2: Bar chart of fraud types from 51 unique and published fraud detection papers. The most recent publication is used to represent previous similar publications by the same author(s). 

Contexts in source publication

Context 1

... temporal information. Not only does insurance (pathology provider) data described in Yamanishi et al (2004) lack temporal information, the other attributes such as proportion of tests performed are not effective for fraud detection. Almost all the data has been de-identified, apart from Wheeler and Aitken (2000) which describes the use of identity information such as names and addresses from credit applications. While most telecommunication account data are behavioural, Rosset et al (1999) includes de-identified demographic data such as age and ethnicity for the telecommunications customer. There are no publicly available data sets for studying fraud detection, except for a relatively small automobile insurance data set used in Phua et al (2004). And obtaining real data from companies for research purposes is extremely hard due to legal and competitive reasons. To circumvent these data availability problems and work on a particular fraud type, one alternative is to create synthetic data which matches closely to actual data. Barse et al (2003) justifies that synthetic data can train and adapt a system without any data on known frauds, variations of known fraud and new frauds can be artificially created, and to benchmark different systems. In addition, they summarised important qualities which should be in simulated data and proposed a five- step synthetic data generation methodology. Barse et al (2003) reported that use of simulated data had mixed results when applied to real data. Three out of the 51 papers presented in Figure 2.2 used simulated data but the credit transaction data was either not realistic (Chen et al , 2004; Aleskerov et al , 1997) or the insurance data and results were not explained (Pathak et al , 2003). The next alternative, according to Fawcett (2003), is to mine email data for spam because researchers can study many of the same data issues as fraud detection and the spam data is available publicly in large quantities. In contrast to the structured data collected for fraud detection, unstructured email data will require effective feature selection or text processing operations. Most fraud departments place monetary value on predictions to maximise cost savings/profit and according to their policies. They can either define explicit cost (Phua et al , 2004; Chan et al , 1999; Fawcett and Provost, 1997) or benefit models (Fan et al , 2004; Wang et al , 2003). Cahill et al (2002) suggests giving a score for an instance (phone call) by determining the similarity of it to known fraud examples (fraud styles) divided by the dissimilarity of it to known legal examples (legitimate telecommunications account). Most of the fraud detection studies using supervised algorithms since 2001 have abandoned measurements such as true positive rate (correctly detected fraud divided by actual fraud) and accuracy at a chosen threshold (number of instances predicted correctly, divided by the total number of instances). In fraud detection, misclassification costs (false positive and false negative error costs) are unequal, uncertain, can differ from example to example, and can change over time. In fraud detection, a false negative error is usually more costly than a false positive error. Regrettably, some recent studies on credit card transactional fraud (Chen et al , 2004) and telecommunications superimposed fraud (Kim et al , 2003) still aim to only maximise accuracy. Some use Receiver Operating Characteristic (ROC) analysis (true positive rate versus false positive rate). Apart from Viaene et al (2004), no other fraud detection study on supervised algorithms has sought to maximise Area under the Receiver Operating Curve (AUC) and minimise cross entropy (CXE). AUC measures how many times the instances have to be swapped with their neighbours when sorting data by predicted scores; and CXE measures how close predicted scores are to target scores. In addition, Viaene et al (2004) and Foster and Stine (2004) seek to minimise Brier score (mean squared error of predictions). Caruana and Niculescu-Mizil (2004) argues that the most effective way to assess supervised algorithms is to use one metric from threshold, ordering, and probability metrics; and they justify using the average of mean squared error, accuracy, and AUC. Fawcett and Provost (1999) recommend Activity Monitoring Operating Characteristic (AMOC) (average score versus false alarm rate) suited for timely credit transactional and telecommunications superimposition fraud detection. For semi-supervised approaches such as anomaly detection, Lee and Xiang (2001) propose entropy, conditional entropy, relative conditional entropy, information gain, and information cost. For unsupervised algorithms, Yamanishi et al (2004) used the Hellinger and logarithmic scores to find statistical outliers for insurance; Burge and Shawe-Taylor (2001) employed Hellinger score to determine the difference between short-term and long- term profiles for the telecommunications account. Bolton and Hand (2001) recommends the t -statistic as a score to compute the standardised distance of the target account with centroid of the peer group; and also to detect large spending changes within accounts. Other important considerations include how fast the frauds can be detected (detection time/time to alarm), how many styles/types of fraud detected, whether the detection was done in online/real time (event-driven) or batch mode (time-driven) (Ghosh and Reilly, 1994). There are problem-domain specific criteria in insurance fraud detection. To evaluate automated insurance fraud detection, some domain expert comparisons and involvement have been described. Von Altrock (1995) claimed that their algorithm performed marginally better than the experienced auditors. Brockett et al (2002) and Stefano and Gisella (2001) summed up their performance as being consistent with the human experts and their regression scores. Belhadji et al (2000) stated that both automated and manual methods are complementary. Williams (1999) supports the role of the fraud specialist to explore and evolve rules. NetMap (2004) reports visual analysis of insurance claims by the user helped discover the ...

