Survey
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
FSC Transaction Due Diligence & Monitoring Using Data Mining and Forensic Techniques to detect fraud and collusive relationships June 13 2014 By Dr Abiodun Osiyemi Forensic Science Consultants (Training Copyright) 1 www.forensicscienceng.com FSC Presenter: Dr Abiodun Osiyemi Dr Abiodun Osiyemi BSc, MBBS, MSc (Distinction, NG), MBA, MSc (Forensic Science UK), PhD (Mgt), CMC, FIMC, MITD, MCFI CEO , Forensic Science Consultants Email: [email protected], Tel: +234-803-300-8505 Website: www.forensicscienceng.com • • • • • Crime Scene Investigator and Forensic Science Expert (Trained at Staffordshire University, Stoke – on – Trent) Certified in document examiner, Trained in criminology and financial crime at Forensic & Compliance Institute USA. Dr Osiyemi is an award winning scholar & graduated with a GPA of 4.86 at the post graduate school He possess varied experience as a crime investigator, forensic document examiner and Certified Forensic Examiner for different clients Dr Osiyemi has investigated numerous anti-counterfeiting investigation on currencies, document and bank cheques He is the author-‘The Rules of Outstanding Achievements, & Director, Harvard Associates Lagos. Dr Osiyemi was nominated into ‘who is who in Nigeria ‘in 2003. 2 www.forensicscienceng.com FSC Can you spot me? Criminalists-UK 2011! 3 www.forensicscienceng.com FSC Crime Scene Investigation ! Doing the right thing 4 www.forensicscienceng.com FSC What we do for our clients • Support clients to establish the forensic framework for collecting, processing , analyze and store evidence • We build capacity in forensic crime investigations • We profile criminals and crime scenes • Support clients to reconstruct crime scenes • Conduct forensic investigations on documents, computer, mobile phone, physical and trace evidence • We represent clients in courts as experts • We train and build capacity fop our clients • We have our private forensic lab • We partner with public & private sectors including Law Enfo. Agents • We network with compliance and fraud examiners globally • We represent PITAGORA SA (Switzerland) across West AfricaThey are a multimillion dollar company involved with forensic equipment manufacturing and document examination expert 5 www.forensicscienceng.com FSC Presentation outline • • • • • • • • Introduction Definitions Types of Fraud and Business Scams Data mining and fraud detection Digital Forensics & Fraud detection Admissibility of expert evidence in law courts Challenges of Fraud Investigation Conclusion 6 www.forensicscienceng.com FSC Introduction 7 www.forensicscienceng.com FSC Do you agree? 8 www.forensicscienceng.com FSC Introduction • Fraud is a consistent fact of business life that affects all sizes of organizations globally • There is no full proof method to prevent fraud , however systematic approach van be used in minimizing the risk. • Two main types of fraud are carried out by the perpetrators i.e. Internal and External fraud. Internal fraud accounts for higher crime occurrences in some countries such Australia 9 www.forensicscienceng.com FSC • The financial loss as a result of financial fraud accounts for billions of dollars annually in various countries. • Australian business and government lost $5.8 billion a year and accounted for one third of all crime occurring in the country (Australian Institute of Criminology 2003) 10 www.forensicscienceng.com FSC Financial Crime : The ‘Crack Team’ 11 www.forensicscienceng.com FSC Essence of Topic • In order to accomplish analysis of large amount of financial information when dealing with fraud and money laundering, it is important to include Data Mining and Digital Forensic in the strategies of the financial institution. • A combination of financial regulation compliance, digital forensics and data mining is an efficient methodology that enhance fraud detection , prevention and investigation. 