Welcome to the Pondera FraudCast, a weekly blog where we post information on fraud trends, lessons learned from client engagements, and observations from our investigators in the field. We hope you’ll check back often to stay current with our efforts to combat fraud, waste, and abuse in large government programs.
Established in 1636, Harvard University is the United States' oldest institution of higher learning and one of the world's most prestigious universities. A couple of weeks ago, I had the remarkable opportunity to participate in the Harvard Business School Executive Education Program for High Potential Leaders. To step foot on this amazing campus filled with brick buildings plush with deep green climbing ivy, you almost immediately feel like you are part of something special (or perhaps inside some Matt Damon/Ben Affleck movie). Stepping foot in the state-of-the-art classroom with the instructor "pit" in the center, surrounded by 100 of the world's most talented and up-and-coming leaders, I wondered if I fit in this group or would have any common ground.
My learning group, a smaller team designed to facilitate debate and discussion on assigned topics, included eight talented young professionals; only two originally from the United States. They represented a variety of industries, none of which had anything to do with mine.
What I learned by working with this group, is that despite my initial hesitation, we were far more alike than I could have imagined. No matter their business, job title, or Country of operation, we faced so many of the same challenges and experiences in our professional lives. During one group activity, I began to think about how this applied to the clientele I serve at Pondera. Whether it's a small State unemployment program or the Nation's largest Medicaid program, these teams of dedicated professionals face so many of the same challenges and share similar experiences. Perhaps, I could bring them together through the Pondera client network and facilitate cross-state, cross-program sharing and learning. My brain was really starting to kick into high gear now.
Reflecting back on my time at Harvard, I decided to focus on the key ways I could translate my experience into benefit for my company and clients. I decided upon three themes:
- Bold, passionate, inspiring leaders can change everything. No matter if you are managing financial accounts worth billions or a Government employee overseeing a Federal entitlement program, the culture created from these kinds of leaders brings success to the whole organization. Skills can be taught, management can be improved, but make no mistake, there is no substitute for extraordinary leadership. We must find these leaders, and then cultivate and cherish them.
- Networks are critical to continued learning and success; make time to grow and nurture yours. Your network could be persons within or outside of your organization, family, friends, peers, professional mentors, etc. Networks serve as a vibrant source of creative energy, partnership, and may just offer the solution to whatever challenge you or your organization is facing. Make time in your daily grind to have a coffee, make a quick call, or even share a meal with key persons in your network.
- Always be willing to adapt and evolve or be prepared for extinction. This is especially true in leading innovation, particularly in the data analytics arena. Fraud schemes change, data sources emerge, programs transform. At Pondera, we can never get comfortable or diminish our aggressive pursuit to lead the way. Governments must embrace the "information age" and transform their processes, modernize their programs, and challenge the status quo.
Medicaid expenditures have nearly doubled over the last decade  and states have increasingly looked to a capitated reimbursement model utilizing managed care organizations (MCO) to ensure continued access to quality health care services. The Centers for Medicare and Medicaid Services (CMS) estimate that roughly 80% of all Medicaid recipients currently receive healthcare services via managed care . While the managed care model differs from the fee-for-service (FFS) system in the manner that state Medicaid agencies reimburse for services, the two systems share many of the same risks from a program integrity perspective. One of the shared vulnerabilities that persists is the substantial hurdle states and Medicaid MCOs encounter when determining the eligibility of prospective providers.
Eligibility screening of providers, both upon application and periodically thereafter, is the cornerstone of any successful Medicaid integrity program. This process identifies those prospective and current providers who are statutorily prohibited from participation due to disqualifying events. However, according to a recent report by the U.S. Government Accountability Office (GAO), the screening process is complicated by the reality that the information needed to ensure the eligibility of providers is scattered across numerous databases maintained by different federal agencies . Additionally, many of the state agencies and MCOs assessed by the GAO reported difficulty accessing some sources and cross-referencing potentially disqualified applicants across databases.
This issue became even more pressing recently when CMS issued a long-anticipated rule (CMS 2390-F) that, for the first time, places the responsibility to appropriately screen and enroll all managed care providers squarely on the shoulders of the states .
Pondera's core detection tool, FDaaS, provides a ready solution to these challenges by merging these disparate data sources with proprietary fraud algorithms to assist users in identifying those bad actors who present a risk to the Medicaid program.
You can read the GAO report in its entirety at this link.
 U.S. Department of Health and Human Services. (2011). Medicaid manged care: Fraud and abuse concerns despite safeguards. Washington, D.C.: U.S. Government Printing Office.
