Teradata Enterprise Risk Intelligence for Fraud and Financial Crimes Prevention Part Two

Transcription

1 Industry Solutions > Financial Services Teradata Enterprise Risk Intelligence for Part Two By: Sam Harris Director of Enterprise Risk Management

2 Table of Contents Executive Summary 2 Introduction 3 Conventional Approach to 4 Fraud Solutions The Next Generation: 4 Big Fraud Solution Components Recommended Actions Now 8 Executive Summary Big data has changed the rules of engagement in the war on fraud. What was originally conceived as a boon to business new customer interaction channels with remarkably rich data stores has become a technical landscape that guerilla fraud networks can exploit, thus increasing the risk of an attack that leads to a precipitous drop in customer and investor confidence. The good news is that fraud detection and prevention has evolved as well. Financial services companies can now add a powerful new tool a big data analytics platform to their fraud detection and prevention arsenal. By efficiently, effectively and economically accessing and analyzing big data within the database, this analytics platform can deliver 10 to 100 times faster performance than other architectures, even as it scales up to petabytes of big data for fraud discovery. Ultra-rapid iterations of new fraud detection risk factors, models, and scenarios lead to faster deployment that produces realworld economic results. The marrying of big data analytics with conventional approaches is a relatively simple and economical process. The new analytics platform literally bolts to the conventional fraud data infrastructure. Using high-speed and high-capacity parallel connectors, the new platform works seamlessly with an integrated data warehouse to deliver powerful fraud prevention and detection at an affordable cost. This platform is especially powerful because it uses a MapReduce framework popularized by Google that simplifies massively parallel processing and extends the power of big data analytics beyond specialized programmers and directly into the hands of business users. EB-7299 > 0812 > PAGE 2 OF 9

3 This, in turn, enables a host of new analyses that dramatically change the balance of power in the fight against fraud. Analysts and business users now have the freedom to examine the largest data sets rather than just samples and aggregates which now can deliver unique analytical insights in the shortest time possible. Introduction In the world of financial services, fraudsters as individuals or small networks operate as guerilla type organizations who constantly devise new ways to exploit institutional weaknesses and attack companies and their customers. Until recently, conventional fraud prevention and detection programs have been relatively effective, but as the fraudsters have adapted, the threat of one disastrous fraud attack landing a company on the front page of The Wall Street Journal and causing a devastating loss of customer and investor confidence has increased. The biggest change has been the way companies use rapidly expanding customer interaction channels to collect incredibly rich data stores. When used correctly this big data can deepen customer relationships and boost the bottom line. Unfortunately, for each new channel and each new interaction there are also thousands of fraudsters nimbly seeking ways to use those interactions to bolster their own bottom lines. Worse, the sheer volume of data that these channels generate makes it easier for the fraudsters to disguise their efforts and foil conventional prevention and detection efforts. That s why big data analytics represent a revolutionary improvement in the fight against fraudsters. Big data refers to a combination of data volume, richness, speed of change, and structural disparity gathered from an array of sources, including , branch, online, call center and more. Integrating big data BI Tools base Tools Monitoring Tools Correspondence Analytic Platform Other Customer TX Mtg., Cards, HELOC, etc., Related Party TX Branch Transaction Customer Profile Online Banking External and Third Party Call Center Figure 1. Comprehensive data sources for fraud and financial crimes detection EB-7299 > 0812 > PAGE 3 OF 9

