Employee Fraud Detection Under Real World Conditions
Total Page:16
File Type:pdf, Size:1020Kb
Zurich Open Repository and Archive University of Zurich Main Library Strickhofstrasse 39 CH-8057 Zurich www.zora.uzh.ch Year: 2010 Employee fraud detection under real world conditions Luell, J Abstract: Employee fraud in financial institutions is a considerable monetary and reputational risk. Stud- ies state that this type of fraud is typically detected by a tip, in the worst case from affected customers, which is fatal in terms of reputation. Consequently, there is a high motivation to improve analytic de- tection. We analyze the problem of client advisor fraud in a major financial institution and find that it differs substantially from other types of fraud. However, internal fraud at the employee level receives little attention in research. In this thesis, we provide an overview of fraud detection research with the focus on implicit assumptions and applicability. We propose a decision framework to find adequate fraud detection approaches for real world problems based on a number of defined characteristics. By applying the decision framework to the problem setting we met at Alphafin the chosen approach is motivated. The proposed system consists of a detection component and a visualization component. A number of imple- mentations for the detection component with a focus on tempo-relational pattern matching is discussed. The visualization component, which was converted to productive software at Alphafin in the course of the collaboration, is introduced. On the basis of three case studies we demonstrate the potential of the proposed system and discuss findings and possible extensions for further refinements. Posted at the Zurich Open Repository and Archive, University of Zurich ZORA URL: https://doi.org/10.5167/uzh-44863 Dissertation Originally published at: Luell, J. Employee fraud detection under real world conditions. 2010, University of Zurich, Faculty of Economics. Employee Fraud Detection under Real World Conditions DOCTORAL THESIS FOR THE DEGREE OF A DOCTOR OF INFORMATICS AT THE FACULTY OF ECONOMICS, BUSINESS ADMINISTRATION AND INFORMATION TECHNOLOGY OF THE UNIVERSITY OF ZURICH by JONAS LUELL from SWITZERLAND Accepted on the recommendation of Prof. Dr. A. Bernstein Prof. Dr. H. Geiger 2010 The Faculty of Economics, Business Administration and Information Technology of the Univeristy of Zurich herewith permits the publication of the aforementioned dissertation without expressing any opinion on the views contained therein. Zurich, April 14. 2010 The Vice Dean of the Academic Program in Informatics: Prof. Dr. H. C. Gall Acknowledgements As no one reads the acknowledgements unless they are very short: Thanks to everyone who supported me, at the university, at the collaborating financial institute, and last but not least at home. Avi, Jiwen (and everyone else in the research group), Eva, Ueli, Susi, Claudia.... : Thank you for giving me this opportunity! I dedicate this thesis to my dad. ii Abstract Employee fraud in financial institutions is a considerable monetary and reputational risk. Studies state that this type of fraud is typically detected by a tip, in the worst case from affected customers, which is fatal in terms of reputation. Consequently, there is a high motivation to improve analytic detection. We analyze the problem of client advisor fraud in a major financial institution and find that it differs substantially from other types of fraud. However, internal fraud at the employee level receives little attention in research. In this thesis, we provide an overview of fraud detection research with the focus on implicit assumptions and applicability. We propose a decision frame- work to find adequate fraud detection approaches for real world problems based on a number of defined characteristics. By applying the decision framework to the problem setting we met at Alphafin the chosen approach is motivated. The proposed system consists of a detection compo- nent and a visualization component. A number of implementations for the detection component with a focus on tempo-relational pattern matching is discussed. The visualization component, which was converted to productive software at Alphafin in the course of the collaboration, is in- troduced. On the basis of three case studies we demonstrate the potential of the proposed system and discuss findings and possible extensions for further refinements. Contents Contents iii 1 Introduction 1 1.1 Motivation .......................................... 3 1.2 Problem Definition ..................................... 5 1.3 Hypothesis .......................................... 7 1.4 Approach Overview .................................... 8 1.5 Contributions ........................................ 9 1.6 Organization ......................................... 