forensics to improve data analytics in fraud detection · pdf fileforensics to improve data...

9/8/2014

1

Forensics to Improve Data Analytics in Fraud Detection

Franklin M Din, DMD, MA, CMIOFraudLens, Inc.

Wednesday, September 17, 2014

Public Story

• June 13, 1994, 2 people found murdered

• Set into motion the trial of the century

• Trial Jan 24, 1995 to Oct 3, 1995

• Touched every hot button, constant media

coverage

• Verdict “Not Guilty”

• Most of the public was disappointed with

verdict

9/8/2014

2

Hidden Story

• After the verdict, I attended a forensic

conference with Dr. Henry Lee as keynote

• Dr. Lee was Invited to review the evidence

• One photo out of hundreds of crime scene

photos caught his eye. Asked audience to look

at the photo

• Does anyone in the audience think that this

photo is relevant to the verdict?

Forensics to Improve Data Analytics in Fraud Detection

Franklin M Din, DMD, MA, CMIOFraudLens, Inc.

9/8/2014

3

What is Forensics

• Essentially it is science and logic applied to

criminal investigation

• Establish the truth within qualitative

ambiguity

– Fingerprints at the scene because they are

friends

• Principles and methods are extendable to

analytics

Science and Logic

• Simple Science

– 2 places at the same time

• Complex science

– Projectile, gravity, composition of target

• Logic: A must precede B. Cannot get to C

without B first.

• Science and logic are constant

9/8/2014

4

Patterns from Science and Logic

• A crime scene gives you a set of data.

• When you analyze the data using science and

logic, you get an answer.

• If you input the similar data using the same

science and logic, you get a similar answer

• The pattern allows you to jump to an answer

with limited data

Why Are Patterns Important?

• Patterns repeat (crime repeats)

• Patterns allow conclusion with small data

sets

• Humans are biologically programmed to

see patterns and thus are easy to

recognize

9/8/2014

5

• Visual

• Audio

•Mathematical

• Financial

• Tactile

• Behavioral

Types of Patterns

• Biologic

•Man‐made

•Math and Physics

• Financial

• Chemical

• Temporal

Pattern Domains

9/8/2014

6

Minimal Patterns ‐ Silhouette

Audio Patterns

Audio of Beethoven's 5th symphony

first 8 notes

9/8/2014

7

Audio to Visual Patterns

Audio of Beethoven's 5th symphony

first 8 notes

•Mathematical Abstractions of reality

• Example 1: 3, 4, 5 triangle

–Math formula a2 + b2 = c2

• Example 2: Fibonacci Sequence

–1, 1, 2, 3, 5, 8, 13

–Math formula Fn = Fn‐1 + Fn‐2

Mathematical Patterns

9/8/2014

8

• Golden spiral

Fibonacci Patterns

Golden Spirals

9/8/2014

9

Golden Ratio – 1.62 : 1• A logical extension of Fibonacci pattern

• Ponzi scheme

• Phishing

• Insider Trading

• Property and Casualty Insurance Scam

Fraudulent Financial Patterns

9/8/2014

10

Ponzi Patterns (Graphic)

Phishing Patterns (Method)

• Appearance of legitimacy

• Trust relationship in place

• Sudden problem that “may” be affect

the user

• User help needed to fix / confirm

extent of the problem

9/8/2014

11

Pattern Consideration for Analytics

• IT dominant world – data crunch

• Pre‐IT dominant world ‐ patterns

• Example: Chess master versus Chess

playing programs

$75 B

4.3 B

OIG 2013 fraud discovery = $4.3 B (5.73%)

• IOM report: fraud =

$75 B or 3% of the

total healthcare spend

• FWA = $765 B

• Getting worse, recent

estimate $287 B

Size of the Healthcare Fraud

9/8/2014

12

$3.3‐11 B

Size of the Dental Fraud

189M

189 M to 630 M@ OIG rate of 5.73%, projected discovery of

189 M to 630 M

• AAOMS report: fraud

= 3 – 10% of the total

dental spend

• Exceeds size of credit

card fraud

Current Status

• Bad Guys Winning

– $ loss increasing, activity growing (south FL)

