Fraud detection processes that are too focused on clearing individual fraud alerts are missing the big picture and probably missing fraud.

A pendulum. Since its discovery around 1602 by Galileo Galilei the regular motion of pendulums was used for timekeeping, and was for many years considered to be the most accurate way to do so. The oscillation from one side to another is a predictable force of nature. In the world of mortgage lending, we have our own predictable pendulum that moves time forward – the oscillation between a focus on risk management on one side, and the focus on production and sales on the other. In response to the mortgage crisis of 2007, that pendulum has swung about as far back to the risk management as it will get. Predictably, we will now begin the trajectory back toward production.

I use the analogy of the pendulum for a reason – if this is as good as it is going to get for fraud detection in the mortgage industry, we need to ensure that we have the best processes in place before we swing back to a production and sales focus. There will be less appetite for new fraud risk controls and new processes in two years. I believe the practices in place are still not optimal and it requires re-thinking them to get it right. In this issue of Fighting Fraud with Frank, I am going to discuss one such process - Alert Investigation and Clearing - which has become the predominant means by which lenders detect fraud prior to funding. I think this approach to dealing with risky loans prior to funding buries analysts with high false positives and distracts them from looking at the comprehensive level of fraud risk on a loan file.

An ever growing list of alerts to clear

Fraud Alerts are typically simple one dimensional business rules that notify a lender of some occurrence that might represent risk. Some examples of what could trigger an alert:

• The borrower’s reported social security number is invalid
  
• The borrower’s reported social security number is on the death master file
  
• The work phone number is a cell phone on reverse directory search

Over the past five years, fraud solution vendors have rushed to provide lenders with an ever growing list of these one-dimensional alerts to check and report back on data mismatches or data inconsistencies in information reported by borrowers. The result of these efforts is that lenders have a larger list of potential fraud alerts than they have ever had before.

High False Positives have created an industry of "Alert Clearing Machines"

While alerts can offer insight into outside information that a lender might otherwise not know about, they are typically not predictive of fraud in and of themselves. As an example, let’s review social security alerts. Social security alerts generally notify the lender when the borrower’s social security number may have issues. The false positive rates of this type of alert are typically off the charts bad, yet lenders continually rely on them as a predominant method of stopping fraud.

Conventional wisdom is that these types of alerts notify lenders of potential identity fraud issues with the borrower. Practical experience from the field tells us something completely different – data entry operators make countless mistakes when they are inputting social security numbers.

The primary problem that has plagued alerts historically has been their high false positive rates. When you have false positive rates of 25:1 or greater, you encourage fraud analysts to become "clearing machines." They begin to find routines and processes to clear an alert, rather than looking for fraud risk on a loan file. The higher the false positive rate of an alert the more focused an analyst will become on clearing the alert rather than looking for and finding fraud.

As I mentioned earlier, the trend in mortgage fraud detection is for lenders to consume more and more of these alerts. These alerts, however, result in more time spent on loan files without much bottom line benefit. Lenders spend more time clearing these high false positive alerts than they do finding and detecting fraud.

Alerts clearing can only get you so far

We conducted a study in 2009 based on historical fraud and non-fraud loans. Our analysis pointed to several key facts:

• Only a few alerts could be considered predictive of fraud on their own (less than 10)
  
• Relying on predictive alerts could only detect a small percentage of a lender’s overall fraud losses (less than 20%)

The study showed that relying on clearing fraud alerts to detect fraud was not an optimal strategy. The false positive rate is high, the number of times an alert may fire is high, and the amount of fraud you can detect with those alerts is low.

One thing is clear, a new approach that is not alert clearing focused is needed to really address the problem of mortgage fraud.

A Fraud Score is a better solution

The concept of scoring has been around since the 1950’s. It was most notably pioneered by FICO to drive credit decisions on whether or not a borrower would repay their bills. A fraud score is a similar approach in that in takes into account a multitude of factors regarding the borrower, the property and the "players" involved in the transaction to provide a single prediction of risk. The higher the score, the higher the probability of fraud risk on that application.

As part of the study I referenced above, we analyzed the power of alerts versus the score in predicting fraud. We discovered two interesting things:

• A fraud score was at least 5 times better in detecting fraud than the most predictive alerts.
• A fraud score had far fewer false positives than the most predictive alerts.

From our study it was clear – a fraud score would be a much better solution in detecting fraud risk on loan files than relying on fraud alerts.

Combining Scores and Alerts becomes the best of both worlds

Fraud scores are the best method for predicting fraud on loan files at the lowest false positive. They are however sometimes difficult to understand and operationalize. Alerts on the other hand are easy to understand and operationalize, however they have high false positives. Is there a way to use both?

The answer to that question is absolutely. In fact the best approach is to use a fraud score to drive which loans are reviewed and then use the associated predictive alerts as a guide on things to check in that loan file. I believe this hybrid approach will become the next generation of fraud detection processes. It is one that will rely more on the fraud analyst’s experience and ability to go out and find the fraud rather than rely exclusively on alerts to tell then what to do and when to stop.

A comprehensive review of loan files is needed

Alert clearing alone can be a dangerous thing. If the alert (which we know in many cases is not predictive) does not detect the actual fraud that is occurring on a mortgage application then that fraud is missed during the review process. It is better to build a comprehensive review into the process which looks at all the different types of risk that may be on the loan file (occupancy risk, identity risk, property risk, income risk, employment fraud risk and so on). Comprehensive review processes can of course include the alerts as a guide to primary things to look for, however the review should not stop when the alerts alone are cleared.

The big picture

Thank you for reading my latest edition of Fighting Fraud with Frank. I try to discuss timely topics that I think are relevant to you, the mortgage industry leaders. I am an advocate of strong fraud controls and part of my mission is to help lenders understand different ways and methods of managing fraud. If you would like to discuss operational best practices designed to look at the big picture, my door is always open.

About the Author

	Formerly Co-founder and Chief Fraud Strategist of BasePoint Analytics, Frank helped develop and introduce advanced predictive technology to detect mortgage fraud.
Frank's vast experience in fraud management has enabled him to identify unique and effective tools to manage lender risk through pattern analysis and evaluating other parties in the transaction, such as mortgage brokers. He now serves as Vice President of Fraud Strategy for First American CoreLogic. He may be reached at (760) 602-4971 x104 or via email at FMcKenna@BasePointAnalytics.com