What Is the Future of Banking Fraud Management?

Transcription

1 What Is the Future of Banking Management? Changing market forces require a new approach to enterprise fraud management Number 62 August 2012 Enterprise fraud management (EFM) began as a compelling vision. Today, finding a better way to combat fraud across the enterprise has become an urgent need, propelled by technological advances and economic pressures changing retail banking markets all over the world. The same forces are dramatically shifting the way the banking industry is thinking about and undertaking EFM. With banks racing to bring new services to market, the idea of a single centralized EFM solution is being replaced by a more agile, less costly approach. Banks can now rapidly deploy fraud solutions focused on specific customer interaction channels or customer asset classes, then link them as needed for higher-level customer protection. And because today s capital and margin pressures often make it impractical to replace proven channel-specific defenses, the new approach provides the means to connect these systems with new capabilities and with each other. By embracing this more flexible approach, banks start experiencing the rewards of enterprise fraud management like better detection of cross-channel fraud and less impact on valuable customers sooner. They gain agility to protect new services, shore up weak channels and adapt to changing fraud patterns. They re able to recoup past investments and adjust to organizational and IT infrastructure changes as they occur, while always moving toward greater integration and benefits. This white paper explores the future of banking fraud management, including: Banking leaders are embracing a new approach to enterprise fraud management one that can be implemented in stages that deliver faster rewards How fraud exposure is dangerously expanding for many banks. The key role of fraud management in building profitable customer relationships. Rethinking EFM for greater flexibility, deployment speed and return on investment. How fraud detection can adapt to changing markets and threats. Essential steps and capabilities for higher-performance fraud management. Make every decision count TM

2 What Is the Future of Banking Management?»The» Growing Threat represents a bigger threat to banks today than ever before. Many companies are dangerously exposed, and not only to the risk of rising fraud losses. The potential for losses is certainly considerable. As always, fraudsters are shifting their attentions from more defended to less defended targets, and today there are plenty of fresh opportunities. New online and mobile services open up vulnerabilities fraudsters are quick to exploit. Under time-to-market pressure, banks may launch without adequate defenses. Indeed, the newness of the services, and the unknowns about how fraudulent and legitimate users will behave, make it difficult to extend protection with traditional fraud detection methods alone. These new ways to engage customers are also multiplying potential entry points for schemes that reach across banking channels, accounts and products to increase the take of customer information and funds. Traditional siloed fraud defenses are largely blind to such maneuvers, which is why they re on the rise. Recent economic turmoil coupled with the emergence of new payment types and technologies has brought out fraudsters of all stripes, from first-timers desperate for cash to the most sophisticated technological manipulators of the industry. Ovum Guide to Anti-Financial Crime Solutions in Retail Banking October 2011 However, the threat extends further. management inadequacies expose banks to the risk of undercutting their own efforts to build the valuable customer relationships they need to increase portfolio profitability and return on equity. In tight markets where banks are trying to earn back customer trust and loyalty, uncoordinated calls or transaction denials that show the company just doesn t understand its customer could endanger success. In growth markets where banks are wooing new customers, such failings could erase a big slice of market share. In all markets, a major fraud outbreak would expose banks to the risk of media excoriation and damage to their reputations. It could also attract increased scrutiny from regulators and raise compliance hurdles.»» Need for a New Way to Expand Defenses The banking industry has been talking about enterprise fraud management for a decade. Over the past half decade, as some banks have started working toward this vision, EFM objectives have evolved and crystallized in response to changing market realities. The initial vision of a monolithic system performing integrated fraud management across all channels, products and lines of business may be impractical from today s vantage point. Few banks are in a position in today s business environment to make the investment it would require, especially in markets where capital has become a scarce resource and lean operating budgets are the norm. Also, many banks are unwilling to abandon their current investments in existing fraud solutions that have delivered proven value. And monolithic solutions don t fit the plans of many bank IT organizations, which are trending toward more flexible architectures with standardized components and service-based functionality. For a few years, some in the industry thought a simpler approach, of performing just case management at the enterprise level, might be the answer. That concept too has been outgrown. Understanding what all the alerts mean in a timely enough manner to intercept sophisticated fraud schemes turns out to be extremely complex. page 2

