Fraud is a network problem. Mid-market banks need network tools

Automated systems are good at catching the individual event, but modern financial crime is organized, transnational and increasingly identity driven. Matt Trepinski, Account Executive – Federal Civilian Agencies at i2 Group, explains how link analysis – long established in law enforcement and intelligence work – helps mid-market banks pull fragmented data together and see the criminal network behind the incident.

Mid-market banks are today in the crosshairs of criminal organizations that historically have targeted large financial institutions.

They are seeing all the same threats, from cyber-attacks to money laundering, to fraud. With the digital economy, the proliferation of devices and accounts and mobile phones, every institution is now an equal target in this new hyper-connected world.

However, their larger counterparts have spent years building specialized fraud, cybersecurity, anti-money laundering (AML) and investigative teams to manage these threats. Smaller banks typically have fewer dedicated resources to deploy. And they don’t always have specialized investigators with the skills to counter what are increasingly becoming simultaneous attacks across multiple identities, accounts, institutions and digital channels.

That imbalance makes them attractive targets for crimes such as fraud, cyber-attacks and money laundering. If you’re an attacker looking to hack a bank, what do you care? You will find a provincial bank, because they will not have all the same tools and capabilities as a global institution. On paper, at least, the smaller institutions appear to be easier targets.

Consequently, these organizations are having to rethink how they manage these evolving risks, their fraud investigations, and, importantly, how they verify customer identities.

Meanwhile, the regulatory burden makes no allowance for the size of the institution carrying it. AML regulations, Counter the Financing of Terrorism (CFT) rules and the Bank Secrecy Act all require compliance. In practice, that means a set of duties that a three-person team must discharge as completely and competently as a three-hundred-person one.

Distinguishing between fake and real

Historically, financial institutions have monitored banking transactions to detect suspicious payments, unusual account activities and irregular fund movements, but criminal organizations are using new technologies to adapt. This includes deploying artificial intelligence (AI) to create convincing digital personas, fraudulent documents and highly personalized social engineering campaigns at scale – and, crucially, to do so in volume. You can flood the zone with credentials and account information.

The raw material for those identities is already in circulation, in the dark web, for example. There have been enough credit card or healthcare breaches to make it easier than ever to piece together a social security number with an address, with a photo, with somebody’s realistic picture off social media.

And where that composite identity is presented matters. It is probably easier to commit fraud of this nature in person versus online, where the software probably catches it. Nor is the individual walking through the branch door likely to be acting alone. This type of financial crime has long since stopped being a lone-actor scenario. These are complex criminal organizations and, increasingly, they’re transnational.

As a result, financial institutions have started to develop processes that continuously evaluate identity-related risk throughout a customer’s lifecycle rather than relying exclusively on point-in-time verification. This ongoing validation of a customer’s identity is critical to determine whether the person they are dealing with is who they really say they are.

The growing complexity of identity-centric fraud is felt particularly acutely for mid-market banks. A single fraud operation may simultaneously involve identity fraud, cyber intrusion, money laundering and social engineering tactics and these banks may not have the financial means to manage risks on such a scale and with such a level of sophistication.

Generally, separate teams are tasked with investigating these different, albeit connected, activities but because they are dealt with independently, their data analysts are unable to join the dots and therefore recognize how these interconnected individuals contribute to the broader fraud picture. They are at risk of missing the meaningful patterns that connect them.

Adopting intelligence methods

To respond effectively to the synthetic identities and the many different interconnected activities that are difficult to identify through a single transaction, banks are increasingly turning to the same investigative methodologies that intelligence agencies and law enforcement organizations use.

The tools that intelligence and law enforcement have historically deployed are designed to uncover complex networks associated with organized crime, counterterrorism and national security threats. In short, banks see financial crime as a network problem rather than a collection of unrelated incidents. Automated detection catches the individual event; investigation makes sense of the pattern behind it.

Identity intelligence, then, becomes a shared capability that supports not only fraud prevention but also its related crimes. Consequently, data analysts acquire a better understanding of the broader network in which an individual operates and whether that person and those connected to them are acting suspiciously. This in turn creates a dynamic understanding of identity that evolves as new risks emerge.

Technology to analyze links

To achieve this, banks need ‘link analysis’ technology, such as i2 Analyst’s Notebook, to connect data on customers, employees, third parties, accounts, devices, transactions and organizations. While this data is often stored separately, intelligence-orientated investigative practices can help banks improve collaboration and information flow among the different investigative teams. This foundational investigative discipline enables analysts to better understand how information pulled from multiple data sources connects to create a more comprehensive risk overview.

It focuses on identifying and visualizing relationships among people, accounts, devices, organizations, transactions, locations and events. Because data analysts gain a better understanding of how those entities connect, they can then help investigators detect hidden associations, criminal networks and patterns of activity that were undetectable using traditional transaction monitoring.

Two ways to see the same case

Transaction monitoring

Each alert is reviewed on its own. The connections stay invisible.

1 alert closed. The scheme carries on.

Link analysis

People, accounts, devices and transactions are connected into one picture.

7 linked entities surfaced. The network is exposed.

Consider a bank I spoke to recently that had identified suspicious activity with a check-cashing scheme. They investigated it, took one incident and tracked it back to another 104 incidents. As soon as it works once, the bad guys are going to revisit the well.

Intelligence agencies and law enforcement organizations have been using platforms like Analyst’s Notebook for years to support complex investigations that involve large volumes of interconnected information. Tools like this can also benefit mid-market banks that are looking to connect their fragmented data sources and build a complete picture of the financial crime networks responsible for fraud.

How the tech works

A good place to start is to use the link analysis function to investigate cases where relationship visibility is likely to produce immediate operational benefits. This could be synthetic identity investigations or mule account detection, for example, because here, the value of relationship analysis becomes visible very quickly.

Just as important is that the technology sits inside the way a bank already works. With Analyst’s Notebook, for example, we have a flexible architecture that can plug into your workflows and the way that you work, and can integrate with the tools you use.

In practice, that means a shared repository for teams working a case together, connections out to third-party risk data and watchlists, and the ability to search across a data warehouse. The link analysis becomes part of your ecosystem.

At the same time, to maximize results, investigators must be trained to think differently. Rather than considering whether a particular account looks suspicious, they need to start looking at other entities connected to the account in question and whether those relationships reveal a broader pattern of fraudulent activity.

Building a case that stands up

There is a further benefit of using a link analysis tool such as i2 Analyst’s Notebook. Because platforms of this kind originated in law enforcement, the case a bank’s fraud team assembles arrives in a form the receiving agency already recognizes. The visualization capabilities are what your federal agency, regulator or FBI agent are used to. You package it up and send it over to the prosecutor, the special investigator, the international financial crime team. Now all of a sudden, you’ve built that story.

This coordination between private-sector investigators and law enforcement leads to better outcomes, because now you’ve got more successful prosecutions as well.

Conclusion

Criminals have started to collaborate more effectively and are deploying ever more sophisticated, increasingly technological means to exploit organizational blind spots.

Mid-market banks are at risk of being caught out by these criminal networks. Adopting a link analysis tool that enables investigators to focus attention on previously hidden, albeit interconnected, relationships rather than concentrating on isolated incidents, provides the best line of defense in this evolving risk landscape.

Because identity has become a convergence point for fraud prevention, anti-money laundering and cybersecurity, decision makers in banks should treat identity as an ongoing investigation and ensure their different investigation teams collaborate effectively to develop a more detailed understanding of the risks they face. A link analysis tool like i2 Analyst’s Notebook makes this possible.