Mike Willett is an Executive Director at Ernst & Young where he leads the Data Risk practice for the Melbourne, Australia office. He has over 13 years experience in the telecommunications industry in fraud management and revenue assurance. Mike is now more actively engaged in other industries undertaking data analytic projects to provide insight and understanding into business process effectiveness and efficiency.
Mike was previously the Director for Fraud & Revenue Assurance at Telstra Corporation Ltd in Australia. Mike was at Telstra for 6.5 years and led the fraud and revenue assurance function in times of great organisational change as Telstra underwent its massive Transformation program. His interest is both in understanding theoretical approaches to improve revenue assurance outcomes but more importantly in how these can be practically implemented to provide tangible and recognisable business value.
He started his career at BellSouth (now Vodafone) in New Zealand and then moved to Praesidium Services in the UK. During his time with Praesidium, he had the opportunity to consult with a number of service providers and vendors around the world and see how fraud and RA is perceived and managed in a number of different operating and cultural environments.
Mike graduated from the University of Auckland in New Zealand with degrees in psychology and marketing. He can be contacted at: email@example.com.
Podcast: Play in new window
Some people are comfortable to ask questions, rather than face them.
Not so Eric Priezkalns of talkRA who stepped out of his interviewer status this week and allowed me, Mike Willett, to pose the questions to him – even though he couldn’t resist turning the questions back on me from time to time. When I proposed to Eric that he be the subject of a podcast, he willingly jumped at the opportunity and granted me full access to ask any question I wanted. What I was most interested in, though, was understanding Eric’s career path from accountant to today, to understand the things that influenced and drove him, the areas that have made him who he is today. Love or loathe Eric, I am sure you will find his insights and comments typical of what we have all come to expect of him – forthright, insightful and reflective. Enjoy this opportunity to get to know Eric a little bit better.
You can listen to this interview through your web browser, or download the mp3 file from here. If you want to be sure that you will never miss a talkRA podcast, you can also subscribe to the talkRA podcast via iTunes.
In my experience, there have been a few truths about fraud that remain as valid today as when I started out in telco fraud management in the late 1990s. Firstly, fraudsters are looking for the gaps that provide them with the maximum benefit, while at the lowest risk. Secondly, once they find this gap they will exploit this until either the gap gets closed or the risk/reward equation changes and they need, or choose to, look elsewhere.
As a result of this, the fraud manager’s response has been fairly uniform. When gaps are identified, then either systems and/or processes are re-designed to close the gap; or detection mechanisms are enhanced to more quickly identify when the fraud is detected. This all makes sense – close the gap and the fraudster has to expend effort to find a new gap, and that effort may be too much and they move on. Enhance your fraud management system and the benefits to the fraudster decline as the time available to profit from the exploit reduces and, again, they find themselves looking elsewhere. But there is another and third truth, that the fraudster is also intelligent and adaptive, and will continue to innovate to maximise their return.
Perhaps this response needs some further consideration and challenge. The cost of process and system re-design can be expensive with no guarantee that it will be successful – especially if this is process driven and relies on human intervention and judgement. Additional controls can also adversely impact the customer experience. The improvement of fraud detection can also take time and resources, especially if new data is required to be integrated and analysts trained on methods for detection. And yet, despite these challenges, fraud teams around the world are often remarkably adept to protecting their organisation from emerging threats.
However, recall the third truth. Once fraudsters learn of the response made and the changes it introduces, they also adapt their behaviour. The game of cat and mouse is underway and the pace accelerates as each new exploit is opened and then closed (even partially). Every time a telco responds, this provides crucial learnings and insight to the fraudsters on areas such as whether the action was even visible to the telco, how quickly they responded, what follow up action was taken, who took the follow up action. It enables the smart fraudster to understand not only the gaps but how to avoid suspicion and detection.
And so, I suggest, maybe telcos could seek to “defraud the fraudster”, to deceive the fraudster as to what the telco’s fraud management capabilities are. Once a fraudster has been identified, by slightly delaying a response, the fraudster may incorrectly assign the trigger for detection to a later action by the telco, as opposed to the real one. This then becomes the behaviour the fraudster tries to change to avoid detection. When the telco has awareness of the fraud occurring and can monitor and manage the risk at an appropriate level, then they can, at least in part, seek to control and alter the fraudster’s understanding of their processes. To provide a simplistic example: a telco has identified the CDR signature of a call-sell operation. Instead of shutting down the operation immediately on the basis of that signature being observed, perhaps a call is made to the “customer” asking about inconsistent account holder information and then this is the rationale for limiting service. The fraudster continues with the same call signature but invests their time looking at how they should set up their fraudulent accounts. Just as fraudsters confuse the telco, the telcos can confuse and frustrate the fraudster, by quickly closing accounts, seemingly for reasons the fraudster does not seem able to bypass.