3 What Is the Future of Banking Management? Mobile Corporate Money Laundering Application Customer Protection Enterprise Payment Card That s not to say that alert aggregation isn t part of the answer. Banks can create fraud defense strategies, for instance, that incorporate alerts from multiple channels and products to make better fraud management decisions in a specific channel or product. However, banks need the ability to share more than just alerts. By sharing fraud scores and dispositions, for example, across multiple detection areas, it may be possible to improve case management in all areas. With the ability to overlay this global information onto their local strategies, analysts would gain a more holistic view of the customer. They d be able to make a better determination of whether an account is subject to fraud, thereby reducing false positives a major cause of customer dissatisfaction. In many situations, banks will also want to make raw data and/or data-derived or profiles Acquiring available Risk across channels and products. This broader view enables analytic models to examine wide-ranging customer and fraudster behavior patterns to quickly distinguish usual from suspicious behavior. It enables them to recognize emerging fraud schemes at the earliest possible moment, Mortgage understand what a multitude of alerts really means and greatly reduce false positive rates. Electronic Overall, the need is for the flexibility to deploy a mix of solutions suited to specific fraud challenges, Auto and to leverage common elements wherever and however it makes sense. Loan Retail Banking First Party Internal Figure 1: New approach to fraud management Initial EFM concept Today s approach Money Laundering Application Payment Card Money Laundering Application Payment Card Mobile Acquiring Risk Mobile Acquiring Risk Corporate Enterprise Mortgage Corporate Customer Protection Enterprise Mortgage Electronic Auto Loan Electronic Auto Loan Retail Banking First Party Internal Retail Banking First Party Internal Monolithic system performing integrated fraud management across all channels, products and lines of business. All case management at the enterprise level. Conform organization and technology infrastructure to EFM concept. Combination of existing and new analytics-based systems that address specific fraud management needs, linked as needed to provide centralized insight and control. Mobile Corporate Application Case management Money and other fraud management Payment functions Laundering Card performed at the level where they are most effective. Ability to share relevant alerts, scores, strategies, decisions and case dispositions across channels, products and lines of business as needed. Acquiring Risk Conform EFM concept to organization and technology infrastructure. Enterprise Mortgage Electronic Auto page 3 Loan Retail Banking First Internal

4 What Is the Future of Banking Management?»»»»A Real-World, Right-Now Approach Today, banking leaders are embracing a new approach to fraud management one that s as comprehensive as the original EFM vision, but can be implemented in stages that deliver faster rewards. The goal is still to integrate fraud defenses across channels and products in ways that improve both fraud detection and customer service. But this goal is achieved using a combination of existing and new analytics-based systems that address specific fraud management needs, linking and potentially replacing legacy systems as needed to provide centralized insight and control. This new approach combines agility for accomplishing what needs to be done right now to solve a diverse range of fraud problems, with continuity for building in a structured, incremental way toward larger objectives. Our clients tell us they want: Agility to 3 Accelerate time to market for innovative new services protected against fraud. 3 Quickly shore up the defenses of weak channels that could be exploited by fraudsters seeking out points of vulnerability. 3 Thwart the growing number and variety of cross-channel, cross-product fraud schemes. 3 Adapt detection to new and morphing fraud patterns. 3 Flexibly address a diverse range of fraud management needs in the ways that make the most sense for each purpose: build own solution with sourced components and tools; implement fully sourced on-site solution; access hosted solution; extend existing solution. 3 Adjust fraud management solutions to changing organizational structures and IT architectures. Continuity to 3 Leverage existing systems that have proven successful and increase returns from these investments. 3 Gradually integrate focused solutions to improve detection by enabling analytics to see more angles of legitimate and fraudulent behavior patterns. 3 Move toward customer-level fraud management strategies that consider the value of the entire customer relationship and coordinate contacts. 3 Standardize on common solution components across diverse business units and geographic markets, creating economies of scale while supporting unique local requirements. 3 Establish centers of excellence that enable shared learning and propagate best practices across the enterprise. page 4

