Using Big Data Analytics to Fight Identity Fraud

Primary IDA Color Palette Secondary Color Palette - Medium

R122 R247 R0 R0 R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Using Big Data Analytics Gray Orange Navy Blue Blue

R106 R84 R102 R191 R42 R147 R165 R216 G154 G148 G49 G191 to Fight Identity Fraud G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216

Light Blue Green Purple Light Gray Light Blue Green Purple Light Gray Dr. Stephen Coggeshall Chief Analytics and Science Officer ID Analytics/Lifelock

2nd Workshop of Mission-Critical Big Data Analytics Prairie View, May 16,17

R122 R247 R0 R0 Outline R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue • All about identity fraud

R106 R84 R102 R191 – modes R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216 – examples Light Blue Green Purple Light Gray Light Blue Green Purple Light Gray

• Using big data analytics to catch identity fraud – a look into our technology

© 2017 ID Analytics, Inc. Confidential 2 One column Primary IDA Color Palette Secondary Color Palette - Medium ID Analytics Overview R122 R247 R0 R0 R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 ID Analytics applies advanced analytics to a unique sources of U.S. identity data, B157 B119 B255 B218

Gray Orange Navy Blue Blue solving critical fraud, identity and credit challenges Gray Orange Navy Blue Blue

R106 R84 R102 R191 R42 R147 R165 R216 G154 G148 G49 G191 • Founded in San Diego, CA in 2002 G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216 • Bought by Lifelock 2012, Symantec 2017 Light Blue Green Purple Light Gray Light Blue Green Purple Light Gray • Focused on empowering leading organizations to make better fraud, credit and identity risk decisions • Over 450 leading U.S. enterprises rely on ID Analytics solutions every day… - 7 of the top 10 financial institutions - 4 of the top 5 wireless carriers - Government agencies: Social Security Administration and Veterans Affairs

R122 R247 R0 R0 What Is Identity Fraud R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue Identity Fraud is the act of

R106 R84 R102 R191 misrepresenting which person you are R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216

Light Blue Green Purple Light Gray Light Blue Green Purple Light Gray Why is it done? • To improperly get products or services (financial services, consumer products…) • To stay “unidentified” while behaving badly (money laundering, terrorists…)

R122 R247 R0 R0 Ways to Classify Identity Fraud R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue Classify by Classify by

R106 R84 R102 R191 Industry/Target Method Used R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216

Light Blue Green Purple Light Gray • Financial identity fraud • Identity Theft Light Blue Green Purple Light Gray ̶ Account openings • Identity Manipulation ̶ Account takeover • Synthetic Identity • Health care id fraud • Tax id fraud • Money laundering • Terrorist activity • …

R122 R247 R0 R0 Three Types of Identity Fraud R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue Who is Nature of the

R106 R84 R102 R191 the victim? misrepresentation R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 B63 B255 B129 B206 B216 B194 B144 B191 Identity Theft • Owner of misused • SSN, name and date of

Light Blue Green Purple Light Gray Core identity: identity birth belong to the Light Blue Green Purple Light Gray Victim • The company victim providing product/ • Address, phone, and/or service email belong to fraudster

Identity • Fraudster • SSN, date of birth and/ Manipulation or name vary slightly • The company Core identity: from the fraudster’s providing product/ Fraudster own, correct information service

Synthetic • No direct consumer • SSN, name and date of Identity victim birth are fabricated or Core identity: chosen randomly • The company None providing product/ service

R122 R247 R0 R0 We All Know About Identity Theft R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue • Fraudster improperly uses another

R106 R84 R102 R191 person’s identity information R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216 – New account origination (name, SSN, DOB) Light Blue Green Purple Light Gray Light Blue Green Purple Light Gray – Account takeover (name, account number, username/password)

• Fraudster frequently uses his own contact information – Phone, address, email

R122 R247 R0 R0 Example of Severe Identity Manipulator R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue

R106 R84 R102 R191 R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216

Light Blue Green Purple Light Gray Light Blue Green Purple Light Gray

9 5 24 11 Suspicious address different different different different variation first last SSNs DOBs names names

