Fraud Analytics and Visualization

Introduction

Fraud analytics applies statistical, computational and visual methods to identify transactions, relationships or communications that differ from legitimate patterns. Its purpose is not to prove fraud automatically. Rather, it prioritizes anomalies for investigation, supports hypothesis testing and helps investigators examine large populations that cannot be reviewed manually.

An anomaly may be entirely legitimate: an unusually large payment might represent annual insurance, emergency procurement or a capital acquisition. Conversely, sophisticated fraud may consist of individually ordinary transactions. Effective fraud examination therefore combines analytics with accounting knowledge, documentary evidence, interviews and professional skepticism.

This chapter examines sampling, ratio and trend analysis, Benford’s Law, outlier detection, link analysis, text analysis and visualization. Particular attention is given to data quality, false positives, governance and the responsible use of artificial intelligence.

Learning Objectives

After studying this chapter, students should be able to:

1. Design an evidence-oriented fraud analytics process.
2. Apply statistical and monetary-unit sampling appropriately.
3. Calculate and interpret ratio and trend indicators.
4. Evaluate whether data are suitable for Benford analysis.
5. Detect univariate and contextual outliers.
6. use link and text analysis to identify suspicious relationships.
7. Design visualizations that communicate anomalies accurately.
8. Assess data quality and measure false-positive risk.
9. Explain ethical, legal and governance requirements for fraud analytics.

1. The Fraud Analytics Process

Fraud analytics normally follows an iterative process rather than a single test.

Figure: An iterative, evidence-oriented fraud analytics process.

1.1 Hypothesis-led analysis

A fraud hypothesis identifies the suspected scheme, actors, mechanisms and expected data traces. For example:

An employee may be directing purchases to an undisclosed related supplier, producing shared addresses, bank accounts or contact details and repeated invoices below approval thresholds.

This hypothesis suggests relevant data sources and tests. Searching for anomalies without a hypothesis can still support exploration, but it creates more false positives and increases the danger of interpreting random patterns as misconduct.

1.2 Population, unit of analysis and features

The population is the complete set of relevant records, such as all supplier payments during a financial year. The unit of analysis may be an invoice, journal entry, employee, supplier or relationship. A feature is a measurable attribute used in analysis—for example, transaction amount, posting time, approver, description length or distance from an employee’s address.

The unit must match the investigative question. Aggregating by supplier may reveal concentration that is invisible at invoice level, while invoice-level analysis may expose duplicate payments hidden within an apparently normal supplier total.

2. Data Acquisition, Preparation and Quality

Analytical conclusions cannot be stronger than the underlying data. Investigators should preserve original data, work from controlled copies and maintain a reproducible record of extraction and transformation.

2.1 Relevant data sources

Common sources include:

• general ledger and journal-entry files;
• accounts payable and receivable records;
• supplier and customer master files;
• payroll, expense and procurement systems;
• approval logs and access-control records;
• emails, reports and whistleblowing submissions;
• public corporate registries and sanctions lists;
• device, location or network logs where collection is lawful.

2.2 Data-quality dimensions

Control totals should be reconciled before analysis. Useful checks include record counts, total debit and credit values, minimum and maximum dates, missing-value rates and comparison with ledger balances. Units and currencies must be standardized before values are combined.

Cleaning should not erase evidence. A typographical variation in a supplier name may itself indicate attempted concealment. Investigators should retain original fields and create separate standardized fields for matching.

2.3 Entity resolution

Entity resolution determines whether differently written records refer to the same person or organization. Exact matching works for standardized bank accounts or tax identifiers. Fuzzy matching may compare names and addresses using edit distance or token similarity. Because two legitimate parties can have similar names, uncertain matches require corroboration.

3. Sampling in Fraud Examination

Sampling reduces review effort but introduces sampling risk: a sample may not represent the population. Fraud is frequently rare, clustered or deliberately concealed, so purely random sampling may miss it. A defensible design may combine random sampling with targeted testing of high-risk items.

