With almost half of all reported crimes in the UK being fraud or cybercrime, the costs to business continue to challenge the bottom line, with organised crime posing continuous and sustained attacks across sectors. How can organisations keep a step ahead and proactively prevent organised fraud whilst also understanding what ‘good customers’ look like?This paper unpacks the challenge, takes a 360 view of fraud and explores how advanced network investigation technology can offer solutions.

STOPPING FRAUD RINGS WITH NETWORK VISUALISATION TECHNOLOGY 01

STOPPING FRAUD RINGS WITH NETWORKVISUALISATION TECHNOLOGY

Growing problemThe UK Government launched a new fraud initiative in early 2016 in response to the unprecedented level of fraud being reported across the UK – with almost one in two crimes being fraud or cybercrime1.

In fact, fraud against the public and private sectors was the National Crime Agency’s top economic crime threat to the UK in 20162 and it’s estimated that fraud losses in the UK are around £193 billion per year, with almost 75% of losses being against the private sector3.

Synectics Solutions work across a range of sectors including financial and insurance, on a national and global scale. Their SIRA product not only provides tailored insights to the individual company, but the National SIRA database exists to share intelligence amongst their clients to help tackle financial fraud. Research conducted by Synectics Solutions suggests that in some sectors, organised fraud activity affects as much as 59% of all fraud filings to the National SIRA database 2017.

STOPPING FRAUD RINGS WITH NETWORK VISUALISATION TECHNOLOGY 02

As more businesses use websites, social media, cloud based services and hold more personal data electronically than ever before, high profile online data thefts continue to rise.”

1. https://www.ons.gov.uk/peoplepopulationandcommunity/crimeandjustice/bulletins/crimeinenglandandwales/yearendingmar20172. http://www.nationalcrimeagency.gov.uk/publications/731-national-strategic-assessment-of-serious-and-organised-crime-2016/file]3. http://www.port.ac.uk/media/contacts-and-departments/icjs/ccfs/Annual-Fraud-Indicator-2016.pdf4. https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/609186/Cyber_Security_Breaches_Survey_2017_main_report_PUBLIC.pdf pg 35. https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/609186/Cyber_Security_Breaches_Survey_2017_main_report_PUBLIC.pdf pg 2

Targeting organised fraudThe increase in organised fraud may be a signal that it is resorting more to application fraud due to the advances made by financial organisations to control and reduce losses post application. Or, it could simply reflect the wealth of easily obtained personal data that is being made available by the public in their day to day lives.

As more businesses use websites, social media, cloud based services and hold more personal data electronically than ever before, high profile online data thefts continue to rise. In fact, two-thirds of big UK businesses have been hit by a cyber-attack in the past year, according to government research4 in 2017.

Keeping ahead of the advancement in digital technology is essential for organised crime groups to maximise their return and evade detection, which is often done from outside of their local jurisdiction. However, despite more companies being concerned about data security, a large proportion still do not have basic protections or have formalised their approach5.

Organised crime groups are making use of new technology, the dark web, and the increasing availability of electronic data within businesses, meaning organisations can be routinely targeted by large scale use of both false and hijacked genuine identities. This, combined with the recruitment of mules, the use of manipulated and false information and prominence of professional enablers, provides them with a variety of means with which to penetrate an organisations’ defences.

Once onboarded, often mimicking the behaviours of good customers, fraudulent accounts are increasingly difficult to identify and track. Their main aim is to get access to products and services to either commit fraud, facilitate fraud or for high end money laundering activity.

Identifying this type of attack and differentiating it from the more opportunistic fraud attempts that organisations are already exposed to on a daily basis is challenging. Fewer organisations are accepting this as just a cost of doing business, particularly in increasingly demanding and competitive environments. Actively targeting organised fraud is a key route to protecting both business and customer assets. Best-in-class fraud prevention and detection systems can help increase market share as well as lead to innovative products and services being offered to customers. Indeed, the cost of preventing fraud at application is far less than the cost of recouping losses once the application proceeds and there are significant benefits to application data where local and syndicated fraud databases can help match and inform insights across other providers.

Per year fraud losses in the UK are around

Organised fraud activity affects as much as

to the National SIRA database 2017

with almost 75% of losses being against the private sector3

£193 billion

of all fraud filings59%

Preventing organised fraud with advanced network investigation technology Today’s organisations need solutions to protect key business information, detect and prevent organised threats before they result in a cybercrime such as data theft or hacking, which can lead to losses both to the business and its reputation.

Traditionally, fraud systems identify incidents in a linear way, which inhouse investigators then explore and where possible connect with other cases. However, with more opportunistic and more comprehensive organised crime groups on the attack, a 360 view of fraud has been used to develop specific fraud products at Synectics Solutions.

Orion is an advanced network investigation technology developed by Synectics Solutions in response to the growing rate and complexities of organised fraud faced by organisations. It offers a deeper view of potentially fraudulent and connected accounts, applied specifically to each individual businesses’ needs both reactively and proactively, to identify instances of organised fraud.

