KKB’s Fraud Detection & Prevention System SABAS · 2009. 3. 2. · SABAS “The Power of Data Sharing & Information Exchange In The Fight Against Financial Fraud In Turkey” 1

KKB KKB –– The Credit Bureau of TurkeyThe Credit Bureau of Turkey

KKB’s Fraud Detection & Prevention SystemKKB’s Fraud Detection & Prevention System

SABASSABAS““The Power of Data Sharing & Information Exchange The Power of Data Sharing & Information Exchange

In The Fight Against Financial Fraud In Turkey”In The Fight Against Financial Fraud In Turkey”

1

World CWorld Consumer Credit Reporting Conferenceonsumer Credit Reporting Conference19/20/21 October 2008 19/20/21 October 2008 -- Rio de Janeiro, Rio de Janeiro, BrazilBrazil

KKAZIMAZIM DDERMANERMANAssistant General ManagerAssistant General Manager


Beware of ID Theft!Beware of ID Theft!Beware of ID Theft!Beware of ID Theft!

World Consumer Credit Reporting World, World Consumer Credit Reporting World, 20020088 -- 19/20/21 October 2008 19/20/21 October 2008 -- Rio de Janeiro, Rio de Janeiro, BrazilBrazil

KKBKKB

�� Special clause defining KKB in the Banking Law of TurkeySpecial clause defining KKB in the Banking Law of Turkey

Banks’ partners, members of board of directors,, employees, representatives and Banks’ partners, members of board of directors,, employees, representatives and officials shall not disclose confidential information relating to any bank or clients officials shall not disclose confidential information relating to any bank or clients

“According to a special clause“According to a special clause in the Banking Law of Turkey the Banking Law of Turkey exchange of customer information can only take place exchange of customer information can only take place

via companies established by at least five banks”via companies established by at least five banks”


2

officials shall not disclose confidential information relating to any bank or clients officials shall not disclose confidential information relating to any bank or clients thereof which they have received in connection with their positions and duties to thereof which they have received in connection with their positions and duties to any authority other than those which has been expressly authorized by lawany authority other than those which has been expressly authorized by law. . This This provision shall not be applicable to the exchange of information between credit provision shall not be applicable to the exchange of information between credit institutions and financial institutions and outsourcing institutions for the institutions and financial institutions and outsourcing institutions for the procurement of services under written contracts to be signed for the purposes of procurement of services under written contracts to be signed for the purposes of monitoring, evaluating and controlling the risk status of clients and for providing monitoring, evaluating and controlling the risk status of clients and for providing customer services.customer services. Any exchange of information among credit institutions and Any exchange of information among credit institutions and financial institutions themselves directly or via companies to be established financial institutions themselves directly or via companies to be established by minimum five banks shall not be covered by this provision, eitherby minimum five banks shall not be covered by this provision, either..


KKBKKBis Turkey’s first and only credit bureau is Turkey’s first and only credit bureau

launched launched inin April 11, 1995 April 11, 1995

by eleven prominent banks operating in Turkeyby eleven prominent banks operating in Turkey

�� Today, KKB Consumer Credit Bureau is one of the Today, KKB Consumer Credit Bureau is one of the largest credit bureaus in Europelargest credit bureaus in Europe


3

KKB started its operations in April 1999. In the 9 months of 1999 only KKB started its operations in April 1999. In the 9 months of 1999 only 100.000 enquiries were performed but today, as of end of August, we 100.000 enquiries were performed but today, as of end of August, we reached 77 million enquiries. We expect 100 million enquiriesreached 77 million enquiries. We expect 100 million enquiries at the end at the end of 2008. of 2008.

In 2007, 40 million credit bureau scores were delivered. In 2007, 40 million credit bureau scores were delivered.

These figures show that, KKB’s Consumer Credit Bureau became one of These figures show that, KKB’s Consumer Credit Bureau became one of the largest consumer credit bureaus in Europe.the largest consumer credit bureaus in Europe.


