Becoming more profitable Defining the next s teps in fraud detection and risk management.

1. Becoming more profitableDefining the next steps in fraud detection and risk management. Istanbul April 7, 2014

2. Do you recognise this? “We want to make our processes more straight through” “The authorities have given us some serious warnings about our compliancy screening” “Our combined ratio is growing and is almost hitting the 100%” “We are recently faced with large fraudulent incidents and just don’t seem to detect them” “We want to show our clients and society that we are fighting fraud better than our competitors” “Since the introduction of our online channel our loss ratios are going through the roof” “We have a fraud detection system but have many false positives and changing the rules is very hard and expensive”

3. Hybrid model FRISS Detection Expert Model Profile Model Predictive Model Social Network Analysis Method based on knowledge rules Method based on "Normal behavior" in profiles Networks based on Link Analysis Predictive models based on historical data FRISS score

4. Fraud and Abuse Detection – What makes the new tools different from existing approaches? Hybrid Approach Solutions for Fraud Detection Existing in Future Text Mining Advanced Analytics PhotoManipulation • Database searching & Contributorydatabases Anomaly Detection Rules Rules • Contributory • databases Anomaly Detection Text Mining Advanced Analytics LinkAnalysis PhotoManipulation Voice Detection LinkAnalysis Voice Detection Automated screening on images Examples: EXIF and manipulation photos of damaged cars or PDFs Voice stress analysis part of claim intake Examples: check lies, exaggeration of claim Filter fraudulenttransactions Examples: Claims in short timeperiod; claimwithin shortperiod ofrenewal Detect individual andaggregatedabnormal patterns vs. peer groups Examples: Deviation, clustering, univeriate & multivariate regression. Sequence analysis, peer group analysis Look for patterns in unstructured data, documents, blogs, reports Examples: Scripted words or phrases, multiple claimants using same words or phrases; specific phrases suggesting lying, Perform knowledge discovery, data mining, predictive analytics Trend analysis, Time Series Analysis Examples: Neural networks, decision trees, generalized linear models, gradient boosting Look for unexpected relationships Examples: Social network + linkage analysis + community detection + advanced analytics Searchdatabase / web services Use matchingtechniques Verify data over multiple external data sources Contributory databases Examples:watchlist, knownfraudsters, external verifcation data Internal Data Imagescreening Behaviour detection Pro active data alerts Pro active data alerts Online Device Screening Online Device Screening Receive data alerts from external data sources, devices, telematics, Data Harvesters Examples: Vehicle data vendors send alerts when car has been sold Online fraudulent devices External Data Cross border searches Cross border searches More In depth screening but to detect cross border fraud KnownPatterns KnownFraud UnknownPatterns UnstructuredPatterns ComplexPatterns Associative Link Patterns External Data Monitoring International fraud Patterns

5. Always measure yourstarting position Current detection rate Current success rate Manual Investigations In order to be able to calculate your savings potential

6. FRISS Funnel Explanation Total Number of Claims Automated Detection rate: #hits / #claims Hits After Manual investigation by sr. claim handler fraud suspects: #suspects for investigators/#Hits Success rate of the claims Success rate of the hits Fraud suspects Manual Investigation success rate: #proven frauds/#suspects Proven frauds

7. Measureresultsbeforeandafter Total Number of Claims DETECTION BASED ON HUMAN INTELLIGENCE AUTOMATED DETECTION Automated Detection rate: #hits / #claims Hits After Manual investigation by sr. claim handler fraud suspects: #suspects for investigators/#Hits Success rate of the claims Less cases to be investigated 67% New detected cases 43% Success rate of the hits Fraud suspects Manual Investigation success rate: #proven frauds/#suspects Proven frauds

8. Sharingknowledge & information • Friss Learning Cycle • Friss Learning Cycle • Friss Learning Cycle Overall score, input for claim processing Reject or quote according to risk Pro Active Alerts to prevent high risk claims Real-time / batch screening Lean on or integrate previous alerts and risk profiles from Underwriting and Policy Change to the claim screening and effectivily screen, validate and process (or investigate) the claim. Real-time screening Add to watchlist, Build predictive models and profiles for frequent claim models, historic fraud model, area alerts, trends, .., in order to prevent bad risks and fraudulent behaviour entering the portfolio Realtime screening on changes in policy pro active monitoring on current policy such as: Address or move alert, vehicle status alerts, insured person alerts, company bankruptcy alert FRISS IntelligenceDB