Network visualisationInitially developed for and used within the intelligence and law enforcement communities, network visualisation software has become a standard method for explaining and understanding complex stories, relationships and interactions based off of evidential data gathered during investigations.

This visual approach has since been adopted and adapted across a multitude of different industries and sectors across the globe where serious and organised crime networks operate with seeming impunity.

As more traditional rule based fraud decision solutions struggle to spot more complex, organised fraud, introducing network visualisation is now becoming standard practice within many industries as part of their counter fraud offerings.

...network visualisation software has become a standard method for explaining and understanding complex stories...”This 360o view of data can help to show direct and indirect links between items, people and locations and the patterns, trends and behaviours that emerge. Not only can this identify organised crime networks, it can improve reaction times, operational flexibility, prevent losses and identify weaknesses or gaps in policies, processes or systems.

OrionOrion, from Synectics Solutions, is a sophisticated financial crime network analysis tool that counters the threats that organised crime poses to organisations. Each year there is over £24 billion of fraud under investigation within Orion networks.

Orion is able to integrate a wealth of data, both within a company and through other systems, including Synectics Solutions’ SIRA system. This allows a richer picture from in and around an organisation and across the sector. The systems’ visualisation and analysis functionality make it possible to easily identify existing and emerging suspicious network activity.

Orion can be either fully integrated with Synectics Solutions’ SIRA system to provide an enterprise wide financial crime prevention solution, or deployed as a standalone network analysis and visualisation system capable of analysing and integrating with any third-party database.

STOPPING FRAUD RINGS WITH NETWORK VISUALISATION TECHNOLOGY 03

...two-thirds of big UK businesses have been hit by a cyber-attack in the past year”

This 360-view of data can help to show direct and indirect links between items, people and locations and the patterns, trends and behaviours that emerge.”

Each year there is over £24 billion of fraud under investigation within Orion networks

Case study: Insider fraud / branch based account openers One of the UK’s largest Retail Banks was able to identify a suspicious pattern of applications being keyed within several of its branches over a 12-month period, working from a tip-off and by using configurable validation criteria available within Orion.

Case study: Staged accidents in Insurance fraud A leading UK Motor Insurance company used Orion to investigate a motor accident claim, which it uncovered to be a highly organised staged accident fraud ring worth over £50,000.

Case study: Demographic profiling in mortgage fraudAn uplift in applications being prevented within the same geographic area sparked an investigation by a leading UK Mortgage Lender, using Orion to identify a number of conveyancing solicitors nominated on a large number of applications with a common profile in the same area.

Case study: Payment terminal Fraud in 1st party fraudUsing Orion’s automated capabilities, one of the UK’s leading Building Societies was able to identify and stop an organised crime group from causing serious losses to the society and therefore protecting their members in the process.

STOPPING FRAUD RINGS WITH NETWORK VISUALISATION TECHNOLOGY 04

Recent case studies

Synectics Solutions Ltd, Synectics House, The Brampton, Newcastle-under-Lyme, Staffordshire, ST5 0QY

+44 (0) 1782 664000 | info@synectics-solutions.com | www. synectics-solutions.com

Further informationIf you are interested in finding out more about how Orion can be used in your organisation to help prevent, detect and investigate organised crime groups, call 01782 664000 or email info@synectics-solutions.com

Further information on Synectics Solutions and how its product offering can benefit your business can be found here.

Using propensity scoring within Orion, the Lenders’ fraud investigation could focus on five conveyancing firms, where a number of inconsistencies appeared.

Early applications had turned into live accounts, both subject to payment terminal fraud. Preventative action against the other connected accounts identified within Orion could be made before further losses were incurred.

Strategy and scorecard in place identified an application which linked to others from the same address, on further investigation other links such as mobile number were made to other applications.

Orion searched direct customer links using standard validation criteria from the originating accident. It linked 130 accidental policies, only 26 were known to the insurer as being fraudulently incepted.

Policies worth £50,000 were identified as still being ‘on book’. The Insurer took remediating action and data was passed to the claims investigation team.

Orion helped to identify the organised crime group and help the Insurer put a stop to additional false claims being paid out.

Timeline analysis identified the pattern of fraud, members of staff involved and the person connecting them, moving between branches during their working day.

Orion analysis and evidence helped the bank’s internal fraud team obtain confessions.

Links to an organised crime gang were made and they were identified through CCTV footage, and the Police were able to affect an arrest which led to them finding an ‘ID Factory’.

An ‘unauthorised’ and unregulated mortgage broker was identified as the source of the fraudulent applications, using false information and manufactured income streams.

Properties were being used as unauthorised ‘Buy to Let’ investment properties, housing multiple occupants, who were new to the country.

The Lender put measures in place to monitor the property portfolio to ensure swift enforcement was taken and any future losses mitigated.

Retrospective action against the conveyancer was taken to prevent further applications.

1

2

1 1

2

3

1

2

3

2 3 4 5