12 www.forensicscienceng.com FSC Thinking and providing Solutions Combating fraud & Corruption 13 www.forensicscienceng.com FSC www.forensicscienceng.com FSC Definitions 15 www.forensicscienceng.com FSC Fraud definition • No precise legal definition of fraud exist. The term fraud is used to describe acts such as deception, bribery, forgery, extortion, corruption, theft, conspiracy, embezzlement, misappropriation, false representation, concealment of material facts, collusion etc. • Fraud can be simply defined as deception. • A known misrepresentation of the truth or concealment of a material fact to induce another to act to his or her detriment Black Law 16 • For practical purposes, fraud may be defined as the use of deception with the intention of obtaining an advantage or causing loss to another party www.forensicscienceng.com FSC The Fraud Triangle Commonly Accepted Theory for Internal Fraud: • Motivation / Pressure • Rationalisation • Opportunity Pressure 17 Opportunity AICPA: Condition of fraud www.forensicscienceng.com Rationalization FSC A Scam A scheme designed with an intent to defraud a group of individuals or an enterprise(s) or a government(s) or a mix thereof, for getting some personal benefit - financial or fame, which requires violation of some law or flouting of certain established controls and involves a team work eg ‘419’ 18 www.forensicscienceng.com FSC Forensic Science Definition: • Relating to the use of science and technology in the investigation and establishments of facts or evidence in a court of law • Relating to or appropriate for courts of law (* Online English Dictionary) Forensics derives from Latin word ‘forum’ and applies to any thing that relates to law Law & Science The philosophical foundation of the criminal justice system remains to protect the innocent and to ensure that the truth emerges for any matter before the court, thereby ensuring that justice is done. For law enforcements to keep up with pace of criminal advancements, other techniques of identifying criminals must develop and Science has come permanently to the rescue with methods that depend less on eye witness 19 www.forensicscienceng.com FSC Digital Forensics • The science which aims to identify , preserve, collect, validate, analyze, interpret, document and present digital evidence stored in electronic sources. • Digital forensics applies to reconstruction of events during criminal investigations, or anticipates unauthorized actions • DF when combined with Data mining can be used to effectively pr 20 www.forensicscienceng.com FSC Locard’s Principle Principle of Exchange • when a person comes into contact with an object or another person, a cross transfer of physical (also-Virtual / Electronic) evidence can occur www.forensicscienceng.com FSC Collusive Relationships • Secret agreement between parties for an illegal purpose; conspiracy • E.g. Collusive relationships to carry out money laundering, financial fraud, terrorism etc 22 www.forensicscienceng.com FSC ‘Partners’ at work 23 www.forensicscienceng.com FSC Fraud Techniques • • • The “Three-Call” Technique The Infallible Forecaster Baits to Lure in • • • Aspect of Risk Show of Familiarity Doing you a favour • • • • An understanding of Psychology Avoidance of Questions High Pressure Sales Tactics Fancy Corporate Names • Howdy Partner 24 www.forensicscienceng.com FSC Corruption 25 www.forensicscienceng.com FSC Fraudulent statements 26 www.forensicscienceng.com FSC Types of Frauds Common financial fraud / crimes: • Money laundering • Financing of terrorism • Telemarketing fraud • Business opportunities • Investment frauds • Business scams 27 www.forensicscienceng.com FSC Business Scams Bank Fraud Business Loans Internet Services Cheque Fraud Counterfeiting Cramming Fake Ads & Directories Fraudulent Orders Supply Scams www.forensicscienceng.com FSC Money Laundering • Practice that hide the connection between the sources of funds and their ultimate use • Disguising the source of ill-gotten money and making it appear to have come from legitimate sources (organized crime) drugs, D&C etc • Laundering process washes dirty money and makes it appear clean 29 www.forensicscienceng.com FSC • In organized crime , Dirty money is laundered to become clean • In Terrorism generally, Clean money is Laundered Dirty! • In both cases above the origin of the money is disguised! NB Terrorist organisations are becoming syndicates that raise money through illegal activities that generate large amounts that cannot just be deposited in the bank! Not all the money is in the bank , however they use wire transfer, deposits etc as convenient way to move money across borders 30 www.forensicscienceng.com FSC Money laundering process The basic phases are: Placement • Smuggler ABC Introduces illegally obtained profits into financial system Layering • Smuggler MEXY transfer $1,000,000 to offshore company XYZ which he owns ( NB: ownership of company XYZ is protected by privacy law in the offshore country). Company EFG in USA owned by MEXY sells a property to Company XYZ Integration • Smuggler MEXY is paid $500,000 for consulting work done for company EFG 31 www.forensicscienceng.com FSC Techniques in Money Laundering Placement • Smurfing • Cash smuggling • Negotiable instruments • Cash exchaneg for negotiable