Overview Abnormal Activity Monitoring

Abnormal Activity Monitoring Overview

In response to growing trends of both elder abuse and online banking fraud, the FFIEC and CFPB are now urging credit unions to keep a closer eye on abnormal and high risk activity among members. For assistance in doing this, the Abnormal Activity Monitoring tool was developed. This tool helps your staff do their due diligence when it comes to fraud and monitoring special situations by automatically sifting through member transactions to find those that are abnormal or high risk according to the parameters set by your credit union. Use this time-saving tool to quickly identify abnormal or high-risk transactions according to the parameters set by your credit union.

What Abnormal Means for Your CU

To configure abnormal activity monitoring patterns or groups via Tool #101 Abnormal Activity Monitoring Config, you will first need to determine your credit union's thresholds for normal and abnormal activity. To learn more about determining abnormal activity thresholds for your credit union, check out this Knowledge Base item or the Abnormal Activity Monitoring booklet. You can also base patterns on previous cases of fraud.

You can always reach out to Asterisk Intelligence to build custom queries for you to help determine what abnormal transaction activity looks like for your credit union.

Abnormal Activity Monitoring by Patterns

Setting up Transaction Patterns

To begin using this tool, you’ll first need to set up patterns of activity you would like to monitor.  You will use these patterns to compare their normal activity and their recent activity.

1. Launch Tool #101 Abnormal Activity Monitoring Config.

2. Select Transaction Patterns (compare members to norm for the that member) to access the first configuration screen.

• From here, you can also run a test of a pattern.

3. Click to add, edit, view or copy a pattern to move to the first pattern configuration detail screen.

4. Enter the basic details of the pattern and choose which type of pattern you would like to create from the following list.  If you are viewing or editing a pattern, this will already be selected.  You will advance to one of three screens:

• Velocity trigger (# and/or amount of transaction in a certain period)

• Idle activity trigger (# and/or amount of transaction after period of inactivity)

• Out-of-the ordinary trigger (%increase in # and/or amount of transaction compared to prior period)

Monitoring Member Activity

After setting up the patterns, you’ll need to start monitoring the activity of the members by them.

1. Launch Tool #537 Monitor Abnormal Transaction Activity.

2. Select Transaction patterns (compare members to norms for that member).

3. This will take you to the Monitor Abnormal Trans Activity screen.  Use this screen to monitor abnormal activity by patterns.

4. Select a date and use Enter. The screen will refresh and populate data.  Use the filters to narrow the results.  All columns are sortable. Use the buttons to move to additional screens to take action on the accounts on the screen.

Abnormal Activity Monitoring for Member Groups

Setting up Member Groups

To begin using this tool, you’ll first need to set up member groups for those members whose activity you’d like to monitor.

1. Use Tool #101 Abnormal Activity Monitoring Config.

2. Select Member Groups (compare members to norms for the group) to access the first configuration screen.

• To view the tables and columns in which the information for these settings resides in CU*BASE, select the Data Source (F8).

3. Click Add Mbr Grouping (F6).

4. Click Select next to the Used for monitoring membership designation(s) field to choose the membership types (membership designations) you’d like to monitor in your group.

5. Click Add Origin Group (F6).

6. Click Select next to the Transaction origin codes field to choose the transaction types (Origins) you’d like to monitor in your group.

7. Enter transaction counts and amounts for what you would consider normal, abnormal, and high risk ranges of activity for your group. For assistance in figuring out ranges, take a look at the “Transaction Activity Summary Compare”dashboard and the “Current Month Activity Compare”dashboard.

Monitoring Member Activity

After setting up member groups, you’ll need to start monitoring the activity of the members in your member groups.

1. Launch Tool #537 Monitor Abnormal Transaction Activity.

2. Select Member groups (compare members to norms for the groups).

3. This will take you to the Monitor Abnormal Trans Activity screen.  Use this screen to monitor abnormal activity for a member group.

4. Select a group to monitor, and the screen will refresh and populate data.  Use the filters to narrow the results.  All columns are sortable. Use the buttons to move to additional screens to take action on the members on the screen.  Monitor activity using the “Monitor Abnormal Activity” dashboard and the “Current Month Activity Compare” dashboard.

Additional Resources

Abnormal Activity Monitoring booklet

What tools can I use to get started with Abnormal Activity Monitoring?

Who provided the thirty Abnormal Activity Monitoring patterns I receive by default?  

How can you “practice” to see if a pattern will return any results? 

What does it mean on the first Abnormal Activity pattern configuration screen when you elect to include only shared branch transaction, only RDC transactions, or only P2P transactions? 

For out of the ordinary Abnormal Activity Monitoring patterns, should I include both an amount and percent? 

For out of the ordinary patterns for Abnormal Activity Monitoring, why is there a qualifier for looking for a total dollar amount of transaction for the period selected?