Transcript pres1

Calling Card Calls
CALLED PARTY
CALLING PARTY
5E SWITCH
Call detail: time of day, duration,
origin, destination, charged number, …
CARD
DATABASE
CPP
BILL SYSTEM
Billdats
RAMP
Scampweb
FRAUD & USAGE
MONITORING GROUPS
CALL DETAIL
DATA WAREHOUSE
SCAMP
GFMS
AT&T SHANNON
R&T LABS
Calling Card Calls
FRAUD & USAGE
MONITORING GROUPS
Charlotte, NC
Work & Strategy
centers
FASC
Fraud Analysis Surveillance
Center
Mark Loper
Scott Davidson
Barbara Jarman
Bridgewater, NJ
Strategy
CARM
Collections and Receivable
Management
Pete Coulter
Rick Budka
Peggy Onorato
Calling Card Calls
AT&T SHANNON
R&T LABS
Colin Goodall
Sylvia Halasz
Hyunsook Lee
Krishnan Eswaran
Gersony Hildebrand(Sandy Hall)
John Mocenigo: GFMS
Daryl Pregibon(Calderbank):Signatures
Rick Greer: Daytona
Anne Rogers(Belanger): Hancock
Data mining of call detail
Daily query and signature updating
Fraud and usage alerts into GFMS
Actual results so far
Number of
cards
used/day
Number of card
sig alerts
generated/day
Number of alerts
worked/day
% of worked
cards taken
down/day
900,000
300
50-70
14-26%
Analogy
distance of
Sun from
Earth
less than once
around the
Equator
Financial results
Amount of uncollectibles on calling cards decreased by ~ $300,000/month (~ 30%)
------- alarms and PFG alerts for AT&T cards 891253 ------109 Card Sig alarms:
6 PFG 137 alarms: cardsig - highest confidence
27 PFG 136 alarms: cardsig - survival model-based
76 PFG 135 alarms: cardsig - high probability ratio
# card signature alerts with the highest confidence of fraud
# for the period 2001-06-10@00:00:00. to 2001-06-11@00:00:00.
# there are 6 card numbers listed
89125394148596539|98
89125392099385357|97
89125333076252335|96
89125321241496143|91
89125320176821960|89
89125333539738110|87
------- alarms and PFG alerts for AT&T cards 891288 -----85 Card Sig alarms:
6 PFG 137 alarms: cardsig - highest confidence
25 PFG 136 alarms: cardsig - survival model-based
54 PFG 135 alarms: cardsig - high probability ratio
# card signature alerts with the highest confidence of
fraud
# for the period 2001-06-10@00:00:00. to 2001-0611@00:00:00.
# there are 6 card numbers listed
8912889723422305|96
8912886916966205|89
8912884740803348|89
8912886650531900|89
8912887889508404|89
8912882692303903|87
------- alarms and PFG alerts for AT&T cards other than 891253 and 891288 ------81 Card Sig alarms:
1 PFG 137 alarms: cardsig - highest confidence
7 PFG 136 alarms: cardsig - survival model-based
73 PFG 135 alarms: cardsig - high probability ratio
# card signature alerts with the highest confidence of fraud
# for the period 2001-06-10@00:00:00. to 2001-06-11@00:00:00.
# there are 1 card numbers listed
9370360670|86
------- alarms and PFG alerts for non-AT&T cards (LEC, Commercial) ------9 Card Sig alarms:
3 PFG 136 alarms: cardsig - survival model-based
6 PFG 135 alarms: cardsig - high probability ratio
# card signature alerts with the highest confidence of fraud
# for the period 2001-06-10@00:00:00. to 2001-06-11@00:00:00.
# there are 0 card numbers listed
 CARD USAGE db and Alerts
•
180 days x 10 summary statistics/card
calls/secs/rate/zeros attemps x domestic/international
•
Dollar based thresholding for
day,week, month, quater
•
Card specific threshold
Bus/Res, ULI, usage and payment history
•
Daytona/Hancock/QuickBin
time & memory, data structures & locality
 Canonical Card No. & CARDINFO db
17
10 (TLN)
16
7,8,9 (Time Choice)
Card aliases
 RAMP CPP/LSA/CSMS connectivity
BusRes discernment
BTN/PAccount
card no.’s
 Parallel screenscrape
180k lookups/hour
 Subscription Fraud
•
Known fraudsters, training data for multiple signatures
•
Enterprise Miner




Cluster Analysis
Discriminant Analysis
Association Rules
Decision Trees
 Modeling
Threshold on card distribution quantiles

Multiple fraud distributions
 Signature enhancement

More components

Multiple distributions/card
