Network analysis (fraud)

On April 3, 2016, the International Consortium of Investigative Journalists published the Panama Papers, 11.5 million documents from the law firm Mossack Fonseca, mined by representing them as a graph in which every company, every shareholder and every address became a node. Insurance fraud teams apply the same idea to claims. Network analysis, or link analysis, models the data as nodes (policyholders, vehicles, phone numbers, addresses, bank accounts, garages, doctors, lawyers) connected by edges: filed a claim, repaired, shares the same phone. The search is then for structures rather than suspicious individuals. An abnormally dense component, a garage used by policyholders who have nothing in common, a mobile number shared by six drivers with no family tie, a witness who turns up in three accidents. The tools range from interactive visualisation, where the investigator expands the neighbourhood of a claim, to community detection and centrality measures, all the way to graph neural networks that learn to classify a node from its neighbourhood. The hard part sits upstream, in entity resolution: deciding that “J. Martin, 12 rue des Lilas” and “Jean Martin, 12 r. des Lilas” are one and the same person. Too strict, and the graph fragments. Too loose, and it links namesakes and builds networks that do not exist. A single insurer's graph also sees only part of the ring, since organized fraudsters spread their claims across companies, hence the value of the industry's shared databases, within the limits set by the GDPR and the French data protection authority, the CNIL. The analyst stays in charge: a link proves proximity, never complicity, and most dense clusters turn out to be families, company fleets or apartment blocks.