10 2 Fundamentals, Premises and Related Work 11 2.1 Fundamentals in Risk and Compliance .......................... 11 2.1.1 Internal Fraud .................................... 15 2.1.2 Internal Fraud at Alphafin ............................. 20 2.1.3 Compliance ..................................... 27 2.1.4 Money Laundering ................................. 27 2.1.5 Other Types of External Fraud .......................... 28 2.1.6 Countermeasures .................................. 28 2.2 Fundamentals of Data Mining ............................... 29 2.3 Related Work ........................................ 32 2.3.1 Classifying Related Work: Prior Knowledge Levels . 32 2.3.2 Fraud Detection Based on Very Low Prior Knowledge . 36 iv CONTENTS 2.3.3 Fraud Detection Based on Prior Identification Knowledge . 39 2.3.4 Excursus: Relation Based Approaches ...................... 42 2.3.5 Fraud Detection Based on Prior Model Knowledge . 48 2.3.6 Visual Data Mining ................................. 55 2.4 Fraud Detection Approaches — A Unifying Framework . 56 2.4.1 Basic Preconditions ................................. 57 2.4.2 Company Factors .................................. 58 2.4.3 Fraud factors .................................... 61 2.4.4 Population Factors ................................. 63 2.4.5 Conclusion ..................................... 64 2.4.6 Applying The Framework To Our Project .................... 67 3 Solution Approaches 71 3.1 The Visualization Component ............................... 71 3.1.1 Justification ..................................... 71 3.1.2 Main Requirements ................................. 72 3.1.3 System Description ................................. 73 3.1.4 The Network View ................................. 73 3.1.5 The Timeline View ................................. 76 3.1.6 The Tabular View .................................. 76 3.1.7 View Editing and Consistency .......................... 76 3.1.8 Pattern Annotation ................................. 79 3.2 The Detection Component ................................. 81 3.2.1 The ChainFinder .................................. 81 3.2.2 Excursus: An Alternative Idea - The GraphSlider . 90 3.2.3 The Transaction Matcher (TMatch) ........................ 92 4 Application and Evaluation 101 4.1 Application Considerations ................................ 101 4.2 The Data Set ......................................... 104 4.3 Case Study I: Internal Fraud Analysis . 106 CONTENTS v 4.3.1 Evaluation Goals .................................. 106 4.3.2 Data Basis and Configuration . 107 4.3.3 Commonness of Chain Structures . 108 4.3.4 Identification of a Reference Fraud Case . 112 4.3.5 Evaluation Efficiency ................................ 112 4.3.6 Example Investigation ............................... 113 4.4 Case Studies II and III: AML/ Compliance Analysis . 116 4.4.1 Case Study II .................................... 118 4.4.2 Case Study III .................................... 124 4.4.3 Discussion ...................................... 128 4.5 Synthetic data evaluation ................................. 133 4.5.1 Criticism ....................................... 133 4.5.2 ChainFinder Runtime Evaluation . 135 4.5.3 TMatch Runtime Evaluation . 135 5 Future Work 139 5.1 Extended TVIS User Group Customization . 139 5.2 Automated Exclusivity Scoring .............................. 139 5.3 Structural Peer Group Analysis .............................. 140 5.4 Connection Probability ................................... 141 6 Limitations and Conclusions 143 6.1 Limitations .......................................... 143 6.2 Conclusions ......................................... 144 A Implementation 145 A.1 TVIS Implementation .................................... 145 A.2 ChainFinder Implementation ............................... 145 A.2.1 Java Implementation ................................ 145 A.2.2 SQL Implementation ................................ 148 A.3 TMatch Implementation .................................. 148 A.4 TMatch Graphical User Interface ............................. 149 vi CONTENTS A.5 Example TMatch Score Results .............................. 153 List of Figures 157 List of Tables 159 Bibliography 161 B Curriculum Vitae 173 1 Introduction This thesis studies the application of data mining and graph pattern matching techniques in com- pliance and risk related topics within a financial institution. The main focus lies on internal or employee fraud. Based on the findings, solutions to practical challenges in this problem field are proposed. A detection system, which has shown its potential under real world conditions, is introduced. The research background originates from a collaboration with a major financial institution. To simplify matters, the collaborating company is