Predictive Threat and Fraud AnalyticsKeith Doan and Shaun Barry
November 2012
© 2012 IBM Corporation
Building a smarter planetAgenda
1. Threat and Fraud Problems
2. Predictive Analytics approach
3. IBM SPSS Predictive Capabilities
4. IBM SPSS Predictive Analytics in Action:
– Detect Insurance Claim Fraud
– Prevent Insider Threat
5. IBM Smarter Analytics Signature Solution
6. Summary
© 2012 IBM Corporation
Building a smarter planet
A smarter planet creates new opportunities but also new risks
The planet is becoming more
instrumented, interconnected and intelligent.
“We have seen more change in the last 10
years than in the previous 90.”
Ad J. Scheepbouwer,CEO, KPN Telecom
New possibilities
New complexities
New risksCritical
infrastructureprotection
New and emerging
risks
Protection against Fraud
© 2012 IBM Corporation
Building a smarter planet
Organisations are facing multitude of threat and fraud
© 2012 IBM Corporation
Building a smarter planetProtecting IT infrastructure is critical
Market Changes and Challenges
Criticalinfrastructure
protection
© 2012 IBM Corporation
Building a smarter planetFraud is expensive and becoming more widespread
Protection against Fraud
Organisations lose an estimated 5% of their revenue to fraud each
year…resulted in a projected global fraud loss of more than $3.5 trillions2
Fraud is difficult to measure … only reflect fraud that has been reported
1. Global Risk Study
2. 2012 Global Fraud Study, Association of
Certified Fraud Examiner
When is a fraud incident involving your
organisation usually detected?
© 2012 IBM Corporation
Building a smarter planetFraud is everywhere
© 2012 IBM Corporation
Building a smarter planetToday‟s environment is constantly introducing new and
emergence risks
New and emerging
risks
© 2012 IBM Corporation
Building a smarter planetAgenda
1. Threat and Fraud Problems
2. Predictive Analytics approach
3. IBM SPSS Predictive Capabilities
4. IBM SPSS Predictive Analytics in Action:
– Detect Insurance Claim Fraud
– Prevent Threat
5. IBM Smarter Analytics Signature Solution
6. Summary
© 2012 IBM Corporation
Building a smarter planet
Managing threat and fraud is a balancing act
© 2012 IBM Corporation
Building a smarter planetA Predictive Approach to Threat and Fraud
© 2012 IBM Corporation
Building a smarter planetAgenda
1. Threat and Fraud Problems
2. Predictive Analytics approach
3. IBM SPSS Predictive Capabilities
4. IBM SPSS Predictive Analytics in Action:
– Detect Insurance Claim Fraud
– Prevent Threat
5. IBM Smarter Analytics Signature Solution
6. Summary
© 2012 IBM Corporation
Building a smarter planetCapabilities to combat diversity of Threat and Fraud
Identity ResolutionResolves identities across transactions
Identifies relationships across entities
Business RulesIndustry specific rules
Business specific rules
Predictive ModelsFind Threat and Fraud patterns in the data
Text mining uncovers insights from notes
Anomaly DetectionCompares against normal behaviour within segment
Identified new and emergence fraud patterns
Threat and Fraud InsightMonitor metrics ensures performance
Provide insights to front-line managers and executives
Entity Analytics/ Network
Analysis
Rule Management
Predictive Modelling
Anomaly Detection
Close Loop AnalysisScoring, Reporting/Dashboard,
Model Management
© 2012 IBM Corporation
Building a smarter planetEvolutionary solutions
© 2012 IBM Corporation
Building a smarter planetIntroduction to SPSS Predictive Analytics portfolio
Collaboration and Deployment Services
CCI
Data Collection
ModelerDecision
ManagementStatistics
Transactions
Demographics
Interactions
Opinions
Predictive Modeling
Data Mining
Text Analytics
Social Network Analysis
Statistical Analysis
Prediction
Rules
Optimisation
Process
© 2012 IBM Corporation
Building a smarter planetAlign: Data at the heart of Predictive Analytics
Behavioral data- Orders- Transactions- Payment history- Usage history
