Healthcare Fraud Detection

Medical Claims with Modifiers - Constantly Evolving Patterns As I dive deeper into finding Fraud, Waste, and Abuse patterns in healthcare billing, I discover fascinating areas I haven't examined closely before. One of these is Modifiers. Modifiers have always been critical for revenue cycle management folks and billers, but when running value-based care analytics and data management, I honestly never paid much attention to them. Yes, I looked here and there, but never studied them deeply. The complexity of modifier usage is remarkable. Take CPT 17000, a simple procedure code used to report the destruction of one premalignant lesion. Looking at Medicare payment data over the years shows dramatic shifts in modifier usage patterns. The most striking change? Around 2019, there was a sudden flip from Modifier 51 (multiple procedures) to Modifier 59 (distinct procedural service), with payments for Modifier 59 skyrocketing from about $25M to nearly $55M by 2022! This is particularly interesting because Modifier 59 is often central to unbundling fraud cases. Providers can use Modifier 59 to "unbundle" services that should have been billed under a single, bundled procedure code - potentially increasing reimbursement. So what caused this dramatic shift? Is it legitimate changes in coding rules, or are we seeing more unbundling practices? Is this a response to reimbursement incentives, or something else entirely? The patterns in our healthcare claims data tell stories - we just need to know how to read them. Fascinating, right?

This is the RiskShield bay at Cashfree Payments, where the team hunts for new fraud patterns before they scale. And they have found something interesting. Well under 0.1% of transaction volume, concentrated in a narrow set of niche UPI handles and card BINs, accounts for 80-90% of the fraud we see. The fraud rings on these handles follow a consistent pattern. They never open with their largest transaction. They start at Rs. 200-Rs. 2000, to see if a merchant’s fraud detection reacts. If it doesn’t, the same handle scales to Rs. 50,000, and in the worst case we have tracked, to Rs. 2.5 lakh, after weeks of testing. To a merchant, these look like regular transactions. RiskShield catches this at the testing stage, in three ways: 1. It sees the same ring across merchants. So,a pattern flagged on one is blocked on the next 2. Its rule engine tracks value within a time window and blocks a handle the moment it crosses a threshold under 50 milliseconds, before authorisation 3. Its device intelligence and behavioural biometrics flag how a transaction is made, not just how much, catching what doesn’t match a genuine customer In the last year, RiskShield blocked over 1.3 million fraudulent transactions, preventing $428.95 million in fraud. I've written more about this, and how merchants can protect themselves, in an article for ET Hindi, link in the comments. Checkout RiskShield if fraud is a problem you want to solve for your business.

Subscription fraud is often invisible - but its impact is significant. Fake free trials and recurring payment abuse rarely appear fraudulent at the start. They typically mimic legitimate user behavior, making detection challenging. Common fraud patterns in subscription businesses • Multiple accounts created by the same user • Use of temporary emails and shared or stolen cards • Abnormal usage during trial periods • Intentional chargebacks after extensive consumption Business impact • Revenue leakage • Increased chargeback ratios • Payment gateway penalties • Distorted growth and retention metrics • Higher customer acquisition costs How fraud is detected effectively • Device and IP intelligence • Behavioral signal analysis • Payment reuse and failure patterns • Usage anomalies during trials and renewals Prevention strategies that scale • Limit free trials per device and payment method • Apply step-up verification for high-risk users • Monitor usage prior to renewals • Block bots and high-risk IP ranges • Leverage AI models to identify evolving fraud patterns Outcomes of a strong fraud strategy • Reduced fake users • Lower chargebacks • Accurate business metrics • Protected recurring revenue • Improved trust with genuine customers Fraud prevention is not friction. It is a safeguard for legitimate users and sustainable growth.

