In previous posts, we have discussed data in terms of its value and its characteristics. In those posts we have touched on data management, but I’d like to focus on it more. Mike Braatz characterized data as the bedrock of “enterprise software in general, and fraud prevention in particular”. If data is the bedrock, then data management is the foundation.
Mike also pointed out that every detection technique relies on good data and the more complete and contextual the data the more techniques can be fully supported. The responses to the posts were interesting as well, making points like, “There now needs to be a marriage of out of the box solutions with a flexible framework to allow you to adjust to the environment.” Which very succinctly recognizes the yin and yang of data management; getting the data is only half the battle, you’ve got to be able to efficiently access it in a way that allows you to do something with it. Another response makes a similar point, “Data does matter indeed. Size matters too! Even if you have the Data, if you are unable to scale dynamically, you’re no better off.” In this case the author brings up the point of volume, and by my reading, its impact on the ability to use the data.
Many data management solutions I’ve seen try to solve the volume problem by being selective about the data they take from the original source or modifying that data in some way like summarizing, aggregating, and other methods that change it from its original form.
The limitation with this approach is that you lose something. You lose either the data itself because you didn’t take it all, or you lose part of the character of the data like relationships between elements and records that only come to light in the original form. So there’s the conundrum. (Don’t you love conundrums? Life would be pretty dull without them.) How do I get everything I want and still be able to manage and use it efficiently?
We might learn something from the Internet here. On the internet, data is stored literally all over the world in a variety of formats, and yet we can find it and access it in a matter of seconds. How do they do that? Now I’m not a technician, and those of you who are will probably roll your eyes at this next statement, but the way I look at it traditional database technology is all about storing data, and search engine technology is all about retrieving it wherever and however it is stored. If I had lots and lots of data, I’d put my money on the second horse. Store it simply and economically, and retrieve it quickly and efficiently.
If you’ve got two cents to spare, please give it to me. One of the objectives of this blog is to stimulate discussion. If I had a nickel for every two cents worth I’ve seen here (save our own), I still wouldn’t be able to buy my favorite frappachino at Starbucks. So if you have a thought (even if you think it’s mundane, someone else might have an epiphany from it) please chip in. Sharing is caring.
Peer Comments
Richard Fowler says:
With all due respect to Mr. Braatz, data cannot be the bedrock of fraud prevention. For example, one of the most common frauds is asset misappropriation, and data mining is not the most efficient way for this fraud to be prevented (or detected). Having access to more data does not aid in fraud prevention at all, since all data can do is record what has already transpired. Now, if we look into fraud detection (rather than prevention), we may be able to utilize data to aid the effort—but even then, we need to know first what fraud schemes we are seeking. There is no data query that states “Select all where Fraud = Yes”. Each fraud scheme has its own markers, so each has to be sought individually. And then, each indication has to be investigated since the data alone cannot distinguish between fraud and an honest mistake.
I’m not saying that data management is not important, because it is. I’m just saying that it is not the most critical element of fraud detection, and has nothing to do with fraud prevention.
posted Tue Feb 2, 2010 at 09:58 am
Mike Braatz says:
Richard – Thanks for sharing your thoughts, and adding to the discussion.
I believe that fraud detection and prevention require a multi-layered approach – data, analytics, decision-making, investigations and experience are some of those layers. I didn’t intend to imply that data is the most critical thing, or that data mining was the silver bullet solution to all fraud schemes. I did, however, propose that data is the bedrock – the bottom layer, a sound foundation supporting all of the other layers.
You make a useful distinction between prevention and detection. And while I agree that they are different, and can be achieved in different ways, they are related. I still believe that good data CAN aid in the prevention of many fraud schemes. Rich contextual data, combined with knowledge of specific schemes and ideas about what constitutes risky and/or abnormal behavior, enables us to assess risk in a systematic way. The ability to know – in advance – the relative risk of accounts, customers, employees and other stakeholders allows us to monitor those entities in a more targeted, intelligent manner based on the nature of the risk. More targeted monitoring enables earlier and more accurate detection, and in many cases, prevention altogether.
Finally, just as a point of clarification, I offered no opinion on what I think is the most important element of fraud detection. My answer would be the dreaded “it depends” (on the scheme, situation, institution, etc.). But I am curious to know if you are willing to offer an opinion.
posted Wed Feb 3, 2010 at 04:51 pm
Mike Mulholand says:
Richard,
Thanks so much for commenting on this post. On the bedrock issue, I would agree that it would have been better if Mike had said detection instead of prevention, but it does raise an interesting topic. Detection vs. prevention has long been a topic of discussion. The root of the answer to the debate may be what are you preventing; the fraud act or the fraud loss? Like the tree falling in the forest, the hypothetical question is: If a fraudulent act does not cause a loss, is it fraudulent? Philosophically, I think all would agree that the answer is yes. From that standpoint you are exactly correct, Richard. No information we acquire or action we take after-the-fact can prevent the fraudulent act. But we can prevent the loss depending on the timeline for value transfer, which is different for different types of transactions. In that sense, timely detection is (or facilitates) prevention.
I see detection and prevention as closely related in another way as well. The best prevention of course comes from eliminating the vulnerabilities in the products and payments mechanisms they utilize in the first place. Even there detection plays a part by uncovering those vulnerabilities through the detection and investigation process. One of my other posts has been about having fraud prevention (or should I say loss prevention) folks involved in product development and marketing. Then they could truly be fraud prevention because they can point out the vulnerabilities and eliminate them or at lest prepare for them up front.
I also like your recognition of the fact that there are many elements of fraud detection, and none of them alone is the answer. I think what Mike was getting at was the relationship between those elements. When we begin the installation process, the first thing we talk about is not data; it’s the fraud schemes being perpetrated against the institution. By understanding that and the markers associated with them we can identify the data we need to detect them. This brings up another point I made in the post, that where data is concerned more is better. You don’t know what markers you will be looking for a month, six months, or a year from now. For me, the bottom line is if I have all of the other elements associated with detectiing fraud, but no data, I’m not going to do anything. Data is the underlying element that supports everything else you do. Thanks again, I love the discussion. Your two cents is worth a million.
posted Thu Feb 4, 2010 at 01:29 pm