Statistical, Behavioural and Network Analytics

Introduction

Banks generate extensive data through payments, account activity, digital channels, customer onboarding, device use and interactions with other institutions. Cybersecurity and fraud analytics converts these observations into evidence about risk. The central challenge is not simply to identify unusual activity. Legitimate customers may behave unusually because of travel, emergencies, business cycles or life events; sophisticated criminals may imitate normal behaviour. Effective analysis therefore combines statistical evidence, behavioural context and network relationships.

This chapter presents an integrated framework for identifying suspicious customers, transactions and organised fraud rings. It covers descriptive analysis, anomaly detection, customer profiling, risk scoring, link analysis, graph analytics, geospatial analysis, sequence analysis and social-network methods. The emphasis is on operational interpretation: an analytical signal should support proportionate investigation and sound decisions, not automatically be treated as proof of wrongdoing.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Describe distributions, concentrations and temporal patterns in banking data.
2. Apply anomaly-detection methods while recognising their assumptions and limitations.
3. Construct behavioural profiles and explain customer-level risk scores.
4. Use link analysis and graph methods to identify connected accounts and fraud rings.
5. Interpret geospatial, sequential and social-network indicators.
6. Design an integrated investigation workflow with governance, validation and human oversight.

1. Analytical foundations and data architecture

A fraud-analytics programme normally integrates several data domains:

Data quality is foundational. Duplicate customer records, inconsistent timestamps, missing device identifiers and changes in product coding can create false patterns. Time should normally be represented in a common, auditable standard such as UTC, while retaining local time for geospatial and behavioural interpretation. Investigators must distinguish an observed absence from a missing value: “no device recorded” is not equivalent to “customer used no device.”

A useful analytical unit may be a transaction, account, customer, device, beneficiary, session or connected component. The unit should match the question. Transaction-level models identify suspicious payments; customer-level models identify persistent behavioural change; graph-level models identify coordinated structures.

2. Descriptive analysis: establishing what is normal

Descriptive analysis provides the baseline against which unusual activity is assessed. Important summaries include transaction count, total value, median amount, interquartile range, channel mix, geographic dispersion, failed-login rate and beneficiary concentration.

For observations x₁, x₂, ..., x_n, the arithmetic mean is:

Here, n is the number of observations and x_i is observation i. The mean is expressed in the same units as the observations. It is sensitive to extreme values; therefore, transaction amounts often require the median and quantiles as well.

The sample variance is:

The denominator n−1 is used when estimating population variability from a sample. The standard deviation is s = √s². These measures are informative when the distribution is reasonably stable, but financial amounts are frequently right-skewed. Log transformation, robust statistics or segmented baselines may then be more appropriate.

A customer’s transaction share for category k can be represented as:

where V_k is the value in category k and K is the number of categories. The shares sum to one when all categories are included and values are non-negative. Concentration may be measured with the Herfindahl–Hirschman Index:

A higher value indicates that activity is concentrated among fewer categories, such as beneficiaries or countries. Concentration is not inherently suspicious; it becomes meaningful when compared with a suitable peer group and other evidence.

Worked example: robust baseline

Suppose five comparable business accounts make weekly outbound payments of 900, 1,000, 1,100, 1,200 and 5,800 currency units. The mean is 2,000, while the median is 1,100. The mean is distorted by the exceptional payment. An analyst could use the median and peer-group quantiles as the initial baseline, then investigate the 5,800 payment in context rather than treating it as conclusive evidence.

3. Anomaly detection

An anomaly is an observation that differs materially from an appropriate reference distribution or expected behaviour. Anomaly detection methods include:

• Rule-based detection: transparent conditions such as an unusually large payment immediately after a password reset.
• Statistical detection: z-scores, robust distances, density estimates and time-series residuals.
• Unsupervised machine learning: clustering, isolation methods and autoencoders where labelled fraud is limited.
• Supervised classification: models trained on confirmed cases, subject to label quality and changing fraud patterns.