R122 R247 R0 R0 Description of Synthetic Identity Fraud R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue

R106 R84 R102 R191 R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 B194 B63 B144 B191 SSN B255 B129 B206 B216

Light Blue Green Purple Light Gray Light Blue Green Purple Light Gray

“Charles Smith” John Trufante

Seen Seen Address DOB Phone Address DOB Phone 1x 10xs

R122 R247 R0 R0 Example Identity Fraud Ring R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218 Six People, Identity Manipulation and Identity Theft Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue 1 Gerald Smith 24 yrs 2 FNs 10 apps

R106 R84 R102 R191 2 Corona Jones 24 yrs 2 SSNs, 2 LNs 12 apps R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 3 Corona Jones 52 yrs 3 SSNs, 2 DOBs, 2 FNs 5 apps B194 B63 B144 B191 B255 B129 B206 B216 4 Monique Jones 43 yrs 2 SSNs, 3 LNs 9 apps Light Blue Green Purple Light Gray Light Blue Green Purple Light Gray 5 Latasha Jones 21 yrs 3 SSNs, 2 DOBs 26 apps

6 Angel Jones 21 yrs No identity manipulation 12 apps

• 85 phone & credit card applications from these 6 people from one address (close to Anacostia Park) in Washington, DC over 3 years. Sharing of SSNs, DOBs, names.

• An additional 5 ID theft victims; 2 victims are deceased (ID theft of the dead).

R122 R247 R0 R0 Identity Fraud Ring Locations R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue

R106 R84 R102 R191 R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216

Light Blue Green Purple Light Gray Light Blue Green Purple Light Gray

R122 R247 R0 R0 Data at ID Analytics R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue • ~2 billion applications for credit cards, mobile phones, retail credit,

R106 R84 R102 R191 other loans…, more than 10 years R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 B194 B63 B144 B191 • U.S. white pages, (NAP*) ~100 million records monthly over ~10 years B255 B129 B206 B216

Light Blue Green Purple Light Gray • Header files (SNAPD*), ~200 million records monthly over ~10 years Light Blue Green Purple Light Gray • ~4 million labeled records of various frauds • Account performance data, ~100 million/month • Account changes, ~10 million/month • Many other smaller files (SSA DMF, OFAC, census…) • > trillion data elements • Data is time stamped – can “roll back the clock”

*SNAPD – SSN, Name, Address, Phone, Date of birth

R122 R247 R0 R0 What’s Behind The ID Score? R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue • Receive the application (SSN, Name,

R106 R84 R102 R191 Address, Phone, DOB, email, device id) R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 B194 B63 B144 B191 • Build the PII-linked graph B255 B129 B206 B216

Light Blue Green Purple Light Gray • Translate this graph into numbers Light Blue Green Purple Light Gray • These features are the inputs to machine learning algorithms • Calculate the score • Return the score and reason codes

All this is done in ~200 ms. Our products are real time delivered and near real time aware.

R122 R247 R0 R0 Machine Learning/Modeling Algorithms R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue • Support Vector Machines (SVM)

R106 R84 R102 R191 R42 R147 R165 R216 G154 G148 G49 G191 • Traditional Neural Nets G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216 • Boosted Trees Light Blue Green Purple Light Gray Light Blue Green Purple Light Gray • Random Forests • Convolutional/Deep Neural Nets • K-Means Clustering • Others – linear, logistic regressions, CART/CHAID, radial basis functions, KNN…

R122 R247 R0 R0 Services That Need Specialized Technology R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue • Identity Risk Scores – requires real time assembly of real time data for

R106 R84 R102 R191 real time score delivery. Very fast R/W, ML calculation. R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216 • Identity Resolution – look back through all data over time and people to Light Blue Green Purple Light Gray resolve an identity when presented with fragmented information. Needs Light Blue Green Purple Light Gray knowledge of complete PII history, complex fuzzy linking.

• Find fraud rings – examine multiple fuzzy linkings across billions of records. Can be batch.

