Risk and Revenue Modeling Group AT&T Labs 12 - June - 2001 AT&T Proprietary 1 Call detail: time of day, duration, origin, destination, charged number,

Risk and Revenue Modeling Group

AT&T Labs

12 - June - 2001 AT&T Proprietary 1

Call detail: time of day, duration, origin, destination, charged number, …

Scampweb

CALLING PARTY CALLED PARTY

5E SWITCH

CARD DATABASE

CPP

BILL SYSTEMBilldats RAMP

CALL DETAILDATA WAREHOUSE

SCAMP

Calling Card Calls

FRAUD & USAGEMONITORING GROUPS

AT&T SHANNONR&T LABS

GFMS


AT&T Labs


Charlotte, NC

Work & Strategy centers

FASC/CPC/FRAT

Fraud Analysis Surveillance Center

Mark Loper

Scott Davidson

Barbara Jarman

Bridgewater, NJ

Strategy

CARM

Collections and Receivable Management

Pete Coulter

Rick Budka

Peggy Onorato

Calling Card Calls

FRAUD & USAGEMONITORING GROUPS


AT&T Labs


Colin GoodallSylvia HalaszHyunsook LeeKrishnan Eswaran

Gersony Hildebrand(Sandy Hall)John Mocenigo: GFMS

Daryl Pregibon(Calderbank):SignaturesRick Greer: DaytonaAnne Rogers(Belanger): Hancock

Data mining of call detailDaily query and signature updatingFraud and usage alerts to GFMS

Calling Card Calls

AT&T SHANNONR&T LABS


AT&T Labs


Actual results so far

Number of cards used/day

Number of card sig alerts

generated/day

Number of alerts worked/day

% of worked cards taken down/day

900,00015000 million signatures

300 50-70 14-26%

Analogy

distance of Sun from Earth

less than once around the Equator

Financial results

Amount of uncollectibles on calling cards decreased by ~ $300,000/month (~ 30%)


AT&T Labs


------- alarms and PFG alerts for AT&T cards 891253 -------

109 Card Sig alarms:

6 PFG 137 alarms: cardsig - highest confidence

27 PFG 136 alarms: cardsig - survival model-based

76 PFG 135 alarms: cardsig - high probability ratio

# card signature alerts with the highest confidence of fraud

# for the period 2001-06-10@00:00:00. to 2001-06-11@00:00:00.

# there are 6 card numbers listed

89125394148596539|98

89125392099385357|97

89125333076252335|96

89125321241496143|91

89125320176821960|89

89125333539738110|87

------- alarms and PFG alerts for AT&T cards 891288 -------

85 Card Sig alarms:





# for the period 2001-06-10@00:00:00. to 2001-06-11@00:00:00.


8912889723422305|96

8912886916966205|89

8912884740803348|89

8912886650531900|89

8912887889508404|89

8912882692303903|87


AT&T Labs


------- alarms and PFG alerts for AT&T cards other than 891253 and 891288 -------

81 Card Sig alarms:





# for the period 2001-06-10@00:00:00. to 2001-06-11@00:00:00.


9370360670|86

------- alarms and PFG alerts for non-AT&T cards (LEC, Commercial) -------

9 Card Sig alarms:




# for the period 2001-06-10@00:00:00. to 2001-06-11@00:00:00.



AT&T Labs


ISSUE PRIORITYOWNER

(S)STATUS

#002LSA Ids Obtain user ids for the purpose of view access of LSA.

Med Peggy OPEN

· 5/17/01 Peggy will obtain LSA ids for Colin and Sylvia and Gersony. Requests submitted to Janice Forner 5/18/01.· 5/23/01 Unix id forms submitted for Colin & Sylvia. Pending for Gersony. · 5/24/01 Waiting for id’s from id administrator.· 5/31/01 Ids received for Colin & Sylvia. Pending for Gersony. · 6/5/01 Need to get IP addresses for Unix and PC applications. Peggy will check with Janice Forner for info. Scott Davidson or Cale Douglas are alternate contacts.

#003Consolidation of duplicate alerts.Consolidate duplicate alerts occurring within Card Sig database.

HighColinSylvia

OPEN

· 5/3/01 Peggy will contact Joe Adams to gain understanding of card formatting. · 5/8/01 Info received via email from Joe (cc’d to Colin/Sylvia). · 5/10/01 Work in progress.· 5/17/01 Work in progress. Mapping of alerts to be complete 5/21/01.· 5/24/01 Working 1st draft for elimination of duplicate card numbers. This will be running by end of week. Further fine-tuning is needed but basics are there.· 5/31/01 Co-Dependent on Issue #004a, Creation of Usage Database. Work in Progress. · 6/5/01 Database is work in progress.

#004aCreation of Usage Database.Create card daily usage database to be used for $$ based thresholds (and other functions.)

HighDependent on issues #004b

and #005.

ColinSylvia

OPEN

· 5/17/01 Work in progress. Database to be complete by 5/28/01. (This effort is dependent on consolidation of duplicate alerts scheduled to complete 5/21/01.)· 5/24/01 Work in progress.· 5/31/01 Work in progress. · 6/5/01 Colin has ironed out computational issues with getting database populated. He will continue to build up database with additional history.

#004bDevelopment of Dollar Based Thresholding incorporating Usage Level Indicators (ULIs)

High

Dependent on issues #004a

and #005.

GersonyColinSylviaPeggy

OPEN

· 6/5/01 Revenue Stratification under development by Gersony. This is being developed using the Usage Database, which is currently being uploaded with more history. The team is pursuing the addition of ULI indicators (taken from CSMS) to the $$ based thresholding logic. Peggy will contact CSMS (Jim Sprandle/Dennis Lindley) for access to CSMS and possible data dump of ULIs.


