Fraud Management System Part4(Different patterns in Fraud Detection)

Different Fraud Patterns-Sequence – eg
The system will detect a sequence of patterns as:
->In a 2 h time window or depends on the business scenario given by the customer ( Time window)
->The user failed 3 logins or depends on the business scenario given by the customer (Accumulation Pattern)
->Downloaded > 300M Bytes or depends on the business scenario given by the customer (Accumulation Pattern)
->Made an access to a blacklisted IP or depends on the business scenario given by the customer (Single Event Pattern)

Sequence Pattern:
Subscriber Checks
->Unknown Entity (e.g. Subscriber/Service)
− Generate an alarm, when a call is received for an unknown service or subscriber

Suspension checks
-Generate an alarm, when call data indicates a call type for which the customer is suspended or barred

Authorization Checks
− Generate an alarm, when call data indicates a call type for which the customer is not explicitly authorized
This logics also applies to the prepaid or postpaid mismatch
Entity Pattern Detection
• User-defined patterns matched against service or subscriber information fed from billing or other customer database:
− Customer Document is Blacklisted
− Dealer Code is 123.*
− Customer name is ~Bartow
New Subscription Checks
• Contact number analysis
• Inactive new subscriber
• Change of installation-defined fields soon after activation
− e.g., change of billing address for identity theft
• Immediate roaming
• Roaming calls not to home country/carrier
High-risk destinations
• Operators can specify high fraud destinations
− Country Code
− Area Code
• Calls to countries or area codes on the high-fraud lists will generate alarms
− “Severe” alarm or “Unusual” alarm
− unless calls to that country or area code are in the service’s profile
• Examples:
− Country Code = 234 Nigeria (Severe)
− Area Code = 305 Miami (Unusual)
Black list checking
• FMS provides unlimited types of Black Lists
• Examples are:
− Service # (subscriber ID)
− Access Point
− From # (A#)
− To # (B#)
− Originating IP address
− Terminating IP address
− Equipment # (wireless)
• Alarm generated when call matches any entry on a black list
− Example: B# = 9785551234
• Partial blacklists match is supported in patterns, with regular expression
Smart thresholds
• Time Intervals tracked
− Time-of day usage
− Daily basis
• Peak and off-peak days, calendar based
• Ability to define free or reduced rate periods (e.g., nights, weekends)
− Weekly basis
− Monthly basis
− Per Call basis
• Seven ways to track usage
− duration, charge, number of calls, data volumes

Related Posts by Categories