Context 2

... reference to figure 2.1, the profit-motivated fraudster has interactions with the affected business. Traditionally, each business is always susceptible to internal fraud or corruption from its management (high-level) and non-management employees (low-level). In addition to internal and external audits for fraud control, data mining can also be utilised as an analytical tool. From figure 1, the fraudster can be an external party, or parties. Also, the fraudster can either commit fraud in the form of a prospective/existing customer (consumer) or a prospective/existing supplier (provider). The external fraudster has three basic profiles: the average offender, criminal offender, and organised crime offender. Average offenders display random and/or occasional dishonest behaviour when there is opportunity, sudden temptation, or when suffering from financial hardship. In contrast, the more risky external fraudsters are individual criminal offenders and organised/group crime offenders (professional/career fraudsters) because they repeatedly disguise their true identities and/or evolve their modus operandi over time to approximate legal forms and to counter detection systems. Therefore, it is important to account for the strategic interaction, or moves and countermoves, between a fraud detection system’s algorithms and the professional fraudsters’ modus operandi . It is probable that internal and insurance fraud is more likely to be committed by average offenders; credit and telecommunications fraud is more vulnerable to professional fraudsters. For many companies where they have interactions with up to millions of external parties, it is cost-prohibitive to manually check the majority of the external parties’ identities and activities. So the riskiest ones determined through data mining output such as suspicion scores, rules, and visual anomalies will be investigated. Figure 2.2 details the subgroups of internal, insurance, credit card, and telecommunications fraud detection. Internal fraud detection is concerned with determining fraudulent financial reporting by management (Lin et al , 2003; Bell and Carcello, 2000; Fanning and Cogger, 1998; Summers and Sweeney, 1998; Beneish, 1997; Green and Choi, 1997), and abnormal retail transactions by employees (Kim et al , 2003). There are four subgroups of insurance fraud detection: home insurance (Bentley, 2000; Von Altrock, 1997), crop insurance (Little et al , 2002), automobile insurance (Phua et al , 2004; Viaene et al , 2004; Brockett et al , 2002; Stefano and Gisella, 2001; Belhadji et al , 2000; Artis et al , 1999), and medical insurance (Yamanishi et al , 2004; Major and Riedinger, 2002; Williams, 1999; He et al , 1999; Cox, 1995). Credit fraud detection refers to screening credit applications (Wheeler and Aitken, 2000), and/or logged credit card transactions (Fan, 2004; Chen et al , 2004; Chiu and Tsai, 2004; Foster and Stine, 2004; Kim and Kim, 2002; Maes et al , 2002; Syeda et al , 2002; Bolton and Hand, 2001; Bentley et al , 2000; Brause et al , 1999; Chan et al , 1999; Aleskerov et al , 1997; Dorronsoro et al , 1997; Kokkinaki, 1997; Ghosh and Reilly, 1994). Similar to credit fraud detection, telecommunications subscription data (Cortes et al , 2003; Cahill et al , 2002; Moreau and Vandewalle, 1997; Rosset et al , 1999), and/or wire-line and wire-less phone calls (Kim et al , 2003; Burge and Shawe-Taylor, 2001; Fawcett and Provost, 1997; Hollmen and Tresp, 1998; Moreau et al , 1999; Murad and Pinkas, 1999; Taniguchi et al , 1998; Cox, 1997; Ezawa and Norton, 1996) are monitored. Credit transactional fraud detection has received the most attention from researchers although it has been loosely used here to include bankruptcy prediction (Foster and Stine, 2004) and bad debts prediction (Ezawa and Norton, 1996). Employee/retail (Kim et al , 2003), national crop insurance (Little et al , 2002), and credit application (Wheeler and Aitken, 2000) each has only one academic publication. The main purpose of these detection systems is to identify general trends of suspicious/fraudulent applications and transactions. In the case of application fraud, these fraudsters apply for insurance entitlements using falsified information, and apply for credit and telecommunications products/services using non-existent identity information or someone else’s identity information. In the case of transactional fraud, these fraudsters take over or add to the usage of an existing legitimate credit or telecommunications ...