Reconstructing the Fraud Triangle in Videris
By Stuart Clarke
Get the latest news and insights sent straight to your inbox
The last two years have seen a huge rise in cases of fraud, with Action Fraud reporting a 33% increase in 2020 compared to the previous year.1 This growth has led to a large uptick in demand for investigation teams’ skills. Open source data is a hugely valuable repository of information for these investigations. In this article, we’re going to discuss how an open source intelligence platform like Videris can be used to satisfy the fraud triangle, in doing so identifying vital information relating to fraud cases.
Explaining the fraud triangle
The fraud triangle has been the cornerstone of fraud theory since it was developed several decades ago by Donald Cressey, a well-known criminologist. The original triangle presents the three elements that need to be in place for fraudulent behaviour. These include the rationalisation for fraud, the pressure that the individual is under that motivates them to commit fraud, and the opportunity for fraud to be executed without being caught. In recent years, however, we have also seen the shape evolve into a diamond. The fourth element added to the triangle – thus creating the fraud diamond – is that of capability, which covers considerations such as the capability to lie, to deal with the stress and to be in the right position or function with the confidence to execute the fraud.
The fraud triangle is useful both in preventative and reactive contexts. For an organisation trying to prevent fraud, identifying gaps in the triangle – such as an undeclared gambling problem that is putting pressure on an employee’s finances – can help it to introduce measures to deter fraud more effectively. Where an investigator is responding to a case of fraud that has already taken place, the fraud triangle provides a clear framework for understanding what has happened.
In either context, the ability to connect the dots between different data types is key to satisfying the fraud triangle.
Why use technology?
To conduct a fraud investigation that includes open source data, an investigator needs to extract and correlate key entities and connections spread across a range of different data, applying analysis to turn this data into Open Source Intelligence (OSINT). However, conducting the whole of this process manually is both time-consuming and prone to error. Investigators need an intelligent, automated way to combine key data sources into a single view, enabling them to see the big picture and to unravel the fraud.
Videris enables fraud investigation teams to ingest all relevant content from financial systems and combine it with data from the surface and deep web (including global corporate records data) for a single view of the factors at play in an instance of fraud.
Drawing on multiple data sources
Data from financial systems and user-generated documents often hold critical information in fraud investigation cases. The investigator needs to ensure that data of relevance is ingested into Videris before the investigation begins for two reasons. Firstly, by extracting and visualising key relationships, it’s possible to carry out an initial triage, allowing the investigator to identify data and connections of importance. Secondly, Videris uses the data already in the investigation to perform contextual analysis against new data when it’s brought into the platform, surfacing relevant data more quickly based on known intelligence, and allowing connections that may have otherwise been missed to be spotted more quickly. Using Videris’ intuitive data import functionality, it’s possible to bring this data into Videris and map it on a chart so that it’s easy to understand before the investigation starts.
The Association of Certified Fraud Examiners (ACFE) defines the rationalisation stage as the following:
‘Because the fraudster does not see himself as a criminal, he must justify the fraud to himself in a way that makes it seem an acceptable or justifiable act.’2
In order to understand the rationalisation for a case of fraud, we need to explore the circumstances in which it took place. To do this, we might first turn our attention to the surface web, where we might find, for example, a variety of different articles relating to job cuts, possible office closures and disruption in the workplace in the months when the fraud was committed. This situation provides an example of possible rationalisation for committing fraud: the perpetrator may have thought that they were protecting their family from potential loss of income, or that they were being treated unfairly.
How can Videris help?
Videris Search allows investigators to conduct targeted searches across open source data and quickly turn these findings into intelligence. It’s easy to search across multiple sources in a single platform, including those from the surface, deep and dark web. Investigators can then bring results into one interface, with filtering and categorisation allowing them to view high-level themes but also drill down to the most relevant data quickly.
Pressure is defined by the ACFE as ‘what motivates the crime in the first place’.3 The data identified through web search also provides some evidence of pressure due to risk of job loss and the associated financial challenges. In addition, when investigating a person of interest, their online footprint might also provide some indicators of pressure. Perhaps they are shown attending expensive events in photos on social media, despite having recently lost their job, or maybe there is evidence that a family member is unwell and in need of financial support.
How can Videris help?
Videris gives investigators the ability to understand an individual’s online footprint quickly and, where public, to map their activities and connections. It’s easy to gain a full, contextualised picture of their circumstances and subsequently identify any pressure points.
Opportunity is said to define the way that the crime can be committed. The perpetrator must see a way that they can use their position to solve a financial problem with very low risk of being caught.4 In many ways, Covid-19 has also created an opportunity for those considering engaging in fraudulent activity. When as many as 9.6 million employees in the UK were furloughed5, many people were left at home with additional spare time. For some, this provided an opportunity to seek income from other sources, including setting up additional businesses.
How can Videris help?
Using Videris, investigators can quickly identify corporate records relating to an individual and map connected officers, companies and addresses. This might allow them to identify vehicles for fraud, addresses where multiple suspicious businesses are registered, or connections to individuals with a history of involvement in criminal activity.
In 2021, the fourth element of the new fraud diamond theory – capability – is a key consideration. As technology plays a growing role in everything we do, the capabilities that allow individuals to commit fraud and keep their identity anonymous are more easily accessible. For example, the dark web provides access to online marketplaces where anonymous individuals buy and sell products and services. Where an individual has acquired goods in a fraudulent manner, they are most likely to sell them on the dark web in order to conceal their identity.
How can Videris help?
Whilst the dark web is technically anonymous, those who use it sometimes leave clues to their identity. Investigators can use Videris to search the dark web for relevant content such as marketplace listings and potentially uncover usernames, email addresses, contact numbers or other identifying information. When combined with the other data sources available in Videris, connections to real-world identities can often be established.
Investigating frauds can often be complex, especially where fraudsters have gone to great lengths to conceal their identity and useful information is spread across a variety of different data sources. However, using an investigations platform like Videris to bring all this disparate data – including internal data – into a single view substantially simplifies the investigator’s task, allowing them to work faster and derive new insights. By analysing multiple types of data and mapping the connections between it, the criteria of the fraud triangle – or diamond – can be fulfilled.