5 What Is the Future of Banking Management? Every Bank Will Move Forward in Its Own Way Because of the flexibility inherent in this new approach to banking fraud management, there is no single route to achieving it. Unlike how EFM was previously defined, banks don t have to think about how to conform their organizations and technology infrastructure to a given concept. Instead, they can define fraud management in their own terms, with the concept conforming to their requirements and evolving with their priorities. Even so, there are commonalities among the early-adopter banks making strides toward higher performance. Here are seven essential steps they re taking and fundamental capabilities they re bringing together into fraud management solutions. Regardless of whether you accept or deny that your business process has weaknesses, fraudsters are highly efficient at finding them. By and large, fraudsters hit as many products as possible in one shot. Bank Risk Manager, Speaking at FICO World Understand where fraud is hurting your business most. Finding the biggest pain points helps banks know where to focus fraud management efforts first. One FICO client, a South African bank, started with auto loans. losses were high in that line of business because once a vehicle leaves a showroom with a fraudster, it is rarely recovered, and even when it is, most of its value has been lost. A UK bank found that account takeover was responsible for some of its heaviest losses, as criminals were moving funds from savings to current accounts, which they emptied using debit cards. In addition to the losses and the negative impact on customer trust, the bank is struggling with the cost and operational headache of complying with regulations that force immediate reimbursement to accountholders. Much of the impact of fraud may be hidden. First-party fraud, for example, is often swept into bad debt write-off. By accurately identifying first-party fraud, banks can take action earlier to treat this behavior appropriately and prevent large losses. A UK bank that worked with FICO to identify and properly treat such accounts achieved a 70% reduction in first-party fraud losses. 2. Think about how your business is organized and incented to fight fraud. Historically, banks have managed fraud exposure within different products, services and customer lifecycle stages, developing dedicated fraud systems that align with these functions. Typically, fraud mangement teams have operated within each business unit, where fraud losses are accounted for and written off under the unit s product or channel profit-and-loss statements. Many banks today, however, are in the process of consolidating into a smaller number of fraud functions, centralizing responsibility as much as possible within the constraints of the larger banking organization. Some banks are going as far as to forge a single fraud management organization responsible to their executive team, board of directors or even to a customer protection czar. They have been able to take fraud management out from under the ownership of individual business units and create a center of excellence (CoE), where all financial crime-related activities, including fraud, compliance, security and operational risk, are interconnected with overlapping spheres of influence. The design of such CoEs reflects the way fraud management thinking has evolved, as well as the increasing pressures within banks to improve the customer experience. For instance, it s generally understood that the CoE should be governed by the bank s determination of its risk appetite for specific asset classes, as well as overall for the customer relationship, balanced by the correct level of aggressiveness in countermeasures for managing customer impact. Thus, the page 5

