Digitalization in banking has been an ongoing trend since many years aiming at automating most of the manual work in payment handling and integrating work flows of the involved service providers. The focus of the work presented in this paper is on fraud discovery and steps to fully automating it. Fraud discovery in financial transactions has become an important priority for banks. Fraud is increasing significantly with the expansion of modern technology and global communication, which results in substantial damages for the banks. Instant payment (IP) transactions cause new challenges for fraud detection due to the requirement of short processing time. The paper investigates the possibility to use artificial intelligence in IP fraud detection. The main contributions of our work are (a) an analysis of problem relevance from business and literature perspective, (b) a proposal for technological support for using AI in fraud detection of instant payment transactions, and (c) a feasibility study of the fraud detection approach.
Digitalization [
Fraud discovery in financial transactions has become an important priority for banks. Fraud is increasing significantly with the expansion of modern technology and global communication, which results in substantial damages for the banks and new regulations. A new complexity in fraud detection is expected with the introduction of instant payment. European Central Bank and Central Bank of Russian Federation have already proposed such systems. Compared to conventional Single Europe Payment Area (SEPA) transactions, in instant payments fraud detection has to be completed within a few seconds instead of a day or more. New technological approaches are required to achieve this goal.
In the above context, the work aims at a contribution to quick fraud discovery by creating a library, which can be utilized in real-world fraud detection task. For this purpose, existing publicly available approaches were investigated to explore their utilization in the area of instant payments. One approach is selected for implementation with explicit focus on efficiency. To evaluate performance in terms of speed and precision, a benchmarking of this approach was performed.
The main contributions of our work are (a) an analysis of problem relevance from business and literature perspective, (b) a proposal for technological support for using AI in fraud detection of instant payment transactions, and (c) a feasibility study of a selected fraud detection approach. The remainder of this paper structured as follows: Section 2 summarizes the foundation for our work from fraud detection in payment transactions including important terms. Section 3 introduces the research approach taken. Section 4 investigates the problem relevance. Section 5 is dedicated to fraud detection and the feasibility study. Section 6 summarizes the results and gives an outlook on future work. 2 2.1
Originally, banks could take their time to process a payment transaction order. The
procedure might take hours and even days. Formally, it consists of clearing and
settlement of an order. Clearing is a process of transmitting, reconciling and, in some
cases, confirming transfer orders prior to settlement. Settlement is the completion of a
transaction or a processing with the aim of discharging participants’ obligations
through the transfer of funds [
To reduce the amount of time it takes to proceed with an order, European Central
Bank and Central Bank of Russia developed the proposal of instant payment systems
[
The Euro Retail Payments Board (ERPB) [
As described by Committee on Payments and Market Infrastructures [
Fraud is wrongful or criminal deception intended to result in financial or personal
gain [
In the work, we focus on bank fraud cases, related to instant payment systems. Mainly, on identity thieves, stealing, duplication or skimming of card information, which may often be the result of phishing and Internet fraud. In other words, our main attention is on fraud approaches that utilize genuine payment card credentials.
In 2016, total fraud involving Single European Payment Area (also known as
SEPA: the EU Member States plus Switzerland, Iceland, Lichtenstein and Norway)
cards decreased to 1.8 billion euros, which is 0.8% less than in 2015. Card fraud at
ATMs dropped by 12.4% and online fraud rose significantly, accounting for 73% of
total value of card fraud in 2016. One Euro for every 2,428 Euros spent on payment
cards was lost to fraud. In relative terms, i.e. as a share of the total value of card
transactions of 4.38 trillion euros, fraud dropped by 0.001 percentage point to 0.041%
in 2016, down from 0.042% in 2015. This is the first decrease since 2011 [
Online card fraud is naturally increasing as digital services develop further and is
becoming more and more sophisticated. The most common types of online fraud
reported by the industry are “clean fraud” – where criminals obtain genuine
cardholder details including 3D Secure and Address Verification credentials – and
“identity theft” – where the fraudster steals the cardholder’s personal data in order to
make unauthorized online transactions. However, in recent years there has been an
increase in “friendly fraud”, where the payer first makes a genuine transaction then
claims that their card has been used fraudulently and asks for money back [
In this section, an overview on related works found in public access is presented. In
summary, more than 40 papers on fraud detection were analyzed in the process of
collecting related researches [
Vishwakarma et al. [
Kultur et al. [
Carminati et al.[
Patil et al. [
Hatamikhal et al. [
Nami et al. [
Panigrahi et al. [
The overall research paradigm we follow in our work is design science research
(DSR) as proposed by [
Within the DSR frame, we use different research methods in different phases of the research work. Problem relevance is investigated by an interview study in different banks and financial service providers (see section 4). This business-oriented aspect of the problem relevance is accompanied by a literature analysis to discover relevant existing work in the scientific body of knowledge (see section 2). The main research questions of the problem relevance investigation are “What challenges do organizations in the financial industry experience in implementing fraud detection in instant payments?”.
Based on the problem relevance, we derive requirements and propose an initial
design of the envisioned technological support, i.e. the AI component. This initial
version serves as a feasibility study for fraud detection in instant payment transactions
applying AI. Lessons learned from the feasibility study and requirements derived
from the interviews form an input for the next design-evaluate cycle of the artefact.
