Fraud prevention is a race against scale.

For example, Mastercard’s network processes roughly 160 billion transactions a year, and experiences surges of 70,000 transactions per second during peak periods (such as the December holiday rush). Finding fraudulent purchases among those – without chasing false alarms – is a rare task, so fraudsters are able to game the system.

But now, sophisticated AI models can analyze individual transactions, pinpointing those that seem suspicious – in milliseconds. This is the heart of Mastercard’s flagship fraud platform, Decision Intelligence Pro (DI Pro).

“DI Pro specifically looks at each transaction and the risk associated with it,” Johan Gerber, EVP of security solutions at Mastercard, said recently VB Beyond the Pilot podcast. “The fundamental problem we’re trying to solve here is real-time assessment.”

How DI Pro works

Mastercard’s DI Pro is built for latency and speed. From the moment a consumer taps a card or clicks “buy,” that transaction flows through Mastercard’s orchestration layer, back to the network, and then to the issuing bank. Usually, this happens in less than 300 milliseconds.

Ultimately, the bank makes the approval-or-denial decision, but the quality of that decision depends on Mastercard’s ability to deliver an accurate, contextualized risk score based on whether the transaction could be fraudulent. What complicates this whole process is the fact that they are not looking for anomalies, per se; they look for transactions that, by design, resemble consumer behavior.

At the core of DI Pro is a recurrent neural network (RNN) that Mastercard refers to as a "repeat recommendation" architecture. It treats fraud detection as a recommendation problem; the RNN conducts a pattern completion exercise to determine how traders relate to each other.

As Gerber explains: “They were here then, they’re here now. Does it make sense to them? Would we recommend this merchant to them?”

Chris Merz, SVP of data science at MasterCard, explained that the problem of fraud can be divided into two sub components: The behavior of a user and the behavior of a fraudster. “And we’re trying to make fun of those two things,” he said.

Another “neat technique,” he said, is Mastercard’s approach to data sovereignty, or when data is subject to the laws and governance structures of the region where it is collected, processed, or stored. To keep the data “on the ground,” the company’s fraud team relies on aggregated, “completely anonymized” data that is not sensitive to any privacy concerns and thus can be shared with models around the world.

“So you can have global standards that influence every local decision,” Gerber said. “We take a year’s worth of knowledge and squeeze it into a transaction in 50 milliseconds to say yes or no, it’s good or it’s bad.”

Scam by scammers

While AI is helping financial companies like Mastercard, it’s also helping fraudsters; now, they are able to rapidly develop new techniques and identify new ways of exploitation.

Mastercard fights back by joining cyber criminals in their backyard. One way they do this is by using "honeypots," or artificial environment intended in essence "Snare" cyber criminals. When threat actors think they have a legitimate brand, AI agents engage with them in hopes of accessing mule accounts used to funnel money. That becomes “more powerful,” Gerber said, because defenders can use graph techniques to determine how and where mule accounts are connected to legitimate accounts.

Because in the end, to get their payout, scammers need a legitimate account somewhere, which is linked to mule accounts, even if it is covered 10 layers below. If defenders can identify it, they can map fraud networks around the world.

“It’s a weird thing when we take the fight to them, because they’ve caused us enough pain like this,” Gerber said.

Listen to the podcast to learn more about:

• How Mastercard is created a "malware sandbox" with the Recorded Future;

• Why a data science engineering requirements document (DSERD) is important to align four disparate engineering teams;

• The importance of "relentless prioritization" and difficult decision-making to go beyond "a thousand flowers blooming" on projects that actually have a strong business impact;

• Why successful AI deployment should involve three phases: ideation, activation, and execution – but many businesses skip the second step.

Listen and subscribe to Beyond the Pilot on Spotify, Apple or wherever you get your podcasts from.

Source link