The growing internet sector has led to a rise in sophisticated fraud. Graph Neural Networks (GNNs) have emerged as effective tools for fraud detection due to their ability to model complex relationships. While spatial GNNs have been adapted to address heterophily in fraud graphs, spectral domain approaches remain underexplored. Heterophily refers to the tendency for individuals (or nodes in GNN) to connect with others who are different to them in terms of attributes such as age, gender, race, religion, or social status. Homophily is simply the opposite of heterophily. Existing spectral domain methods, primarily focused on anomaly detection, often neglect the high heterophily issue common in fraud graphs. Recent research has explored novel approaches that explicitly address heterophily in GNNs for fraud detection, combining techniques from both spatial and spectral domains. It has been shown in the analysis of synthetic graphs that heterophily in fraud networks leads to a shift in spectral energy from low to high frequencies. Real-world datasets confirm this trend, demonstrating that splitting graphs based on heterophilic and homophilic edges can extract more meaningful signals from different frequency bands. Based on these observations, the authors of [1] propose SplitGNN, a spectral GNN model designed to capture signals for fraud detection in the presence of heterophily. SplitGNN is constructed by 4 components: • an edge classifier, • a band-pass graph neural network • relation aggregation • a node predictor SplitGNN employs an edge classifier to divide the original graph into positive and negative subgraphs. It then utilizes flexible band-pass graph filters to learn representations for predicting both homophilic and heterophilic edges. If you're unfamiliar with band-pass filtering, it's a signal processing technique that removes both low and high frequencies from a signal, allowing only a specific band of frequencies between a lower-band (Lband) and upper-band (Uband) to pass through. The band-pass GNN uses different filters on the original graph and 2 split graphs to capture different signals. The representations from multiple relations are then aggregated. Finally, the node predictor predicts the labels of the nodes. The authors conducted extensive experiments on three real-world datasets, including a newly released financial statement fraud detection dataset with high heterophily that they constructed. Results demonstrate that SplitGNN outperforms state-of-the-art methods such as XGBoost, MLP, GCN, GAT, GPRGNN, and others. The paper preprint [1] and the #Python GitHub repo [2] links are posted in the comments.

⚡ How Banks Detect Card Fraud in Under 100 ms Every time you tap your card, an incredible amount of analysis happens before your transaction is approved—usually in less than 100 milliseconds. Let's see what happens behind the scenes. 💳 Step 1: Transaction Initiated You tap your card at a POS terminal. An ISO 8583 authorization request is created and sent through: POS Terminal ↓ Acquirer Bank ↓ Visa / Mastercard ↓ Issuer Bank The issuer now has only a few milliseconds to decide whether the transaction is genuine. 🧠 Step 2: Fraud Engine Takes Over Before checking your account balance, the issuer's Fraud Detection Engine evaluates the transaction using hundreds of rules and AI models. It analyzes signals such as: 📍 Location Check Is the transaction happening in a location consistent with your recent activity? Example: A purchase in London just minutes after one in Delhi is suspicious. 💰 Transaction Amount Is the amount unusual for this cardholder? ⚡ Velocity Check Have there been multiple transactions within a very short time? Example: 5 purchases in 2 minutes. 🏪 Merchant Category (MCC) Does the merchant type match your normal spending behavior? 📱 Device & Channel Is this a trusted device or payment channel? 📊 Behavioral Analysis Does this transaction fit your historical spending pattern? 🚫 Blacklist & Watchlists Is the card, merchant, IP address, or device already flagged? 🤖 Step 3: AI Generates a Risk Score All these checks are combined to calculate a risk score. Risk Score < 30 ↓ Approve ✅ Risk Score 30–70 ↓ Step-up Authentication (OTP / 3DS) Risk Score > 70 ↓ Decline ❌ This decision is made in just a few milliseconds. ⏱️ Example Timeline 0 ms → Card tapped 20 ms → Authorization reaches issuer 45 ms → Fraud engine evaluates risk 75 ms → Decision made 95 ms → Response reaches POS The customer only notices a brief "Processing..." message, while the bank has already analyzed hundreds of data points. 🛡️ Why It Matters Modern fraud detection isn't based on a single rule. Banks use a combination of: Rule-based engines Machine Learning models Real-time behavioral analytics Device fingerprinting Historical transaction patterns to stop fraudulent transactions before money leaves the account. 💡 Key Takeaway Banks don't just check your balance—they evaluate every transaction against hundreds of risk signals in under 100 milliseconds before deciding whether to approve or decline it. Every time you tap your card, an AI-powered fraud engine races against the clock—analyzing hundreds of signals and making a decision in under 100 milliseconds. That's the invisible technology protecting billions of transactions every day.

BEC Invoice Fraud, also called Payment Redirection Fraud, Invoice Spoofing, or Man-in-the-Middle (MITM) Billing Attack, is a sophisticated scam where fraudsters impersonate vendors to redirect legitimate payments. How It Works: 1. Reconnaissance:Attackers research your company via LinkedIn, websites, or leaked data to identify suppliers and payment patterns. 2. Compromise:They hack or spoof a vendor’s email (e.g., changing payments@vendor.com to paym3nts@vend0r.com) using phishing, malware, or domain spoofing. 3. Interception:During ongoing invoice discussions, they insert fraudulent messages with new bank details, often mimicking real threads. 4. Urgency: Fake emails push rushed payments ("Pay today to avoid delays!") exploiting tight deadlines. 5. Diversion: Funds land in mule accounts (often overseas) and vanish within hours. Precautions: - Verify Changes: Call vendors using known numbers (not email signatures) to confirm bank changes. - 2FA & DMARC: Enforce multi-factor authentication and email authentication protocols (SPF/DKIM/DMARC). -Payment Controls: Require dual approval for new payees; flag IBAN/country mismatches. - Employee Training: Teach staff to spot subtle spoofing (e.g., Cyrillic "а" vs. Latin "a"). - Vendor Portals:*Use secure supplier portals for invoices, not email. In 2024, FBI reported $2.7B in BEC losses—80% from invoice fraud. One missed call can cost millions. Stay paranoid. #BEC #InvoiceFraud #CyberSecurity