4 with traditional Structured Query Language (SQL) data to deliver new, fast analytical iterations that were too difficult or expensive to achieve in the past results in a cost effective and extremely powerful expansion to companies fraud prevention and detection arsenals. Additional analyses from new data types produce new variables, risk factors, models, rules or scenarios to run in real-time fraud engines, which then shine a bright light into the many dark corners in which fraudsters hide. This whitepaper examines how to collect, integrate and analyze data from all channels to neutralize even the most sophisticated fraud networks. Conventional Approach to Fraud Solutions The conventional approach to fraud and financial crimes detection and prevention is a 360º iterative process that is constantly learning and improving by processing new information to evolve with changes in fraud techniques. It typically involves integrating data from multiple systems related to disparate customer, product, and channel groups, as illustrated in Figure 1. At a high level, conventional fraud prevention and detection efforts fall into two categories: analysis and deployment. Analysis is the process of creating actionable, fraud fighting insights from the firm s data. Deployment is the act of operationalizing this insight. (For a more detailed explanation of conventional efforts, see Part One of this series.) Tools Analysis Gather Explore Patterns and Relationships Build and Refine Models and Rules Validate Analytic Platforms Packaged and Custom Analytics Modeling Tools Analysis begins with gathering the data in one location where sophisticated software explores it for patterns and relationships using a wide variety of analytical and statistical tools. Ultimately, the solution classifies the data into two groups good transactions and potential fraudulent or criminal transactions and generates exceptions for each group. This leads to the defining of patterns and relationships used for statistical models. Once the models are validated, they become the basis for rules that run in a real-time fraud rules engine designed to detect fraud before or as it occurs. Deployment is the action of taking the rules and enabling them to fire in the realtime rules engine. Exceptions and suspected fraudulent transactions are routed through a workflow engine to the fraud investigation unit, which uses case management software to aggregate the exception, the Real-Time Processing Historical Processing Deployment Tools Event-Processing Engines Warehouses Packaged Fraud Applications Investigation Figure 2. Key Components of Fraud Detection Solutions data that triggered the exception and the history of the customer. The exception is processed and the outcome real fraud or false positive is recorded as a new historical observation. The historical information is used to further improve and tune the fraud models in the analytical environment. Figure 2 illustrates the interdependent relationship between analysis and deployment. The Next Generation: Big Fraud Solution Components Traditionally structured SQL data work well for conventional legacy approaches to fraud detection, but accessing new, nontraditional big data presents new challenges. Possible sources of big data (Figure 1) include text from and comment fields in various systems, machine generated data from online banking activity, every EB-7299 > 0812 > PAGE 4 OF 9

5 1 2 3 Import Multi-structured and structured data into analytic platform Explore and investigate of data to identify relationships indicative of potential fraud Integrate fraud detection into operations Real-time processing in event-processing engine Batch processing in data warehouse Raw Multi- Structured Web logs Text fields Teradata Aster Analytic Platform Rules Real-time Processing Engine Models Relational Transactions Means of Payment Customer Profile Teradata Integrated Warehouse Figure 3. Teradata and Teradata Aster Fraud Solution Components transaction for every account for every customer across multiple channels and more most of which have disparate and unconventional structures that are not SQL. Loading this disparate data into SQL databases can be very expensive and in some cases it may be impossible. Conventional solutions try to work around this challenge by exporting data sets and creating a plethora of independent data marts, but then wind up with a number of flaws that limit their power to combat newer fraud networks. latency problems, lengthy processing times, limited insights because analytics only examine samples and aggregations, and excessive costs all hamper the ability of conventional approaches to ferret out fraudsters who exploit these flaws. Now, however, there is a new type of solution that can return the upper hand to companies trying to track, expose and stop the fraudsters. In conjunction with an integrated data warehouse, this solution enables companies to efficiently load traditional and non-traditional data types into a single analytical and discovery environment, as illustrated in Figure 3. Rooted in a massively parallel processing (MPP) analytics platform, the solution provides end-to-end parallelism of data and analytic processing, which means organizations can examine very large data sets with unprecedented granularity and depth of analysis. Such an approach does not replace conventional solutions, but rather enhances them by making it easy to create advanced analytics and embed 100 percent of both SQL and big data analytic processing inside the platform. Known as in-database processing, this approach eliminates massive data movement and makes it possible for organizations to perform rich and deep analyses of large data sets at ultra-fast speeds in order to leverage their data with advanced analytics in ways that were previously impractical or impossible. EB-7299 > 0812 > PAGE 5 OF 9

