Decoding Tenure: Why Early Fraud Detection Isn’t Enough

February 9, 2024
Alex Faivusovich
Head of Fraud Risk

The digital landscape of payments and banking is continuing to grow and evolve every day. A recent SAS survey of banking executives found that the digitalization of financial services and the adoption of emerging technologies tops the next decade’s most influential trends for the industry. But as always, with great innovation comes an increased exposure to risk – a sentiment that rarely rings as true as it does as when in the financial world. According to the State of Fraud and AML, Vol 2. 61% of respondents said moving from fraud detection to prevention was one of the most important challenges for them. 

In this series, we will explore how data gathered on the Unit21 platform from over 4.05B events worth more than $2.77 trillion worth can offer unique insights into the realm of fighting fraud and ensuring compliance.

Decoding tenure: The first line of defense in fraud prevention

When thinking about fraudulent activity, there are obviously some well-recognized red flags. We can track IP addresses and user behavior, sensitive customers and geographic concerns; there is a long list of these types of data points, which, when combined, can offer an immensely powerful view into suspicious behaviors.

Example Rule

But it’s also important to break down each factor to see why and how each one contributes to the whole picture so you can more effectively spot suspicious activity and stop it. One of these factors is the longevity of an account and how that is distinctly tied into fraudulent activity rates.

Fraud detection rates diminish over time

The data shows that there is a distinct relationship between account tenure and the likelihood of fraudulent activity being detected – the rate of true positives for accounts in their first 7 days stands at 41.62%, which drops by more than half to 17.53% for accounts that have been active for over 90 days.

There's a relative decrease of about 12% when comparing true positives of accounts in their first week to those that have been open for a month. This trend of decreasing true positives continues, with the rate for accounts over 90 days old experiencing a relative decline of more than 58% compared to the first week!

Simply put: As account tenure increases, the amount of bad actors caught decreases.

While our analysis points towards a natural decrease in true positive rates as account tenure increases, it's crucial to consider the role of adaptive fraud prevention strategies. As organizations identify bad actors and fraud patterns, the initial high true positive rates may also reflect a period of learning and rule calibration. However, the challenge remains not just in identifying fraud but in refining detection algorithms to balance the true positive/false positive ratio effectively.

Without continuous adjustments to these rules based on evolving fraud tactics, there's a risk that fraud detection becomes less about identifying genuine fraud and more about navigating an outdated set of parameters. This necessitates a proactive, iterative approach to fraud prevention – one where the insights gained from initial detections are used to hone detection mechanisms, ensuring they remain as effective on day 90 and beyond as they were on day 1.

Early monitoring is critical, but…

As the data indicates, true positive rates for fraud detection decrease as account tenure increases. It's possible that fraudulent actors were caught early on and thus this brought down fraud rates over time. However, given the high rates of fraud across the industry, it’s likely that accounts are more susceptible to fraudulent activity shortly after creation, and the likelihood of catching fraud decreases over time. Take the significant 4.93% drop in the true positive rate after the initial 7-day period (through 30 days), with a notable decrease from 41.62% to 36.69% in the 30-day tenure group. These numbers highlight the first week as a critical period for monitoring new accounts for potential fraudulent activity.

But why do the first 30 days have such a high true positive rate, especially compared to older accounts? Instant activity from Day 1 can be a good indicator of fraud – it’s why establishing a baseline of what genuine activity looks like in that timeframe is a good way to compare what activity is real and what isn’t. 

… Don’t forget long-term vigilance is also crucial

While the highest risk appears to be within the first 30 days, with true positive rates at nearly 49%, the continued presence of fraud detection beyond 90 days means that monitoring must continue well-beyond the critical first-week period. In the post 30-60-90-days of an account’s tenure, fraud tends to shift to a different vertical. For example, a bad actor may change tactics from a fast money grab to a more long-term fraudulent strategy, such as prolonged money muling or a more sophisticated money laundering scheme.  In the first 7 days, we have no account history and usually rely on baseline. Moving to the 30-60-90 strategy, we make adjustments to the baseline but also take into consideration the actual account history.

Creating a risk-based product offering can be of good use during these initial days of monitoring, as well. You may see your new-account fraud rates soar if you give away the entire product to your end-users from the get-go. If you can introduce product friction into your customer experience (without impacting it, of course), then you can provide another barrier to entry for fraudsters.

New call-to-action

The takeaway

At the end of the day, staying vigilant, identifying opportunities, and understanding how important ongoing monitoring is are all key to combating risk.

So, while the early days in an account’s tenure are especially important, the growing and evolving nature of the industry calls for ongoing vigilance and monitoring of even the most well-established accounts.

Want to learn more about how account tenure is linked to fraud and how you can transform your risk & compliance program? ‍Contact us for a demo to see how it works in practice.

Subscribe to our Blog!

Please fill out the form below:

Related Articles

Getting started is easy

See first-hand how Unit21
can help bolster your risk & compliance operations