Network-based fraud detection

Spotting fraud by looking across many organizations instead of inside just one.

One bank may see a single application that looks fine. A network can see that the same pattern is turning up at several institutions.

A detection approach that uses signals from multiple organizations, rather than only an institution's own data, to identify fraudsters, devices, and patterns that repeat across the network. A signal is a piece of evidence, such as a match to an identity that was a problem elsewhere.

A network-based approach works in a few steps:

1. Each participant contributes information about fraud it has confirmed, in a protected form.
2. When a new case arrives, the participant checks it against what the network knows.
3. The check returns a signal if the identity or pattern has appeared elsewhere.
4. The participant combines the signal with its own data and rules to decide what to do.

Networks can look for several kinds of pattern:

• Repeat actors, such as the same person or device returning after being caught elsewhere.
• Shared attributes, such as details that link applications at different institutions.
• Coordinated activity, such as rings that spread an attack across many targets.

The central design question is how the participants collaborate:

• Consortium models send records to a central place that everyone queries.
• Privacy-preserving networks keep raw data in place and return only a limited, de-identified signal.

Network-based fraud detection sits next to terms that are easy to mix up:

• Identity graph links accounts within one organization's own data.
• Fraud ring is a coordinated group, which network views can reveal.
• TrustGraph is Incode's privacy-preserving network for this kind of detection.