Insider Fraud: Protect with insider threat management

Cross-Platform Search:

The cross-platform search allows investigators the ability to search any term across any monitored application. For example, to find all users who accessed a specific customer account within a specific timeframe. This search can be easily performed on recorded data from a specific platform or on data recorded from several platforms.

Reports:

The solution is able to report on myriad data including user actions, generated alerts and any other data related to defined entities in the system. A number of pre-configured reports are available to go along with a robust custom reporting engine.

At this point, the investigator can choose how to best resolve the alert by marking it as:

• False Positive
• Justified (meaning the alert is legitimate, but not valid in this case)
• Fraud

If further investigation is required in order to determine the cause of the fraudulent or suspicious event, the users can take advantage of the Case Management functionality within the Investigation Center. Further information about Enterprise Case Management is available.

How the analytics work

During initial implementation and onboarding, pre-configured analytics are deployed based on the use cases under consideration by the customer. These analytics are based on the library of scenarios available within the Insider and Employee Fraud solution or can be configured on a custom, case-by-case basis as needed. For some use cases, this enables the solution to immediately begin identifying high-risk behavior. This is typically able to occur with more binary use cases, such as policy violations.

In parallel, as the system begins to monitor user behavior it also begins to understand what is normal for employees. As these baselines are established, the solution will begin to raise incidents on a wider range of scenarios. This could include a user performing action more often than they typically do within a work day or a user performing an activity that is not typically performed by someone with their same role.

Machine learning

In addition to identifying known scenarios and anomalous behaviors, Bottomline’s Fraud and Financial Crime Management solutions incorporate machine learning to further refine their analytical capabilities and increase fraud detection capabilities. The solutions utilise supervised and unsupervised learning techniques in order to maximise the analytic capabilities of the solution. Machine learning enables the analytics engine to discover previously unknown anomalies, reduce false positives and continuously refine the analytics based on user interaction with the generated alerts.

These machine learning capabilities are particularly effective as they leverage the depth of fraud detection expertise that the solution provides. All machine learning algorithms are built to leverage expert-defined features within the data while also building in insights from the high-risk behavior and policy violations identified by the standard analytics engine. By leveraging these data points, Fraud and Financial Crime Management is able to provide more insightful and meaningful results for compliance officers.

Leakage of sensitive information/data theft

• Performing account/customer inquiries, above the average expected number
• Performing an excessive number of account/ customer prints
• Performing an excessive number of common name searches
• Performing an excessive number of detailed inquiries without subsequent monetary transaction
• Behaving inappropriately for a given role (e.g., off-hours inquiries, examining other departments’ accounts, inquiring on accounts from other states/ regions/countries)
• Performing a customer inquiry on a customer who belongs to a VIP active list
• Downloading large amounts of information

Policy violations

• Accessing accounts of coworkers
• Opening a multiple number of low or no balance accounts
• Performing a customer inquiry on a customer who belongs to a VIP active list
• Performing excessive number of refund transactions over the last 7 days
• Performing a money transfer(s) on their own account
• Performing fee reversal(s) on their own account
• Performing account/customer inquiries, above the average expected number
• Performing a service transaction on their own account

Embezzlement

Account has monetary transaction(s) of a certain category with a large total amount

• Account with excessive transactions of a certain category
• Branch has excessive number of transactions of a certain category on accounts of a certain type
• Employee own account has an excessive number of transactions of a certain category
• Employee performs a monetary transaction on an account which doesn’t have any recent activities
• Employee performs withdrawals from escheatable accounts

Internal account takeover

Account has monetary transaction(s) of a certain category with a large total amount

Account is logged in multiple times from multiple different IP addresses at once

Logging in from new IP address

Logged in from an implausible geo-location based on last login time and place

Deviation from normal working behaviors (e.g., off-hours inquiries, examining other departments’ accounts, inquiring on accounts from other states/ regions/countries)

Employee logged in without swiping badge