Descriptive data- Attributes- Characteristics- Self-declared info- (Geo)demographics
Attitudinal data- Opinions- Preferences- Needs & Desires- Survey results- Social Network Data
Interaction data- E-Mail / chat transcripts- Call center notes - Web Click-streams- In person dialogues
“Traditional”
High-value, dynamic
- source of competitive differentiation
CCI
Data Collection
Text Mining
© 2012 IBM Corporation
Building a smarter planetAnticipate: Statistical Analysis and Data Mining
Statistics
Modeler
© 2012 IBM Corporation
Building a smarter planetIBM SPSS Statistics enables accuracy and confidence
Statistics
© 2012 IBM Corporation
Building a smarter planetSensitivity Analysis with Monte Carlo Simulation
Statistics
© 2012 IBM Corporation
Building a smarter planetSPSS Modeler – Data mining workbench
Easy to learn: requires no programming using intuitive graphical interface
– Allows analytics to be repeated and integrated within business systems
High productivity with powerful Automated Modelling:
– Automatically create accurate, deployable predictive models
– Choose the best solution with multi- model evaluation
High performance data mining and text analytics workbench
Modeler
© 2012 IBM Corporation
Building a smarter planet
AssociationSegmentation
Comprehensive Data Mining Techniques
Classification
Text MiningEntity Analytics Time series
Social Network Analysis
Modeler
© 2012 IBM Corporation
Building a smarter planet
Technique Usage Algorithms
Classification
(or prediction)
• Used to predict if a new transaction is
fraudulent?
• Auto Classifiers,
Decision Trees,
Logistic, SVM, Time
Series, etc.
SPSS Modeler - Data mining techniques
Known normal cases
Known fraudulentcases
All casesFraud Patterns
© 2012 IBM Corporation
Building a smarter planetClassification uncovers Fraud Patterns
© 2012 IBM Corporation
Building a smarter planet
Technique Usage Algorithms
Classification
(or prediction)
• Used to predict if a new transaction is
fraudulent?
• Auto Classifiers,
Decision Trees,
Logistic, SVM, Time
Series, etc.
Segmentation • Used to identify groups of similar cases
and cases that appear unusual
• Auto Clustering, K-
means, Two-Step,
Kohonen
• Anomaly detection
SPSS Modeler - Data mining techniques
Segmentation
© 2012 IBM Corporation
Building a smarter planet
Anomaly Detection – Finding Suspicious behaviour
© 2012 IBM Corporation
Building a smarter planet
Technique Usage Algorithms
Classification
(or prediction)
• Used to predict if a new transaction is
fraudulent?
• Auto Classifiers,
Decision Trees,
Logistic, SVM, Time
Series, etc.
Segmentation • Used to identify groups of similar cases
and cases that appear unusual
• Auto Clustering, K-
means, Two-Step,
Kohonen
• Anomaly detection
Association • Used to find events that occur together
or in a sequence
• APRIORI, Carma,
Sequence
SPSS Modeler - Data mining techniques
© 2012 IBM Corporation
Building a smarter planet
An example of using Association for Fraud Detection
Healthcare Billing Fraud
Cardio
Orthopedic
Neuro
Discover entities or events
that occur coincidentally
© 2012 IBM Corporation
Building a smarter planetSPSS Modeler - Time-series analysis to visualise future
behaviour
Forecast future data points using seasonality, one-time occurrences, interventions or changes in expectations
ARIMA (Auto-Regressive Integrated Moving Average) model accounts for various factors, such as seasonal usage patterns and outliers
© 2012 IBM Corporation
Building a smarter planet
SPSS Modeler - Text Mining
Broaden the Perspective
– Mine unstructured data, regardless of source
Extract Relevant Data
– Natural Language Processing
– Concepts, Categories, and Relationships
– Combination of automated and customized extraction
Integrate Extracted Data
– Combine narratives with numbers
– Deeper understanding
29
© 2012 IBM Corporation
Building a smarter planetSPSS Modeler - Entity Analytics
Useful for many applications:
– Fraud:
Is this the same person who already defaulted on a loan?