A conventional standardized score is:

where μ is the reference mean and σ is the reference standard deviation. This score is most interpretable when the reference population is stable and approximately symmetric. For skewed or contaminated data, a robust alternative uses the median and median absolute deviation (MAD):

A robust standardized score may be written as:

The factor 1.4826 makes MAD comparable to standard deviation under a normal distribution. This normality-based calibration does not make the data normal; it only provides a familiar scale under that assumption.

Thresholds must be selected using validation data, operational capacity, investigation cost and the consequences of missed cases. A threshold is not a universal law. Seasonality, salary dates, holidays, product launches and known incidents require time-aware baselines. Peer segmentation may use customer type, geography, tenure, product, business size and channel.

Precision and recall help evaluate detection:

Here, TP is true positives, FP false positives and FN false negatives. Precision answers “how many alerts were useful?”; recall answers “how much confirmed suspicious activity was found?” Improving one may reduce the other. Evaluation must use a time-separated test period to avoid leakage from future information.

4. Behavioural profiling and customer risk scoring

Behavioural profiling describes how an entity normally operates. A profile may include:

• typical transaction amount and frequency;
• usual time-of-day and day-of-week pattern;
• normal channels, devices, locations and beneficiaries;
• balance and cash-flow cycles;
• authentication and failed-login behaviour; and
• relationships to other customers or accounts.

Profiles should be dynamic. A long-established change may become the new normal, whereas an abrupt change deserves attention. “Customer segmentation” is not equivalent to “customer suspicion”: a segment is a descriptive group, while a risk assessment combines evidence and consequences.

A transparent composite score can be represented as:

where f_j is a normalised feature, w_j is its weight, m is the number of features and weights are chosen through expert judgement or validated modelling. If the features are intended to contribute comparably, they must be placed on a defined scale, such as 0 to 1. The score is not a probability unless it has been calibrated against outcomes.

A calibrated probability model may use logistic regression:

Here, Y=1 denotes the target outcome, x_j are predictors, β_j are estimated coefficients and β₀ is the intercept. The model estimates a conditional probability only under the assumptions represented by the data, model specification and calibration process. Correlation does not establish causation, and a high score should trigger proportionate review rather than automatic adverse treatment.

Model governance requires documented features, rationale, training population, performance by subgroup, threshold authority, override rules, drift monitoring and an appeal or correction process. Sensitive attributes and proxies require particular scrutiny.

5. Link analysis and graph analytics

Link analysis asks which entities are connected and how. A graph consists of vertices (entities) and edges (relationships). Vertices may be customers, accounts, devices, phone numbers, addresses, merchants or beneficiaries. Edges may represent ownership, a transfer, shared credentials, common device use or common address.

A graph can be represented as G=(V,E), where V is the set of vertices and E the set of edges. In an undirected graph, the degree of vertex v is the number of incident edges. In a weighted graph, edge weights may represent transaction value, frequency or confidence. Different edge types should not be collapsed without preserving their meaning: sharing an address is weaker evidence than a verified common controller.

Useful measures include:

• Degree: identifies highly connected entities, but may merely reflect legitimate intermediaries.
• Betweenness centrality: identifies vertices lying on many shortest paths and potentially bridging groups.
• PageRank or eigenvector centrality: identifies entities connected to influential entities.
• Community detection: finds dense groups, although results depend on algorithm and resolution.
• Connected components: identifies groups joined by available links.

For a graph adjacency matrix A, degree centrality for vertex i in an unweighted graph is:

where A_ij=1 when an edge exists and zero otherwise. In a directed graph, in-degree and out-degree must be distinguished. Network measures describe structure; they do not independently prove intent.

Organised fraud indicators

Potential indicators include many apparently unrelated customers using one device, rapid movement through newly opened accounts, common beneficiaries, circular transfers, shared contact details, and a small number of coordinators connected to many low-activity accounts. Analysts should test alternative explanations such as a payment service provider, family group, employer payroll system or shared corporate infrastructure.

