Memento provides next-generation technology and solutions that enable financial institutions to rethink and improve the way they combat fraud and manage compliance. Memento customers realize unmatched business value and rapid ROI.

bank fraud forum

Putting Things In Context

July 15, 2009 by Mike Mulholand
9 comment(s)

A big part of my job involves talking to fraud management professionals, trying to better understand their "day in the life" challenges and how technology might help them to be more productive and efficient. We take away many interesting insights from these discussions (some of which we'll cover in future blog posts), but one that I'm starting to see articulated more recently is the value of information sharing and collaboration between two important groups of fraud professionals.

The first group is the loss prevention specialists, focused on detecting and stopping fraud BEFORE a loss occurs. The second group is fraud investigation/recovery specialists, focused on investigation, mitigation, and recovery AFTER a potential fraud has occurred. I realize that the terminology might be slightly different in your experience, but for the purpose of this post, let's use analysts to refer to loss prevention personnel, and investigators to refer to investigation and recovery personnel.

While both groups are instrumental in the fight against fraud, their day-to-day work is different. They're focused on different aspects of the process, and as a result they develop different perspectives on what is often the same information. Analysts have one perspective – alerts, verification, and speed of disposition, and investigators have a different perspective – cases, discovery, recovery, and process management. Yet in too many financial institutions, there is little or no sharing or cross-reference of those unique perspectives.

It seems that everywhere you turn people are talking about the need for cross-channel fraud prevention, and rightly so. A holistic, cross-channel view of activities and information provides the best possible context for finding and stopping fraud. The same principle of context applies to analysts and investigators as well. Exchanging information derived from their use of underlying data has to be beneficial. For example, wouldn't it be good for the investigator working a case to know that the account they're investigating had multiple fraud alerts on it last month? Given that information, it's possible (likely, even?) that the investigator might approach that case a bit differently. Wouldn't the loss prevention team love to have information about an organized ring operating in the area that was uncovered during an investigation (or multiple investigations)?

We'll be diving into the concept of context a bit more in the coming weeks. In the meantime, please share your perspectives on context, and what it means for loss prevention and investigation/recovery.


Make a Comment

* = Required
*
*
*
*
 

Recent Comments:

Fraudtastic
July 15, 2009 - 6:01 PM
"Would like to hear your thoughts on fraud prevention versus customer experience, specifically how it relates to the "false positive" rate and how to strike a balance between forgone revenue (due to false positives) and lower losses. "
Mike Mulholand
July 23, 2009 - 4:20 PM
"I think there are two ways customer experience interacts with fraud prevention. First, and probably most importantly, successful fraud prevention shields the customer from the experience of being a victim of fraud. When a fraud suspect is appropriately acted upon and the fraud prevented, the customer is blissfully unaware of the event, and rightfully so. A failed prevention …. Well, we know how that goes. False positives on the other hand have two effects. First, in an effort to reduce false positives some may employ a strategy of raising the thresholds for certain detection mechanisms. This results in lower dollar frauds flying under the radar resulting in detection by the customer. Now we've got a bad customer experience. I don't know about you, but even if the bank makes me whole, I'm not very comfortable with the fact that a fraudulent item posted to my account. Even the explanation that it was a "processing error” (if that is used) doesn't help much. Second, customers are generally unaware of false positives…unless they are acted on in a way that affects the customer's account. If an action were taken like returning an item, or placing a hold on the account, the customer will likely be negatively impacted, another bad customer experience outcome. Customer experience needs to be taken into account when deciding how to deal with false positives. It's not just about how much that institution is willing to risk in dollar loss (as in threshold setting), but also how much are they willing to risk in bad customer experience outcomes. Every fraud event has a human repercussion. While the primary focus of most loss prevention programs is to protect the institution, I would submit to you that protecting the customer is protecting the institution. In a previous post, Don't Let Fraudsters Steal New Revenue 3/30/09, I talked about the loss prevention manager collaborating with the marketing and product management folks. By understanding the products you are planning to offer including their vulnerabilities, you can improve the business case for that product by reducing expected losses. This concept applies to existing products as well. A better, albeit more difficult way to reduce false positives is to understand what causes them and eliminate the cause. You'll never get to zero, but you can certainly make a dent. This requires meticulous, detailed work, but from my perspective it is worth the effort. I am also aware that this is much tougher for some detection systems than others, maybe even impossible. If the latter is true, start looking around. "
changes
July 27, 2009 - 7:51 AM
"Hi, i have been working on the investigator side for the past years and am now looking to move into the analytical side. Do you have any tips/hints how you can expand your horizon and further your career in that field and bring the best knowledge (courses?) and experience to the company? thanks for the input. "
Mike Mulholand
July 27, 2009 - 12:09 PM
"There are in my view three things a fraud analyst must have • An understanding of how fraudsters attack your institution • An understanding of your institution's products (particularly from a vulnerability standpoint) • A very good understanding of how your detection system(s) work(s). (Data, rules, weightings, research capability, etc.) Having been an investigator, you have the first one down, and you probably have a pretty good understanding of the systems your institution uses. The other two, you'll have to be the judge. To me, the biggest difference to me between the two roles on a day to day basis is the analyst is all about detection, verification, disposition, and prevention, while the investigator is about discovery, recovery, process management, and reporting. Another huge difference is speed. The analyst's need for speed puts me in mind of a scene from the movie Top Gun, where our heroes are walking down the flight line and saying while they high-five "I feel the need….the need…for speed.” The analyst typically looks at hundreds of items a day. Their ability to quickly recognize what they are looking at, take steps to verify it, and quickly make a decision and disposition the item is key to their success. In regard to training, the most prominent fraud- focused certification is the Certified Fraud Examiner (ACFE.Com). Another, the Certified Risk Professional (bai.com) is popular with regulators. The primary anti-money laundering certification is the CAMS (acams.org). Hope this is helpful. "
changes
July 27, 2009 - 3:25 PM
"Hello Mike, thanks a lot for your time. its much appreciated! "
Nittany
July 28, 2009 - 9:59 AM
"Mike, you are spot on. Some F.I.'s are seeing the benefits of having the open dialogue between the analysts and investigators and the sharing of data, which does many things from reducing losses, mitigating additional/future exposures, reduces reputational risk and provides better cross training for employee development. I feel there is still room for growth within many F.I's to enhance the sharing of data between other risk areas in the F.I. such as internal fraud and AML groups. Over my years in financial fraud investigations, I many times said the crooks have a better network of communication than we ever did. As long as that is the case, the crooks will continue to walk through the door while we decide who is going to watch the house. "
Littlefish
August 11, 2009 - 8:11 PM
"When it comes to ACH fraud how much liabilty does the bank have? "
Vyacheslav Nehoroshih
August 12, 2009 - 1:21 AM
"Dear Mike. I staying in the top of fight against fraud process in the Ukrainian division of the international bank. And I must say according to my experience, that we can't compare work of fraud prevention and investigation teams. They are both in my unit, and can't exist without each other. The main goals of fraud prevention unit are to support underwriting process (fraud scoring, client verification methods and rules etc.) and to seek fraud schemes in current assets and liabilities databases. Fraud analytics unit - is a head of fighting against fraud system, but fraud investigation unit - is its hands. They are using information provided by fraud analytics unit, doing fraud investigations and reporting and the main - describing new fraud schemes, discovered in the fraud ivestigation process, for putting them as algorithms by fraud analytics in the fighting against fraud system. So it doesn't matter when you are expecting fraud losses - BEFORE of AFTER. You always prepared thanks to work of fighting against fraud system. "
Mike Mulholnad
September 4, 2009 - 10:40 AM
"First, let me apologize for the delay in my response. From an ACH perspective, the ODFI carries all of the risk for ACH transactions they send to other ACH participants because of the warranties they make pursuant to section 2.2 of the operating rules. 2.2.1.1 in particular says "Except in the case of XCK entries initiated pursuant to section 2.7 (Destroyed Check Entries), each entry transmitted by the ODFI to an ACH Operator is in accordance with proper authorization provided by the Originator and the Receiver." That basically says if it isn't authorized, you just ate it. Usually the agreement between the originator and the ODFI transfers their risk to the originator, but if the originator can't or won't (e.g. a fraudster who disappears) cover it, the ODFI is left holding the bag. Even with these contracts in place there are lawsuits that result from fraud losses. Also it is not uncommon for a bank to take the hit because of the strength of the customer relationship, which often goes far beyond ACH origination. "