– Government:
Is this the same person / car that was suspicious before?
Is this voter deceased and still voting?
– Business:
How do I match external data with current customer records?
How can I determine if an account / individual is the same across my
multiple data sources?
30
© 2012 IBM Corporation
Building a smarter planet
Entity Analytics Overview
Entity Analytics functionality robust and developed over many years
– Includes GNR (Global Name Recognition) – database of different
permutations of the same name (i.e. Bob = Robert = Bobby)
– Can define level of accuracy – more or less aggressive based on
business need
– Default config comes with many features pre-mapped based on
years of experience
I.e. driver licence, phone, birthdate, etc
Cleaner data for Modeling = Accuracy!
– 5 people or 1 person represented 5 ways?
31
© 2012 IBM Corporation
Building a smarter planetSimple Illustration
32
FName LName Addr1 Addr2 ZipCode ... Entity ID
Alan Alberts 923 West
Road
Anytown ... 831939
Al Alberts 12 North
Road
Anytown ... ... 412052
Albert Alberts Snigsfoot
Cottage,
North
Road
Anytown ... ... 412052
Dorothy Alberts 7 Main Sq Anytown ... ... 112343
... ... ... ... ... ... ...
Match
© 2012 IBM Corporation
Building a smarter planet
Business Rules
Predictive
Analytics
Simulation/
Optimisation
Optimised Decisions
Access to All Data
Act: IBM Analytical Decision Management
MonitoringScoring
Decision Management
© 2012 IBM Corporation
Building a smarter planet
34
Act: SPSS Collaboration & Deployment Services
© 2012 IBM Corporation
Building a smarter planetAgenda
1. Threat and Fraud Problems
2. Predictive Analytics approach
3. IBM SPSS Predictive Capabilities
4. IBM SPSS Predictive Analytics in Action:
– Detect Insurance Claim Fraud
– Prevent Threat
5. IBM Smarter Analytics Signature Solution
6. Summary
© 2012 IBM Corporation
Building a smarter planet
Challenge
Santam was losing millions of dollars paying out fraudulent claims every year.
Low customer satisfaction due to higher premiums and longer waits to settle legitimate claims
Santam InsuranceCatch fraud early in the claim process
Results
Identified a major fraud ring in less than 30 days after implementation
Saved more than $2.5 million on fraudulent claims in the first 6 months
Speed of claim handling from 3 days to an hour to settle claims
Solution
Through predictive modelling they spot suspicious claims early to expedite legitimate claims
Claims are continuously analysed and scored during the process
Reduce false positives to reduce claim investigation
© 2012 IBM Corporation
Building a smarter planet
37
Apply Predictive Modelling in Claim Fraud Assessment
All claims
Referred claims
Business rules: more claims get referred
Predictive Analytics: find fraud patterns
Denied claims
Anomaly Detection:find emerging forms of fraud
Predictive Analytics:reduce false positives
© 2012 IBM Corporation
Building a smarter planet
Next Best Action: Pro-active and real-time
Level Points
Low Risk > -5
Medium Risk > +1
High Risk > +8
Predictive Analytics
Rules
Structured, Unstructured, Social Media & Business Intelligence Data
Simulation & Optimisation
Scoring
Front-line Rep only sees “Refer” at the point of impact
© 2012 IBM Corporation
Building a smarter planet
Local rules drive governance, input, and a critical link to strategy
Decision ManagementModeler Statistics
Collaboration and Deployment Services
CCIData Collection
The types of questions asked are driven by the rules that help govern answers, decisions, and recommendations
