Fighting Fraud with Fusion Center Analytics

The problem of financial fraud is growing in size and complexity for both government agencies and corporations. Every digital interaction a person has—doing an internet search, visiting a website, creating a user profile—creates a trail of information and data called “digital exhaust.” Sophisticated fraudsters exploit this rapidly accruing digital exhaust to perpetrate financial fraud—and they're now acting with more advanced technological skill and greater speed and destructiveness than ever before.

Organizations that fail to counter and keep ahead of these evolving threats face many risks. The clearest risk is a significant loss of financial value from the bottom line. But successful fraud exploits also degrade customer experiences, disrupt operations, and generate negative publicity and political backlash. 

To stay ahead of fraudsters, today’s commercial and government organizations need a cohesive, multidisciplinary approach—one that builds on established methods of fraud detection and prevention and deploys a Fraud Fusion Center to deliver next-generation services. This is the advanced approach Booz Allen implements to support large federal programs and Fortune 500 financial institutions in combating fraud.

Harnessing the advantages of this holistic solution means accomplishing four key actions: (1) establish a Fraud Fusion Center operating model, (2) leverage advanced analytics and artificial intelligence (AI) technologies, (3) complement defenses with intelligence tradecraft, and (4) enable continuous improvement with integrated case management. 

Organizations should no longer treat cybersecurity and fraud defense as separate domains. A Fraud Fusion Center integrates an organization’s cyber threat intelligence and cyber defense information and business units with its operational data and fraud detection specialists through the efficient sharing of information about threats and bad actors. By establishing the processes and tools needed for a “fused” cyber and fraud team, the center enhances an organization’s overall security posture and creates a more hostile environment for fraudsters. The unified team hunts together for threats across domains and shares data, surveillance technologies, and case management tools.

Collaboration with both internal stakeholders (such as business units and operating divisions) and external stakeholders is vital to this operating model. Regular coordination, communication, and information sharing around datasets, known and potential threats, and other information make for stronger fraud prevention. Collaboration also extends to law enforcement entities. Organizations that understand law enforcement priorities and resource constraints can refer higher quality cases for investigation. Prosecuting significant offenders and imposing consequences on criminal networks can take fraudsters out of circulation and deter future fraud.

With its centralized operating model, a Fraud Fusion Center helps organizations anticipate threats by detecting indicators of attack in addition to indicators of compromises that are taking place and have already happened. What’s more, consolidating cyber and fraud capabilities into an agile, cohesive organization facilitates rapid tactical coordination to respond to and contain threats. The Booz Allen insight “How a Fusion Center Can Combat Fraud” describes in detail the Fraud Fusion Center approach, its components, and initial steps for successful setup. 

Traditional approaches to fraud prevention are no longer adequate in the face of today’s threats. For example, predictive models are largely trained on known categories of fraud schemes, which means they routinely fail to detect novel techniques that elite hackers develop every day.

More-sophisticated analytics are at the heart of the latest efforts to detect bad actors. It's essential for a Fraud Fusion Center to collect relevant data from multiple sources across the entire organization and beyond, especially data that may be siloed. Furthermore, the latest AI and machine learning (ML) techniques bring new potential to detect patterns and anomalies that suggest underlying process flaws.

Rapidly evolving tactics and tradecraft from the intelligence community, which continuously applies innovations such as AI to more effectively safeguard sensitive data and national security, provide the best options for augmenting and amplifying traditional commercial methods. Achieving these improvements requires advanced analytic technologies that implement Data Operations (DataOps) and ML Operations (MLOps). DataOps and MLOps are automated approaches for the execution, deployment, monitoring, and continuous improvement of analytic methods for fraud detection. When DataOps and MLOps are part of fraud analytics, the benefits are faster releases of analytic models that are automatically and continuously updated to address fast-changing fraudster techniques. 

Traditional fraud detection controls focus on stopping fraud as it happens or afterward, instead of proactively identifying fraudsters and their methods before they can act. Every hour of every day, the intelligence, security, and law enforcement communities confront and detect novel attack methods from sophisticated and relentless adversaries.

These communities’ tradecraft and tactics are continuously improving thanks to AI and other innovations, which are used to safeguard sensitive data and national security. Threat hunting and targeting analysis are examples of intelligence community tradecraft that a Fraud Fusion Center can use to prevent fraud propagation and identify the specific group or individual perpetrating attacks. This intelligence tradecraft solution involves skilled threat hunters first defining and validating fraud targeting needs. Then they methodically analyze dark web forums, darknet marketplaces, proprietary data sources, social media, and other sources to identify threats and anticipate attacks.

When fraudsters are found, analysis of their observed behavior patterns provides additional valuable information for fine-tuning analytical models. With improved analytics, it becomes possible to attribute specific actions to them. In addition, when the real-world identity of a bad actor is known, it’s possible to map their digital footprint to uncover their professional networks and any ties to websites hosting malicious content for perpetrating fraud. Organizations can use this detailed information to build fraud cases that can be referred to law enforcement for possible prosecution. Removing bad actors from circulation and unveiling their networks and behavior help thwart future attacks. 

Many organizations reactively develop manual fraud case workflows and processes as potential threats arise. A more effective and sustainable approach is to integrate case management with the analytics platform—leveraging DataOps and MLOps—to automate workflows, repeatable processes, and feedback loops.

For example, when analytic models detect suspicious transactions or activities, cases are automatically opened and routed to the right person for analysis. In addition, chain of custody and data lineage are maintained for each case, and case outcomes are captured. Organizations can then use this information to help ensure fraud detection models are continuously updated and responsive to changing fraudster behavior. Automated and standardized workflows and business processes have the added benefit of enabling examiners to explore and triage potential fraud cases based on available workloads while improving the performance and efficiency of enterprise systems.

Achieving next-generation fraud detection and prevention services is no longer aspirational. A cohesive solution, centered on a Fraud Fusion Center, is within the reach of every commercial and government organization. The solution is technically feasible thanks to current advances in data analytics and intelligence tradecraft. It's also practical and resource-efficient given today’s collaboration and automation tools. The time is right for organizations to capitalize on the Fraud Fusion Center approach to stay ahead of fraudsters.