1. Risk and Revenue Modeling Group AT&T Labs 12 - June - 2001 AT&T Proprietary 1 Call detail: time of day, duration, origin, destination, charged number, … Scampweb CALLING PARTY CALLED PARTY 5E SWITCH CARD DATABASE CPP BILL SYSTEM Billdats RAMP CALL DETAIL DATA WAREHOUSE SCAMP Calling Card Calls FRAUD & USAGE MONITORING GROUPS AT&T SHANNON R&T LABS GFMS

2. Risk and Revenue Modeling Group AT&T Labs 12 - June - 2001 AT&T Proprietary 2 Charlotte, NC Work & Strategy centers FASC/CPC/FRAT Fraud Analysis Surveillance Center Mark Loper Scott Davidson Barbara Jarman Bridgewater, NJ Strategy CARM Collections and Receivable Management Pete Coulter Rick Budka Peggy Onorato Calling Card Calls FRAUD & USAGE MONITORING GROUPS

3. Risk and Revenue Modeling Group AT&T Labs 12 - June - 2001 AT&T Proprietary 3 Colin Goodall Sylvia Halasz Hyunsook Lee Krishnan Eswaran Gersony Hildebrand(Sandy Hall) John Mocenigo: GFMS Daryl Pregibon(Calderbank):Signatures Rick Greer: Daytona Anne Rogers(Belanger): Hancock Data mining of call detail Daily query and signature updating Fraud and usage alerts to GFMS Calling Card Calls AT&T SHANNON R&T LABS

4. Risk and Revenue Modeling Group AT&T Labs 12 - June - 2001 AT&T Proprietary 4 Actual results so far Number of cards used/day Number of card sig alerts generated/day Number of alerts worked/day % of worked cards taken down/day 900,000 15000 million signatures 30050-7014-26% Analogy distance of Sun from Earth less than once around the Equator Financial results Amount of uncollectibles on calling cards decreased by ~ $300,000/month (~ 30%)

5. Risk and Revenue Modeling Group AT&T Labs 12 - June - 2001 AT&T Proprietary 5 ------- alarms and PFG alerts for AT&T cards 891253 ------- 109 Card Sig alarms: 6 PFG 137 alarms: cardsig - highest confidence 27 PFG 136 alarms: cardsig - survival model-based 76 PFG 135 alarms: cardsig - high probability ratio # card signature alerts with the highest confidence of fraud # for the period 2001-06-10@00:00:00. to 2001-06-11@00:00:00. # there are 6 card numbers listed 89125394148596539|98 89125392099385357|97 89125333076252335|96 89125321241496143|91 89125320176821960|89 89125333539738110|87 ------- alarms and PFG alerts for AT&T cards 891288 ------- 85 Card Sig alarms: 6 PFG 137 alarms: cardsig - highest confidence 25 PFG 136 alarms: cardsig - survival model-based 54 PFG 135 alarms: cardsig - high probability ratio # card signature alerts with the highest confidence of fraud # for the period 2001-06-10@00:00:00. to 2001-06-11@00:00:00. # there are 6 card numbers listed 8912889723422305|96 8912886916966205|89 8912884740803348|89 8912886650531900|89 8912887889508404|89 8912882692303903|87

6. Risk and Revenue Modeling Group AT&T Labs 12 - June - 2001 AT&T Proprietary 6 ------- alarms and PFG alerts for AT&T cards other than 891253 and 891288 ------- 81 Card Sig alarms: 1 PFG 137 alarms: cardsig - highest confidence 7 PFG 136 alarms: cardsig - survival model-based 73 PFG 135 alarms: cardsig - high probability ratio # card signature alerts with the highest confidence of fraud # for the period 2001-06-10@00:00:00. to 2001-06-11@00:00:00. # there are 1 card numbers listed 9370360670|86 ------- alarms and PFG alerts for non-AT&T cards (LEC, Commercial) ------- 9 Card Sig alarms: 3 PFG 136 alarms: cardsig - survival model-based 6 PFG 135 alarms: cardsig - high probability ratio # card signature alerts with the highest confidence of fraud # for the period 2001-06-10@00:00:00. to 2001-06-11@00:00:00. # there are 0 card numbers listed

