The Importance of Effective Link Analysis In Detection and Investigation
November 1st, 2018
Organized crime rings are reaping billions of dollars per year from a variety of attacks on the global financial services ecosystem. One of the criminals’ key advantages is their organization; they run themselves as innovative and efficient enterprises, often spread across multiple countries. This strength is also a weakness, however. The organized nature of criminals’ business can be used against them with effective link analysis solutions.
Link analysis is an important tool in the arsenal of loss prevention and anti-money laundering (AML) teams. It can analyze vast amounts of data by sifting through data streams and repositories and discovering connections between customers and accounts, then graphically displaying the resulting networks to facilitate detection and investigation. Advanced tools also score the networks based on the degree to which they exhibit high-risk characteristics to help prioritize the workload. Link analysis can be used to detect mule networks, uncover synthetic identities, understand beneficial ownership, and more.
- Mule networks: Money mules are an important element of how criminals extract their illicit funds from the financial system. Mules transfer stolen funds using their own accounts or third-party money transfer services; they can be knowing participants in the financial crime activity or people who have been duped by “easy money” or romance scams. Organized crime rings typically use large networks of seemingly unconnected mules to move the money multiple times before it finally arrives in accounts ultimately controlled by the crime ring. Link analysis is a critical tool in mule network detection, since it can enable financial services providers to leverage both account data and digital identity data to discover the hidden connections and linkages, follow the flow of funds, and shut down the mule accounts.
- Synthetic identities: Synthetic identity fraud results when criminals fabricate identities to establish new bank accounts or lines of credit and use those fake identities to steal money. This problem is rapidly growing, as discussed in this Aite Group report, and is particularly acute in the U.S. Link analysis can find synthetic identities in a couple ways. During case investigations, a specific data element is often shared among a number of different synthetic identities (e.g., a physical or email address, phone number, device ID). Sometimes there are slight variations in the data (e.g., firstname.lastname@example.org and email@example.com), so the fuzzy matching capability in link analysis is also important. This analysis can help lead from a single-case investigation to the discovery of the entire ring. Financial institutions can also use this technology to screen their portfolios for suspicious linkages, which often are bust-outs biding their time.
- Beneficial ownership: Understanding beneficial ownership of banks’ legal entity customers is a complex AML problem that currently is a hot button for regulators around the globe. Link analysis can help institutions map and visualize complex corporate ownership structures, uncover hidden relationships, and document their due diligence for regulators.
While link analysis is a crucial solution for financial crime detection and investigation, not all link analysis solutions are created equal. Financial services providers need to ensure their link analysis solution can perform fuzzy matching, analyze entity relationships in real time, perform retroactive analysis of portfolios, score suspicious activity at both the entity and portfolio level, and display the results in an intuitive manner. Armed with a robust link analysis capability, financial crime fighters can effectively turn the network effect into criminals’ Achilles heel.