Image Based Fraud Detection Technology A White Paper By Mitek Systems, Inc. Mitek Systems, Inc. 14145 Danielson St. Suite B Poway, CA 92064 Phone: 888-363-6767 February 2003 Web: http://www.miteksys.com Image Based Fraud Detection Technology White Paper Table of Contents Check Fraud: An Overview Fraud Detection Technology Review The Limits of Current Technology Next Generation Image Based Fraud Detection Systems Some Future Factors Conclusion Check Fraud: An Overview Check Fraud is often measured along two dimensions: gross dollars attempted and net dollars lost. According to the American Bankers Association (ABA), the gross dollar amount of attempted check fraud has been growing at about 50% per year for the past four years, and was slightly over $4.3 billion in calendar year 2001. Successful check fraud, or net (actual) dollar losses due to check fraud, has remained stable at $650 to $700 million over the same time period. Information technology fraud detection systems get some of the credit for keeping the net dollars lost from growing in parallel with the gross dollars attempted. Another interesting statistic from the ABA divides net dollars lost into several categories, including large and community Banks. Large Bank losses as a percentage of the total are declining. The same group of large banks report preventing over 80% of the attempted frauds. Community Bank losses as a percentage of the total actually doubled in CY 2001, and the reporting group of community Banks in the study prevented less than 50% of the attempted frauds. It would be wise for bankers to assume that criminals planning future check fraud have access to either the ABA study itself or public summaries of the study, and that they possess at least a rudimentary understanding of statistics. This line of thinking suggests that community Banks in particular now face a disproportionate increase in future check fraud attempts. It also suggests that there is room for improvement in making more affordable and effective systems for all Banks, and for helping Community Banks implement these systems more rapidly. Fraud Detection Technology Review To understand how to make improvement in fraud detection systems, it is helpful to understand the current scope and function of these systems. The major focus here is to describe and categorize the current generation of check fraud technologies, and to identify the kinds of check fraud that are not being detected at present due to limitations in the current systems. According to the ABA, the most common type of check fraud was forgery of check signatures and endorsements. A number of check imaging and document imaging vendors position standard image archive and retrieval systems with remote access as fraud protection solutions. These systems provide the ability for a teller to retrieve an image of a signature card or a digital photo of a customer from an archive server. In reality, these are just standard docume nt imaging system functions that are being positioned as ‘fraud protection’. Several vendors of handwriting recognition systems have also produced signature comparison and analysis tools. When incorporated into a Bank wide system, these tools can compare check or item signatures to a good signature master image. If an uncertainty threshold is exceeded, an application incorporating this technology may produce an appropriate alarm to bank personnel. Signature comparison and analysis is a form of image based fraud detection. Another type of fraud ‘prevention’ is based on the use of printed authentication codes. At the time of issue an encrypted code is computed based on some combination of unique elements for each check. Alteration of any negotiable informa tion corrupts the authentication code when the image is processed. This type of system may not be practical for high volumes of personal or business checks. It may be useful in financial operations where there is a low volume of high dollar checks. ost The m widely deployed fraud detection systems in use today are based on pattern analysis of transactions. Such systems are typically an extension or add-on to a check or item processing application. They define a set of transaction variance criteria that are tracked over time in a relational database. When variance exceeds a predefined threshold, an alarm mechanism warns bank personnel. All of these systems require at least 90 days of transaction data on which to base the variance criteria. Some of the typical transaction variance criteria found in these systems include: • Excessive deposit or withdrawal activity • High dollar deposits or withdrawals • Serial # variance These kinds of systems are most widely deployed today in large Banks, and they have a solid track record of helping find and contain some types of check fraud. These systems can be best described as transaction based fraud detection. The Limits of Current Technology In the spring of 2002 one or more criminals used counterfeit Bankers cashier checks in seven or more Banks to commit fraud. Fraud detection systems were unable to detect some or most of these fraudulent items. These cashier checks were likely printed using low cost digital color printing technology, and contained valid bank routing numbers. Some of the items, upon close inspection, contained subtle differences in image when compared to authentic cashier checks. For example, background and printed text colors of the forged items were