6. Geospatial analysis

Geospatial analytics examines where events occur and whether location is consistent with other evidence. Relevant features include distance between consecutive transactions, impossible travel, unusual country or merchant location, device-location mismatch, and clusters around cash points or mule-recruitment sites.

If latitude and longitude are available, great-circle distance can be estimated using the haversine formula:

Here, φ is latitude, λ longitude, differences are in radians, R is Earth’s radius (approximately 6,371 km), and d is distance in kilometres. The formula assumes a spherical Earth and is an approximation; it is appropriate for many operational distances but not for high-precision surveying.

An impossible-travel signal compares distance with elapsed time. It should account for transport, VPNs, mobile-network routing, shared devices, geolocation uncertainty and legitimate travel. IP location is often a proxy for network infrastructure rather than a person’s physical location.

7. Sequence and temporal analytics

Fraud often appears as a sequence rather than a single event. Examples include account opening, credential change, new-device registration, inbound credits, rapid pass-through transfers and cash withdrawal. Sequence analysis preserves order and timing.

A transition probability between states can be estimated as:

where N_ij is the observed number of transitions from state i to j. This is a first-order Markov assumption: the next state depends on the current state, not the full prior history. The assumption may be unsuitable where long histories, external events or customer-specific context matter.

Sequence methods include event-pattern rules, time-window features, frequent-sequence mining, hidden Markov models and change-point detection. Analysts should avoid learning sequences from labels that were created after the investigation outcome, as this can create target leakage.

8. Social-network methods and multimodal fusion

Social-network analysis studies relational structure, including community density, brokerage, reciprocity, homophily and coordinated timing. In fraud, the “social” network may represent digital or transactional relationships rather than friendship. A fraud ring may contain a coordinator, recruited account holders, cash-out points and beneficiary accounts.

A practical approach is to construct a multilayer graph: one layer for payments, another for devices, another for addresses and another for communications or authentication. Cross-layer links must be confidence-rated. A shared public Wi-Fi address should not be treated like a verified common device identifier.

The strongest investigations combine modalities:

1. establish a behavioural deviation;
2. examine the transaction sequence;
3. expand through high-confidence links;
4. inspect geography and timing;
5. compare with legitimate peer explanations; and
6. produce an evidence-based case narrative.

This is preferable to adding every available variable to a single opaque score. Analysts should preserve provenance: every alert feature should be traceable to a source, timestamp, transformation and model version.

Applied case: Project Lantern

The following is an illustrative fictional case.

Background and problem

A bank observed a rise in authorised push-payment losses. Individual payments were often below existing transaction thresholds, and accounts belonged to apparently unrelated customers. The fraud team suspected coordinated mule activity but lacked a reliable way to connect cases.

Analysis

The bank created a 90-day baseline by customer segment. It identified accounts with a sudden increase in inbound credits followed by outbound transfers within two hours. It then built a heterogeneous graph linking accounts, devices, phone numbers, beneficiaries and login locations.

Three indicators were combined: a robust deviation score for inbound value, a sequence indicator for rapid pass-through, and graph evidence based on high-confidence shared devices and common beneficiaries. A shared device was weighted more strongly than a common postal address. Investigators also checked whether the device belonged to a legitimate business or family relationship.

The graph revealed a component containing 28 customer accounts, four recently created beneficiaries and two devices. Eight accounts had received small credits from unrelated senders and transferred most funds to the same beneficiary within minutes. Geospatial analysis showed that several logins came from a location inconsistent with the customers’ normal patterns, but the bank did not rely on location alone because a commercial VPN was present.

Approach and outcome

The bank temporarily applied enhanced verification to the highest-confidence cases, contacted affected customers, preserved relevant evidence and referred appropriate cases under its legal and regulatory procedures. It did not automatically close every connected account. Some accounts were legitimate family or small-business relationships and were removed after review.