We built 12 fraud detection patterns that catch what most rewarded networks miss. Here's why this matters: Fraud hides in averages. Your UA campaigns might be losing 10% to fraud because when you only see campaign aggregated data, everything looks "good enough." When we launched Ciao Games (our publishing studio), we suddenly had access to user-level data. We could watch individual users cheating in real-time. The patterns became obvious: - Users completing impossible numbers of actions - Suspicious activity at odd hours - Device ID manipulation patterns - Suspicious reward claim timing - Unrealistic progression speeds - Geographic mismatches Publishing our own games helped us understand both our clients and our players better. When you can actually SEE what's happening at the user level, you realize: 1. Most fraud is preventable 2. Real-time monitoring matters 3. Pattern recognition is everything 4. Aggregated data hides the truth 5. User-level insights change decisions But here's what frustrates me: Most advertisers accept "good enough" reporting while part of their budget vanishes into fraud they can't even see. We felt the pain in our own apps, and that helped us fix it for everyone else.

How Small Transactions Slip Past Detection Instead of draining accounts all at once, many use a “low-and-slow” approach — making small, frequent transactions just below the detection threshold to quietly evade fraud systems. In the screenshots below, a fraud seller instructs buyers to stay within certain limits when using stolen cards, even sharing chats with customers who successfully performed the fraud. This clearly shows their awareness of how financial institutions detect suspicious activity. In the past, I’ve identified such patterns by aggregating small transactions over short time windows and flagging repeated micro-payments to the same merchants. To mitigate: ✅ Use rolling-window velocity rules ✅ Implement step-up authentication ✅ Alert customers for unusual small-value transactions Even subtle patterns can expose major fraud operations — we just need to look closer. Stay vigilant and enhance your detection strategies to identify these fraudsters early.

A few years ago, I discovered a $250K promo abuse ring by accident. I noticed something odd: Perfectly normal-looking customers were hitting our 'limit 1 per household' promos exactly 14 days apart. Not 13. Not 15. Exactly 14 days. It was 3 AM, and I couldn't let it go. Something felt wrong. So I dug deeper. These "customers" had flawless order histories. Perfect progressive spending patterns. Everything looked legitimate on the surface. Too legitimate. That's when it hit me The fraudsters were carefully building account histories to fly under the radar. The pattern was beautiful in its simplicity: → Create accounts → Build perfect order history → Wait exactly 14 days → Hit the high-value promos → Scale to hundreds of accounts By the time we caught it, they had scaled to 500+ aged accounts. We rebuilt our entire detection around lifecycle patterns: → Account aging signals → Order progression metrics → Network connection mapping → Behavior pattern analysis The fraudsters are still out there, still trying. But now we know what to look for. And our promos actually drive real growth instead of funding abuse networks. Every time I see a "too perfect" order pattern now, I go back to that 3 AM discovery. ps... If you’ve been wondering how to protect your promos and keep things running smoothly, I'm sharing even more in tomorrow's Fraud Friday chat https://lnkd.in/eEHQ-BXG See you there

🔎 Finding Fraud Rings in a Sea of Transactions: A Graph Data Science Approach Fraudsters don’t operate alone — they operate in networks. Yet most fraud models still analyze transactions as isolated rows and columns, missing the hidden connections between cards, devices, and identities. 🚀 Nuno Pedro Leitão just released a new repository showing how to uncover these hidden fraud rings using Neo4j Graph Data Science and the IEEE-CIS Fraud Detection dataset. Here’s what you’ll find inside: ✔ Ingestion & Graph Modeling – Transform raw CSV transaction data into a connected graph of Cards, Devices, and Identities. ✔ Exploratory Analysis – Surface “Fraud Islands” through graph visualization and community detection. ✔ Graph Feature Engineering – Apply algorithms like PageRank, Louvain, and FastRP to generate powerful structural features. ✔ Machine Learning Pipeline – Train an XGBoost model that combines graph features with traditional tabular data. 📈 The impact? The graph-enhanced model delivered a clear lift in ROC-AUC and Precision-Recall over the baseline tabular approach. Because in fraud detection, who you’re connected to can be just as predictive as what you’re buying. If you're working on fraud, risk, or anomaly detection, this is worth exploring. Would love to hear how you're incorporating graph features into your ML pipelines 👇 Check out the code and notebooks here: https://lnkd.in/eU-qvK6A #GraphDataScience #FraudDetection #MachineLearning #Neo4j #DataScience