Of course, the risk must be managed based on the organisation’s objectives and a balance is needed as I would not want to recommend allowing frauds to run without remediation – that sends a different and more dangerous message. But fraudsters learn quickly about cause and effect, and perhaps seeking to manipulate understanding this can help, in what remains the ongoing battle to manage telco fraud.
I finally managed to listen to the podcast from the WeDo WUG that Eric posted some months ago. Towards the end, Eric asked me a question along the lines of “with pricing getting simpler, such as all you can eat bundles, what does that mean for RA?”. As I listened to the podcast, I wasn’t convinced with my response, and so this blog gives me an opportunity to add to that answer.
On the WUG, I mentioned that behind the $70 per month, unlimited usage, plan, there would be all sorts of partner agreements that need assurance. There is some validity in this comment and it does bring RA to a margin analysis activity. However, I also think my answer was based too heavily on telco revenue streams as they have been over the last ten years, and not what they may look like in the future.
As I dip into this topic, let me make an assumption that we are discussing here the consumer, mass market customers; as this is most likely to whom these pricing constructs will apply. If so, then the telco that is content to collect $70 per month and essentially act as the “dumb pipe” is not the telco that is likely to survive through the significant disruption that digitalisation of business will bring. Telcos continue to search for new products, new partnerships, and better ways to personalise and improve the customer experience. And this, I feel, is where the new battlegrounds for revenue assurance will emerge.
It’s not the $70 per month that RA will need to worry about as controls on that can and should be automated. It’s assuring the small and incremental spend of each customer, where offers are individually tailored (welcome to the world of Big Data) and purchased in real time, that will make the difference to the winners and losers in the market. Getting that right is going to be key. RA has always played in the crucial 1%s of an organisation’s revenue and it is that 1% that can mark the difference between profit and loss.
I was talking to a finance manager in a non-telco industry the other day and the conversation turned to my life at Telstra in revenue assurance. He seemed very interested in the subject matter and, for someone new to this discipline, he asked very insightful questions about how things could go wrong and what could be put in place to prevent revenue leakage.
Finally, he asked me where the name “revenue assurance” came from in the first place because he argued, that the work I’d just described to him was rarely focussed on revenue. Nothing, he said, is revenue until it is in the financial systems, and yet much of the work I described focussed upstream around OSS and BSS – far away from the financials. This, he argued, is perhaps billing or charging related but not revenue. Next he asked me if I had provided “Assurance” in any of the work I had done. He spoke about what “assurance” means to him, which is a definition that I am more accustomed to now with my current organisation. For finance managers, “assurance” has a more specific meaning associated with the accounting and audit profession and provision of an independent opinion. RA’s more hands on role and the methodologies I’d described didn’t align to his experience of what constituted assurance and working with auditors.
Why this post? Much is discussed within telcos about taking RA to other industries. However, before we do, let’s consider carefully the language we use, as the terms “revenue” and “assurance” when put together already have a clear definition to many people, and it will probably be quite different to what we understand it to mean.
I don’t think it would be too controversial if I stated that (attempted and successful) incidents of customer / subscription fraud increase as sales channels move from stores to telesales and then again from telesales to online.
Traditional explanations suggest that this is related to the increasing difficulties operators have in validating the identify of an individual requesting service. Certainly this explanation has intuitive appeal. If someone needs to present a photo ID document to a sales person in a store, it is a lot easier to check the picture against the person in front of you and the signature on the ID against that on the contract. This may not be possible for a phone based sale, but it could be difficult for an 18 year old to present themselves as a 65 year old. The anonymity of online prevents all this, and so operators often look to enforce some checks at the point of delivery rather than the point of sale. Of course, this sounds fine but research by credit card companies has shown that photos on cards are not really useful, with merchants accepting payment from cards with pictures of animals instead of people and with the signature panel unsigned. So perhaps the traditional explanation does not tell the whole story.
I recently had a discussion with a colleague who explained that dishonesty is easy when distance can be put between the action and the perpetrator. By example, he said that a golfer with a ball in the rough may not contemplate throwing the ball back onto the fairway, but is more likely to kick it back, and even more likely again to hit it back with a club. The reason being, that the distance from the action increases, in that case from the golfer’s hand, to a shoe and then to the club, as a further extension. The trolley problem provides a further example (http://en.wikipedia.org/wiki/Trolley_problem). So what about online fraud…online channels place more distance between the application and the applicant and so makes dishonesty and fraud more palatable to the “customer”. This perspective may supplement the traditional explanation. Payments provide another example of increasing distance correlating to increased fraud. Payments used to be cash, then cheques, then through a card with a signature or PIN, and now its tap and go. All these changes put small but increasing distance between the customer and the transaction and so, my colleague asserts, would leave it more prone to dishonesty and fraud.
So what can operators do? Well I have no silver bullet, but suggest that they consider the distance being created in transactions and dealings with customers, and whether there are ways that this can be reduced, either in reality or by perception.