7. Risk and Revenue Modeling Group AT&T Labs 12 - June - 2001 AT&T Proprietary 7 ISSUE PRIORITY OWNER( S) STATUS #002 LSA Ids Obtain user ids for the purpose of view access of LSA. MedPeggy OPEN · 5/17/01 Peggy will obtain LSA ids for Colin and Sylvia and Gersony. Requests submitted to Janice Forner 5/18/01. · 5/23/01 Unix id forms submitted for Colin & Sylvia. Pending for Gersony. · 5/24/01 Waiting for id ’ s from id administrator. · 5/31/01 Ids received for Colin & Sylvia. Pending for Gersony. · 6/5/01 Need to get IP addresses for Unix and PC applications. Peggy will check with Janice Forner for info. Scott Davidson or Cale Douglas are alternate contacts. #003 Consolidation of duplicate alerts. Consolidate duplicate alerts occurring within Card Sig database. High Colin Sylvia OPEN · 5/3/01 Peggy will contact Joe Adams to gain understanding of card formatting. · 5/8/01 Info received via email from Joe (cc ’ d to Colin/Sylvia). · 5/10/01 Work in progress. · 5/17/01 Work in progress. Mapping of alerts to be complete 5/21/01. · 5/24/01 Working 1st draft for elimination of duplicate card numbers. This will be running by end of week. Further fine-tuning is needed but basics are there. · 5/31/01 Co-Dependent on Issue #004a, Creation of Usage Database. Work in Progress. · 6/5/01 Database is work in progress. #004a Creation of Usage Database. Create card daily usage database to be used for $$ based thresholds (and other functions.) High Dependent on issues #004b and #005. Colin Sylvia OPEN · 5/17/01 Work in progress. Database to be complete by 5/28/01. (This effort is dependent on consolidation of duplicate alerts scheduled to complete 5/21/01.) · 5/24/01 Work in progress. · 5/31/01 Work in progress. · 6/5/01 Colin has ironed out computational issues with getting database populated. He will continue to build up database with additional history. #004b Development of Dollar Based Thresholding incorporating Usage Level Indicators (ULIs) High Dependent on issues #004a and #005. Gersony Colin Sylvia Peggy OPEN · 6/5/01 Revenue Stratification under development by Gersony. This is being developed using the Usage Database, which is currently being uploaded with more history. The team is pursuing the addition of ULI indicators (taken from CSMS) to the $$ based thresholding logic. Peggy will contact CSMS (Jim Sprandle/Dennis Lindley) for access to CSMS and possible data dump of ULIs.

8. Risk and Revenue Modeling Group AT&T Labs 12 - June - 2001 AT&T Proprietary 8 #005 PFGs for $$ Based Thresholding Create usage based alerts using revenue stratification. High Dependent on issues #004a & #004b Colin Sylvia OPEN  5/3/01 Development of PFGs is in progress per Nick Borrelli (email to Peggy 5/3)  5/10/01 PFG’s in the 130 range would be used. Colin has them available. Work in progress.  5/17/01 Per Nick, development is still in progress. Rick will check with Nick to see specifically who is working on the development. Bus/Res Discernment is crucial to this effort.  5/24/01 Work in progress. Stratification still being developed.  5/31/01 Work in progress.  6/5/01 Revenue Stratification and Usage Database under development. #007 Subscription Fraud Analysis - 1 st pay default Build a tool to allow cross referencing of cards, BTNs and GFMS alert history in an effort to better define the amount of coverage GFMS is giving in terms of card alarms on accounts that went to write off. High Peggy Colin OPEN  Colin will use script logic to cross reference card numbers, and BTNs with GFMS alert history to perform analysis.  5/31/01 Work in progress.  6/5/01 Three steps involved: We need to figure what exactly we want to get out of GFMS database. We want to look at a whole range of alerts. 1. Make sure we have all card activity for a given a list of card numbers. 2. Query GFMS to get set of all alerts to see where we are generating and where we are not. Get history of alert handling from GFMS. 3. Look into developing and extending signature approaches to subscription fraud. Work in progress #008 Web Browser Obtaining access to the Web browser database being developed for the FASC. This database will contain card history allowing the reps 24/7 access to info even when systems are down. Medium Peggy Colin OPEN  5/24/01 Peggy and Colin will talk with Lou to gain access to this browser. Colin will assist in database development by providing a data exchange of info provided from GFMS.  5/31/01 Peggy is in the process of setting up a meeting with Lou.  6/5/01 Peggy has not heard from Lou. She will continue to pursue.

