Memento provides next-generation technology and solutions that enable financial institutions to rethink and improve the way they combat fraud and manage compliance. Memento customers realize unmatched business value and rapid ROI.

bank fraud forum

"False Positive" - Roll that around your brain and tell me what you think

May 12, 2009 by David Hood
5 comment(s)

Mention the phrase "false positive" to a bank fraud analyst or investigator, and you get range of reactions: from an angry gnashing of the teeth to tired submission. I think it is fair to say that none of these emotions on the continuum portend quick, decisive action!

The false positive is the bane of fraud analyst's existence. If you want to do a great job fighting bank fraud, you often have no choice but to weed through these nasties. On any given day, they test the mental fortitude of the most well-intentioned. Over the years, it is inevitable that a few legitimate cases of fraud slip through the cracks. Over a career, they can produce that most jaded of fraud fighters: the skeptic (cynic?) that disbelieves that the false positive problem will be reasonably controlled.

But what is a false positive anyway? Technically, only alerts that result a determination of fraud are true positives: all other alerts are false positives. But some alerts are so suspicious that you'd rather investigate than not, right? And how about an alert which does not directly point to a problem, but triggers an investigation that finds you something much different, and perhaps much bigger? The equivalent of the traffic cop stopping the guy that runs a red-light, only to find the loaded, unlicensed hand gun in the back seat.

And how quickly can you explain an alert away as a false positive? I am always amazed at how quickly fraud analysts work through their case load. I think there's an element of Blink (Malcolm Gladwell) in how fraud analysts do their job.

How can thinking that takes place so quickly be at all useful? Don't we make the best decisions when we take the time to carefully evaluate all available and relevant information?

Certainly that's what we've always been told. We live in a society dedicated to the idea that we're always better off gathering as much information and spending as much time as possible in deliberation. As children, this lesson is drummed into us again and again: haste makes waste, look before you leap, stop and think. But I don't think this is true. There are lots of situations--particularly at times of high pressure and stress--when haste does not make waste, when our snap judgments and first impressions offer a much better means of making sense of the world.

Do you recognize this feeling of "rapid cognition" that Malcolm Gladwell talks about in fraud prevention?


Make a Comment

* = Required
*
*
*
*
 

Recent Comments:

Tony
May 13, 2009 - 12:03 PM
"Although I am not a fraud analyst, I was a project manager specializing in fraud detection and had the opportunity to observe fraud analysts in depth for over nine years. One particular analyst had begun observing certain 'information/patterns' that led him to quickly spot certain kinds of transaction fraud (positives). His rate of 'false positives' was real low. The automated fraud detection systems we put in place made certain to put 'flags' that were favored by the analysts so that when they pulled up a suspect transaction, they had enough information on the screen to make a quick intuitive judgement. Fraud detection is, in my opinion, a process of observing 'patterns'. And, being aware that patterns change as new patterns are found. Those fraudsters seem to know when it is time to change their procedures. Sometimes it is a particular amount (e.g. the amount always ends with .88 cents or a dollar less than a baseline). We can innundate our analysts with a lot of information, but that just creates 'noise' and deters from their ability to spot fraud quickly. Too much information can be more deleterious to our work than not enough information. Fraud detection is a numbers game. Also, case reviews are very important to determine how a fraudulent transaction was missed and how can we adapt a process or rule to catch it in the future. Finally, let me say that so many transactions must be reviewed to satisfy management's policy of how much must be reviewed. The analysts I worked with did not have time to do intensive reviews and I'm not certain that the additional time would have been cost effective. Time is money also. I appreciate fully the role of the fraud analyst and their ability to 'spot' fraudulent transaction and reduce the number of false positives. Great article, by the way. "
Jon J. Bjarnason
May 15, 2009 - 8:05 AM
"Measuring the performance of a fraud detection system consists of more then just measuring the the false positive ratio. It is important to set goals for any detection system and to set in place a method to ensure that these goals are met. It is also important that the correct information is measured, i.e. an already blocked card or transaction should not contribute to the statistics in the favor of the detection system. The first thing to decide is your threshold and case load, how many alerts can you handle. There can be a few thresholds, some taking manpower into account, others considering technical issues. Your detection goals have to be within these thresholds and they need to be measured prior to a system being activated (on historical data) and on a regular bases on an active system. For a plastic card detection systems, these goals and measurements could be: False positives, how many alerts are you getting for non fraudulent transactions versus alerts for actual frauds Positive false, how many fraudulent transactions have not triggered an alert. Transaction detection rate, the ratio of fraudulent transactions detected. Card detection rate the ratio of cards having fraudulent transactions detected. Volume detection rate, the ratio of fraudulent amount detected. First found detection rate, How often are you finding the first transaction in a sequence of fraudulent transactions. Detection Delay. The average number of the first fraudulent transaction detected in a sequence of transactions that triggered an alert. This is the way I do things at least, no avalanche of alerts, no detection system activated that does not meet the customers goals and the customer knows when the performance is deteriorating. "
Jake
May 15, 2009 - 8:29 AM
"This is an interesting subject. I'd disagree with your first statement that any alert that doesn't identify true fraud is a false positive, and fall in line with your assertions ala the loaded gun in the back seat. In the end, false positives are alerts that are "a waste of time". Many alerts, that end up not being fraud or money laundering, are useful and the kinds of things we want our monitoring system to bring to our attention, even though this particular case was benign. "
obie003
May 27, 2009 - 2:24 PM
"You guys are experts in fraud detection. I have to tell you that since I was a victim, I had no idea of how easy personal information can be gotten on the net to get information to open a person's financial portfolio. That is what happened to me and they were so good, they opened accounts that I had closed, they charged on accounts I had current and in 4 months wiped me out. What about the innocent person. If any of the banks looked at my credit history, there would have been a good chance that they would have seen rapid charges on multiple cards in the same bank. I am still penniless although I am not giving up the fight. I know somewhere there will be someone who will find this worth looking into because it could also help fraud investigators see what theives do. I was able to figure it out. "
Scamout
May 27, 2009 - 2:26 PM
"I find it interesting that this thread doesn't contain a reference to financial impact. At merchant911.org, I preach to our members that it's cheaper to ignore a good order than to ship a bad one. I'm wondering if a similar thought process should be part of the false positive problem. While a good fraud investigator will certainly be able to rely on instinct, patterns, and all the rest, there are those times when we should weigh the cost of the investigative time against the potential gain or loss and make a final decision based on that. Tom Mahoney, Director Merchant911.org "