– 6% found = 94% undetected, risk reward ratio

• Extensive Resources

– RAC, MAC, OIG, zPIC, SIU, PIU, MCFU

• Approach

– Pay and Chase

9/8/2014

13

Where We Want to Be

• Move from “Pay and Chase” to “Detect and

Prevent”

– Reduce $ lost. Early detection = Early intervention

– Increase recovery. Intervene before money is lost

– Reverse Risk reward ratio

– Reduce anti‐fraud expenditures

– Monitor

• Good Guys Winning

Getting to Detect and Prevent

• Current approach cannot get there

• New and old approach – Back to the

Future

• Old = Forensic Patterns

• New = Informatics

• Newish = Information Technology

9/8/2014

14

Forensic Contribution

• If something is done repeatedly, there is a pattern

• Financial crimes are pattern crimes

• Understand the pattern and you understand how to detect any occurrence

• Pattern can be detected with limited data

Informatics Contribution

• Informatics enhances data

– Informatics is explicit, implicit, contextual,

relational, and networked

– Informatics extracts additional

information and data from data

9/8/2014

15

Useful Informatics Techniques

• Semantics

• Inheritance

• Inference (“ortho‐information”)

• Ontologies

• Time analysis

• Episodes

IT Contribution

• Software algorithms to detect a

pattern

• Data structures and software designed

to extract additional information

through informatics

• Usability software to simplify analysis

• Hardware to process everything

9/8/2014

16

Pattern Detection Solution 1

1. Identify the pattern of fraud

2. Determine how to detect the pattern

3. What data / information do you need to

detect the pattern

4. What data / information do you have

5. What data / information gaps exist

6. Informatics to improve data usefulness

Pattern Detection Solution 2

7. Model and build the algorithm

8. Establish the software and hardware

architecture

9. Feed data and informatics derived data to

the algorithm

10.Test and evaluate the results

11.Go catch bad guys

9/8/2014

17

Build Example Step 1

• Identify the pattern of fraud

– Plans uses agents to sell healthcare policy.

– Agents are paid a front end commission

– Some agents enroll patients in nursing facilities

• These are unsuitable members

– Unsuitable enrollee is found only after denial of

payment for service

– Agent long gone


• Determine how to detect the pattern

–Enrollees are in nursing homes, etc.

–Multiple enrollment on single day,

exceeds the norm

–Multiple enrollment at single location

–Enrollee is not educated in health plans

9/8/2014

18


•What data / information do you need

to detect the pattern

–Member enrollment data

–Agent demographic data

– Location of nursing homes

Build Example Step 4 and 5

•What data / information do you have

–All agent and member data is available

–Nursing home location data is readily

available

•What data / information gaps exist

–none

9/8/2014

19


• Informatics to improve data usefulness

–Agent must travel to member to complete

enrollment and obtain signatures

–Agent location must be within driving

distance to the nursing home

–Each enrollment takes time, agent must

have sufficient time to complete multiple

enrollment


• Model and build the algorithm

– By number signed per day

•Map the number signed for each Agent for each

workday

– By location

•Map the location of the enrollees against the

location of the nursing homes

– By transit time

•Map travel route for each agent for each date

9/8/2014

20

Build Example Step 8 and 9

• Establish the software and hardware

architecture

–Build as needed

• Feed data and informatics derived data

to the algorithm

–Data processing


• Test and evaluate the results

– By number signed per day

•Outliers 1 – 2 STD above the average

– By location

•Enrollee location same as nursing home

– By transit time

•Average travel time per enrollee is much lower

for multiple signings

9/8/2014

21


• Go catch bad guys

– All algorithms are near real time. Detection

well within the window for decision making

– Deny enrollment for fraudulent enrollee.