KKBKKB“Today, KKB has 100% of the country’s consumer credit data “Today, KKB has 100% of the country’s consumer credit data provided by it’s

38 Members in its database”38 Members in its database”


4World Consumer Credit Reporting World, World Consumer Credit Reporting World, 20020088 -- 19/20/21 October 2008 19/20/21 October 2008 -- Rio de Janeiro, Rio de Janeiro, BrazilBrazil

KKBKKB


NUMBER OF ENQURIES (MILLION)NUMBER OF ENQURIES (MILLION)


KKBKKB


NUMBER OF CREDIT ACCOUNTS IN DATABASE NUMBER OF CREDIT ACCOUNTS IN DATABASE

(MILLION)(MILLION)


KKBKKB““KKB’s Consumer Credit Bureau is a world class credit bureau”KKB’s Consumer Credit Bureau is a world class credit bureau”

�� with positive and negative information, valuewith positive and negative information, value--added added products such as bureau score and with many subproducts such as bureau score and with many sub--bureau bureau systemssystems

�� Fraud Detection and Prevention System (SABAS)Fraud Detection and Prevention System (SABAS)


7

�� Fraud Detection and Prevention System (SABAS)Fraud Detection and Prevention System (SABAS)

�� Internet Fraud Alert System (IFAS)Internet Fraud Alert System (IFAS)

�� Credit Card Limits Control System (LKS)Credit Card Limits Control System (LKS)

�� Batch Enquiry SystemBatch Enquiry System

�� Customer Disputes Clearing System (MIDES)Customer Disputes Clearing System (MIDES)

�� Supplementary Information Request SystemSupplementary Information Request System

�� Portfolio Accessibility Quality Measurement SystemPortfolio Accessibility Quality Measurement System

�� Information Verification SystemInformation Verification System

�� Bad Checks Alert SystemBad Checks Alert System


KKBKKB“The Commercial Credit Bureau System is “The Commercial Credit Bureau System is

KKB’s new credit bureau system”KKB’s new credit bureau system”

�� The Commercial Credit Bureau System allows all relevant The Commercial Credit Bureau System allows all relevant positive and negative information about a company to be positive and negative information about a company to be shared in a matter of secondsshared in a matter of seconds


8

�� It works in full integration with KKB’s Consumer Bureau It works in full integration with KKB’s Consumer Bureau System, SABAS and the other KKB systemsSystem, SABAS and the other KKB systems

•• Hence, member institutions get full service from a single source, Hence, member institutions get full service from a single source, KKBKKB

•• This enables them to reduce their credit intelligence efforts and This enables them to reduce their credit intelligence efforts and costs signficantlycosts signficantly

�� KKB will soon provide scoring and rating services in KKB will soon provide scoring and rating services in Commercial Credit BureauCommercial Credit Bureau


SABASSABAS

is is a a fully automated and interactive fully automated and interactive

data sharing data sharing & information exchange & information exchange system system

KKB’s Fraud Detection and Prevention SystemKKB’s Fraud Detection and Prevention System


9

data sharing data sharing & information exchange & information exchange system system

for detecting and preventingfor detecting and preventing

IIdentity Theftdentity Theft & & FFinancial Fraudinancial Fraud


SABASSABAS

�� Leading Considerations Leading Considerations

•• Victimizing Risk:Victimizing Risk:

DEVELOPMENT PROCESSDEVELOPMENT PROCESS

“Sharing fraudulent data and exchanging the related information without “Sharing fraudulent data and exchanging the related information without precautionary measures may create serious legalprecautionary measures may create serious legal risksrisks !”!”


10

•• Victimizing Risk:Victimizing Risk: Assigning the relevant information to each single Assigning the relevant information to each single piece of fraud related data is necessary. Doing otherwise may turn an piece of fraud related data is necessary. Doing otherwise may turn an innocent person’s life to a nightmare!innocent person’s life to a nightmare!

•• Reputation Risk:Reputation Risk: Members should be trained very well about what to Members should be trained very well about what to do what not to do! do what not to do! Otherwise it is possible that a member may Otherwise it is possible that a member may causecauseother other mmemberembers and KKB to face serious legal problemss and KKB to face serious legal problems..

Beware of ID Theft!Beware of ID Theft!


