How to identify a potential fraud in seconds

Marks & Spencer, the UK clothing and food retailer, has successfully completed the trial of its 'Profit Protection' system, designed to detect fraud among the company's 2m customer transactions per day. The system was built using Visual Studio .Net, Microsoft's web services development tool.

"We can catch fraudsters at the till," says Martin Wilkinson, Marks & Spencer's profit protection manager. "The application allows live searches of our data, 24 hours a day, seven days a week, and instantly alerts loss prevention investigators to potential problems via a cell phone or e-mail message."

By collecting and analysing sales information and case histories, scanning every transaction and recognising if suspicious activity is happening, the application will help detect stolen or cloned debit and credit cards and prevent other types of payment fraud.

Adrian Morrish, retail industry marketing manager with Microsoft in the UK, explains that the Profit Protection system transfers point-of-sale information from Marks & Spencer's 312 UK stores in real time via a Microsoft message queue to a BizTalk Server file in the company's datacentre.

"Marks & Spencer wrote a 'rules engine', which allows the company's fraud protection specialists to define their own business rules for spotting possible fraudulent transactions," explains Mr Morrish. "So far, they've got about 500 rules: some are simple, some complex."

The rules can check each transaction against a number of criteria - including high-refund credit card accounts, statistical ranking on all transaction types, possible collusion involving employees - where the information can be held in databases on different platforms.

Each transaction is fed through the rules base and analysed. If fraud is suspected, a message can be sent back to the store, typically within three seconds of the transaction taking place.

At the same time, Marks & Spencer's central Profit Protection agency is alerted, and also - if necessary - the police. "We've already caught many offenders who've gone on to be prosecuted," says Mr Wilkinson.

Marks & Spencer has been working with one of the local police forces, studying serial crime patterning techniques in a particular geographic area. "Linking into mapping software, again through web service interfaces, they can do predictive analysis of where someone will next attempt to carry out a fraudulent transaction," says Mr Morrish.

Once real-time transactions have been analysed, within ten minutes they are added to the company's SQL Server data warehouse. "Going back for the last couple of years or so, the company can reproduce a physical copy or an electronic representation of a till receipt in under five seconds," says Mr Morrish. "Marks & Spencer can do almost real-time business intelligence analysis against the data in its warehouse," he says. "The company is not using online analytical processing (Olap), just straight relational business intelligence. It can carry out historic analysis, and real-time analysis, plus the ability, through the web services it has built, to extend the analysis out to short messaging service (SMS), and e-mail."

Functionality increased

The code Marks & Spencer's developers have produced - using Visual Studio .Net and Microsoft's Java-like programming language C# - runs faster than the C++ code written for previous prototypes, according to Mr Morrish.

"They also managed to add a lot of functionality they wouldn't originally have been able to fit into the scope of the project," he says.

"One of the things they did in about two days maximum was to write a system which allows Marks & Spencer's chairman to be able to type in on his phone the ID number of any store," says Mr Morrish. "He then receives a real-time feed of its revenue and profitability."

He points out that once Marks & Spencer had put the .Net infrastructure in place for the Profit Protection system, new projects could be rapidly and cost-effectively developed on it.

"The company is now looking at a number of business areas, such as merchandising, and stock-out elimination," he says.

Marks & Spencer is also ensuring its entire staff is aware of the Profit Protection system's existence. "The unfortunate problem is that a certain percentage of the fraud comes from staff," says Mr Morrish. One unexpected side-effect of the system has been the identification of staff members who have not received sufficient store training.

And is the cost of the Profit Protection system justified? "Marks & Spencer have a project nearly completed, which will produce the economic justification for the system," says Mr Morrish.

"Depending on how you measure the cost of the system's implementation, the longest time for a return on investment is 12 months. There are also figures around that show the system returned its cost of development - not the same as cost of ownership - while still in its pilot stage."

EMAIL THIS PRINT THIS MOST POPULAR