6 What Is the Future of Banking Management? CoE allows for the agile deployment of fraud department resources based on each type of risk (first-party, third-party, internal) and helps the bank deliver a consistent customer experience across products and channels. Other banks are adopting a hybrid approach, merging some functions, focusing where the benefits are greatest. Some are keeping fraud management organizationally, procedurally and systemically separate while sharing common processes, data and systems. They re developing interfaces to connect fraud systems through common APIs that will enable scores and information from multiple channels to be aggregated into customer profiles, which can be used to affect subsequent transaction decisions at both the customer and channel level. Even where fraud organizations remain largely federated, banks can improve coordination by aligning everybody s priorities and incentives around common higher-level goals. The online banking fraud management group, for example, can be rewarded not only for reducing fraud in its channel, but for the role it plays in reducing overall deposit account fraud as well. 3. Develop an enterprise fraud roadmap. Banks should start with current fraud pain points and/or where they anticipate greater pain in the near future. One FICO banking client making notable progress in EFM has not experienced a lot of cross-channel fraud yet. Garanti Bank has gone ahead with cross-channel fraud detection anyway to stay ahead of the criminals. The time to invest is before the fire, explains Beyhan Kolay, the bank s senior vice president. Case study: Garanti Bank Turkey s second-largest private bank has been an early mover in EFM. While fraud rates in Turkey are still relatively low, the bank s board and senior management made the decision, as a matter of good corporate governance, to commit to EFM. In addition, the bank, which is known for being ahead of its sector in terms of using the most advanced technologies, regards EFM as a source of competitive advantage. Garanti aims to do a better job of protecting customer assets and information, while reducing fraud management impact on customers, than its larger rival. Organizational structure: Anti-fraud monitoring is one consolidated fraud management organization, reporting directly to the board of directors. Current scope of fraud detection: Application fraud detection for all lines of credit Credit card portfolio Debit card portfolio Deposit accounts Online banking Merchant monitoring Anti-money-laundering (AML) EFM roadmap: Organizational structure Reporting to the board Covering possible fraud risks of all business areas in a single department Board of Directors Audit Department Internal Control Unit Risk Management Audit Committee (Two non-executive members) Anti- Monitoring AML Officer Independent from execution Integration of all channels in customer level Unique customer identifier linked to all channels and products Customer-level and product-based rules and scores Cross-channel detection regarding customer behavior Common case manager Reducing operational costs page 6

7 What Is the Future of Banking Management? From the chosen starting place(s), banks build their roadmap out with a combination of short- and long-term initiatives. What needs to happen when will depend on bank business objectives and priorities, capital position and emerging technology directions. 4. Prioritize and standardize pertinent data and fraud processes. One of the most important things banks can do to prepare for more integrated and effective fraud management is to start moving toward using common data definitions. At minimum, there needs to be a common data field that identifies a wide variety of transactions ATM withdrawal, mobile payment, online banking deposit, credit card purchase as being made by the same customer. Findings of 2011 Aite Group EFM survey of US banks: 40% said they had a functional organization in place to oversee fraud management across the enterprise But only 3% were actually sharing even their own past-fraud data There was surprisingly little correlation between the professed enterprise fraud strategy and the level of data sharing taking place among respondents. Similarly, there was not a significant correlation between the size of the institution and the extent to which data sharing was taking place. Aite Group Enterprise Management: Investments in Integration February 2011 With a unique customer identifier, banks lay the foundation for analytics to be able to link diverse account activity to the customer performing the actions. Beyond this, as banks move toward a unified, shared data model, analytics operating at the customer level, or even at product or channel levels, will be able to examine a much wider, richer range of predictive data. Adoption of standardized processes is also essential. Standard policies on how to differentiate first-party fraud from credit abuse, for example, will increase the accuracy and productivity of fraud analysts. Standard policies on when and how customers are to be contacted will increase not only customer satisfaction but operational efficiency as well. As an example, an international banking group that consolidated fraud protection operations across 11 subsidiary banks improved the performance of its fraud analysts by 400%. The head of fraud operations summed up the advantages this way: Now that we have the transactional data in one place, it s like Treasure Island. We can do so much valuable analysis for the benefit of the whole group. By identifying areas like this where different fraud groups find common ground, banks begin to lower the silo walls and leverage cross-channel information and customer information in decisions within their traditional silos. In addition, common policies can at some point be turned into shared business rules. Banks could consider creating a loose link between incompatible legacy systems, for example, by enabling them all to call the same external rules-driven decision service for a customer contact recommendation. Also, banks should look at ways that sharing fraud scores and other decisioning data can create mutually beneficial fraud management improvements. For example, a score indicating suspicious online account activity would be very useful to other areas of the bank making wire transfer or deposit hold decisions. (For more about integration, see section 7 on page 9.) 5. Identify the appropriate analytics for each fraud problem. Banks today need the flexibility to apply a variety of analytic techniques for different fraud management needs. page 7