The investigation improved precision by combining sequence and graph evidence, while customer contact reduced harm from false positives. Post-incident review found that device identifiers were occasionally reset, so the bank introduced identifier confidence scores and improved data retention documentation.

Learning points

1. Ring detection requires relationships, not only transaction thresholds.
2. Multimodal evidence is stronger when each signal has a clear meaning.
3. Network proximity is not guilt; alternative explanations must be tested.
4. Operational controls should be proportionate and reversible where possible.
5. Data lineage and post-case feedback are necessary for model improvement.

Challenges, ethics and governance

Analytics can amplify historical bias. If past investigations disproportionately targeted a demographic group, a model trained on those outcomes may reproduce that bias. Proxy variables such as postcode, language, device type or occupation may create similar effects. Governance should include fairness testing, explainability appropriate to the decision, human review, data minimisation, retention limits and mechanisms for correction.

Privacy obligations require a defined purpose, lawful processing, access control and secure handling of personal and network data. Graph expansion is particularly risky because an innocent person may be connected to a suspicious entity. Access should be role-based, and investigative notes should distinguish facts, inferences and hypotheses.

Adversaries adapt. They may distribute activity across accounts, mimic ordinary timing, use residential proxies, compromise legitimate devices or deliberately create misleading links. Consequently, models require drift monitoring, adversarial testing, champion–challenger evaluation and periodic threshold review. Generative AI may assist investigators in summarising evidence or querying data, but it should not invent links, conceal uncertainty or make unreviewed adverse decisions. Retrieval controls, audit logs and human approval are essential.

Best-practice analytical workflow

A mature workflow is:

1. define the risk question and decision authority;
2. inventory and validate data sources;
3. establish segmented behavioural baselines;
4. generate candidate anomalies and sequences;
5. expand candidates through validated graph links;
6. score or prioritise cases with calibrated evidence;
7. investigate alternative legitimate explanations;
8. apply proportionate controls and document reasons;
9. measure precision, recall, losses prevented, customer impact and investigator workload; and
10. feed confirmed outcomes back into monitoring and governance.

The objective is not maximum alert volume. It is timely, explainable and defensible intervention that reduces harm while protecting legitimate banking access.

Chapter Summary

Statistical analytics establishes normal distributions, concentrations and temporal baselines. Behavioural analytics compares current activity with customer- and peer-specific expectations. Anomaly methods range from transparent rules to statistical and machine-learning models; all require appropriate segmentation, validation and monitoring. Risk scores prioritise attention but are not automatically probabilities or proof.

Link and graph analytics reveal shared devices, beneficiaries, accounts and other relationships that may expose organised fraud. Geospatial analysis adds location and travel context, while sequence analysis identifies suspicious order and timing of events. Social-network and multilayer methods help distinguish isolated incidents from coordinated structures. Effective practice combines modalities, preserves data lineage, tests legitimate explanations and applies ethical, privacy-aware human oversight.

Key Terms

Anomaly detection: Identification of observations that differ materially from an expected baseline.

Behavioural profile: Representation of an entity’s normal activity across time, channel, location and relationships.

Betweenness centrality: A network measure based on a vertex’s position on shortest paths.

Calibration: Agreement between predicted probabilities and observed outcome frequencies.

Community detection: Identification of densely connected groups in a graph.

Connected component: A set of vertices linked through available graph paths.

False positive: An alert or classification indicating risk when the relevant condition is absent.

Graph: A structure composed of vertices and edges.

Heterogeneous graph: A graph containing multiple entity or relationship types.

Link analysis: Examination of relationships among entities and events.

MAD: Median absolute deviation, a robust measure of dispersion.

Precision: Proportion of positive alerts that are true positives.

Recall: Proportion of relevant positive cases detected.

Sequence analysis: Study of ordered events and their timing.

Social-network analysis: Study of relational structure, connectivity and communities.