goods • ATM Deposits • Cash Value Insurance policies • Corporate bank accounts Layering Integration • Tax Havens & Offshore Banks • Use of haven bank credit cards • Bank Secrecy Law as a layering tool • Receiving as consulting or directors fee • Offshore (Offshore trusts) • Arrangement of corporate loans • Shell corporations • Proceeds of gambling • Walking accounts • Buy a bank • Financial intermediaries • Real estate transactions • Stock Purchase • Use of business • International importing and exporting • Buy a bank • Buy a banker • Use of free trade zones www.forensicscienceng.com FSC Anti-Money Laundering Laws & Organisations Financial Action Task Force (FATF) • Established in 1989 by a group of 8 countries (Canada, France, Germany, Italy, Japan, UK, US, Russia) • The FATF produced 40 recommendations to combat money laundering and 9 recommendations to combat terrorist financing Some of the 40 recommendations • Creating and implementing international anti-money laundering conventions • Criminalizing the act of money laundering • Setting policies and procedures for seizing money laundering proceeds • Requiring financial (and certain nonfinancial ) institutions to implement due diligence anti-money laundering programs • Increasing international cooperation in anti-money laundering investigations and prosecutions www.forensicscienceng.com 33 FSC Fraud Control • • • • • Risk assessment Prevention Investigation Detection Bankers role & compliance 34 www.forensicscienceng.com FSC Transaction due diligence & monitoring Bankers Role & Compliance Banks Compliance program • Purpose • Benefits to examiners • Benefits to Bank Compliance program elements • Senior management commitment • Compliance officer • Internal audit • Internal controls • Independent testing • Training 35 www.forensicscienceng.com FSC Fraud: High Risk Areas • • • • • • • • • • • Deposit taking Sale of official cheques and negotiable instruments Wire transfers Loans International correspondent banking Special use account Private Banking Trust department Brokerage operations Trade financing Internet Banking 36 www.forensicscienceng.com FSC Non Bank • • • • • • • • • • • • Securities dealers, brokers Insurance companies Credit unions Saving Institutions Cooperative and NGOs Exchanges Money transmitters Credit card companies Leasing firms Privatization agencies Factoring firms’ Pawn shops 37 www.forensicscienceng.com FSC Non Bank (contd.) • • • • • • • • • • • Casinos, lotteries & gaming rooms Dealers in precious metals and jewels Accountants Auto dealers Lawyers Notaries Artwork dealers Antique dealers Real estate sales Pension funds Investment advisors 38 www.forensicscienceng.com FSC Fraud Detection 39 www.forensicscienceng.com FSC Fraud detection process • Involves identifying indicators of fraud that suggest a need for further investigation • Indicators are only suggestive of fraud and if investigated might lead to discovery of fraud 40 www.forensicscienceng.com FSC Objective of Fraud Detection • ‘Catching’ Fraud • Preventing fraud • Note that if the risk of rapid detection is high, fraudster are generally less likely to attempt fraud! • Also rapid investigation and follow up can deter repeated fraudulent activities 41 www.forensicscienceng.com FSC Fraud detection • • • • • • Tips and hotlines Accident Financial statement Auditors (SAS No. 99) Internal auditors Inspectors General (e.g. US) Security department (Information security department) 42 www.forensicscienceng.com FSC Fraud Detection in ERM Process • Prevention – First line of defence • Detection – second line of defence • Correction – Third line of defence Fraud detection is part of the larger enterprise risk management! 43 www.forensicscienceng.com FSC Data Mining & Fraud Detection 44 www.forensicscienceng.com FSC Data Mining This is an extractive process of Information Also known as Pattern Data Analysis, has been used to detect fraud as well as tool to improve business processes and better compete in the market. (Beer & Diapers story!) Data is produced at a phenomenal rate and we have more ability to store information therefore users expect more sophisticated results DM- Statistical Analysis + Artificial Intelligence Objective: • Fit data to a model • Obtain potential result that may not be obvious from raw data www.forensicscienceng.com 45 FSC Data Mining Similar Terms • Pattern data analysis • Exploratory data analysis • Deductive learning Tough one! • Unaccompanied Animal couriers – The donkey , the pigeon (Arab world!) 