SABASSABAS

Without taking the following points and issues into Without taking the following points and issues into


“Sharing fraudulent data without “Sharing fraudulent data without precautionary measures precautionary measures may create serious legal may create serious legal risksrisks !”!”


11

Without taking the following points and issues into Without taking the following points and issues into consideration developing a fraud detection and consideration developing a fraud detection and

prevention system (FDPS) is prevention system (FDPS) is

nono--wayway--outout!!


SABASSABASDEVELOPMENT PROCESSDEVELOPMENT PROCESS

““Neutrality and Transparency Neutrality and Transparency areare essential essential for the success of an for the success of an FDPS”FDPS”


•• A TA Trustable Authorityrustable Authority


12

•• A TA Trustable Authorityrustable Authority

�� KKB BoardKKB Board

�� KKB ManagementKKB Management

�� Member CommitteesMember Committees



“Each Member must sign an agreement “Each Member must sign an agreement that defines the operational rules and the penalties of the FDPS”that defines the operational rules and the penalties of the FDPS”


•• KKB Membership Agreement encompassesKKB Membership Agreement encompasses


13

•• KKB Membership Agreement encompassesKKB Membership Agreement encompasses

�� KKB’s ResponsibilitiesKKB’s Responsibilities

�� Member’s ResponsibilitiesMember’s Responsibilities

�� General Rules (confidentiality, reciprocity, operations, penalties)General Rules (confidentiality, reciprocity, operations, penalties)



“An FDPS without rules is a great “An FDPS without rules is a great riskrisk itself!”itself!”


•• A A SABAS Member mustSABAS Member must


14

•• A A SABAS Member mustSABAS Member must

�� provide every single piece of its caseprovide every single piece of its case--related data/information to the related data/information to the

FDPS’s DatabaseFDPS’s Database

�� update its caseupdate its case--related data/information stored in the FDPS’s related data/information stored in the FDPS’s

Database, according to the system rulesDatabase, according to the system rules

�� set all necessary inhouse procedures to perform FDPS operations set all necessary inhouse procedures to perform FDPS operations

accordinglyaccordingly


SABASSABAS


•• Case Filing:Case Filing:


“No matter how complex the fraud case is FDPS must answer “No matter how complex the fraud case is FDPS must answer all questions and explain the whole story accurately! ”all questions and explain the whole story accurately! ”


15

•• Case Filing:Case Filing: Different objects (ID cards, addresses, telephone numbers, Different objects (ID cards, addresses, telephone numbers, etc.) used in the same fraud attemp need to be stored into the database etc.) used in the same fraud attemp need to be stored into the database with correct correlation definition. Therefore, we had to find out a Case with correct correlation definition. Therefore, we had to find out a Case Filing Structure.Filing Structure.

•• Instant Alert Messages:Instant Alert Messages: System must alert the member instantly System must alert the member instantly when there is a single piece of FDPS data used in one of the member’s when there is a single piece of FDPS data used in one of the member’s (account opening, credit application, etc.) transactions.(account opening, credit application, etc.) transactions.


SABASSABAS





16

•• Who is the applicant?Who is the applicant?

Is he/she the perpetrator or the victim?Is he/she the perpetrator or the victim?

Should you call the police or grant the credit?Should you call the police or grant the credit?

•• Is this a critical fraud alert message for you?Is this a critical fraud alert message for you?

Do you have to take prompt action?Do you have to take prompt action?

Is somebody using personal ID of one of your good clients?Is somebody using personal ID of one of your good clients?





•• Do you know who the perpetrator is?Do you know who the perpetrator is?


17

•• Do you know who the perpetrator is?Do you know who the perpetrator is?

Is this the perpetrator’s personal ID?Is this the perpetrator’s personal ID?

Is this the perpetrator’s home/business address and telephone?Is this the perpetrator’s home/business address and telephone?

Is this a fake address or does it belong to a companyIs this a fake address or does it belong to a company or someone or someone

not connected to this fraudulent activity?not connected to this fraudulent activity?

•• What type of a fraud attemp is this?What type of a fraud attemp is this?

Is this a oneIs this a one--man fraud or an organized gang fraud?man fraud or an organized gang fraud?