3.1 Statistical and non-statistical sampling

Simple random sampling gives each population item an equal selection probability. Systematic sampling selects every kth item after a random start. Stratified sampling divides the population into meaningful groups, such as value bands, and samples within each group. Monetary-unit sampling (MUS) selects monetary units, causing high-value transactions to have greater selection probability. Judgmental sampling deliberately selects suspicious items but does not support statistical projection to the full population.

3.2 Sample size for estimating a proportion

For a large population, an initial sample-size approximation is:

where:

• n₀ = initial sample size;
• z = standard-normal critical value for the chosen two-sided confidence level;
• p = anticipated population proportion with the attribute;
• e = desired absolute margin of error, expressed as a proportion.

This formula assumes a probability sample and uses the normal approximation to the sampling distribution of a proportion. The frequently stated independence condition is only a large-population approximation. In simple random sampling without replacement, selections are dependent. If the sampling fraction is material, the finite-population correction should be applied:

Here, N is the finite population size and n is the corrected sample size. The result should be rounded upward. If the expected proportion is unknown, p = 0.5 gives the largest variance and therefore a conservative sample size under this model.

Worked Example 1: Sample size

An investigator wants to estimate the proportion of problematic invoices in a population of 10,000 invoices, using 95% confidence, a 5-percentage-point margin of error and p = 0.5. For 95% confidence, z = 1.96.

Applying the finite-population correction:

The investigator rounds upward and samples 370 invoices. This calculation addresses estimation precision under random sampling; it does not guarantee detection of rare fraud. Targeted tests should supplement it where concealment or clustering is suspected.

3.3 Projection and limitations

Statistical projection is defensible only when selection probabilities and error definitions are established in advance. Items chosen judgmentally because they appear suspicious cannot be treated as a representative random sample. Investigators should distinguish:

• projected error in a statistically selected sample;
• known error found through full-population testing;
• exceptions requiring investigation but not yet established as errors.

4. Ratio and Trend Analysis

Ratio and trend analysis identify unexpected relationships over time, across entities or against operational expectations.

4.1 Financial and operational ratios

Common analytical ratios include:

All numerator and denominator values must cover compatible periods, entities, currencies and accounting bases. Ratios involving a zero or near-zero denominator are undefined or unstable and should not be interpreted mechanically.

A sudden deterioration in gross profit margin might reflect inventory theft, false purchases, incorrect cut-off, price changes or a legitimate change in product mix. The ratio identifies a question; it does not identify the cause.

4.2 Trend measures

Percentage change is calculated as:

where X_t is the current-period value and X_t−1 is the comparison-period value. The denominator must be non-zero.

An index can express each period relative to a base period:

Seasonality, inflation, acquisitions, policy changes and business growth should be considered when selecting the comparison period.

Worked Example 2: Disproportionate purchasing growth

A company reports the following monthly results:

Purchases increased by:

Sales increased by only 5.0%. The purchases-to-sales ratio increased from 1.25 ÷ 2.00 = 62.5% to 1.84 ÷ 2.10 ≈ 87.6%, a rise of approximately 25.1 percentage points. Possible explanations include inventory accumulation, supplier price inflation, duplicate payments or fictitious procurement. Inventory records, receiving documents and supplier-level trends are needed for resolution.

5. Benford’s Law

Benford’s Law describes the first-digit distribution of many naturally occurring datasets spanning several orders of magnitude. Under the law, smaller leading digits occur more frequently than larger ones.

For first digit d ∈ {1,2,…,9}:

For example:

Thus, approximately 30.1% of qualifying observations are expected to begin with 1.

5.1 Applicability conditions

Benford analysis is most appropriate when values:

• arise from multiplicative or naturally varying processes;
• span several orders of magnitude;
• are not assigned identifiers;
• are not constrained by rigid minimums, maximums or fixed prices;
• contain enough observations for meaningful comparison.