46 www.forensicscienceng.com FSC Sources of Data A: Internal control Data • Reconciliation failure • Control total failure • Exception transactions • Apparent Errors B: Basic tips & hotlines C: Security breaches D: Pattern data • Records and inventory falsifications • Software manipulation • Control override 47 www.forensicscienceng.com FSC Getting started How easy is it to Uncover hidden information in these transactions from : • 100,000,000 cards • up to 400 transactions per second (peak hours) • up to 15,000,000 transactions per day • 3000,000,000 transactions per year 48 www.forensicscienceng.com FSC Know Your Customer (KYC) Examine for coverage of: • Citizens accounts • Business accounts • Monitored Accounts NB! Mine your customers but Remember the have a right to their privacy too! 49 www.forensicscienceng.com FSC The Typical financial fraudster • Male • 36-45 yrs • Commits fraud against his own employer 50 www.forensicscienceng.com FSC Data Mining 51 www.forensicscienceng.com FSC Data mining Essence! • Identification of profile variables (Know Your Customer) • Sampling (very skewed distributions) • Development of the scoring model Optimization criterion: what do we optimize: (Before, During & AfterProfile recognition & predictability • Number of detected fraud transactions? • E.g. -Number of detected fraud cards? • Amount of money saved? Triggers of Likely fraud • Red flags, Red flags that trigger SAR • Suspicious Activity Reporting Requirements 52 www.forensicscienceng.com FSC • • • • • • Data Mining Challenges No “universal fraud patterns” What is normal for one cardholder is unusual for another Fraud patterns changing dynamically Thieves are clever: action => reaction Huge volumes of data Hundreds of transactions per second, millions of accounts 53 www.forensicscienceng.com FSC Data Mining Data mining is also known as Pattern Data Analysis. • Data Mining employs different rules such as association and classification rules therefore different form database monitoring . • Normal data monitoring fail because of random error or loopholes in the controls, monitoring process and reporting process 54 www.forensicscienceng.com FSC Why standard fraud indicators fail! Standard fraud indicators can fail when fraudsters intentionally circumvent then by manipulating the very data that are normally used to signal possible fraud eg • Records and inventory classification • Software manipulation • Control override 55 www.forensicscienceng.com FSC Data Base Vs Data Mining Database: • Find all credit applicants with the last name Awolade • Identify customers who have saved more that $15,000 last month Data Mining • Find all applicants who are poor credit risks (Classification) • Identify customers with similar buying habits (clustering) • Find all items which are frequently purchased with beer 56 www.forensicscienceng.com FSC Data Mining Models & Tasks Data Mining has both models • Predictive • Descriptive Predictive • Classification • Regression • Time series analysis • Prediction 57 www.forensicscienceng.com FSC Descriptive • Clustering – groups data together into clusters • Summarization – maps data with associated descriptionCharacterization and generalization • Association rules • Sequence discovery • Link Analysis Uncovers relationship among data – Affinity analysis , association rules, sequential analysis determines sequential patterns 58 www.forensicscienceng.com FSC Predictive • E.g. - Time series analysis • Example of stack market • Predict future values • Determine similar pattern over time • Classify behaviorr 59 www.forensicscienceng.com FSC Data Mining & Knowledge Discovery in Databases • Data mining involves use of algorithms to extract the information and patterns derived by the KDD process • KDD is Knowledge Discovery in Databases: It is the process of finding useful information and patterns in data. 60 www.forensicscienceng.com FSC Data mining process (SEMMA) • • • • • Sampling Exploration Modification Model Assessment 61 www.forensicscienceng.com FSC Data driven fraud detection • Sample: Select data with some fraud cases • Explore: work with sample and identify fraud predictors • Modify : consider revising sample and set of predictors • Model: use predictors to develop a prediction mode; • Assess: Apply model to test samples. Assess performance 62 www.forensicscienceng.com FSC Data mining Vs human processing • Can uncover fraud that would go unnoticed • Humans are not capable of processing more that a handful of data items when making decisions • Humans are not capable of monitoring huge volume of data especially associated with modern business processes • Humans can identify that a the risk of a credit card fraud is high with new accounts but may