sales Offices Forrester has research centers and sales offices in more than 27 cities internationally, including Amsterdam; Cambridge, Mass.; Dallas; Dubai; Foster City, Calif.; Frankfurt; London; Madrid; Sydney; Tel Aviv; and Toronto. For a complete list of worldwide locations visit For information on hard-copy or electronic reprints, please contact Client Support at , , or clientsupport@forrester.com. We offer quantity discounts and special pricing for academic and nonprofit institutions. Forrester Research, Inc. (Nasdaq: FORR) is an independent research company that provides pragmatic and forwardthinking advice to global leaders in business and technology. Forrester works with professionals in 19 key roles at major companies providing proprietary research, customer insight, consulting, events, and peer-to-peer executive programs. For more than 27 years, Forrester has been making IT, marketing, and technology industry leaders successful every day. For more information, visit