Enrollee is notified before any claim for service

– Deny agent commission, start disciplinary

action.

– Monitoring of this pattern will deter others

who might attempt this fraud in the future

Advantages of the Build Example

• Benefit

– Early detection –upon receipt or enrollment

– Loses are minimized or prevented

– Analysis can serve as evidence in a criminal

action

– Build once / run forever

– Monitoring = prevention

9/8/2014

22

Build Dental Example Step 1

• Dental fraud follows patterns

–Upcoding, claim treatment that was not

performed, claim treatment on patients

that were not seen, under treatment,

over treatment, illegal provider, balance

billing, dual insurance double billing


• Detecting the pattern

–Upcoding and phantom Tx, are

vulnerable to time analysis

–Upcoding – harder procedures more

complex more time

–Phantom Tx – if Tx performed, takes time

9/8/2014

23


•What data / information do you need

to detect the pattern

–Member enrollment data

–Claims data

–Provider enrollment data

–Time data

Build Dental Example Step 4 and 5

•What data / information do you have

–All claims, member, and provider data is

available

•What data / information gaps exist

–Time

9/8/2014

24


• Informatics to improve data usefulness

and address data gaps

–Claims report Tx via codes

–Each Tx Code is a summary of a real event

–The real event require time

–The real event is a repeatable pattern

– Informatics methods used to establish time


•Model and build the algorithm

–Parse claims

–Calculate time required to perform procedure

–Compare Calculated time with time available

–Establish threshold of action

–Score providers

9/8/2014

25

Build Dental Example Step 8 and 9

• Establish the software and hardware

architecture

–Ready as SaaS or build internally

• Feed data and informatics derived data

to the algorithm

–Process raw and informatics data


• Test and evaluate the results

–Time analysis

•Identify providers whose calculated time is 20%

above the time available

•Problem providers identified, scope of problem

identified, near real‐time.

•Does not pinpoint specific fraud which requires

review of clinical records. Focuses record

request.

9/8/2014

26


• Go catch bad guys

– Alert provider that problem has been detected.

– Administrative recovery

– Simplifies and speeds investigation

– Can submitted to AG / OIG for criminal prosecution

– Near real‐time. Detection well within the window

to deny payment

– Monitor for future fraudulent activity

Dental Results

• 1440 minutes available for a patient to sit in a chair

• 535 minutes for clean, disinfect, setup time between patients

• Estimated time to perform all – 2153 minutes

• Need an additional 1248 minutes

9/8/2014

27

Biography

• DMD (1980), MA (NLM post doc fellowship)

Biomedical Informatics (2005)

• 25+ years dentistry, 15 years forensics, 9

years medical Informatics

• Multiple papers and presentations in

informatics and dentistry

• Textbook co‐editor and contributor

• www.linkedin.com/in/frankdin

OJ Simpson Case

9/8/2014

28

Crime Scene Blood Patterns

• Science dictates the pattern

• Transfer versus Spatter

• Transfers occur when a blood source comes in

direct contact with a surface

• Spatters occur when blood travels through the

air before landing on a surface

Transfer Blood Patterns

Swipe – bloody surface

meets a clean surface

Wipe – an object moves through a bloody surface

9/8/2014

29

Spatter Blood Patterns

Free Fall Pattern Angle of Impact

• Spatters usually fall from an open wound or from a surface that is saturated with blood

• Can determine severity, time sequence, etc.

Dr. Henry Lee Discovery

Noticed a small round dot of blood in one of the photos. Based on blood spatter knowledge, this blood spatter had to come from the killer. OJ had a cut on his hand when arrested.

9/8/2014

30

Relevance to our Presentation

• Demonstrates the power of patterns. Blood drop had to come from the killer or accomplice

• The answer to “Not enough data” excuses. One drop of blood outweighs all.

