Using Data Mining to Identify Fraud

Transcription

1 Using Data Mining to Identify Fraud Joe Fallon Investigations Manager Americas 2010 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice

2 Entitlement Abuses Relating to Warranty In 2000 Price Waterhouse Coopers estimated that entitlement abuses relating to warranty service costs the US business billions of dollars each year 2003 HP developed a strategy to reduce entitlement abuses relating to warranty service. The major part of the strategy was a proactive fraud detection program that involved data mining 2004 A historical review of warranty fraud cases was completed that identified common methods of operation that were used to defraud HP Data sources were identified that have the information that was used by the fraudulent party to commit the fraud.

3 Warranty Fraud Investigation Sales & Service Partner Case Overview 60,000 warranty claims across 16 branches 1 yr of data reviewed Data Analytics Indicates: multiple claims on same serial numbers fake customer companies & address bonus fraud Customer Address Verification Multiple Customers for a Single Serial Number S/N: FR claims filed over 9 months by 9 different customers for the same product % of 4/ 5 Survey Responses from Top 10 Phone #'s 100 Residents at 5 of 7 addresses on via PO did not match customer details Partner phone numbers and personnel used to complete customer surveys yielding higher bonus payment (S.O.S. BARI) (S.O.S. ADRIATICA) (S.O.S. CAGLIARI) (S.O.S. ADRIATICA) (S.O.S. PALERMO) (S.O.S. PALERMO) (S.O.S. TORINO) (S.O.S. BARI) (S.O.S. BARI) (S.O.S. NAPOLI) (S.O.S. TORINO)

4 Results of Historical Method of Operation Used in Fraudulent Claims Activity Used in the Fraud Historical Frequency Sequential Serial Numbers 1,362 Duplicate Serial Number 613 Number of Claims Grouped by Date 1,382 Unusual Tech Workload 3,622 Bulk Parts Ordering 4,102 Non Return Parts 3,454 Fake Customers 3,235 Proactive Repairs 3,235 Survey Fraud 1,954

5 Fraud Metrics The Investigative and Suspicious thresholds are listed below. Metric Title Investigation Threshold Suspicion Threshold Investigation Threshold Suspicion Threshold 1 Valid SN 3 13a Not Returned Parts per SN Near Duplicate SN 3 13b Not Returned Parts per Customer a # Claims per Customer c Not Returned Parts per b Total Street Price per Customer $10,000 $2,000 13d Not Returned Parts per Address # Claims per e Not Returned Parts per Phone # # Claims per Address Price per SN $25,000 $10,000 8 # Claims per Phone # a Multiple Parts, Same Day, by Item Qty_Sum 8 4 9a Parts per SN b Multiple Parts, Same Day, by RATIO 8 4 9b Parts per Customer a Customers per SN 5 3 9c Parts per b SNs per Customer d Parts per Address a Addresses per SN 5 3 9e Parts per Phone # b SNs per Address a Exchange Claims per SN Addresses per Customer 5 11b Exchange Claims per Customer Customers per Address 5 11c Exchange Claims per a Expensive Parts per Customer d Exchange Claims per Address b Expensive Parts per Address e Exchange Claims per Phone # c Expensive Parts per Phone # a Non-Returnable Parts per SN a Customers per Phone # b Non-Returnable Parts per Customer b Phone #'s per Customer 4 12c Non-Returnable Parts per a Phone #'s per Address 5 12d Non-Returnable Parts per Address b Addresses per Phone # 5 12e Non-Returnable Parts per Phone # 10 3 Metric Title 4

6 Metric: Sequential Serial Numbers Number of Clusters 48,960* near-duplicate SN clusters were identified. Each of these clusters contained 2 or more serial numbers. However, we recommend focusing on the near-duplicate SN clusters that have 6 or more serial numbers. There are 603* clusters with 6 or more serial numbers % of all clusters. The accompanying Excel workbook contains claim-level detail about all 603* of these clusters (5,400 claim records). 5

7 The most suspicious clusters Those containing the most serial numbers trimmed_sn (first 9 characters) CREATE_DT Partner (Ship-To) Serial Number count_in_cluster 2UA8150P6 5/16/2008 D UA8150P60AM680US 32 2UA8150P6 5/16/2008 D UA8150P61AM680US 32 2UA8150P6 5/16/2008 D UA8150P62AM680US 32 2UA8150P6 5/16/2008 D UA8150P63AM680US 32 2UA8150P6 5/16/2008 D UA8150P64AM680US 32 2UA8150P6 5/16/2008 D UA8150P65AM680US 32 2UA8150P6 5/16/2008 D UA8150P66AM680US 32 2UA8150P6 5/16/2008 D UA8150P67AM680US 32 2UA8150P6 5/16/2008 D UA8150P68KA378UA 32 2UA8150P6 5/16/2008 D UA8150P69KA378UA 32 2UA8150P6 5/16/2008 D UA8150P6AKA378UA 32 2UA8150P6 5/16/2008 D UA8150P6BKA378UA 32 2UA8150P6 5/16/2008 D UA8150P6CKA378UA 32 2UA8150P6 5/16/2008 D UA8150P6DKA378UA 32 2UA8150P6 5/16/2008 D UA8150P6FKA378UA 32 2UA8150P6 5/16/2008 D UA8150P6GKA378UA 32 This is a partial list. All claims in this cluster are listed in the accompanying workbook. Part AM680US is listed as dc7800c/e6550/80hnw/2.0r/7k US and Part KA378UA is listed as dc7800ps9/e6550/80hnq/2.0r/7k US in the Part Description field. 6

8 Fuzzy Address Larelwood Drive Lorelwood Drive Laurelwood Dr. Lauralwood Dr. Laurelwood Dr. Suite 2

9 Different Type Customers Different MO and Data Models Direct Consumers Indirect HP Partners and Large Customers Sequential Serial Number Bulk Claims Drop Ship

10 Indicators of Fraud Individuals Same Address Same Zip Code Cell Phone or Unlisted Telephone Number Different Company Names Different Individual Names Limited Diagnostics Similar Serial Numbers Customer Never Provides a Proof of Purchase

11 HP Partners Large Customers Sequential Serial Number Bulk Claims Drop Ship Rotation of Serial Numbers Product Part Mismatch

12 HP Warranty Fraud Initiative In 2005 HP initiated a proactive warranty compliance program using data mining 2005 Realized 10.8 millions in savings 2006 Realized 10.1 millions in savings 2007 Realized millions in savings 2008 Realized millions in savings 2009 Realized 17.9 millions in savings

13