Why typologies, on top of models
An anomaly detection model flags what is rare in your traffic. Yet several fraud schemes do not look rare: topping up a wallet and transferring at once is ordinary use. Others are defined by the texts rather than by statistics, such as split operations. A typology is an explicit check, readable by an analyst and by an auditor, that complements the model.
1. The false reversal
Someone claims to have sent money by mistake and asks for it back. In the data: an amount received, then sent back almost at once to whoever sent it. Taken alone, each movement is ordinary; it is the sequence that raises the alert.
2. Sending right after a SIM swap
A stolen or fraudulently replaced SIM card gives access to its holder’s account. In the data: an outgoing transfer shortly after the SIM swap. This typology needs your system to send the date of the last SIM swap; without it, it cannot see anything.
3. The pass-through account
An account receives money from several third parties and sends it on almost at once: the role of a transit account, often opened or rented to move funds away from their origin. In the data: most of the amounts received go out again within a short time.
4. The receiver with many senders
One person paid by many different senders within a week may be collecting the proceeds of scams or pooling funds for a network. In the data: the number of distinct senders of a receiver over seven days.
5. Splitting under a limit
Several significant operations, each under a limit, that together exceed it: the pattern of split operations, which anti-money laundering texts expressly target. In the data: the total of one customer’s operations over a period, compared with the limit you set, counting only amounts that are a significant share of it.
6. Splitting at one agent
The same customer cashing out several times at the same agent within the hour may be trying to get around a limit, or letting the agent multiply commissions. In the data: a customer’s repeated cash-outs at one agent over an hour.
7. A dormant account waking up
An account idle for months that suddenly sends a large amount may have changed hands. In the data: the time since the sender’s last operation and the amount of this one.
8. An identifier on your lists
Your team keeps watch and block lists: customers, phones, wallets, merchants, agents, pick-up points, devices, countries. Any operation that touches one is flagged. Identifiers are pseudonymised there as everywhere else.
Switching them on without flooding the team
- Start in observation: the typology records the operations concerned without deciding anything.
- Replay it on your history: how many alerts a day, how many overlap with those your models already raise, how many your team can handle.
- Adjust its parameters, such as a delay or a limit, then switch it on with a minimum decision: review, alert or, if you have allowed it, block.
- Follow it over time: a typology that never fires, or fires too often, is tuned again.
In YARDA
These eight typologies are built into YARDA and start in observation. Your team replays, tunes and switches them on from the console, and a typology can be switched on only after a recent replay. Every alert it raises names the typology and its reason, in French and in English.
This guide describes schemes and how to monitor them. It does not replace the analysis of your own risks or the texts that apply to your institution.