Fraud Detection Techniques
What this domain tests
This domain tests the toolkit for finding fraud without a specific tip: rules, benchmarking, duplication tests, digit analysis, link analysis, and anomaly detection - plus knowing when each is invalid.
Core rules
- Exception rules and red-flag queries screen the full population; sampling is for validation, not for coverage.
- Peer benchmarking flags outliers relative to a matched group.
- Duplicate and near-duplicate tests catch double payments and re-submitted invoices.
- Benford's law applies to naturally occurring numbers spanning several orders of magnitude with large counts; caps, thresholds, and fixed-price schedules distort it.
- Link analysis reveals shared addresses, phones, bank accounts, and repair vendors.
- Velocity and timing tests: policies written close to loss dates, repeated claims just under a threshold.
- Score models rank referrals; every rule needs monitoring for false positives and periodic retuning.
- A hit is a lead. Confirmation requires documents, statements, or records.
Worked example
A vendor invoice population of 20,000 items is proposed for a Benford first-digit test. Reasoning: invoices were split into bands and capped at $25,000, and many are fixed-fee, so the digit distribution is constrained by policy, not by natural occurrence. Benford would produce a meaningless signal. Instead run duplicate detection on invoice number and amount, test vendor concentration by adjuster, and check invoice dates against service dates - three tests that fit the data's actual structure.
Traps that cost marks
- Applying Benford to constrained or thresholded amounts.
- Treating a rule hit as confirmed fraud.
- Never measuring false positive rates, so the rule loses credibility.
- Missing that a threshold pattern (claims clustering just below a limit) needs its own test.