Fraud detection: An overview

This blog is part of the “Fraud Risk” series.

Jump to:

What is fraud detection?

Why is fraud detection important?

Understanding how to detect fraud

Next step: Investigation

Perhaps the person continually wins the business’s “employee of the month” award. Or maybe that buyer has been a friendly, excellent customer for many years. Or they could be the complete opposite, an employee or an outsider hiding in the dark. Then, almost by chance, the business discovers that that employee or that customer has defrauded it of hundreds of thousands of dollars during the past few years. While the business has stopped the employee or customer from stealing more, the financial damage they would get would have been much less significant and dangerous if it had detected the fraud earlier.

Fraud costs organizations of all kinds billions of dollars each year. What’s more, reports of fraud have been increasing annually in the U.S., with large jumps in activity the past few years. In 2021, the U.S. Federal Trade Commission received 5.74 million fraud reports, up from 4.87 million in 2020. The Association of Certified Fraud Examiners (ACFE) estimates that organizations lose an average of 5% of their revenue to fraud each year. For banks and financial services, the losses are typically higher. According to the ACFE, historical data cost of fraud for U.S. financial institutions in 2021 was $4.2 billion.

As we noted in a previous post, preventing fraud is the best fraud risk management strategy. But not all fraud can be prevented. Fraudsters continue to come up with new tricks for stealing money or data (or both). That’s why organizations need to have rigorous fraud detection protocols in place.

What is fraud detection?

Fraud detection is the systematic identification and analysis of suspicious activities or anomalies within financial transactions, data, metrics, APIs, or processes to uncover instances of fraudulent behavior.

Fraud detection is the second of the three fundamentals—prevention, detection, and investigation–of fraud risk management. It identifies fraudulent activity that has occurred or has been attempted. In other words, it is a response to an existing threat.

A key reason fraud goes undetected for so long: Many organizations don’t sufficiently evaluate their fraud risk. Fraud risk refers to the possibility of financial or other losses (such as company and customer data) due to deception perpetrated by an individual or a group either inside or outside the organization. In some cases, the perpetrators may be both internal and external, working collaboratively.

Detecting risk requires knowing where it might be found. The organization’s financial transactions are the most obvious place to look. Have there been some remarkably large payments made regularly to a vendor? Does a certain bank customer make regular deposits and withdrawals of specific sums at particular times? Detecting financial fraud requires analyzing data patterns over time.

That noted, sophisticated fraudsters will use tactics that aren’t necessarily detected by looking at a single set of data. They could even use artificial intelligence (AI) or machine learning to complicate the fraud. Someone taking out a loan, for instance, might pass all of a bank’s background checks. The bank later discovers that the person’s address, credit history, and so on are connected to a fraudulent co-conspirator. State agencies managing government benefits such as Medicaid and SNAP might be making payments to ineligible people who’ve successfully disguised their true identity through fraudulent documents.

Why is fraud detection important?

The main reason fraud detection is important: the costs of not detecting it. These include not only financial losses and data compromise, but also indirect costs due to lost productivity and customer trust.

Benefits of fraud detection

Many of the benefits of fraud detection resemble those of fraud prevention. Fraudulent activity—whether by customers, vendors and other third parties, cyber thieves, employees, or people seeking government benefits illegally—often interconnects with other types of risks, including those relating to cybersecurity, an organization’s financial stability, and (often) reputational risks.

Fraud detection is a key principle of fraud risk management. By managing its fraud risk, an organization also makes its overall risk management more effective. Risk management involves identifying, assessing, and controlling potential risks or uncertainties that could negatively impact an organization’s objectives. It helps organizations anticipate potential obstacles and reduce their impact, thus facilitating financial stability and more effective decision-making.

Challenges of fraud detection

The earlier the fraud is detected, the less damage it can cause. However, there are several factors that can short-circuit detection efforts. Here are a few:

• Trusting too much. As we noted at the beginning, a great deal of fraudulent deception succeeds because an organization trusts the deceiver. It may not monitor the activities of the employee or a vendor simply because it doesn’t think it’s necessary.
• False identities. Many fraudsters create false identities or use stolen personal information. They might use their own name or that of another person whose personal information they’ve stolen, which often includes that person’s Social Security, bank account, and credit card numbers.
• Complexity. An organization may be so large and its records so complex that it’s difficult to detect fraudulent transactions. An infamous recent example is Theranos, a high-flying startup that claimed its technology could perform rapid blood testing using compact automated devices. Not only were its claims proven false—but so were its financial projections. Theranos executives used accounting sleight-of-hand to convince investors that it would generate over $100 million in revenues in 2014 and $1 billion in 2015. Actual revenues for those years turned out to be significantly smaller. In 2022, the company’s leaders were convicted of wire fraud.