It is generally unsuitable for invoice numbers, employee identifiers, postal codes, fixed allowances or prices set at a standard amount. A dataset’s failure to conform is not proof of fraud, and conformity does not prove legitimacy.

5.2 Measuring deviation

A Pearson chi-square statistic may be calculated as:

where O_d and E_d are observed and expected counts for digit d. For a conventional goodness-of-fit approximation, expected counts should generally be at least 5, observations should be appropriately modeled, and the categories must be mutually exclusive. Transaction dependence, preselection and repeated testing can invalidate a simple significance interpretation.

Mean absolute deviation (MAD) provides a descriptive measure:

Here, n is the number of observations and P_d is the Benford expected proportion. Thresholds sometimes used in practice are heuristic and should not replace contextual investigation.

6. Outlier and Anomaly Detection

An outlier is an observation that differs substantially from an expected pattern. Outliers may be global, such as an exceptionally large invoice, or contextual, such as an ordinary-sized payment made at an unusual time or by an unauthorized employee.

6.1 Standard score

For approximately symmetric data without severe contamination, the standard score is:

where x_i is an observation, x̄ is the sample mean and s is the sample standard deviation. Rules such as |z_i| > 3 are screening conventions, not universal proof of abnormality. Transaction amounts are often skewed, making robust methods preferable.

6.2 Interquartile-range rule

Let Q₁ and Q₃ be the first and third quartiles, and IQR = Q₃ − Q₁. A common screening rule flags observations outside:

This rule is robust to extreme values but should be applied within comparable groups. Combining all suppliers may label legitimate high-volume suppliers as outliers.

6.3 Median absolute deviation

The median absolute deviation is:

A commonly used modified score is:

The constant 0.6745 makes the score approximately comparable with a standard score for normally distributed data. The method requires MAD > 0; alternative handling is needed when many values are identical.

Worked Example 3: Robust outlier score

Suppose a supplier’s comparable invoices have a median of $10,100 and a MAD of $300. For a $25,000 invoice:

The invoice is an extreme statistical outlier within this comparison group. Nevertheless, the investigator must inspect the purchase order, goods receipt, authorization and business purpose before drawing a conclusion.

6.4 Rule-based and multivariate detection

Fraud tests often combine multiple attributes:

• duplicate invoice number, amount and supplier;
• repeated payments just below an approval threshold;
• weekend or after-hours postings;
• round-dollar transactions;
• rapid creation and payment of a new supplier;
• mismatch among order, receipt and invoice quantities;
• unusual combinations of user, account and location.

Multivariate models, including clustering, isolation forests and autoencoders, can detect unusual combinations. Their scores depend on model design and training data. Explainability and human validation remain essential, particularly when decisions affect employees or suppliers.

7. Link Analysis

Link analysis represents entities as nodes and relationships as edges. Nodes may include employees, suppliers, addresses, bank accounts, telephone numbers and transactions. Edges should represent verified or explicitly qualified relationships—not speculative associations.

Figure: The address node is connected to both Employee E17 and Vendor V204, while the bank-account node connects Vendors V204 and V319.

In this network, Vendor V204 shares an address with Employee E17 and a bank account with Vendor V319. These are potentially significant relationships, but alternative explanations—such as a home-based legitimate business, data-entry error or shared payment agent—must be tested.

Useful network measures include degree centrality, the number of edges incident on a node, and connected components, which identify groups linked directly or indirectly. High centrality is not inherently suspicious; payroll processors and major banks naturally connect to many entities.

8. Text Analytics

Text analytics converts unstructured language into features that can be searched, compared and classified. Relevant sources include invoice descriptions, journal narrations, emails, hotline reports and audit notes.

8.1 Preparation

Typical steps include tokenization, case normalization, removal of non-informative terms, stemming or lemmatization and preservation of legally relevant metadata. Negation must be handled carefully: “approved” and “not approved” have opposite meanings.