How many individuals and companies are involved in this fraud?How many individuals and companies are involved in this fraud?


SABASSABAS


•• What are the objects used in this fraud?What are the objects used in this fraud?




18

•• What are the objects used in this fraud?What are the objects used in this fraud?

What is the What is the riskrisk definition of this object? definition of this object?

What is the What is the riskrisk definition of this object field?definition of this object field?

•• What does the additional information alert message say?What does the additional information alert message say?

Does the other Member say Does the other Member say “there is a victimizing “there is a victimizing riskrisk” with this ID”” with this ID”??

Does the other Member say that Does the other Member say that “He is one of my good customers and“He is one of my good customers and

this is his stolen ID card!”this is his stolen ID card!”??



“A SABAS Case must be finalized with no doubt!”“A SABAS Case must be finalized with no doubt!”


•• If we all agree that there is If we all agree that there is no no riskrisk then there is then there is no Caseno Case!!


19

•• If we all agree that there is If we all agree that there is no no riskrisk then there is then there is no Caseno Case!!

If a Member says that If a Member says that “The Suspicious Applicant is one of my good “The Suspicious Applicant is one of my good

customers therefore we must delete the file!”customers therefore we must delete the file!” then the Case must be then the Case must be

dropped!dropped!

•• If we all agree that he is the If we all agree that he is the PerpetratorPerpetrator!!

“Let’s go to court to prosecute him together so he can stay in jail longer; “Let’s go to court to prosecute him together so he can stay in jail longer; longer than if only one of us had taken legal action.”longer than if only one of us had taken legal action.”



“And finally, we had to find a name for it”“And finally, we had to find a name for it”

sasahtehtehte..................Counterfeit, ForgedCounterfeit, Forged

BBilgi / Belge /Beyan / Başvuruilgi / Belge /Beyan / Başvuruilgi / Belge /Beyan / Başvuru


20

BBilgi / Belge /Beyan / Başvuruilgi / Belge /Beyan / Başvuruilgi / Belge /Beyan / Başvuru..................Information/Document/Declaration/ApplicationInformation/Document/Declaration/Application

aalarmlarmlarm..................AlertAlert

ssistemiistemiistemi..................SystemSystem


SABASSABASBASICS of DESIGNBASICS of DESIGN

“A fraud “A fraud CaseCase can be shared in can be shared in SABASSABAS with one of the below with one of the below riskrisk definitions”definitions”

•• Active Active RISK RISK


21

•• Active Active RISKRISK SuspicionSuspicion

•• Potential Potential RISKRISK


SABASSABASBASICS of DESIGNBASICS of DESIGN


22

Unit Data

Object


SABASSABAS

•• FraudulentFraudulent

•• SuspiciousSuspicious

BASICS of DESIGNBASICS of DESIGN“An “An ObjectObject can be shared in can be shared in SABASSABAS with one of the below with one of the below riskrisk definitions”definitions”


23


•• Lost/StolenLost/Stolen

•• TrustableTrustable

•• ProtectedProtected

•• No CommentNo Comment!!


SABASSABAS

•• FakeFake

BASICS of DESIGNBASICS of DESIGN“A “A Unit DataUnit Data (data in a field of an (data in a field of an ObjectObject)) can be shared in can be shared in SABASSABAS

with one of below with one of below riskrisk definitions”definitions”



24

•• FakeFake

•• RiskyRisky


•• No Comment!No Comment!


•• Perpetrator’sPerpetrator’s

•• Victim’sVictim’s

•• TrueTrue


SABASSABAS

•• ApplicationApplication

•• AccountAccount

BASICS of DESIGNBASICS of DESIGN“An “An ObjectObject can be shared in can be shared in SABASSABAS with one of the below with one of the below SourceSource definitions”definitions”


25

•• AccountAccount

•• Third PartyThird Party

•• Trustable CustomerTrustable Customer

•• Trustable Third PartyTrustable Third Party

•• Goverment AuthorityGoverment Authority


SABASSABAS

Members should comply withMembers should comply with particular rules particular rules andand standards standards when they receive fraud alert messages otherwise they may be when they receive fraud alert messages otherwise they may be

the main cause ofthe main cause of

BASICS of DESIGNBASICS of DESIGNFRAUD ALERT MESSAGE SYSTEMFRAUD ALERT MESSAGE SYSTEM


26

thethe Victimizing Victimizing RiskRisk andand thethe ReputationReputation RiskRisk!!