8 What Is the Future of Banking Management? Fusty old retail banking faces its biggest shake-up in 200 years...an upheaval is coming, driven by technological changes the growth of internet usage on smartphones, the rise of big data computer processing and the increasing willingness of customers to do complicated things online. Counter Revolution The Economist May 19, 2012 For instance, at originations, custom application fraud models can be trained to detect first-party fraud recognizing behavioral patterns of applicants who do not intend to honor the credit obligations they are attempting to assume. They can be used in conjunction with third-party application fraud models that incorporate identity checks. Link analysis can be used to find relationships between the application data and suspicious entities the same phone number, for example, as another individual whose previous application scored high for fraud. For transactional fraud detection, where sufficient historical data is available for analytic development, training and validation, neural network models provide superior fraud detection. Used with dynamic profiles, which compress historical behavioral data into carefully selected and highly predictive characteristics, neural network models can detect abnormal account behavior in a fraction of a second. This profiling technique can be extended to detect abnormal behavior in other entities involved in banking transactions, such as ATMs, point-of-sale terminals and mobile phones. In one case recently, when extended profiling was added to an existing neural network protecting the PIN ATM segment of a bank s debit card portfolio, fraud detection improved by an additional 30%. 6. Incorporate the capacity for innovation. With retail banking continuing to undergo change in technologies, customer behaviors and competitive business models, banks need a capacity to innovate. Whether through internal resources or through partnering with an analytics leader, they need access to the latest fraud detection and decisioning techniques. For instance, the self-learning outlier model is an innovative analytic technique for protecting new channels, products and markets. Where the historical data needed to build traditional supervised models is lacking, banks can nevertheless use this new technique to provide an increasing degree of fraud protection from launch, to early adoption and onward to mass adoption. As depicted in Figure 2, self-learning outlier models quickly recognize typical behavior patterns for peer groups of customers with similar characteristics and adjust to how those behavior patterns change over time. They infer the values of normal and abnormal activity from the transactions they are processing by dynamically scaling variable values (converting them to a common unit for comparison across peer groups) using anomaly detection and other statistical techniques. Figure 2: Self-learning analytics protect new and changing markets detection deployed Month Month Month 9... detection for new channels, products and markets must adjust to how behavior patterns change as consumers grow accustomed to using the service and fraudster schemes emerge. What constitues an outlier behavior outside the range of what is typical for the peer group changes. This is represented by the changing shape of the high-risk portion of the curve. % Population Dynamic calculation of outlier range High risk # High-value transactions per day % Population Dynamic calculation of outlier range High risk # High-value transactions per day % Population Dynamic calculation of outlier range High risk # High-value transactions per day Transactional data Profile dynamically updated Dynamic variable scaling Analytic model Dynamic variable scaling Dynamic variable scaling page 8

9 What Is the Future of Banking Management? Because the characteristics being compared among peers can include cross-channel and crossproduct, self-learning outlier models are also quite effective against the increasing number of broad-reaching fraud schemes that siloed fraud detection misses. The technique also simplifies customer-level fraud management, since what is typical behavior for the peer group and what is an outlier is determined by the self-calibrating distributions of values represented in Figure 2 by the changing shape of the red high risk area. This eliminates the need for supervised model training based on historical fraud dispositions (which could become very complex where banks have a multitude of diverse fraud reporting requirements across channels and products). 7. Integrate fraud solutions where and how it makes sense. Figure 3: Combining application fraud score with transactional fraud DETECTION RATE 60% 50% 40% 30% 20% 10% LEGEND Application-only score Transaction-only score Integrated transaction score Depending on organization and IT structure, integrating decisions may be as simple as sharing elements of an automated decision from one area into the case view of another area to improve human analysis. Or it may involve a more holistic approach of leveraging disparate events and transactions from multiple areas together as part of the formation of a score or decision. One example of an integrated solution is linking application fraud management with ongoing transactional fraud management. A bank might have an originations solution that uses rules and a custom application first-party fraud model to decision new accounts. When applications are rejected because of high fraud scores, the application data, score and decision can be shared with other product areas to determine if the fraudster has any linkages, such as common phone numbers or addresses, with accounts already on the bank s books. Some of these linked accounts may already be in the collections process; by identifying them, banks can treat them appropriately, preventing further waste of collections resources. Others may still be transacting, without giving signs of the true risk they represent; by identifying these, banks can act in time to prevent balance build up and bust-out fraud schemes from succeeding. On the other hand, applications receiving scores that are elevated but not high enough for rejection may be approved but subsequently monitored closely for the first signs of fraud. This can be done very FALSE POSITIVE RATE effectively by taking an integrated fraud management approach that combines the original application fraud score with ongoing transactional fraud scores. As shown in Figure 3, the combined score will be more accurate, at all false positive rates, than either score alone. Conversely, the results of transactional fraud scoring could be used by application fraud decision strategies should the customer apply for additional lines of credit. 0% 0.0% 1.0% 2.0% 3.0% 4.0% 5.0% page 9