The initial version of the method is not discussed in this paper but presented in related
work [
The investigation of problem relevance was performed in two steps: first, we performed interviews with three different payment service providers about their way of performing fraud detection in conventional SEPA payments. In the second step, we analyzed the payment handling in a company offering IP clearing services.
The interviews were conducted on the basis of a structured questionnaire. Objective of the interviews was to understand which steps in conventional SEPA fraud detection could no longer be performed in instant payment fraud detection because of the short time frame. In SEPA payments, banks usually have one bank day for fraud detection, in instant payments max. 10 seconds. Thus, the interviews aimed at gaining a better understanding of the process of processing suspected cases. For the analysis of the suspected case, the manual process receives or fetches different information: • Reason for displaying the suspicious case, e.g. known suspicion / fraud pattern, rule(s), • assessment result of the criticality of the suspected case, e.g. using multi-level scale, • Information about the triggers of the transaction, for example name, age, address data; transaction / sales history, • Information about the content and recipient of the transaction, such as account information of the trigger, amount, intended use, name and bank details of the recipient, • Any further information about the trigger of the transaction, such as the service agent in the bank assigned to the customer.
The basic process flow of fraud detection takes an average time for the manual parts between 5-10 minutes and up to 30 minutes for difficult cases.
The payment service provider is a small company from Germany offering clearing layer and settlement layer functions, as well as value-added services, such as sanction screening and embargo checking, for small and medium-sized banks. The company is one of the first in Germany to offer support for instant payment transactions. Motivated by a report of a Danish payment service using machine learning for fraud detection in domestic real-time payments in Denmark, the case study company decided to explore possibilities of AI use of IP in their own services. Currently, the fraud detection in IP is performed using a rule-based approach, which is not fully suitable to automate the manual steps discovered in the interview study. 5
Section 2.3 shows that there are many fraud detection approaches but that publications describing these approaches do not provide sufficient information for using or implementing them. Thus, we decided to apply a general approach, i.e., for the feasibility study, the use of a random forest approach was selected. 5.1
Random Forest is an ensemble classifying algorithms that represents ensembles a collection of Decision Trees, each of which is built on a randomly selected set of features. A decision tree is a tree where each node represents an attribute and edges following from it represent a condition, under which the edge can be traversed. On leafs of the tree target classes are located. The final decision is represented by majority of results. It is easy to see that model behind Random Forest can be easily visualized and analyzed for investigation, thus, results of classification can be explained in reasonable amount of time.
Methods for creation of Random Forest mainly consist of three approaches: bagging, random split and random set of weights. Bagging is made by sapling original training data set randomly, until certain size is reached. This way, training data sets made by bagging may contain duplicates. For random splitting, a tree is built using K attributes from training data set, selected at random. Last approach is similar to bagging but duplicates are represented by weighting of instances – the more instance’s weight, the more copies of it were sampled.
A decision is made by traversing the tree from root to leaf by a path that meets conditions associated with it. In the end, arriving to a leaf presents the result of classification process. Random Forest runs classification on each tree it consists of during the runtime. Further in implementation, Instances, Instance and Attribute were used for storing and handling of data. Rich set of operations can be performed with Filter class, which makes it easy to manipulate large amounts of data without need in manual implementation with aforementioned classes and interfaces. 5.3
For initial unit testing of different algorithms’ implementation and for testing
assumptions about their performance the Junit [
Since it is unknown whether Random Forest model must be built for each user separately or can be global, the first approach was assumed. Loading of data is separated from benchmark evaluation into the setup, since implementation mainly requires only vector of float point numbers, so transformation into this representation would depend on actual data source. In addition, building a detector and actual detection always spited into different benchmarks. Typically, 10 iterations of building process and 50 iterations of detection were benchmarked. For purpose of precision evaluation, Fβ-scores were calculated with β = 1 and β = 2 Results of the evaluation
Evaluation was performed on transaction data set, generated by modified version of PaySim. This data set contained around 15 thousand transactions, more than 600 of which were fraudulent and 450 clients were involved in the simulation.
Performance measure was performed by 5 benchmarks, each of which were executed 101 number of iterations with 5 iterations of warm-up. Evaluation was performed on typical PC-class machine with 16 GB of RAM and Intel® Core™ i53450.
Since global profile of user is derived from payee of a transaction and represented by a single score, it can be derived outside the detector. Since resulting score is a multiplication of all scores and amount value, it is correct to assume that detection time for global profile is constant, as it only depends on how results of the profile creation are stored.
In this work, current state of fraud detection area was researched and overviewed. Limitations of the research area and existing approaches were presented. The biggest limitation currently is the lack of real-world test data which can be used for developing and evaluating fraud detection approaches.
Based on the observations and analysis results of the problem analysis presented in section 4, we argue that there is a need for additional technology support for fraud discovery in instant payments and propose an AI implementation using random forest approach. To overcome unavailability of proper testing data, a modification of existing payment simulator was proposed and implemented. This allowed successful evaluation of the explored approach.
The selected approach was efficiently implemented and tested for ability to be applied in instant payments area. As an artifact, a programming library that provides this approach for further production use was designed and implemented.
Further research can be done by improving the library with other production-ready approaches. In addition, area of payment simulators can be improved to generate more suitable transactions for different kinds of payment methods. This would allow gathering more useful context information that can slightly improve the quality of detection process.
The research presented has been supported by Government of Russian Federation, Grant 08-08 and by German International Exchanges Agency (DAAD), Grant 57464138.