SABAS delivers two different Fraud Alert Message for each SABAS delivers two different Fraud Alert Message for each FDPS hit:FDPS hit:

•• One message goes to Member that hits the FDPS data with its One message goes to Member that hits the FDPS data with its Bureau enquiryBureau enquiry

•• The other message goes to Member that made the The other message goes to Member that made the RiskRisk definition definition for this datafor this data


SABASSABAS

MEMBER MEMBERMEMBER--AA

CASE RISK ActiveActive RiskRisk

OBJECT National ID CardNational ID Card

OBJECT RISK FraudulentFraudulent

SOURCE Trustable CustomerTrustable Customer

BASICS of DESIGNBASICS of DESIGN


27

Case RecordCase Record Perpetrator’sPerpetrator’s

TrueTrue

Victim’sVictim’s


SABASSABAS

Member/Object # MEMBERMEMBER--A (1)A (1)

CASE RISK Act. Act. Risk Risk SuspicionSuspicion


OBJECT RISK SuspiciousSuspicious

SOURCE ApplicationApplication

SAMPLE SCENARIO:SAMPLE SCENARIO: DAY 1DAY 1


28

No CommentNo Comment

SuspiciousSuspicious


Object Opening CRObject Opening CR


SABASSABAS

Member/Object #Member/Object # MEMBERMEMBER--B (2)B (2)

CASE RISKCASE RISK Act. Act. Risk Risk SuspicionSuspicion

OBJECTOBJECT National ID CardNational ID Card

OBJECT RISKOBJECT RISK No Comment!No Comment!

SOURCESOURCE Guarantor (1)Guarantor (1)


Member/Object # MEMBERMEMBER--B (2)B (2)

CASE RISK Act. Act. Risk Risk SuspicionSuspicion


OBJECT RISK No Comment!No Comment!

SOURCE ApplicationApplication


29



ProtectedProtected



SABASSABAS

Member/Object #Member/Object # MEMBERMEMBER--C (1)C (1)



OBJECT RISKOBJECT RISK ProtectedProtected

SOURCESOURCE AccountAccount



30



ProtectedProtected

Object Updating CRObject Updating CR


SABASSABAS


CASE RISKCASE RISK Active Active RiskRisk


OBJECT RISKOBJECT RISK StolenStolen

SOURCESOURCE Trustable CustomerTrustable Customer



3131


RiskyRisky




SABASSABAS




OBJECT RISKOBJECT RISK TrustableTrustable




3232


TrueTrue




SABASSABAS

Member/Object #Member/Object # MEMBERMEMBER--A (1)A (1)



OBJECT RISKOBJECT RISK StolenStolen

SOURCESOURCE Application Application



3333

Perpatrator’sPerpatrator’s

RiskyRisky




SABASSABAS

Member/Object #Member/Object # MEMBERMEMBER--D (2)D (2)



OBJECT RISKOBJECT RISK ProtectedProtected




34



ProtectedProtected



SABASSABAS

Member/Object #Member/Object # MEMBERMEMBER--D (4)D (4)



OBJECT RISKOBJECT RISK TrustableTrustable




3535


TrueTrue




SABASSABAS

Member/Object #Member/Object # MEMBERMEMBER--B (2)B (2)



OBJECT RISKOBJECT RISK FraudulentFraudulent




36

FakeFake


Object Updating CRObject Updating CR No CommentNo Comment


SABASSABAS

MEMBERMEMBER--A (1)A (1)

Active Active RiskRisk

National ID CardNational ID Card

StolenStolen

Application Application

MEMBERMEMBER--C (3)C (3)



TrustableTrustable

Trustable CustomerTrustable Customer

MEMBERMEMBER--B (2)B (2)



FraudulentFraudulent

AccountAccount

MEMBERMEMBER--D (4)D (4)



TrustableTrustable


SAMPLE SCENARIO:SAMPLE SCENARIO: The ENDThe END


37

Application Application


RiskyRisky

Perpatrator’sPerpatrator’s




TrueTrue

AccountAccount

FakeFake




TrueTrue


SABAS CASE FILESABAS CASE FILE


No Comment!No Comment!

