1. Fraud and social network analysis
In this section, we discuss how social network analytics can help boost the performance of your analytical fraud detection methods.
2. Is fraud a social phenomenom?
One of the essential questions before analyzing a network regarding fraud, is deciding whether the detection models might benefit from social network analytics.
In other words, do the relationships between people play an important role in fraud, and is fraud a contagious effect in the network? Are fraudsters randomly spread over the network, or are there observable effects indicating that fraud is a social phenomenon?
3. Is fraud a social phenomenom?
We look for evidence that fraudsters are possibly exchanging knowledge about how to commit fraud using a specific social structure. Fraudsters tend to cluster together as they seem to attend the same activities, are involved in the same crimes, use the same set of resources, or even are sometimes one and the same person such as in identity theft.
4. Homophily
Homophily is a concept which stems from sociology. There it implies that people have a strong tendency to associate with others whom they perceive as being similar to themselves in some way.
In a fraud network, homophily implies that fraudsters are more likely to be connected to other fraudsters, and legitimate people are more likely to be connected to other legitimate people. Depending upon the business context and type of fraud, homophily may be present or not. Let's give some examples from our own research.
5. Homophily - social security fraud
Here you see an example of social network analysis for detecting social security fraud. Red nodes correspond to fraudsters and green nodes to non-fraudsters. From the network, it becomes clear that the fraudsters are clustered in a community that indicates homophilic behavior. The idea of social network analysis is to model this effect as accurately as possible.
The function "assortativity_nominal" measures the level of homophily of the network, based on some vertex labeling. If the coefficient is high, that means that connected vertices tend to have the same labels.
6. Identity theft
Social networks can also be used to detect identity theft. In this form of fraud, a fraudster adopts another person’s profile. Examples of identity theft can be found in telecommunications fraud, where fraudsters steal an account from a legitimate customer.
In the network on the left, the legitimate customer (customer 1) calls his or her frequent contacts.
7. Identity theft
The network on the right shows what happens after the fraudster (customer 2) steals the identity of customer 1. Each customer's legitimate calls are shown in green. Because the fraudster continues to call his or her own contacts, the network starts linking customer 1's account with the fraudster's own account. As the red lines indicate, you can now see customer 1 making fraudulent calls to customers H through O, who were previously part of customer 2’s network. This is a clear sign of identity theft.
8. Money mules
Let us extend the network from the previous lesson by indicating whether a beneficiary is a money mule or not. Money mules are persons for which the bank knows that they transferred money acquired illegally.
9. Add attributes to nodes
Here we have the names of the nodes and the list of money mule accounts.
For each node, we check whether it is a money mule and add this information as TRUE or FALSE to the node.
We assign a color to each node depending on whether it is a money mule or not.
Here you can see that the information is added to the network.
10. Network with highlighted money mules
The money mules are now clearly noted when plotting the network.
11. Let's practice!
Now let's put these new tools into practice.