What makes so much fraud so challenging to prevent and detect is the complexity of many transactions. Credit card payments, online apps, cryptocurrency, and other financial tools make transactions more efficient and less costly. PDFs and online platforms make document sharing a matter of a few clicks. These conveniences also make it faster, easier, and cheaper for bad actors to engage in fraud. They also can make it easier for them to run and hide after committing their crimes—and thus harder to detect.

In addition, more and more digitally powered fraud is being committed by transnational criminal organizations with the resources and the digital savvy to create increasingly believable false identities for perpetrating phishing attacks, opening false bank accounts, engaging in money laundering, or stealing government benefits.

Risk, fraud, and investigations solutions Know today’s risk and navigate tomorrow’s challenges View our products

Understanding how to detect fraud

Fraud detection requires rigor, dedication, and financial resources. Here are some key detection strategies that organizations should focus on:

• Ranking and prioritizing fraud risks can help focus an organization’s fraud detection efforts on those risks most likely to happen. The ranking process should also include the determination of how much those fraud risks might cost the organization should they become full-blown risk events (that is, when the fraud is successfully committed).
• Risk audits conducted by several parties across the organization (as well as by external auditors) can boost the effectiveness of fraud prevention, detection, and investigation efforts. Risk audits can include financial audits, cybersecurity audits, and investigations of other risk factors. For agencies managing government benefits, for instance, fraud detection often means giving databases and application documents painstaking scrutiny.
• Technology can present new opportunities for organizational success–and new ways for bad actors to commit fraud. But organizations can fight fire with fire by using digital technology tools to detect fraudulent activity. These tools can rapidly conduct transaction monitoring and identity verification. They also can help organizations analyze and detect data patterns that could reveal potentially fraudulent activity. Using artificial intelligence (AI) with real-time machine learning, automation, and algorithms could further boost your organization’s risk management and strategies.

Types of fraud to focus on

Fraud detection strategies depend largely upon what the organization does. They also can vary depending upon the type of fraud being committed whether it is internal or external. Knowing what to look for (and being aware of false positives) helps make an organization’s detection efforts more successful.

One form of fraud that requires the vigilance of every kind of organization is accounting fraud. Typically, this involves manipulating accounting records to make an e-commerce or business’s financials look better than they are. In some cases, this is driven by executives who want to attract investors or hide suspect transactions. In other cases, an employee seeking to embezzle funds will alter financial datasets to camouflage his or her illicit activities. To detect financial fraud, organizations need to be aware of potential red flags. And of course, they should also conduct regular, thorough audits to review any gaps and make sure there hasn’t been an account takeover. Other types of internal fraud include mail fraud, credit card fraud, wire fraud, check fraud, payroll fraud, and false claims on financial statements.

In cases of insurance and government benefits fraud, the person lies or withholds information to falsely obtain benefits or coverage. Techniques include using false identities or falsified documents as well as exaggerating the cost of damages and faking injuries which authentication could help to prevent damage. Healthcare fraud could involve schemes related to pain management, insurance scams involving false documents, or unnecessary treatments. Many of these forms of fraud can also be instances of cyberfraud, though the better-known examples of this are phishing and ransomware attacks. Other types of external fraud include identity theft, bank fraud, and investment fraud.

Next step: Investigation

Again, prevention is the most cost-effective approach to fraud risk management. But as we’ve also noted, some types of fraudulent activity can pierce even the seemingly toughest prevention armor. That’s when detection, the second fundamental of fraud risk management, comes into play. Techniques and digital tools for fraud detection can minimize the damage fraudulent actions might cause. Having a good fraud detection system can save your company time and money.

After fraud is detected, the organization must then investigate the action in order to mitigate its potential impacts. Fraud investigation and best practices related to it will be the subject of an upcoming post.

The next fundamental Fraud investigation: conducting thorough fraud examinations to determine next plans. Read blog post