SABASSABAS

•• There are no codes in SABAS! Members are sharing data and There are no codes in SABAS! Members are sharing data and exchanging information among each other with uniqueexchanging information among each other with unique RiskRiskDefinitionsDefinitions that help to explain the full story of that help to explain the full story of the Casethe Case and and therefore there is no therefore there is no Victimizing Victimizing RiskRisk and and ReputationReputation RiskRisk!!

BENEFITS and FEATURESBENEFITS and FEATURES““SABASSABAS isis thethe Safe HarbourSafe Harbour for its Membersfor its Members andand the Victimsthe Victims””


38

therefore there is no therefore there is no Victimizing Victimizing RiskRisk and and ReputationReputation RiskRisk!!

•• SABAS is capable of generating Member specific alerts for each SABAS is capable of generating Member specific alerts for each CaseCase. . This enables Members to save resources and to promptly react to these This enables Members to save resources and to promptly react to these alerts for taking proactive measures againstalerts for taking proactive measures against thethe fraud fraud riskrisk..

•• Thousands of users may share their thoughts and comments about Thousands of users may share their thoughts and comments about even a single even a single Unit DataUnit Data via web basedvia web based Information Exchange Information Exchange Platform of SABASPlatform of SABAS..


SABASSABAS

•• System can link different System can link different CasesCases by using telephone numbers, by using telephone numbers, addresses, PINs and numbers of ID cards!addresses, PINs and numbers of ID cards!

•• System has a very modular and flexible infrastructure to address System has a very modular and flexible infrastructure to address

BENEFITS and FEATURESBENEFITS and FEATURES““SABASSABAS isis thethe Safe HarbourSafe Harbour for its Membersfor its Members andand the Victimsthe Victims””


3939

•• System has a very modular and flexible infrastructure to address System has a very modular and flexible infrastructure to address the changes in the market. Any new idea can easily and quickly be the changes in the market. Any new idea can easily and quickly be integrated into it.integrated into it.

•• SABAS is capable of deveoping advanced reports and statistics to SABAS is capable of deveoping advanced reports and statistics to determine general fraud levels and fraud methods.determine general fraud levels and fraud methods.


SABASSABAS

•• 6,56,5 �� Average number of Members related to each Average number of Members related to each CaseCase

PROMINENT STATISTICSPROMINENT STATISTICS““1 July 1 July –– 31 August 200831 August 2008””


40

•• Distribution of shared information:Distribution of shared information:

•• VictimsVictims % 65% 65

•• PerpetratorsPerpetrators % 5% 5

•• SuspiciousSuspicious % 24% 24


SABASSABASINCENTIVE SYSTEMINCENTIVE SYSTEM

“Expecting a member to spend time and effort to share all its data “Expecting a member to spend time and effort to share all its data to help the other members was justto help the other members was just a dream but ...”a dream but ...”

Not to face Not to face Victimizing Victimizing RiskRisk and and Reputation Reputation RiskRisk

we had to find a way to get all available data and related we had to find a way to get all available data and related


41

we had to find a way to get all available data and related we had to find a way to get all available data and related information being shared and exchanged! information being shared and exchanged!

AndAnd we developed an incentive system: we developed an incentive system:

“SABAS “SABAS MemberMemberss get free credit reports and bureau get free credit reports and bureau scores scores in return for the amount ofin return for the amount of useful information useful information

theythey share with othershare with other members”members”


SABASSABASSABAS

THANK YOU!THANK YOU!


42

THANK YOU!THANK YOU!

KKAZIMAZIM DDERMANERMAN

[email protected]@kkb.com.tr


Documents

KKB’s Fraud Detection & Prevention System SABAS · 2009. 3. 2. · SABAS “The Power of Data Sharing & Information Exchange In The Fight Against Financial Fraud In Turkey” 1