Global financial services leader relies on SAS^® for comprehensive fraud detection

Aiming to reduce its global losses from fraudulent transactions and rapidly changing threats, HSBC has deployed SAS Fraud Management as the foundation for its real-time fraud detection and ongoing fraud management across its global network. The solution is live in the US, Europe and Asia, protecting 100 percent of credit card transactions in real time. HSBC envisions expanding these initiatives to encompass fraud across multiple lines of business and multiple sales channels.

Customer Success Video

Check out this video to learn more about HSBC and its successes with SAS.

View Video

• Windows Media Player
• Real Player

(Runtime: 5 mins., 24 secs.)

---

Customer Viewpoint
You have questions; our customers have answers. Check out this video Q&A.

Derek Wylde
Head of Group Fraud Risk, HSBC

View Video

• Windows Media Player
• Real Player

---

(Requires Windows Media Player 6.4.7 or higher)

The credit card transaction request comes in – a $4,500 purchase for a high-end, flat-screen high-definition television – and you have one second to make a high-stakes decision: Approve it or reject it as potentially fraudulent. If you reject a legitimate purchase, you anger a loyal customer, lose the fee income from the purchase and risk an account churn. But if you approve a fraudulent purchase, you've allowed your customer to become a crime victim, and ultimately, your bank is out $4,500. With fraud levels surging around the world, banks are facing greater regulatory scrutiny, as well as the risks associated with damaging publicity from fraud. The ability to correctly make these split-second decisions – before the fraud occurs – is more important than ever.

With assets of approximately US$2.5 trillion, HSBC Holdings plc is one of the world's largest banking and financial services organizations, serving more than 100 million customers through 10,000 offices in 86 countries and territories. Not surprisingly, combating all forms of fraud – payment cards, online transactions and even first-party (customer) fraud – has vaulted to the top of the corporate agenda.

According to Derek Wylde, Head of Group Fraud Risk, Global Security and Fraud Risk for HSBC, the bank has extensive anti-fraud policies that span the entire enterprise. A big part of a bank's relationship with customers is giving them confidence that you are protecting them against fraud, and balancing that with their need to have access to your services. "Fraud losses are true operating costs that go directly to the bottom line and affect our ratios," he said. "So, it's an incredibly important focus for HSBC. Like most institutions, we've implemented policies to segregate duties, create dual controls and establish strong audit trails to spot anomalies. But what sets our anti-fraud strategies apart is our commitment to technology to monitor and score the millions of transactions we process every day. SAS Fraud Management is the cornerstone of these efforts."

A development partner
"We've enjoyed a long partnership with SAS in many areas of our organization," Wylde said. "When we were listing the criteria for a fraud management partner – global reach, analytical strength and collaborative abilities – SAS was the logical choice. We liked that, starting out, this wasn't an off-the-shelf product. It was exciting to be able to help develop the requirements and have some meaningful interest in the direction that the product has taken."

HSBC's first implementation of SAS went live in the United States in June 2007. "The US is our biggest portfolio – we have about 30 million cards issued there," Wylde said. "That's an awful lot of transactions with significant spikes, but they're all scored seamlessly in real time. In fact, we have very little downtime with SAS. It's very stable and very fast – and, obviously, those are key.

"We wanted to have the biggest impact as quickly as possible with SAS – and that's certainly the case with the US deployment. Since then, we've fully implemented in a number of other markets. The UK market is fully protected by SAS for both debit and credit cards, and we've implemented in eight other countries in Asia. As the deployments have continued, we've been able to do more of the work ourselves – but SAS is still there if we need the help. We anticipate rolling out SAS to protect the remainder of our card portfolio in the next 24-36 months.

"We're very pleased with the SAS models," he said. "In particular, we've found that our detection rates on debit ATM transactions have been very, very good. We believe we have the best anti-fraud models that the marketplace can offer right now. The proof is in our fraud numbers – our detection rates and our false-positives – which continue to meet our aggressive goals."

Staying a step ahead of the fraudsters
Of course, financial fraud is an incredibly dynamic phenomenon – and fraud models have a very short shelf life. Once HSBC closes up one loophole, thieves devise new threats to exploit other potential vulnerabilities. As a result, fraud monitoring algorithms and scoring models require constant refreshing.  “Because of the nature of this battle, it's critical to constantly monitor fraud detection performance,” said Wylde. "Our solution from SAS provides a wealth of up-to-date information about the performance of our fraud defenses and allows us to adapt, as needed, to battle changing threats. We also need different models for different regions of the world. The models that have been developed and deployed by SAS have helped us to detect these evolving threats. We’re very, very pleased with the results. SAS has been able to identify individual fraudulent transactions much more effectively than any other solution we’ve deployed."

Expanding to other channels
Moving forward, HSBC is expanding its SAS deployment to monitor multiple transactions across different channels to obtain a customer-centric view of fraud threats. Rather than have separate, isolated teams looking at online bill payments, debit-card transactions and credit-card purchases, HSBC will be using SAS to look at that data in the aggregate. "Sometimes there are subtler threats that – when viewed separately – can appear benign. But when you bring them together, you can spot fraud earlier," said Wylde. "For instance, if a customer's credit card is used shortly after his debit card and there is also activity on the Internet banking channel, you don't want all of that activity being reviewed by three separate analysts in three different locations. Instead, all of your customers' transactions should be viewed together – in a customer-activity detection system."

HSBC Hong Kong will be the first to use the new integrated system from SAS. The system will screen all of a customer's non-card transactions and put all forms of payment transactions through the same solution and a single database. Most banks still operate in silos, with one system for monitoring credit cards, one for debit cards, one for checks, and others for monitoring online and telephone payments and staff activity. According to Wylde, even though the institution is using the same solution in each area, it is less likely to catch the fraudster because the areas aren't communicating one another. "It's also a better customer experience to be consulted once, instead of three separate contacts," explains Wylde.

According to Wylde, SAS has been an ideal partner to work with in achieving its impressive results and pursuing its future objectives. "We've seen some quite exceptional improvements that exceeded the results we achieved with previous systems," he said. "SAS is committed to ensuring that we continue to have a leading-edge anti-fraud solution. We are very pleased with the results. Our IT guys like it, the business guys like it and the finance guys like it as well. Fraud analytics can often bring significant benefits, and that's certainly been our experience with SAS."

The results illustrated in this article are specific to the particular situations, business models, data input, and computing environments described herein. Each SAS customer’s experience is unique based on business and technical variables and all statements must be considered non-typical. Actual savings, results, and performance characteristics will vary depending on individual customer configurations and conditions. SAS does not guarantee or represent that every customer will achieve similar results. The only warranties for SAS products and services are those that are set forth in the express warranty statements in the written agreement for such products and services. Nothing herein should be construed as constituting an additional warranty. Customers have shared their successes with SAS as part of an agreed-upon contractual exchange or project success summarization following a successful implementation of SAS software. Brand and product names are trademarks of their respective companies.

Copyright © SAS Institute Inc. All Rights Reserved.