© 2012 IBM Corporation
Building a smarter planetPredictive analytics leverages the likely state, status, or action to
enable answers, decisions, recommendations
Decision MgmtModeler Statistics
Collaboration and Deployment Services
CCIData Collection
Responses create the data that are used to create a predicted score of fraud
© 2012 IBM Corporation
Building a smarter planetDecision Management drives the answer to the point of impact and
recommends an action, consistent with organizational strategy
Decision MgmtModeler Statistics
Collaboration and Deployment Services
CCIData Collection
SPSS Decision Management adjudicates the predictive models, local rules, scoring, and optimisation to provide a scored answer/decision
© 2012 IBM Corporation
Building a smarter planetThe feedback loops enables an ongoing link from the execution of
decisions to strategy
Decision MgmtModeler Statistics
Collaboration and Deployment Services
CCIData Collection
© 2012 IBM Corporation
Building a smarter planet
Insurance Claim Assessment Workflow
© 2012 IBM Corporation
Building a smarter planet
© 2012 IBM Corporation
Building a smarter planet
© 2012 IBM Corporation
Building a smarter planet
© 2012 IBM Corporation
Building a smarter planet
© 2012 IBM Corporation
Building a smarter planet
© 2012 IBM Corporation
Building a smarter planet
© 2012 IBM Corporation
Building a smarter planet
© 2012 IBM Corporation
Building a smarter planet
© 2012 IBM Corporation
Building a smarter planet
© 2012 IBM Corporation
Building a smarter planet
© 2012 IBM Corporation
Building a smarter planet
© 2012 IBM Corporation
Building a smarter planet
© 2012 IBM Corporation
Building a smarter planet
© 2012 IBM Corporation
Building a smarter planetAgenda
1. Threat and Fraud Problems
2. Predictive Analytics approach
3. IBM SPSS Predictive Capabilities
4. IBM SPSS Predictive Analytics in Action:
– Detect Insurance Claim Fraud
– Prevent Threat
5. IBM Smarter Analytics Signature Solution
6. Summary
© 2012 IBM Corporation
Building a smarter planet
Challenge
Uncover security threats in time to take action against them
Deal with several million events per day, most of them are legitimate activities
Malicious insiders have had a devastating impact
A Government AgencyInsider threat prevention
Solution
Through predictive modelling, built filters that automatically remove:
o Irrelevant events
o Events likely to be False Alarm vs. All Others
Identify unusual behaviours
Results
A 97% reduction in alarms to be manually reviewed!
Detection rate of 91%
© 2012 IBM Corporation
Building a smarter planetDealing with data challenges
59
© 2012 IBM Corporation
Building a smarter planet
Disparate data sources are
merged/appended
Subject matter and sentiment are
extracted from unstructured data
sources
New fields are created and
existing fields are normalised
across all data sources
60
Data Transformation
© 2012 IBM Corporation
Building a smarter planetDetermining what is “normal”?
© 2012 IBM Corporation
Building a smarter planetSolution for insight: monitoring and detecting anomalies
© 2012 IBM Corporation
Building a smarter planetUncover the characteristics of risk profiles
Classification approach results in a model that can be used to score other data environments for other instances
of the profile.
© 2012 IBM Corporation
Building a smarter planet
A Nearest Neighbor and CorrespondenceAnalysis approach can be used to very
quickly identify other data points that closely resemble a person of interest.
Who else looks similar?