6 Such a solution is a true inflection point in the battle against ever more sophisticated fraud networks. The sea change is that this platform can deliver 10 to 100 times faster performance than other architectures, even as it scales up to petabytes of big data for fraud discovery. Ultra-rapid iterations of new fraud detection risk factors, models, and scenarios lead to faster deployment that produces real-world economic results. Breaking it Down: The Solution Architecture The solution depends on a partnership between an integrated data warehouse and the analytic platform. The warehouse fuels and consumes results from the analytic platform to make the fraud analytics operational in a real-time fraud rules engine. The warehouse also gives the fraud analysis team timely access to all current and historical data. How the data is organized within the warehouse is critical. Rather than a solution or application model, an industry-specific Logical Model (LDM) based on how the business defines itself makes the data processing considerably more efficient. Just as blueprints describe and detail a floor plan of a building, the LDM details how data moves and interrelates within an organization. A Financial Services Industry Logical Model (FS-LDM) can contain well over 11,000 attributes, which are available in the fight against fraud; the LDM ensures those attributes are deployed efficiently. In fact, when the FS-LDM is used to develop the data integration layer (tier 2), illustrated in Figure 4, the integrated information environment goes beyond fraud prevention to support data reuse. By fostering a complete picture of the customer, the data makes possible the monetizing of fraud and financial crimes data for revenue generating purposes, such as customer intelligence for campaign management and execution. Structured Sources Acquisition 1-n (Tier 1) Integration (Tier 2) Access 1-n (Tier 3) Delivery Control Framework ROLAP Loading Tables Txn Staging Tables Txn Reference Country Views Reporting www Tables EAI Bus User External Files Diversified Sources Dump Active Load CDC Export Files Structured Big Full Stream Delta App Master Transactional Summary, derived, scored, aggregate data Busines Unit Views Applications and Engines Operational Analytics and Hot Views Marts ADS Dependent Independent Relational www EAI Bus Export Files Adhoc Dashboard Applications External Intracore Mining Downstream Results Logs Text Big Archive Labs Country 1-n BU 1-n Discovery and Investigation Big Environment Metadata Figure 4. Teradata Reference Information Architecture EB-7299 > 0812 > PAGE 6 OF 9

7 It s important to understand, however, that for best practice, big data analytics for fraud should be an additive approach layered on top of the traditional models created with traditional data sources. Analysts can then use historical data to continue to develop and refine conventional fraud models using what is known as the Lab. The Lab allows the analyst to use a proxy drawn from production data while developing and testing fraud models. The data infrastructure of the integrated information environment accesses, stores and provides both big data and traditional SQL data to real-time fraud rules engines. The beauty of all this is that marrying big data analytics with conventional approaches is a relatively easy operation. Companies can literally bolt big data analytical capabilities to the conventional fraud data infrastructure, complementing the Brings data science to the masses Aster Analytic Platform SQL-MapReduce Example Apps Investigative Analysis Log Analysis (web, security, ) Scoring and Behavioral Anomaly Analysis Fraud/Cheating Detection Social Media Retention and Analysis Investigate in Aster, Integrate and Operationalize in the Warehouse integrated data warehouse and reducing the effort and degree of difficulty for implementing big data analytics. The analytic platform is pre-installed on an appliance a workload specific database using high-speed and high-capacity parallel connectors. Together, the appliance, the high-performance connectors and the integrated data warehouse enable revolutionary big data analytics for fraud at an affordable cost. Breaking it Down: How the Solution Works Until recently, massively parallel processing of big data required extremely specialized programming skills, but the MapReduce framework, popularized by Google, has simplified and standardized the process, though until now it s required specialized developers who are experienced with its programming paradigm. However, by Teradata Integrated Warehouse (or Appliance) Example Apps Integrated Web Intelligence Relationship Management Fraud Prevention Process Optimization OLAP Scoring Analytics Reporting Figure 5. Teradata Aster Complements Teradata Integrated Warehouse coupling SQL with Map Reduce in SQL- MapReduce (SQL-MR) framework, this new analytic platform has dramatically increased the accessibility and ease of use of MapReduce for analytics. Business analysts can now use it without ever needing to learn MapReduce programming or parallel programming concepts. This is a significant technological innovation. Using SQL-MR, developers can write powerful and highly expressive functions in a variety of programming languages and push them into the database for advanced in-database analytics. Additionally, pre-packaged analytic toolsets for business intelligence or data mining that use standard SQL can natively access a MapReduce-enabled analytic application without any code changes, making the power of MapReduce easily and transparently accessible to business analysts. In short, all of this enables a host of new analytical capabilities that dramatically change the balance of power in the fight against fraud. Analysts and business users now have the freedom to examine the largest data sets, which in turn can deliver unique and unprecedented analytical insights in the shortest time possible. Specifically, these in-database analytics facilitate and optimize approaches that include: > Path Analysis, which can analyze seemingly unrelated actions across multiple channels that result in a fraud loss. The paths formed act as digital fraud signatures in unstructured data. EB-7299 > 0812 > PAGE 7 OF 9

