Reduce losses from fraudulent transactions

HSBC significantly lowered incidence of fraud across tens of millions of debit and credit card accounts

Aiming to reduce its global losses from fraudulent transactions and rapidly changing threats, HSBC has deployed SAS Fraud Management as the foundation for its real-time fraud detection and ongoing fraud management across its global network. The solution is live in the US, Europe and Asia, protecting 100 percent of credit card transactions in real time. HSBC envisions expanding these initiatives to encompass fraud across multiple lines of business and multiple sales channels.

The credit card transaction request comes in – a $4,500 purchase for a high-end, flat-screen high-definition television – and you have one second to make a high-stakes decision: Approve it or reject it as potentially fraudulent. If you reject a legitimate purchase, you anger a loyal customer, lose the fee income from the purchase and risk an account churn. But if you approve a fraudulent purchase, you've allowed your customer to become a crime victim, and ultimately, your bank is out $4,500. With fraud levels surging around the world, banks are facing greater regulatory scrutiny, as well as the risks associated with damaging publicity from fraud. The ability to correctly make these split-second decisions – before the fraud occurs – is more important than ever.

With assets of approximately US$2.5 trillion, HSBC Holdings plc is one of the world's largest banking and financial services organizations, serving more than 100 million customers through 10,000 offices in 86 countries and territories. Not surprisingly, combating all forms of fraud – payment cards, online transactions and even first-party (customer) fraud – has vaulted to the top of the corporate agenda.

According to Derek Wylde, Head of Group Fraud Risk, Global Security and Fraud Risk for HSBC, the bank has extensive anti-fraud policies that span the entire enterprise. A big part of a bank's relationship with customers is giving them confidence that you are protecting them against fraud, and balancing that with their need to have access to your services.

"Fraud losses are true operating costs that go directly to the bottom line and affect our ratios," he said. "So, it's an incredibly important focus for HSBC. Like most institutions, we've implemented policies to segregate duties, create dual controls and establish strong audit trails to spot anomalies. But what sets our anti-fraud strategies apart is our commitment to technology to monitor and score the millions of transactions we process every day. SAS Fraud Management is the cornerstone of these efforts."

A development partner

"We've enjoyed a long partnership with SAS in many areas of our organization," Wylde said. "When we were listing the criteria for a fraud management partner – global reach, analytical strength and collaborative abilities – SAS was the logical choice. We liked that, starting out, this wasn't an off-the-shelf product. It was exciting to be able to help develop the requirements and have some meaningful interest in the direction that the product has taken."

HSBC's first implementation of SAS went live in the United States in June 2007. "The US is our biggest portfolio – we have about 30 million cards issued there," Wylde said. "That's an awful lot of transactions with significant spikes, but they're all scored seamlessly in real time. In fact, we have very little downtime with SAS. It's very stable and very fast – and, obviously, those are key.

"We wanted to have the biggest impact as quickly as possible with SAS – and that's certainly the case with the US deployment. Since then, we've fully implemented in a number of other markets. The UK market is fully protected by SAS for both debit and credit cards, and we've implemented in eight other countries in Asia. As the deployments have continued, we've been able to do more of the work ourselves – but SAS is still there if we need the help. We anticipate rolling out SAS to protect the remainder of our card portfolio in the next 24-36 months.

"We're very pleased with the SAS models," he said. "In particular, we've found that our detection rates on debit ATM transactions have been very, very good. We believe we have the best anti-fraud models that the marketplace can offer right now. The proof is in our fraud numbers – our detection rates and our false-positives – which continue to meet our aggressive goals."

SAS is committed to ensuring that we continue to have a leading-edge anti-fraud solution. We are very pleased with the results.

Derek Wylde
Head of Group Fraud Risk

Staying a step ahead of the fraudsters

Of course, financial fraud is an incredibly dynamic phenomenon – and fraud models have a very short shelf life. Once HSBC closes up one loophole, thieves devise new threats to exploit other potential vulnerabilities. As a result, fraud monitoring algorithms and scoring models require constant refreshing.  “Because of the nature of this battle, it's critical to constantly monitor fraud detection performance,” said Wylde. "Our solution from SAS provides a wealth of up-to-date information about the performance of our fraud defenses and allows us to adapt, as needed, to battle changing threats. We also need different models for different regions of the world. The models that have been developed and deployed by SAS have helped us to detect these evolving threats. We’re very, very pleased with the results. SAS has been able to identify individual fraudulent transactions much more effectively than any other solution we’ve deployed."


Reduce incidence of fraud, lower costs and increase customer confidence.


SAS® Fraud Management


HSBC has achieved significantly lower incidence of fraud across tens of millions of debit and credit card accounts, significantly exceeding aggressive objectives.

The results illustrated in this article are specific to the particular situations, business models, data input, and computing environments described herein. Each SAS customer’s experience is unique based on business and technical variables and all statements must be considered non-typical. Actual savings, results, and performance characteristics will vary depending on individual customer configurations and conditions. SAS does not guarantee or represent that every customer will achieve similar results. The only warranties for SAS products and services are those that are set forth in the express warranty statements in the written agreement for such products and services. Nothing herein should be construed as constituting an additional warranty. Customers have shared their successes with SAS as part of an agreed-upon contractual exchange or project success summarization following a successful implementation of SAS software. Brand and product names are trademarks of their respective companies.