Social Network Analysis, Part II

Chris Swecker, a former assistant director of the FBI who is currently an independent consultant on enterprise financial crime strategies, regulatory compliance and control measures for business and government, views fraud as an enterprise in general.


"I don't mean to say that all fraud is network. There is a lot of opportunist, one-off fraud that is taking place every day. But the ones that are hurting the financials the most are the networked organized groups," he said.

A lot of activity, especially on the Internet, is organized criminal activity, according to Swecker. "You've heard of sensitive credit card information being stolen and sold on the Internet in these deep, dark carding Web sites ... that's a criminal network," he said.

These groups have a type of supply chain, he explained. They steal the data, sell it to another group that repackages it and sells it to another group that uses it to steal money one way or another from a channel the financial institutions provide like an ATM or teller, he said.

Swecker suggested going after fraudsters as "a broader fraudulent network" and working with law enforcement to dig it up by the roots. "That's where the analytics part comes in -- it helps you put some context around the content of your data so you understand your data better," he said.

The best way to fight a network, according to Swecker, is to be able to see it. "Just like in good law enforcement, when you're working on an organized crime case or you're working on al-Qaeda or working on a gang or working the la Cosa Nostra, you have to understand who the participants are," he said.

"Instead of taking them off one-by-one for a traffic violation, you take them off as an organization and you take them off all at one time and the only way to do that is to have good intelligence information, good data and then run really powerful analytics against it to see the whole picture," he said.

Federal agents said the Denver-based scheme led to losses of more than $80 million and involved 700 people - mostly students in the U.S. on visas who were recruited by the criminal enterprise.

An alleged massive organized bank-fraud scheme involving 16 Russian immigrants was busted by federal agents in August 2009, with 15 raids at several locations, including an Aurora auto dealership and a Denver medical-marijuana business. Described by authorities as a "bust out" scam, the allegations involved using the identity and credit line of a business to obtain loans and goods with no intention of repaying the money or paying for the merchandise, according to the case affidavit unsealed Friday. Additionally, some of the 700 obtained credit cards to buy luxury items with no intention of paying for them, while others took out cash loans without repaying, it is alleged.

Social network analysis, or link analysis, will prove to be valuable in fraud prevention and detection, particularly in “bust out” fraud, a type of fraud that eludes most fraud tools. The usual transaction monitoring is of little benefit. Bust out fraud typically involves “bad” payments to increase the open-to-buy, so that a criminal can run up a credit card balance to many times the credit limit. Bust out fraud can also involve “sleeper fraud”, where a fraudster may make small purchases, pay them off, for several months, creating a “legitimate” history, then bust out.

Does Social Network Analysis Have a Place in Fraud Detection?

Does Social Network Analysis have a place in fraud detection and prevention?


Part I

Professionals estimate that around $300 billion is lost to public assistance fraud in the US annually – and half of that is believed to be stolen by organized crime groups.

In 2007, California’s Contra Costa County’s civil grand jury estimated child-care fraud costs county taxpayers $500 million annually. County officials agreed to study “data mining” systems in 2007 after reports were published that showed chronic fraud in federal, state and local public assistance programs by criminal enterprises. The data mining system will assign a numerical score to all welfare recipients that will alert investigators about suspicious people.

The system will use activities and characteristics of past welfare cheats to create a computer model that assigns a “risk score” to help identify new cheats. The new data mining system also has an advanced option called “social network analysis” (SNA). SNA helps investigators see relationships between people and assistance providers to create a relationship picture of suspicious people, associations, groups and behaviors.

Financial institutions are also exploring the benefits of SNA. According to Ellen Joyner-Roberson, Financial Services Marketing Manager at SAS: Social network analysis, also known as link analysis, is a powerful tool in understanding the structure of social and organizational networks that are often connected to criminal behavior. SNA maps and measures relationships and flows among people, groups, organizations, computers or other information/knowledge processing entities. The nodes in the network are the people and groups, while the links show relationships or flows between the nodes. Standard rules-based systems can't unearth "first-party fraud" and "bust-out fraud" where criminals establish accounts for the sole purpose of committing fraud.


A classic example is found within the credit card industry. TowerGroup, a Needham, Mass., research and analysis firm, projects that total card credit losses for issuers of U.S.-branded cards will peak at $55.6 billion in 2009. Rules-based systems are looking at more traditional types of risk, such as poor credit. With SNA, fraud-based risk can be seen by investigators, making it easier to uncover previously unknown relationships and conduct more effective investigations.

According to Joyner-Roberson, banks’ first concern is to know and authenticate the customer so they know with whom they are doing business. They must take a 360 degree view of their customer. Social network analysis, especially using more sophisticated analytics, can be used to find previously undetected fraud rings.