Term frequency can be expressed as:

A smoothed inverse-document-frequency measure is:

where D is the total number of documents and df_t is the number containing term t. The combined weight is:

Terms frequent in one document but uncommon across the collection receive greater weight.

8.2 Applications and limitations

Text methods can identify urgency language, requests to bypass controls, unusual similarity between bids, concealed conflicts or recurring allegations. Sentiment scores alone are weak fraud evidence: vocabulary differs across cultures, professions and languages. Email review also raises privacy, privilege, employment-law and data-retention issues.

Large language models can summarize documents and assist with topic classification, but they may hallucinate, omit qualifications or reproduce bias. Outputs should be traceable to source text and independently verified.

9. Visualization for Investigation and Communication

Visualization supports three functions: exploration, prioritization and communication. Appropriate choices include:

Effective visualizations provide clear titles, units, time periods, source notes and definitions. Axes should not be truncated in ways that exaggerate differences. Three-dimensional decoration, excessive color and crowded dashboards reduce accuracy.

Color should communicate meaning consistently and remain interpretable for users with color-vision deficiencies. Sensitive names should be removed or masked when a chart is distributed beyond the investigation team.

Dashboards should allow users to move from aggregate patterns to underlying records. A chart without an auditable path to source transactions may be persuasive but evidentially weak.

10. Managing False Positives and Model Performance

A false positive is a legitimate item incorrectly flagged as suspicious. A false negative is a fraudulent item that remains unflagged.

Key measures are:

where TP is true positives, FP is false positives and FN is false negatives. Precision measures the proportion of alerts that are truly positive; recall measures the proportion of known positive cases detected.

Base-rate effect

Suppose 100 of 100,000 transactions are fraudulent. A model detects 80% of fraud and has 99% specificity.

• True positives: 100 × 0.80 = 80.
• Legitimate transactions: 99,900.
• False positives: 99,900 × 0.01 = 999.
• Precision: 80 ÷ (80 + 999) ≈ 7.4%.

Even apparently strong performance can produce many false alerts when fraud is rare. Alert thresholds should reflect investigative capacity, expected loss, legal consequences and the relative costs of missed fraud and unnecessary review.

Good controls include risk scoring, tiered triage, suppression of documented legitimate patterns, periodic rule recalibration and monitoring by business segment. Confirmed outcomes should feed back into model evaluation without treating uninvestigated alerts as known negatives.

11. Illustrative Case: Procurement Analytics at Meridian Components

Background

This fictional case illustrates an integrated investigation. Meridian Components, a manufacturer, experienced a 19% increase in indirect procurement expenditure while production volume rose by 3%. Management received an allegation that a procurement employee was favoring related suppliers.

Problem

The investigation team needed to determine whether the increase reflected legitimate price changes, control failures or supplier fraud. The population contained 48,000 invoices from 620 suppliers over two years.

Approach

The team preserved source extracts and reconciled invoice totals to the general ledger. It standardized currencies and supplier addresses while retaining original values. Tests included:

1. monthly purchase-to-production trends;
2. duplicate invoice and payment detection;
3. first-digit analysis of variable indirect purchases;
4. robust outlier analysis within supplier and expense category;
5. matching employee and supplier addresses, telephone numbers and bank accounts;
6. text analysis of invoice narratives and procurement emails;
7. targeted document examination and a random sample of routine invoices.

Analysis

The team did not treat the address match or Benford result as proof. Public registry documents established that Employee E17’s sibling controlled Vendor V204. Bank evidence showed that V204 and V319 received payments into the same account. Receiving staff could not verify delivery for several invoices, and metadata showed repeated orders had been created minutes apart.

Outcome

The investigation substantiated 14 improper invoices totaling $96,400. Eleven duplicate alerts were explained by corrected invoices or legitimate recurring charges, demonstrating the importance of false-positive review. Meridian recovered part of the loss, initiated disciplinary and legal procedures, and introduced beneficial-ownership declarations, duplicate-payment controls and continuous monitoring.