10 What Is the Future of Banking Management? Another area where the advantages of integrating fraud management are quite clear is across different types of transacting accounts. For instance, banks can do a better job of protecting deposit accounts if they have an integrated view of all the channels (e.g., debit cards, online banking, ACH payments) and products (e.g., checking accounts, savings accounts, overdraft credit lines) providing access to them. This enables analytics to look at how the customer interacts with the account and how funds come in and out of it. Real-time transactional models can thereby detect changes in payment velocity, payee distribution and other dynamics that provide early indications of rising fraud risk. One of the best ways to achieve this kind of integration is with a system that can apply dynamic profiling techniques at the channel, product and customer levels. As shown in Figure 4, all transaction records carry the same customer ID, associating the transactions with the individual Figure 4: Integrating fraud management through analytics TRANSACTIONS through any channel have same customer ID DYNAMIC PROFILES update in real time with every transaction FRAUD SCORES generated at one or multiple levels ACTIONS taken where most effective ATM POS Debit Online banking Customer profile Account profiles Customer DDA/Current Account Account Savings Account Credit Card #1 Account profile summaries Channel profile summaries Channel profile summaries Cross-account Cross-channel Cross-channel Customer score Account score Customer-level action based on:» customer score & profile Account-level action based on:» account score & profile or any mix of:» customer score» account score» customer profile» account profile Mobile payments POS Credit Channel profiles Account Channel profile summaries Channel Channel Channel Cross-channel Channel score Channel-level action based on:» channel score & profile or any mix of:» customer score» account score» channel score» customer profile» account profile» channel profile Channel ACH Channel page 10

11 What Is the Future of Banking Management? customer making the transactions. Every transaction updates dynamic profiles at the channel, account and customer levels which compress vast amounts of historical behavior data into an efficient set of for real-time analysis. detection systems can therefore analyze the current transaction in the context of this rich, multilevel view of what is normal or suspicious for this individual. This broader view improves fraud detection while helping banks take actions that have less impact on legitimate customers. However, that doesn t mean all fraud detection, case management and treatments or even any of it, initially has to occur at the customer level. Analytics-based integration should provide banks with the flexibility to generate and use profiles at multiple levels, to perform fraud scoring at one or more levels simultaneously, and to take actions where they will be most effective. For example, channel-level scoring can use profiles from anywhere in the hierarchy. Conversely, customer-level scoring can use channel profiles to analyze channel-specific customer behaviors.»conclusion» Enterprise fraud management is finally in reach for many banks but it s taking a far different shape for some than originally expected. Rather than a monolithic solution for all fraud problems, today s approach provides flexible ways to address a variety of fraud management needs. Instead of mandating top-down centralization, it gives banks the means to move toward greater integration when and where it makes sense for their business. Learn more: Download Insights white papers, which regularly cover analytic innovations and best practices in fraud. Subscribe to the FICO Banking Analytics Blog for the latest on enterprise fraud management and other fraud topics. Get an overview of FICO s approach to fighting fraud across the enterprise. The Insights white paper series provides briefings on research findings and product development directions from FICO. To subscribe, go to For more information North America toll-free International web (0) [email protected] FICO and Make every decision count are trademarks or registered trademarks of Fair Isaac Corporation in the United States and in other countries. Other product and company names herein may be trademarks of their respective owners Fair Isaac Corporation. All rights reserved. 2896WP 08/12 PDF