Writing
I write for practitioners about how losses actually happen: the schemes that defeat controls which were working exactly as designed, and what assurance over machine learning systems has to look like. These pieces are in preparation, and I will link each one here when it is published.
Business Email Compromise in Insurance Claims Payments
A payment diversion scheme in which the compromise happened outside the insurer altogether, at the external loss adjuster, the least defended link in the chain. Every payment control applicable to the settlement operated exactly as designed and the money still went to the wrong account.
Collusion at the Point of Settlement
What prosecuted vendor and adjuster schemes show: segregation of duties was secured in every case, and was ineffective. Detection came from analysing relationships across transactions, or from someone outside the institution picking up the phone.
From Sampling to Signals
Sampling and anomaly detection answer different questions. Fraud is not distributed at random, because the perpetrator picks the transaction precisely for being unlikely to be picked by the auditor.
Auditing the Algorithm
Eight control objectives for a deployed machine learning model. The exposures are governance exposures: where the training data came from, how the labels were derived, who may move the threshold, and whether the institution can state the basis on which it acted.
The Three Lines Against Organised Fraud Rings
Organised schemes do not defeat the three lines model. They exploit a gap in the allocation it prescribes, because the pattern is visible from no position the model defines.