not know that a card has an elevated risk for fraud. E.g. the type of purchases card holders make can make credit card companies cancelling card the card holders cards. • Eg string of ATM charges made in casino during working hours • Credit card charge for 63 www.forensicscienceng.com FSC Data mining & Fraud detection tools DATA MINING & BUSINESS INTELLIGENCE SOFTWARE • The Micro strategy Business Intelligence platform • SAP Business object • SAS Data mining Other Data –driven fraud detection applications and tools • FraudPoint • Experian Detect • The US IRS Electronic Fraud Detection system ,,, • Actimize employee fraud solution • FraudLabs – Frauds detection web service 64 www.forensicscienceng.com FSC Fraud Detection Vs Collusive Relationships Relationships can be via • • • • • Email communications Fund transfers Financial exchange Memberships in groups Memberships in organisations 65 www.forensicscienceng.com FSC Social Network Analysis: The benefit of social network analysis is that it can sometimes fully identify all major players in a fraud scheme. Police investigators routinely analyze phone rerecords to identify relationships between suspect and the others . (collusive relationships) Applications for fraud detection: • SAS’s social networking analysis model Content Analysis and Text analysis Benford Analysis : Presents another interesting analysis 66 www.forensicscienceng.com FSC Forensic Techniques & Fraud detection Essence: To forensically identify, collect and analyze financial evidence . The goal of the investigator is to collect evidence relevant to the fraud under investigation. Such evidence , when well organised , provides answers to the classic sleuth’s questions regarding to the possible fraud: Who, what , when , when , where, how and why. The most important questions are What was the fraud? What was the loss? 67 www.forensicscienceng.com FSC Steps in building a fraud detection system • Risk analysis and control development • Exploitation of expert knowledge • Knowledge discovery Data mining process (SEMMA) • Sampling • Exploration • Modification • Model • Assessment www.forensicscienceng.com 68 FSC Data driven fraud detection • Sample: Select data with some fraud cases • Explore: work with sample and identify fraud predictors • Modify : consider revising sample and set of predictors • Model: use predictors to develop a prediction mode; • Assess: Apply model to test samples. Assess performance 69 www.forensicscienceng.com FSC Digital / Computer Forensics & Fraud Detection 70 www.forensicscienceng.com FSC Forensic Science is the application of science to legal matters special interest to financial crime investigations: • Digital / Computer forensics • Mobile phone forensics • Criminalisitics • Dactylography • Forensic Evidence • Forensic Identification • Questioned Documentation Examination (Palaeography) 71 www.forensicscienceng.com FSC General Rule of Forensic Investigations! • Every Crime Scene must be processed in the same manner bearing in mind the 7S’s of Crime Scene investigation • The forensic accountant focuses more on the financial records, money or transaction trails but must still abide with the general rule to avoid inadmissibility of evidence 72 www.forensicscienceng.com FSC 7 S’s of CSI 1. 2. 3. 4. 5. 6. 7. Securing the Scene Separating the Witnesses Scanning the Scene Seeing the Scene Sketching the Scene Searching for Evidence Securing and Collecting the Evidence www.forensicscienceng.com FSC Sketch the scene & lable 74 www.forensicscienceng.com FSC www.forensicscienceng.com FSC Digital / Computer Forensics & Fraud Detection Collection and Preservation of Evidence at the crime Scene • The criminalists are trained to collect evidence at the crime scene • They have special training in computer and information systems, which is becoming more important as computer criminals become more sophisticated! - They are called Computer Analysis and Response Team (CART) They are Computer – Specialize Criminalists) 76 www.forensicscienceng.com FSC Digital Forensics- Extraction Methods Logical Extraction File System Extraction Physical Extraction www.forensicscienceng.com FSC Collusive Relationship: Mobile Forensic Analysis Caught 3 suspects Do they know each other or have they contacted mutual parties? What are the important connections? How do they communicate? Is there investigation related data? Were they in the same place and in the same time? 78 www.forensicscienceng.com FSC Forensic Document Examination - Cheque www.forensicscienceng.com FSC Admissibility of expert evidence • In the United States of America, there are two general