These require very special data organization and systems

R122 R247 R0 R0 Modified Lambda Architecture R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Batch Layer Serving Layer Gray Orange Navy Blue Blue

R106 R84 R102 R191 Batch R42 R147 R165 R216 G154 G148 G49 G191 Batch processing RDB (RO, RW) Reporting, BI G197 G201 G113 G216 B194 B63 B144 B191 Data Flow Analysis Flat files B255 B129 B206 B216

Light Blue Green Purple Light Gray Model building MapR Hadoop RDBs Light Blue Green Purple Light Gray R&D Spark, Hive Real time services N+1 redundancy

Near real time synchronization

Speed Layer Real Time Data Flow Real time service delivery RDB (RO, RW) ~200 ms response time Flat files MapR-DB Real time services GR, N+1 redundancy

R122 R247 R0 R0 Real Time Production Scoring R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218 Tasks: Gray Orange Navy Blue Blue • 24x7, low latency, moderate throughput scoring via system API calls Gray Orange Navy Blue Blue • Real time scoring, real time awareness R106 R84 R102 R191 R42 R147 R165 R216 G154 G148 G49 G191 • Demanding database needs: multiple index random read/writes <50 ms from G197 G201 G113 G216 B194 B63 B144 B191 multiple Tb data stores B255 B129 B206 B216

Light Blue Green Purple Light Gray • Complex scoring model execution: typically boosted trees, ~1000 trees, ~300 Light Blue Green Purple Light Gray variables for each score calculation • Return 99% of score requests in under 200 ms • Score ~1 million/day

Environment and technology stack: • ~200 nodes, ~256 Gb memory/machine, ~1.3 Pb storage, n+1 redundancy • Hot, warm geographic redundant data centers with continuous data replication • Linux, java • Continuous delivery software development pipeline (Maven, Ansible,…) • Multiple instances of highly tuned MySQL with some sharding • Springboot, Docker, Kubernetes • Some products in AWS for faster product development and iteration

R122 R247 R0 R0 Batch Data Inflow and Production Data Deployment R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Tasks: Gray Orange Navy Blue Blue • Receive, process, field many large batch files efficiently R106 R84 R102 R191 R42 R147 R165 R216 G154 G148 G49 G191 • Many files have complex hierarchical structure G197 G201 G113 G216 B194 B63 B144 B191 • Move, standardize, transform, clean, organize, encrypt B255 B129 B206 B216

Light Blue Green Purple Light Gray • Catalogue, governance Light Blue Green Purple Light Gray • Deploy across multiple databases and environments

Environment and technology stack: • Oozie, Kafka, Moveit, Drools • MapR Hadoop, Map Reduce • Hive, Pig, Spark

R122 R247 R0 R0 Backend Analytics Infrastructure R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Tasks: Gray Orange Navy Blue Blue • Build predictive models R106 R84 R102 R191 R42 R147 R165 R216 G154 G148 G49 G191 • Perform “Retro tests” G197 G201 G113 G216 B194 B63 B144 B191 • Ad hoc analyses B255 B129 B206 B216

Light Blue Green Purple Light Gray • Explore new candidate data sets Light Blue Green Purple Light Gray • R&D (algorithms, variables, data organizations…)

Environment and technology stack: • ~35 node compute cluster, ~512 memory/machine • Small GPU cluster • ~500 Tb MapR hadoop • Completely timestamped data system • Condor, Hive, Spark • Python, Scala, java • Graphx, Weka, TensorFlow for prototyping • Custom model platform for production models

R122 R247 R0 R0 R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue

R106 R84 R102 R191 R42 R147 R165 R216 G154 G148 G49 G191 R&D Project: G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216

Light Blue Green Purple Light Gray 3D Identity Event Profiling Light Blue Green Purple Light Gray

R122 R247 R0 R0 R154 R250 R47 R165 G134 G143 G53 G114 3D Identity Profiling G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue Better understand and categorize the nature of the risk

R106 R84 R102 R191 R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216 Fundamental Questions Light Blue Green Purple Light Gray Light Blue Green Purple Light Gray 1. Is the asserted identity real? 2. Does the asserted identity belong to the applicant? 3. Does the applicant have a good intent?