slightly different than authentic items. Another common check fraud involves the theft of bill payment envelopes from home mailboxes. Personal checks intended for standard bill payment are removed from the envelopes. The payee and amount information is altered on the checks and then presented. Transaction based fraud detection systems may not detect either of the above cases, because the items do not contain any transaction variance criteria that exceed defined thresholds. These particular fraud examples point towards a need for better image based fraud detection. Next Generation Image Based Fraud Detection Systems One of the great benefits of the PC and microprocessor revolution has been the tremendous decline in the cost of raw computing power. This has a direct impact on image processing systems…it makes them much more affordable and practical from an implementation and support standpoint. A check or financial instrument, once captured in a digital image format, can be broken down by next generation image based fraud systems into multiple sub- components. Sophisticated and specific tests can be defined by sub-component. Sub- component tests can also be aggregated into a single overall score for the whole image. This approach provides Banks and their vendors with an ongoing set of tools to tune image analysis against fraud attacks of varying types. For example, based on known past patterns of fraud in a particular city, a Bank may define template settings for image analysis as follows: • A summary score by image plus a signature score for all items over $1,000 US dollars. • A summary score by image plus signature score plus payee name, CAR, and LAR image zone analysis for all items over $5,000 US dollars. The same Bank may add a sub-zone logo analysis for all items of any amount based on awareness of new, low dollar fraud incidents in a nearby town. What is new and powerful about next generation sub-component image analysis systems is their ability to rapidly establish and then revise combinations of fraud detection tests using affordable PC platforms. Here is a more detailed diagram of the components and functions of this next generation image based fraud technology running as an integrated subsystem within a Proof of Deposit operation. Central Check 2b. Set template tests by acct # Processing s ster t Ma Site 1. S elec POD Fraud Protect Image Server Administration 2a. (FPA Console) Iden ti By A fy Maste 4a. cct # rs Pro Ima cess ges New vs. 'O Ma nus' 6. A on S ste r lert usp Ethernet FP ect s AC s nfig e co writ ons t #, cct # acc ole ate a alid by FraudProtect se 3. V aba Server dat ults to res rite 5. W POD Database Server 4b. Process New 'Onus' Images vs. Master Ethernet Remote Office Windows PC Branch Capture Device Some Future Factors Even before the events of September 11, 2001 impacted the Federal Reserve’s transit item air transportation system, the concept of digital image network exchange clearing had significant momentum. It has become clear to many industry observers that the pending passage of the Check Truncation Act will start a potentially rapid migration in the handling of transit items. This migration will shift the transit item workload in a typical Bank away from slower, hardware and transport workflow centric operations to faster, network software centric modes of operation. This shift has obvious potential to improve the speed and resilience of the check payment system. But it can also improve the speed and effectiveness of transit item fraud detection. Large network connected image processing data center exchanges are the ideal place for scalable image base fraud detection systems. Fraud patterns across wide geographic regions can be detected in real time. Successful detection tests can be applied almost instantly. While individual Banks should adopt fraud detection systems to handle ‘on us’ items, it will be up to the electronic and image exchanges to provide such services for ‘transit’ items. Note the following diagram: Exchange Image Member Exchange Banks Data Center Good Master Images (GMI) Transit Item Images (TII) Fraud Protect Console Image Bank 1 Servers GMI Ethernet TII IPsec Fraud Protect Servers Bank 2 VPN Alert Member on Suspect TII Member GMI Database Servers Bank N Conclusion The ABA statistics on losses from check fraud make it clear that vendors who really want to help Banks with anti- fraud technology need to focus on continuous improvement. Image component sub-analysis is especially attractive because it provides the flexibility and responsiveness that Banks need to react to constantly evolving fraud techniques perpetrated by criminals. About Mitek Systems Mitek Systems is a leading provider of check imaging software for financial institutions, and an established global supplier of embedded software recognition engines. These engines process over 8 billion checks and other documents per year for a variety of OEM and reseller partners. Mitek helps reduce operating costs by automatically reading, classifying and processing high volumes of checks and documents. Our applications also help customers implement new image document Web Services for Internet and intranet configurations. For more information about Mitek Systems, contact us at 14145 Danielson Street, Suite B, Poway, CA 92064; 858-513-4600 or visit our Web site at www.miteksys.com.
Pages to are hidden for
"Check Fraud Detection whitep1"Please download to view full document