AT&T Labs


#005PFGs for $$ Based Thresholding Create usage based alerts using revenue stratification.

HighDependent on issues #004a & #004b

ColinSylvia

OPEN

5/3/01 Development of PFGs is in progress per Nick Borrelli (email to Peggy 5/3) 5/10/01 PFG’s in the 130 range would be used. Colin has them available. Work in progress. 5/17/01 Per Nick, development is still in progress. Rick will check with Nick to see specifically who is working on the development. Bus/Res Discernment is crucial to this effort. 5/24/01 Work in progress. Stratification still being developed. 5/31/01 Work in progress. 6/5/01 Revenue Stratification and Usage Database under development.

#007Subscription Fraud Analysis - 1st pay default Build a tool to allow cross referencing of cards, BTNs and GFMS alert history in an effort to better define the amount of coverage GFMS is giving in terms of card alarms on accounts that went to write off.

HighPeggyColin

OPEN

Colin will use script logic to cross reference card numbers, and BTNs with GFMS alert history to perform analysis. 5/31/01 Work in progress. 6/5/01 Three steps involved: We need to figure what exactly we want to get out of GFMS database. We want to look at a whole range of alerts. 1. Make sure we have all card activity for a given a list of card numbers. 2. Query GFMS to get set of all alerts to see where we are generating and where we are not. Get history of alert handling from GFMS. 3. Look into developing and extending signature approaches to subscription fraud. Work in progress

#008

Web BrowserObtaining access to the Web browser database being developed for the FASC. This database will contain card history allowing the reps 24/7 access to info even when systems are down.

MediumPeggyColin

OPEN

5/24/01 Peggy and Colin will talk with Lou to gain access to this browser. Colin will assist in database development by providing a data exchange of info provided from GFMS. 5/31/01 Peggy is in the process of setting up a meeting with Lou. 6/5/01 Peggy has not heard from Lou. She will continue to pursue.


AT&T Labs


#010Rolling Windows – Fraud Detection for Commercial CardsDevelop PFG107 &108 Fraud Suspect Alarm logic for Commercial Cards. Generate alerts on a rolling five window basis. Fraudsters know thresholds and tend to stay under them. This would help prevent this.

High

Mark LoperCheryl

BroomeColin

OPEN 6/5/01 Mark and Cheryl will document specifics and send them to Colin.

#001 RACF IDS for Bus/Res ScriptingObtain user ids for the purpose of scripting Bus/Res discernment.

High Peggy CLOSED

5/3/01 Peggy in process of obtaining 10 ids for Colin and 1 for Gersony for scripting purposes. Form for Colin has been submitted to Janice Forner. Waiting for form from Gersony to process. 5/10/01 Ids still in process of being obtained for Colin per Janice Forner, CARM. These 10 id’s for Colin will be provisioned as view only but will have access to platforms RCAM1 through RCAM6. These id’s should be available 5/11/01. 5/17 Id’s completed for Colin. Id for Gersony in process of being created. Should be available in a few days. 5/23/01 All Ids received. Issue Closed

#006Data Dump for 1st pay defaults out of PMDB.Obtain account/card payment delinquency info for development of usage alerts.

High Peggy CLOSED

5/17/01 Peggy will check with Marget Johnson to see what info is available. Gary Craig was also contacted and is checking for info that may be available from CARM. 5/18/01 Per Marget a first pay default analysis is performed monthly. This could be performed more often in GFMS (weekly). BTNs are run up against RAZ to get product usage to see allocations of $$’s to card. Outlier analysis is performed as well. (Per Rick, Sept/Oct timeframe would be appropriate for this NBD segmentation. We need two sets of results, one to include CLECS and one that would show CLEC NBD data segmentated seperately. 5/24/01 Info on BTNs seen provided by Marget. Peggy will perform analysis of numbers and provide info to Colin, Sylvia and Gersony via email. 5/31/01 Info provided. Additional info to be provided ongoing when received from Marget.


AT&T Labs


#009 Exclusion List for CardDevelop an exclusion list for card. This will reduce the amount of alarms generated where usage has been confirmed with the customer.

Medium

PeggyColinSylvia

Gersony

CLOSED

5/24/01 Development to begin in the near future. 5/31/01 Work in progress. 6/5/01 Since it has been determined that an exclusion list is available for Card, this issue is being closed. Please reference issues #005 (PFGs for $$ Based Thresholding) and Issue #004b (Development of $$ Based Thresholding incorporating ULIs) for more information.


AT&T Labs


CARD USAGE db and Alerts• 180 days x 10 summary statistics/card calls|secs|rate|zeros|attempts X domestic|international

• Dollar-based thresholds for

day, week, month, quarter

• Card-specific thresholds

Bus/Res, ULI, usage and payment history

• Daytona/Hancock/QuickBin

time & memory, data structures & locality


AT&T Labs


Canonical Card Nos. & CARDINFO db

17 10 (TLN: CIID, Personal Choice)

16 7,8,9 (True Choice)

Card aliases & info RAMP CPP/LSA/CSMS connectivity

Business/Residential discernment

BTN/PAccount card nos.

parallel screenscrape: 180k lookups/hour


AT&T Labs


Subscription Fraud• Known fraudsters, training data for multiple signatures• Enterprise Miner

• Cluster Analysis• Discriminant Analysis• Association Rules• Decision Trees

Modeling Threshold on card distribution quantiles Multiple fraud distributions

Signature enhancement More components Multiple distributions/card

Documents

Risk and Revenue Modeling Group AT&T Labs 12 - June - 2001 AT&T Proprietary 1 Call detail: time of day, duration, origin, destination, charged number,