© 2012 IBM Corporation
Building a smarter planet
Detect Healthcare Fraud
Payment Collection
Anti-money Laundering
Detect Welfare Fraud
Protect National Border
Maximise Tax Revenue
Assess Network Outages
Manage Inventory Loss
Manage Liquidity Risk
A National Customs Border Agency
Other Threat and Fraud applications
A Southern European Agency
© 2012 IBM Corporation
Building a smarter planetAgenda
1. Threat and Fraud Problems
2. Predictive Analytics approach
3. IBM SPSS Predictive Capabilities
4. IBM SPSS Predictive Analytics in Action:
– Detect Insurance Claim Fraud
– Prevent Threat
5. IBM Smarter Analytics Signature Solution
6. Summary
© 2012 IBM Corporation
Building a smarter planetFraud and abuse is fundamentally a problem of analytics: IBM is
uniquely positioned to tackle fraud analytics
Manage Enterprise Business Processes
IBM Fraud Business Architecture
Manage Workload
Manage Domain Data
Detect Transactions
Identify leads
Process referrals
Create models
Execute models
Evaluate Workload
Screen leads
Select leads
Prioritize cases
Report Results
Measure success
Broadcast results
Enforce „Compliance Plan‟
Identify Vulnerabilities
Identify schemes
Estimate exposure
Probe weakness
Assign cases
Work cases
Process appeals
Conduct Remediation
Manage Enterprise Business Processes
IBM Fraud Business Architecture
Manage Workload
Manage Domain Data
Detect Transactions
Identify leads
Process referrals
Create models
Execute models
Evaluate Workload
Screen leads
Select leads
Prioritize cases
Report Results
Measure success
Broadcast results
Enforce „Compliance Plan‟
Identify Vulnerabilities
Identify schemes
Estimate exposure
Probe weakness
Assign cases
Work cases
Process appeals
Conduct Remediation
Detect Transactions
Identify leads
Process referrals
Create models
Execute models
Detect Transactions
Identify leads
Process referrals
Create models
Execute models
Evaluate Workload
Screen leads
Select leads
Prioritize cases
Evaluate Workload
Screen leads
Select leads
Prioritize cases
Report Results
Measure success
Broadcast results
Enforce „Compliance Plan‟
Report Results
Measure success
Broadcast results
Enforce „Compliance Plan‟
Identify Vulnerabilities
Identify schemes
Estimate exposure
Probe weakness
Identify Vulnerabilities
Identify schemes
Estimate exposure
Probe weakness
Assign cases
Work cases
Process appeals
Conduct Remediation
Assign cases
Work cases
Process appeals
Conduct Remediation
© 2012 IBM Corporation
Building a smarter planet
© 2012 IBM Corporation
Building a smarter planet
Applying Smarter Analytics: Aetna
Finding #1: Predictive models will substantially lower Aetna‟s false positive rate for
prepayment claims review:
– We achieved the following false positive improvement results:
Durable Medical Equipment: 79% » 29% (64% improvement)
Anesthesia and Pain Management: 68% » 46% (32% improvement)
Home Health Care: 31% » 7% (79% improvement)
– In 4Q2011, Aetna could have reviewed 4,000 fewer claims yet stopped the same number of dollars.
Finding #2: Aetna appears to be leaving a lot of highly suspicious claims un-reviewed.
– Finding #2a: There are many claims that look like the validated „bad‟ claims that Aetna‟s current
method is not flagging. We‟ve identified 59,000 such claims.
– Finding #2b: There are numerous claim areas (procedure types) in which we see high dollars paid but
unusually low fraud rates.
© 2012 IBM Corporation
Building a smarter planetApplying Smarter Analytics: New Jersey Department of the Treasury
Denied more than $60 million in fraudulent tax refunds in 6 months
Findings:
– Preparers submit multiple returns with same financial data
– Underreporting and over-reporting income to maximize credit
– Use of dependent SSN‟s from other states/territories
Taxpayer response:
– Lots of phone calls; few appeals
– Fewer returns with refund claims in March (compared to previous
year)
– Analyzing data to see if tax preparers are shifting to abuse
other tax credits
© 2012 IBM Corporation
Building a smarter planetAgenda
1. Threat and Fraud Problems
2. Predictive Analytics approach
3. IBM SPSS Predictive Capabilities
4. IBM SPSS Predictive Analytics in Action:
– Detect Insurance Claim Fraud
– Prevent Threat
5. IBM Smarter Analytics Signature Solution
6. Summary
© 2012 IBM Corporation
Building a smarter planetEnd to End Threat and Fraud Analytics
Support organisations with predictive
capabilities to address a diverse range of
Threat and Fraud problems
IBM SPSS Predictive Analytics is easy to use
Short timeframe to be productive with
actionable results
Business results focused
Cost effective solution that delivers powerful
results across organisation
IBM is uniquely positioned to tackle threat and
fraud analytics with IBM Smarter Analytics
Signature Solution
Top Related