tests for admissibility. In 1923, in the case of Frye test versus United States (also referred to as Frye test or general acceptance test) it was held that the court will go a long way in admitting expert testimony deduced from scientific principle or discovery which must have gained general acceptance in a particular field it belongs. • Also in 1993, in the case of Duabert versus Merrel Dow pharmaceuticals Inc, the Supreme Court ruled that proof that establishes the scientist reliability of expert testimony must be produced before it must be admitted . • Finally for the FDE to be of important relevance to the justice system they must have appropriate qualification to qualify to give expert testimony and be up to date with developments in their field through continuing education. 80 www.forensicscienceng.com FSC Expertise of Computer Analysis and Response Team They have expertise in 9 areas • Content • Comparison • Transactions • Extraction • Deletion • Format conversion • Keyword searching • Password recovery • Limited source code 81 www.forensicscienceng.com FSC The Investigation teams • • • • Evidence Response Team (ERTs) Questioned Documents Unit Investigative and Prospective graphics unit Racketeering Records unit 82 www.forensicscienceng.com FSC Steps in Forensic Investigations Note: Great care and discipline must be exercised in preserving computer and physical evidence Step 1: Size up the situation Step 2: Log every detail Step 3: Conduct the initial survey Step 4: Assess the possibility of ongoing undesirable activity Step 5: Power down Step 6: Check for Booby traps Step 7: Duplicate the hard drive or other permanent storage unit Step 8: Analyze the Hard drive 83 www.forensicscienceng.com FSC Law Enforcement Database Networks Many databases are helpful during Investigations and Law Enforcement agents have access to them especially in the G8 countries, and other ‘developed countries’! The databases includes: • Automated Fingerprint Identification System (AFIS=IAFIS) • National DNA Index System (NDIS) • Combined DNA Index System (CODIS) • Financial Crimes Enforcement Network (FinCEN) • National Law Enforcement Telecommunications Systems (NLETS) • National Crime Information Center (NCIC) network 84 www.forensicscienceng.com FSC Fraud Investigation Challenges • Bankings’ role in facilitation of the activity • Acceptance of flight capital by western countries • Laws and limitations of other countries • Jurisdictional conflicts and lack of international coordination • Bank Secrecy • Volume and complexity of international transfers of funds www.forensicscienceng.com FSC • Internet based banking • Tax heavens as sanctuaries • Offshore corporations • Having to prove fraudulent transfer • Shortfall of reporting requirements • Criminals influencing Government and Bank support • The widespread use and acceptance of trade mispricing 86 www.forensicscienceng.com FSC Combating Fraud: Measure of Success “Is there anywhere that the Secret Service won’t come looking?” “Anti US regime country, are safest place” www.forensicscienceng.com FSC Conclusion • Fraud detection is an unending challenge because fraudsters are forever inventing fraud schemes • Data Mining must be included in the strategies of financial institutions to be effective in predictive and other modes of fraud detection • Forensic techniques are essential for detection and investigating frauds if they are to be admissible in the law courts • The roles of the regulators, bankers , law enforcement agents must be defined and effective in fraud control • An integrated approach would not eliminate fraud completely but would make a huge impact in detecting and curbing fraud • CCCOBIN must partner with forensic scientists and other stake holders to form a formidable winning team as a way forward 88 www.forensicscienceng.com FSC Acknowledgements The reference materials • Anti money laundering methodology: financial regulations, information security and digital forensic s working together. Flores . D. A et al • Fraud : A guide to its prevention , detection and investigation: PriceWaterHouseCoopers • William S. Hopwood et al Forensic accounting and Fraud Examination : Second ediction : • James Wright : Bank Examinations Techniques • Wojtek Kowalczyk : Detecting fraud with data mining • Celebrite – Roy Shamir • David A. Iacovetti. Financial crimes and emerging criminal trends • Internet online sources 89 www.forensicscienceng.com FSC Thank you Contact details of Presenter Dr Abiodun Osiyemi +2348033008505 CEO: Forensic Science Consultants [email protected] www.forensicsciencng.com 90 www.forensicscienceng.com