9. Predictive underwriting • Use profiles and predictive models based on internal and external data about object, insured, driver, address, phone, bank account, device, etc. • Predict future risks (like fast claiming, claim consciousness, fraud risk, churn, etc.) • For example frequent claim prediction Number of policies Loss ratio Frequent claim probability

10. Connecting data & cases Proven fraud case Real Time Network detection will reveal hidden relations between subjects and objects (i.e. Phone numbers, bank accounts, devices, ...) New SUSPECTfraud case Proven fraud case Proven fraud case Proven fraud case

11. Measure benefits for your business in combined ratio / loss ratio improvement • Proven in a retro analysis for a contributory database (sharing claims & incidents)

12. Use external data in aninnovative way- deeplinking data - Principals Principals Administration Management Administration Management Principals Company Administration Management Holding Holding Principals Company Company Subsidiary Subsidiary Subsidiary Subsidiary

13. Use external data in aninnovative way- proactive alerts - Personal bankruptcy Principals Principals Administration Management Administration Management Principals Company Administration Management Holding Holding Principals Company Company Unfavourable out of business Subsidiary Subsidiary Subsidiary Subsidiary

14. Text mining on Claim ReportThe power of incorporatingunstructured data Reason of claims(HADISE_NOTU) • 12.11.2012 GÜNÜ HALİT YILDIZ İDARESİNDEKİ 41 TK 243 PLAKALI ARACI İLE 1. CADDE ÜZERİNDE SEYİR HALİNDEYKEN ARACINI SAGA KIRMASI SONUCVU PARK HALİNDE OLAN  FLEETCORP OPERASYONEL ADINA KAYITLI 34 HL 2700 PLAKALI ARACA ÇARPARAK HASARA SEBEBİYET VERDİGİ EKTEKİ TUTANAK TETKİKİNDEN ANLAŞILMIŞTIR. • 34 HL 2700 PLAKALI ARAC TARAFIMCA GÖRÜLÜP EKSPERTİZ ÇALIŞMASI YAPILMIŞTIR. ANCAK  GEREK MAGDUR ARAC GEREK SİGORTALI ARAC İNCELENİP ANLAŞMALI TUTANAK VE HASAR  İNCELENDİGİNDE HASARIN EKTEKİ TUTANAK DA BAHSEDİLDİGİ ŞEKİLDE OLUŞAMAYACAGI GÖRÜŞÜNE VARILMIŞTIR; ŞÖYLEKİ 41 TK 243 PLAKALI ARACIN ARKA TAMPON İLE 34  HL 2700 PLAKALI ARAC ÖN KISMINA ÇARPMASI SONUCU ARACLARIN YÜKSEKLİKLERİDE GÖZ ÖNÜNDE BULUNDURULDUGUNDA  ÇARPMIŞ OLSA DAHİ BU ŞEKİLDE HASAR OLUŞAMAYACAGI VE UYUMSUZOLDUGU GÖRÜŞÜNE VARILMIŞ  KALDIKİ SÖZ KONUSU ARACIN PARK HALİNDE OLDUGU ANLAŞMALI TUTANAKDA BELİRTİLMİŞ OLUP DOSYANIN TEDBİR AMAÇLI OLARAK ARAŞTIRMAYA VERİLMESİ TARAFIMCA UYGUN GÖRÜLMÜŞTÜR. ANCAK ARAC SAHİBİNİN BU HASARINDAN VAZGEÇTİ İÇİN DOSYANIN KAPATILMASIAN  KARAR VERİLMİŞ VE FERAGATYAZISI SİSTEME YÜKLENMİŞTİR. #blocked# #blocked# #blocked# #blocked# #blocked# Text Mining on Claim Adjuster Reports will reveal new fraud cases that previously were not detected. Results of expert(EKSPER_NOTU) #blocked# #blocked# UYUMSUZ = Incompatable, ARAŞTIRMAYA = investigation department, FERAGAT = waiver

15. DEVICE REPUTATION COMPONENTS ? Is this device making a fraudulent transaction? 1. IDENTIFICATION 2. EVIDENCE Has anyone seen this device? 3. ASSOCIATIONS Has anyone had a bad experience? 4. ANOMALIES Does the device have connections? Have any anomalies been found? This round-trip takes about 500 milliseconds!

16. In summary

17. Thankyouforyourattention!For questions please do not hesitate..