How Do Fraud Applications Work?

Fraud management is used to detect possible fraud that could be carried out through customer accounts, and because it provides additional security when necessary for transactions on those accounts, it is one of the top priorities for banks.

Fraud management is basically divided into two categories: Application Fraud and Transaction Fraud. In this article, I will discuss Transaction Fraud.

So how do banks manage transaction fraud?

First, banks identify fraud cases that have occurred in the past and those that are likely to occur in the future. They define separate scenarios for each case.

The actions to be taken when transactions matching the defined scenarios are caught are also defined within the fraud application. In short, a scenario definition can be divided into two parts: Scenario Conditions and Actions. In the condition definition, transactions matching the specified criteria are caught; in the action definition, the action to be taken for a transaction matching that condition is determined.

For example, consider a scenario with the following criteria:

• For wire transfer transactions
• If the transaction amount is 10,000 TL or more,
• If a transfer is being made from that account to the receiving account for the first time,
  • Send an SMS to the customer.
    • If the SMS code is correct, carry out the transaction.
    • If the SMS code is incorrect, block the transaction." Let's imagine a scenario written like this.

• No SMS is sent for any wire transfer transaction up to 9,999 TL, since it does not meet the scenario's rule criteria.
• Or, if no other scenario is defined, no SMS is sent for EFT transactions of 10,000 TL or more either, since they are not wire transfers.

In a cash withdrawal scenario defined for a customer's ATM transactions as follows:

• For cash withdrawal transactions of 1,000 TL or more
• Between 18:00 and 09:00,
• If this is the first transaction made with that card at that ATM
• Ask for the last 2 digits of the date of birth.
  • If the date of birth is entered correctly, continue with the transaction
  • If the date of birth is entered incorrectly, block the transaction." Let's imagine a scenario written like this.

• Cash withdrawal transactions made between 09:01 and 17:59
• Transactions under 1,000 TL
• If the customer has previously made a successful cash withdrawal at that ATM, the date of birth is not asked; in other cases, the date of birth is asked.

The scenarios I mentioned above cover what we call real-time fraud checks, performed before the transaction is carried out.

So is transaction fraud management only performed before the transaction? Isn't it done afterward as well?

Fraud management can also be performed immediately after transactions are carried out. This is called Near Real Time fraud management.

Just like real-time fraud management, near real-time fraud management is also handled through scenarios. Here too, actions to be taken at the end of the scenarios are defined.

For example, in a scenario written as follows:

• Made with the same card from different countries within 5 minutes,
• After the 3rd authorization transaction
  • Temporarily close the card, and
  • Automatically call the customer." Let's imagine a scenario defined like this.

Since it is highly unlikely for the same card to be used from different country locations within the same time window, the card is temporarily closed for control purposes, preventing any further transactions. The customer is called automatically, and either confirms that they made the transaction, or states that the transactions were not made by them. If the transactions were made by the customer, the card is reactivated. If they were not made by the customer, the card is permanently closed with the customer's confirmation. If the customer requests a new card, a card with a different card number is reissued to the customer.

How is the "if it's being done for the first time" check, mentioned several times above, actually performed?

This check is referred to as statistics management. For example, a statistics definition is created specifying that a card's cash withdrawal transactions at an ATM will be tracked in a table. Once this definition is created, data starts to accumulate in the corresponding statistics table. You can think of each statistics definition as a separate table. For a statistics definition that tracks whether a given card has transacted at a given ATM, it is enough to keep a two-column table consisting of the card number and the ATM number. Statistics tables are updated daily.

For scenarios that rely on statistics, it is important that the statistics definition has already been created, and that it runs before the scenario definition.

In payment system transactions, it is important for transactions to be answered end-to-end within a certain time frame (usually 20 seconds). Since the fraud application is itself a step within that end-to-end completion time, catching fraudulent transactions is not the only thing that matters in fraud management. It is equally important to perform fraud checks on transactions and respond as quickly as possible. For this reason, the scenarios and statistics definitions used to manage the fraud system need to have very good performance.

The performance of fraud management is directly related to building the integration between banking applications, the bank's authorization system, and the fraud system on solid foundations. For this reason, when setting up such systems, clearly determining the current state of these three structures and how they affect one another has a direct impact on the fraud system's performance.

In a project I was previously part of, we designed an end-to-end fraud system taking all of these structures into account. We delivered a very successful project in terms of transaction performance, a parametric structure the user could manage, and user satisfaction. Catching, in the very first week, a single fraud case large enough to cover the entire cost of the project was a reward of its own for us.

In short, while fraud is extremely important for banks, when transaction performance and parametric management are also kept at a high standard, the system's effectiveness and operational performance reach a satisfying level as well.