Three models that answer these 3 questions comprise the set of axes in order to locate each application as a point 1. Synthetic Identity Score 2. Identity Mismatch Score 3. Bad Intent Score

R122 R247 R0 R0 R154 R250 R47 R165 G134 G143 G53 G114 ID3D Shows the Risks Confronting a Bankcard Client G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218 . Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue

R106 R84 R102 R191 T R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216 S Light Blue Green Purple Light Gray F Light Blue Green Purple Light Gray

C M bad intent score

G • (F)irst Party Fraud synthetic identity score • (C)redit Bad • ID (T)heft • (S)ynthetic ID fraud • ID (M)anipulation

R122 R247 R0 R0 R154 R250 R47 R165 G134 G143 G53 G114 ID3D Shows the Risks Confronting an Alternative Lender G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218 . Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue

R106 R84 R102 R191 T R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216 S Light Blue Green Purple Light Gray F Light Blue Green Purple Light Gray

C bad intent score M G • (F)irst Party Fraud synthetic identity score • (C)redit Bad • ID (T)heft • (S)ynthetic ID fraud • ID (M)anipulation

R122 R247 R0 R0 R154 R250 R47 R165 G134 G143 G53 G114 3D Identity Profiling G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue

How this helps us R106 R84 R102 R191 R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216

Light Blue Green Purple Light Gray - Better understanding of the nature of the risk Light Blue Green Purple Light Gray - a synthetic identity or manipulated identity could be created with good intent

- Analyze, identify, and inform each client … - What types of risk they deal with and should pay attention to - How the trend in the bad behaviors are changing

- Discover new modes of bad behavior

R122 R247 R0 R0 R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue

R106 R84 R102 R191 R42 R147 R165 R216 G154 G148 G49 G191 R&D Project: G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216

Light Blue Green Purple Light Gray Early Breach Detection Light Blue Green Purple Light Gray

People at high risk R122 R247 R0 R0 Analysis of our ID Network in a large bank R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 can discover data breaches B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue

R106 R84 R102 R191 R42 R147 R165 R216 G154 G148 G49 G191 • Data breach — G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216 Identity information is Light Blue Green Purple Light Gray released into the black Light Blue Green Purple Light Gray market and exploited by fraudsters

• Early breach detection — Pro- actively identify fraudulent activities from undisclosed breaches as they occur Each circle is one person with ID Score > 600 (red > 900) Each connection is a shared (address, phone or email)

© 2017 ID Analytics, Inc. Confidential Primary IDA Color Palette Secondary Color Palette - Medium Specifically, we noted unusual activity on these R122 R247 R0 R0 R154 R250 R47 R165 G134 G143 G53 G114 SSNs at Bank B . . . G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue

R106 R84 R102 R191 fraud “burst” R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 B194 B63 B144 B191 20 B255 B129 B206 B216

Light Blue Green Purple Light Gray 18 Light Blue Green Purple Light Gray

6 #Daily applications prior activity 4

0 Jun-15 Jul-15 Aug-15 Sep-15 Oct-15 Nov-15 Dec-15 Jan-16 Feb-16

R122 R247 R0 R0 . . .Identifying the potential breach event R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Gray Orange Navy Blue Blue Gray Orange Navy Blue Blue

R106 R84 R102 R191 R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216

Light Blue Green Purple Light Gray Light Blue Green Purple Light Gray

R122 R247 R0 R0 Summary R154 R250 R47 R165 G134 G143 G53 G114 G155 G187 G163 G194 B142 B30 B95 B156 B157 B119 B255 B218

Orange Navy Blue Blue Gray Orange Navy Blue Blue Gray Identified and described three modes of identity fraud

R106 R84 R102 R191 • Identity Theft, Identity Manipulation and Synthetic Identity R42 R147 R165 R216 G154 G148 G49 G191 G197 G201 G113 G216 B194 B63 B144 B191 B255 B129 B206 B216

Light Blue Green Purple Light Gray Real time fraud detection and awareness requires very careful Light Blue Green Purple Light Gray system architecture • Data ingestion, storage, retrieval • Separation of real time, batch and BI/reporting • Optimization of data layout

Big Data systems allow exploration, R&D on large data sets