Learning Points

• Multiple independent indicators are stronger than a single anomaly.
• Data reconciliation and preservation are prerequisites for defensible analysis.
• Relationships require verification, not assumption.
• Threshold-based controls can encourage transaction splitting.
• Documented false positives improve future detection rules.

12. Governance, Ethics and Contemporary Practice

Fraud analytics can affect privacy, employment and commercial relationships. Organizations should establish lawful purpose, proportionate access, retention periods and role-based security. Chain-of-custody records should identify who collected, transformed, accessed and exported evidence.

Analysts must avoid confirmation bias and discriminatory proxies. A model may indirectly reproduce protected characteristics through location, language or employment patterns. Material decisions should include qualified human review and an opportunity to correct inaccurate data where legally appropriate.

Contemporary systems increasingly combine process mining, graph databases, machine learning and continuous controls monitoring. Process mining compares recorded event sequences with approved workflows, while graph databases efficiently traverse complex relationships. These technologies expand coverage but do not remove the need for transparent rules, validation, accounting judgment and due process.

Professional best practices

1. Begin with a clearly documented fraud hypothesis.
2. Reconcile analytical data to authoritative records.
3. Preserve original values and transformation logs.
4. Compare like with like and document assumptions.
5. Use multiple techniques and independent corroboration.
6. Measure precision, recall and investigator workload.
7. Separate anomaly detection from allegations or conclusions.
8. Restrict access to sensitive data.
9. Validate automated and AI-generated outputs.
10. Retain a reproducible audit trail of queries, code and results.

Chapter Summary

Fraud analytics uses quantitative and visual methods to prioritize evidence within large datasets. Sampling can estimate population characteristics, but rare or clustered fraud often requires targeted procedures. In simple random sampling without replacement, selections are dependent; the large-population sample formula is therefore an approximation, and a finite-population correction is appropriate when the sampling fraction is material.

Ratio and trend analysis reveal disproportionate changes, while Benford’s Law evaluates qualifying naturally occurring numbers. Outlier methods identify unusual values or contexts, and link analysis exposes relationships among employees, suppliers, addresses and bank accounts. Text analysis can detect recurring language and control-bypass themes. Visualization makes patterns accessible but must represent scales, units and relationships accurately.

Anomaly indicators are not proof of fraud. Data quality, base rates and model design can produce substantial false positives. Defensible practice requires reconciliation, documented assumptions, corroboration, privacy safeguards, reproducibility and qualified human judgment.

Key Terms

Anomaly: An observation or relationship that differs from an expected pattern.

Benford’s Law: A logarithmic distribution describing leading digits in many naturally occurring datasets.

Chain of custody: Documentation showing the collection, possession, transformation and transfer of evidence.

Contextual outlier: An observation that is unusual only within a particular time, group or circumstance.

Data lineage: The documented origin and transformation history of data.

Entity resolution: The process of determining whether different records refer to the same real-world entity.

False negative: A fraudulent item incorrectly classified as legitimate or not flagged.

False positive: A legitimate item incorrectly flagged as suspicious.

Feature: A measurable attribute used in an analytical test or model.

Finite-population correction: An adjustment to sampling variance or sample size when sampling without replacement from a finite population.

Fraud hypothesis: A testable proposition describing a suspected scheme and its expected evidence.

Link analysis: Examination of entities and their relationships using nodes and edges.

Mean absolute deviation: An average absolute difference between observed and expected proportions; also used descriptively in distribution comparison.

Median absolute deviation: A robust measure of dispersion based on distances from the median.

Monetary-unit sampling: A probability-proportional-to-size method in which monetary units are sampled.

Precision: The proportion of positive alerts that are true positives.

Recall: The proportion of actual positive cases detected by a method.

Text analytics: Computational analysis of unstructured language to extract patterns or classifications.

Review Questions

Short Answer Questions

1. Why should an anomaly not be treated as proof of fraud?
2. Distinguish a global outlier from a contextual outlier.
3. When is Benford’s Law unsuitable for a dataset?
4. What is the difference between precision and recall?
5. Why should original fields be preserved during data cleaning?