• Humans, even experts, make errors. Every expert but Henry Lee missed this

• Speed of analysis. Had importance of this blood spot been recognized at the scene, a positive ID would have been made long before the trial.

Footnotes for slidesSlide Title Footnote

Audio patterns audio ‐ http://mp3skull.com/mp3/beethoven_5th.html

Audio to visual patterns audio ‐ http://mp3skull.com/mp3/beethoven_5th.html

Audio to visual patterns musical score ‐ http://www.edforall.net/index.php/humanities/performing‐arts/3183‐listening‐to‐music

Fibonacci Patterns"Fibonacci spiral 34" by User: Dicklyon ‐ self‐drawn in Inkscape. Licensed under Public domain via Wikimedia Commons ‐http://commons.wikimedia.org/wiki/File:Fibonacci_spiral_34.svg#mediaviewer/File:Fibonacci_spiral_34.svg

Golden Spirals nautilus ‐ www.inspriationgreen.com

Golden Spirals egg ‐ www.Holistichouseplans.com

Golden Spirals fingerprint ‐ www.123rf.com

Golden Spirals Hurricane Irene, August, 2011 ‐ www.ingur.com

Golden Ratio 1.62 : 1

DaVinci man ‐ "Pentagram and human body (Agrippa)" by Heinrich Cornelius Agrippa ‐ From Heinrich Cornelius Agrippa's Libri tres de occulta philosophia. Scanned by Jörgen Nixdorf; originally at en:Image:Pentagram3.jpg.. Licensed under Public domain via Wikimedia Commons ‐http://commons.wikimedia.org/wiki/File:Pentagram_and_human_body_(Agrippa).jpg#mediaviewer/File:Pentagram_and_human_body_(Agrippa).jpg

Golden Ratio 1.62 : 1Pentagram ‐ "Pentagram‐phi" by Original uploader was Jamiemichelle at en.wikipedia ‐ Originally from en.wikipedia; description page is/was here.. Licensed under Public domain via Wikimedia Commons ‐http://commons.wikimedia.org/wiki/File:Pentagram‐phi.svg#mediaviewer/File:Pentagram‐phi.svg

Golden Ratio 1.62 : 1 Female face ‐ http://www.jaypeejournals.com/eJournals/ShowText.aspx?ID=4400&Type=FREE&TYP=TOP&IN=_eJournals/images/JPLOGO.gif&IID=343&isPDF=NO

Golden Ratio 1.62 : 1 Smile ‐ www.phimetrix.com

Madoff Ponzi Patterns http://marketsci.wordpress.com/2008/12/15/madoff‐uber‐ponzi‐returns/

OJ Simpson Casehttp://www.bestgore.com/murder/nicole‐brown‐simpson‐and‐ronald‐goldman‐crime‐scene‐photos/attachment/nicole‐brown‐simpson‐and‐ronald‐goldman‐crime‐scene‐photos‐02/ and http://www.bestgore.com/murder/nicole‐brown‐simpson‐and‐ronald‐goldman‐crime‐scene‐photos/attachment/nicole‐brown‐simpson‐and‐ronald‐goldman‐crime‐scene‐photos‐03/

Crime Scene Blood patterns www.crimescene‐forensics.com

Transfer Blood Patterns both graphics ‐ www.crimescene‐forensics.com

Spatter Blood Patterns both graphics ‐ www.crimescene‐forensics.com

Dr. Henry Lee Discovery http://www.bestgore.com/murder/nicole‐brown‐simpson‐and‐ronald‐goldman‐crime‐scene‐photos/attachment/nicole‐brown‐simpson‐and‐ronald‐goldman‐crime‐scene‐photos‐03/

9/8/2014

31

Questions

Comments

Observations

Contact: [email protected]

Website: www.fraudlens.com

http://nadpconverge.org/evaluations

forensics to improve data analytics in fraud detection · pdf fileforensics to improve data...

Documents