9. Risk and Revenue Modeling Group AT&T Labs 12 - June - 2001 AT&T Proprietary 9 #010 Rolling Windows – Fraud Detection for Commercial Cards Develop PFG107 &108 Fraud Suspect Alarm logic for Commercial Cards. Generate alerts on a rolling five window basis. Fraudsters know thresholds and tend to stay under them. This would help prevent this. High Mark Loper Cheryl Broome Colin OPEN  6/5/01 Mark and Cheryl will document specifics and send them to Colin. #001 RACF IDS for Bus/Res Scripting Obtain user ids for the purpose of scripting Bus/Res discernment. HighPeggy CLOSED  5/3/01 Peggy in process of obtaining 10 ids for Colin and 1 for Gersony for scripting purposes. Form for Colin has been submitted to Janice Forner. Waiting for form from Gersony to process.  5/10/01 Ids still in process of being obtained for Colin per Janice Forner, CARM. These 10 id’s for Colin will be provisioned as view only but will have access to platforms RCAM1 through RCAM6. These id’s should be available 5/11/01.  5/17 Id’s completed for Colin. Id for Gersony in process of being created. Should be available in a few days.  5/23/01 All Ids received. Issue Closed #006 Data Dump for 1 st pay defaults out of PMDB. Obtain account/card payment delinquency info for development of usage alerts. High Peggy CLOSED  5/17/01 Peggy will check with Marget Johnson to see what info is available. Gary Craig was also contacted and is checking for info that may be available from CARM.  5/18/01 Per Marget a first pay default analysis is performed monthly. This could be performed more often in GFMS (weekly). BTNs are run up against RAZ to get product usage to see allocations of $$’s to card. Outlier analysis is performed as well. (Per Rick, Sept/Oct timeframe would be appropriate for this NBD segmentation. We need two sets of results, one to include CLECS and one that would show CLEC NBD data segmentated seperately.  5/24/01 Info on BTNs seen provided by Marget. Peggy will perform analysis of numbers and provide info to Colin, Sylvia and Gersony via email.  5/31/01 Info provided. Additional info to be provided ongoing when received from Marget.

10. Risk and Revenue Modeling Group AT&T Labs 12 - June - 2001 AT&T Proprietary 10 #009 Exclusion List for Card Develop an exclusion list for card. This will reduce the amount of alarms generated where usage has been confirmed with the customer. Medium Peggy Colin Sylvia Gersony CLOSED  5/24/01 Development to begin in the near future.  5/31/01 Work in progress.  6/5/01 Since it has been determined that an exclusion list is available for Card, this issue is being closed. Please reference issues #005 (PFGs for $$ Based Thresholding) and Issue #004b (Development of $$ Based Thresholding incorporating ULIs) for more information.

11. Risk and Revenue Modeling Group AT&T Labs 12 - June - 2001 AT&T Proprietary 11  CARD USAGE db and Alerts 180 days x 10 summary statistics/card calls|secs|rate|zeros|attempts X domestic|international Dollar-based thresholds for day, week, month, quarter Card-specific thresholds Bus/Res, ULI, usage and payment history Daytona/Hancock/QuickBin time & memory, data structures & locality

12. Risk and Revenue Modeling Group AT&T Labs 12 - June - 2001 AT&T Proprietary 12  Canonical Card Nos. & CARDINFO db 17 10 (TLN: CIID, Personal Choice) 16 7,8,9 (True Choice) Card aliases & info  RAMP CPP/LSA/CSMS connectivity Business/Residential discernment BTN/PAccount card nos. parallel screenscrape: 180k lookups/hour

13. Risk and Revenue Modeling Group AT&T Labs 12 - June - 2001 AT&T Proprietary 13  Subscription Fraud Known fraudsters, training data for multiple signatures Enterprise Miner Cluster Analysis Discriminant Analysis Association Rules Decision Trees  Modeling  Threshold on card distribution quantiles  Multiple fraud distributions  Signature enhancement  More components  Multiple distributions/card