Standard deviation: A measure of dispersion around a mean.

Target leakage: Use of information unavailable at the time a prediction would have been made.

Time-series baseline: Expected behaviour indexed by time and seasonal context.

Transaction graph: A graph whose edges represent financial transfers.

Review Questions

Short Answer Questions

1. Why can the median be preferable to the mean for transaction amounts?
2. Define precision and recall in fraud-alert evaluation.
3. What is the difference between a vertex and an edge in a graph?
4. Why should a shared address usually be interpreted cautiously?
5. What does sequence analysis add beyond transaction-level anomaly detection?

Long Answer Questions

1. Explain how a bank could construct and validate a segmented behavioural baseline.
2. Compare rule-based, statistical, unsupervised and supervised anomaly detection.
3. Discuss how multilayer graph analytics can identify organised fraud while limiting false positives.
4. Explain the assumptions and limitations of the z-score and robust MAD-based score.
5. Evaluate the ethical, privacy and governance requirements for customer risk scoring.

Analytical / Application Questions

1. A customer’s activity is normally stable, but three large outbound payments occur after a new-device registration and password reset. Design an investigation using statistical, behavioural and sequence features.
2. Twenty accounts send funds to one beneficiary, but many share a legitimate employer address. Explain how graph weighting, peer comparison and alternative-explanation testing should be used.
3. Design a performance-monitoring plan for a fraud model in which fraud patterns, customer behaviour and investigation capacity change over time.

Multiple Choice Questions with Answers

Question 1

Which measure is generally most robust to a single extremely large transaction?

A. Arithmetic mean

B. Median

C. Variance

D. Range

Correct Answer: B. Median

Question 2

In the formula z_i = (x_i − μ)/σ, what does σ represent?

A. The sample count

B. The reference mean

C. The reference standard deviation

D. The transaction value

Correct Answer: C. The reference standard deviation

Question 3

A model has 80 true positives and 20 false positives. What is its precision?

A. 20%

B. 50%

C. 80%

D. 100%

Correct Answer: C. 80%

Question 4

Which graph measure identifies vertices lying on many shortest paths?

A. Degree centrality

B. Betweenness centrality

C. Transaction volume

D. Clustering threshold

Correct Answer: B. Betweenness centrality

Question 5

Why should a composite risk score not automatically be called a probability?

A. Scores cannot contain numbers

B. Weights and features may not have been calibrated to observed outcomes

C. Probabilities cannot be used in banking

D. All scores must be binary

Correct Answer: B. Weights and features may not have been calibrated to observed outcomes

Question 6

What is a key limitation of an impossible-travel alert based only on IP geolocation?

A. IP addresses always identify a person precisely

B. IP location may represent network infrastructure rather than physical location

C. Distance cannot be calculated from coordinates

D. Travel is never relevant to fraud

Correct Answer: B. IP location may represent network infrastructure rather than physical location

Question 7

A first-order transition model assumes that the next state depends primarily on:

A. The current state

B. The customer’s income only

C. The final investigation outcome

D. The graph’s total number of vertices

Correct Answer: A. The current state

Question 8

Which feature most directly helps identify a pass-through account?

A. Long account tenure alone

B. Inbound credits followed rapidly by outbound transfers

C. A high-quality postal address

D. A low transaction count over many years

Correct Answer: B. Inbound credits followed rapidly by outbound transfers

Question 9

What is target leakage?

A. Loss of a target customer

B. Use of information unavailable when the prediction would have been made

C. Removal of duplicate graph edges

D. Encryption of model outputs

Correct Answer: B. Use of information unavailable when the prediction would have been made

Question 10

Which practice best supports defensible fraud analytics?

A. Treating every network connection as proof of guilt

B. Maximising alert volume without review

C. Preserving data lineage and testing legitimate explanations

D. Using only historical labels without drift monitoring

Correct Answer: C. Preserving data lineage and testing legitimate explanations