Long Answer Questions

1. Explain the stages of an evidence-oriented fraud analytics process.
2. Compare random, stratified, monetary-unit and judgmental sampling in fraud examination.
3. Evaluate the strengths and limitations of ratio, trend and Benford analyses.
4. Explain how link and text analytics can support a procurement-fraud investigation.
5. Discuss the ethical, privacy and governance implications of AI-assisted fraud detection.

Analytical / Application Questions

1. A company’s sales increased by 8%, while purchases increased by 35%. Design an analytical plan to determine whether the difference indicates fraud, operational change or accounting error.
2. A detection system produces 1,400 alerts, of which 98 are confirmed fraud. Calculate its observed precision and recommend ways to improve alert quality without automatically reducing recall.
3. An employee and supplier share an address, while two suppliers share a bank account. Identify alternative explanations, additional evidence needed and appropriate investigative safeguards.

Multiple Choice Questions with Answers

Question 1

Which dataset is least suitable for first-digit Benford analysis?

A. Variable supplier payments spanning several orders of magnitude

B. Naturally varying customer account balances

C. Sequentially assigned invoice identification numbers

D. Operating expenses generated by many independent activities

Correct Answer: C. Sequentially assigned invoice identification numbers

Question 2

For a population of 10,000 invoices, 95% confidence, p = 0.5 and a 5% margin of error, what sample size results after the finite-population correction and upward rounding?

A. 196

B. 370

C. 385

D. 500

Correct Answer: B. 370

Question 3

Net sales are $800,000 and cost of goods sold is $520,000. What is the gross profit margin?

A. 28%

B. 35%

C. 53.8%

D. 65%

Correct Answer: B. 35%

Question 4

A comparison group has a median invoice value of $1,000 and a MAD of $300. What is the modified score for an invoice of $1,300 using M = 0.6745(x − median) ÷ MAD?

A. 0.3000

B. 0.6745

C. 1.0000

D. 1.3490

Correct Answer: B. 0.6745

Question 5

In a properly constructed link-analysis graph, what does an edge between a vendor and an address node represent?

A. The vendor is automatically fraudulent

B. The address has the highest degree centrality

C. A defined relationship links the vendor to that address

D. The vendor approved every payment at that address

Correct Answer: C. A defined relationship links the vendor to that address

Question 6

Under TF-IDF, which term generally receives the greatest weight?

A. A term frequent in one document but uncommon across the document collection

B. A term absent from the selected document

C. A term appearing equally in every document

D. A term removed before tokenization

Correct Answer: A. A term frequent in one document but uncommon across the document collection

Question 7

A system reviews 100,000 transactions containing 100 frauds. It detects 80 frauds and falsely flags 999 legitimate transactions. What is its precision?

A. 0.08%

B. 7.4%

C. 80.0%

D. 99.0%

Correct Answer: B. 7.4%

Question 8

Which visualization practice is most likely to mislead readers?

A. Displaying units and reporting periods

B. Linking dashboard totals to source transactions

C. Using a truncated axis to exaggerate small differences

D. Using consistent colors for equivalent risk categories

Correct Answer: C. Using a truncated axis to exaggerate small differences

Question 9

Why may the finite-population correction be needed in simple random sampling without replacement?

A. Selections are dependent and the population is finite

B. Every selected item changes its monetary value

C. Judgmental samples always support projection

D. The correction eliminates all sampling risk

Correct Answer: A. Selections are dependent and the population is finite

Question 10

An employee and a vendor share an address. What is the most appropriate next step?

A. Conclude immediately that procurement fraud occurred

B. Delete the match because shared addresses are always legitimate

C. Corroborate the relationship using ownership, HR and transaction evidence

D. Project the relationship statistically to all vendors

Correct Answer: C. Corroborate the relationship using ownership, HR and transaction evidence