Internal Fraud Value Paradox
4 comment(s)
As most bankers know, a business case with a strong return on investment is crucial when implementing a new fraud prevention strategy or system. With most types of fraud, this is fairly straight forward but not when you consider insider fraud.
As other posts on Bank Fraud Forum have pointed out, many institutions don't do a good job of admitting they have an internal fraud problem. One of the major problems is that many internal frauds are classified as external because institutions are unable to identify the insider collusion. The result is that insider fraud losses are underestimated, so the business case is tough from the outset. Projecting costs is still fairly straight forward, but the biggest challenge is yet to come - the "value paradox".
Once you've implemented an insider fraud solution, the next step is to measure the results and ensure you are achieving the forecast in your original business case. This is where the "value paradox" raises its ugly head. One of the keys to successfully mitigating insider fraud is to catch it early. The goal is to detect the fraud much earlier in the cycle to prevent incurring an extremely large loss. Once you've implemented a solution, you can achieve that goal. But, at that point, how do you quantify the loss avoidance associated with that early detection? How do you validate you are achieving the results you originally forecasted? There are many opinions on this topic, but no industry standards currently exist to quantify loss avoidance for insider fraud, so there is little consistency. If you insist that the value of the system is limited to the small amount stolen (due to early detection), the solution may appear to be doing an extremely poor job.
Let's say pre-solution, you had a number of employees who were refunding fees to accounts they controlled (whether or not the fees were actually incurred). It was not unusual for some employees to steal hundreds or thousands of dollars from the bank before being caught. After implementing the solution, employees are routinely detected after only one or two fraudulent refund occurrences. So, what is the value of the detection? Many will argue it is $25, $39, $90 or whatever the amount of the fee that was refunded. Using this logic, it is clear you could never justify continuing to use a very successful solution because no value is assigned to the timely detection of the dishonest employee. In other words, no value is awarded to recognize that the behavior that was quickly shut down would have continued without the solution. What a paradox!
Here's another shocker from institutions with whom I've worked; some bankers seem to honestly believe there is no value in detecting employees who are surfing customer data and confess to providing the data to external fraud rings. Granted, there may not be an immediate, quantifiable dollar loss associated with this activity, but to say there is no value in detecting and stopping this behavior? I am amazed" Certainly, losses will result at some point in the future due to the fraud rings having this data, although it is admittedly difficult to agree upon a precise measurement. Again, the value paradox raises its ugly head as one more challenge fraud professionals must manage in their efforts to fight fraud on behalf of their financial institution.
The value paradox must be addressed in order to justify fighting insider fraud and to measure the results you achieve in a logical, meaningful, way. The good news is that the American Bankers Association has agreed to work with a committee of bankers to define standard industry measurements for various types of insider fraud. It is critical this group understand and address the value paradox if they are to be successful.
What is your reaction? Is the value paradox an issue within your institution or does management fully understand and appreciate this challenge?