8 A big data analytics platform can integrate unstructured and SQL data for Path Analysis that exposes these new fraud signatures and then incorporates them into risk factors, models and scenarios that run in the fraud engine. > Pattern Analysis, which can detect the digital tracks left behind by the fraud networks or rings that have arisen to enable more sophisticated fraud techniques. The organizers of these rings might recruit associates to open demand-deposit accounts and slowly build up balances and account history, only to follow with large deposits of uncollected funds and a sudden account closure. Other examples include fraud network associates collaborating to apply for unsecured credit and developing paid-as-agreed account history. Then they apply for a limit increase, max out the card with cash advances and purchases, and disappear. But they do leave behind digital patterns that can include repeat personal information such as address and phone numbers, or shared professional relationships, including employers, service providers, and professions. Pattern Analysis can identify these relationships and expose fraud rings to the bank s fraud investigators before they have a chance to execute the final transaction that results in a loss to the bank. > Faster iterations of fraud analysis, in which a massively parallel processing system accelerates the iteration cycle. > Analytics on the entire data set, which becomes a powerful enhancement to sample and aggregate data sets, with advantages that include: Needle in a Haystack, False Negative, and Exceptional Cases searches Very rare events can only be found (and defined) against the background of the entire data set. Statistical significance Reliable analytics may require using a large portion of the data, which cannot be fit on a typical, single database machine. Model tuning The parameters for predictive models depend on aggregate statistics of the entire data set. Appropriate algorithms Algorithms developed on smaller data sets may not scale appropriately to the full data set. Recommended Actions Now These new tools add significant power to financial services companies efforts to improve their fraud and financial crimes detection, prevention and remediation capabilities. These tools have demonstrated their efficacy in various test cases. Now is the time to harness the power of this solution in your own environment, using your company s vast stores of untapped data with actionable insights. About Teradata Teradata has been in the business of serving the data and data management needs of the banking, capital markets and insurance community for more than 30 years. The company has experience and data infrastructure expertise in the banking and capital markets sectors for campaign management & customer intelligence; financial performance management & optimization; fraud prevention, detection & remediation; and risk intelligence for market, credit & operational risk, as well as all aspects of the credit life cycle. Teradata also has experience in the insurance industry for claims, underwriting, customer management, risk and finance management, fraud and abuse. Teradata offers a robust authoritative, comprehensive data infrastructure for insurance companies. Our industryleading Financial Services Logical Model is in its eleventh iteration and addresses the insurance industry at both a business-unit and group level. Our comprehensive platform family enables us to address business requirements for institutions of all sizes. We provide a wide range of professional services including governance, data quality and other data management services, as well as data warehouse implementation services. We also team with a wide variety of partners ranging from ISVs, stochastic modeling platform providers, analytical tool vendors, and systems integrators to provide a complete solution for the ERM marketplace. Teradata has a successful history of solving complex risk and compliance problems globally. We understand business EB-7299 > 0812 > PAGE 8 OF 9

9 Teradata.com problems, have a solution for fraud, and proven experience implementing solutions for the banking, capital markets and insurance community. About the Author Sam Harris leads the Teradata Enterprise Risk Management program for the Industry Marketing and Solutions business unit. Harris joined Teradata after having worked for Microsoft in the Financial Services Industry organization, leading enterprise risk management and compliance sales opportunities in the U.S. for banking, capital markets, and insurance. Prior to Microsoft, Sam worked for SAS, focusing on risk and compliance issues. Harris has experience in financial services and with risk management solutions for operational, market and credit risks, credit scoring and risk factors. Prior to joining SAS, he enjoyed a successful career at Wachovia Bank as a vice president in treasury services. Harris is an alumnus of the University of North Carolina at Chapel Hill, where he earned a bachelor s degree in Business Administration with a concentration in Finance. The Best Decision Possible is a trademark, and SQL-MapReduce and Teradata and the Teradata logo are registered trademarks of Teradata Corporation and/or its affiliates in the U.S. or worldwide. Teradata continually improves products as new technologies and components become available. Teradata, therefore, reserves the right to change specifications without prior notice. All features, functions, and operations described herein may not be marketed in all parts of the world. Consult your Teradata representative or Teradata.com for more information. Copyright 2012 by Teradata Corporation All Rights Reserved. Produced in U.S.A. EB-7299 > 0812 > PAGE 9 OF 9