Centers for Medicare & Medicaid Services. (2015). Managed Care. Retrieved June 6, 2016, from Medicaid.gov: https://www.medicaid.gov/medicaid-chip-program-information/by-topics/delivery-systems/managed-care/managed-care-site.html
 U.S. Government Accountability Office. (2016). MEDICAID PROGRAM INTEGRITY: Improved Guidance Needed to Better Support Efforts to Screen Managed Care Providers. Retrieved from http://www.gao.gov/products/GAO-16-402
 Centers for Medicare & Medicaid Services. (2016). Medicaid and Children's Health Insurance Program (CHIP) Programs; Medicaid Managed Care, CHIP Delivered in Managed Care, and Revisions Related to Third Party Liability. Retrieved from https://www.gpo.gov/fdsys/pkg/FR-2016-05-06/pdf/2016-09581.pdf
Almost everyone is familiar with antivirus software. Not everyone is familiar with how it works though. Even fewer have examined how we can apply the way antivirus software works to combat fraud. I believe that there are important lessons here which can improve our approach to fraud detection and prevention.
At a high level, antivirus software performs two important functions prior to opening a file on your computer: 1) It compares the file to known viruses and other forms of malware, and 2) It checks the file for suspicious code which may indicate a new, previously unknown virus.
The first function depends on a network of users willing to share known viruses and a system that is able to collect the virus data, design a fix, and disseminate the fix to other users prior to them being infected. The second function depends on heuristic programmers that can design systems to learn and even anticipate potential problems. Working together, this is one of the most effective ways to address the constantly changing nature of Internet malware.
Government fraud prevention, when done properly, works in a very similar manner. By examining known bad actors, bad transactions, and bad behaviors, systems can quickly compare ongoing program data to identify suspect transactions. Modern fraud detection systems also include predictive algorithms that can detect anomalies, trends, patterns, and clusters that may indicate fraud.
Unfortunately, many governments are unable, or unwilling, to share data. This limits the “network” effect that antivirus software uses so effectively. If more states and programs shared fraud schemes and findings, the library of known bad actors and methods could detect fraud and prevent it from moving from state to state and program to program.
The good news is a number of states are moving toward state-wide fraud prevention efforts and a number of government subsidy programs are moving toward cross-state fraud prevention efforts. I am confident that the future success of these efforts will promote additional sharing, leading to a larger network, and more efficient governments.
People often ask me if I think we can make a difference fighting fraud by stopping down-on-their-luck Americans from grabbing a few extra bucks that they are not entitled to from government programs. In fact, many people ask if it’s even the right thing to do. After all, they explain, wouldn’t anyone do the same given the circumstances?
This illustrates the common misperception that fraud is only perpetrated in small amounts by desperate people who are temporarily bending the rules. In fact, much of what we see takes place on a larger scale. And more importantly, the truth is that money obtained fraudulently is rarely used for good purposes. Examples include:
- During a “National Counter Terrorism-Awareness Week” in 2014, government officials explained that taxpayer money was being defrauded out of government programs (including student loans) to fund terrorism. In effect, we are helping to fund groups that want to do us harm.
- The Wall Street Journal reported on, in March 2016, the growing trend of street gangs funding activities through fraud. Fraud offers attractive forms of theft because “they are more lucrative, harder to detect and carry lighter prison sentences”.
Considering that the government distributes over two trillion dollars per year in subsidies, and considering how fraudulently obtained money can be used, it is critical that we address the issue of fraud, waste, and abuse. So to answer the questions posed earlier: Yes, I do believe we are doing the right thing, and Yes, I do believe we can make a difference.
Way back in 2006, I read an article in the Harvard Business Review that described how the Internet had changed the sales profession. One key observation dealt with the “de-coupling” of the sales cycle from the buying cycle. Prior to the Internet, buyers had to contact vendors for information on their products. Today, buyers do their own research and successful salespeople need to unhinge preexisting customer assumptions prior to starting their sales process.
I believe that the Internet has had an even greater impact on fraud in government benefit programs. Government agencies are under constant pressure to move applications, certifications, and other processes on line to make them more convenient for citizens and businesses. This makes perfect sense because, after all, government exists to serve the needs of the citizens. Unfortunately, moving these processes to the Internet dramatically increases the incidence of fraud.
The Internet provides a degree of anonymity that makes it extremely attractive to fraudsters. The number of fictitious businesses and “ghost beneficiaries” in government programs has exploded in recent years. Many of our customers deal with applications associated with out-of-state or out-of-country IP addresses. Others come from deceased or incarcerated individuals. Still others show indicators of originating in “sweat shops” that create bulk applications and claims.
Just like the salesman that had to adjust to the new sales cycle, it’s important that government program integrity staff adjust to the changing fraud landscape. IP spoofing, anonymous email services, and the wide availability of stolen identities are realities in the post-Internet fraud market. Relying solely on the traditional detection and investigation techniques is no different than the sales person who thinks their prospect hasn’t done any of their own research.
Big data analytics and the predictive engines they spawned give Internet companies a way to monetize the online experience. By tracing online behavior, companies can target advertising, promotions, and point of sale opportunities based upon past buying decisions. Online habits of Web users can be associated with ideologies, interests, and values. Increasingly sophisticated probability engines predict future buying decisions with enough accuracy to fuel a dramatic increase in online sales and commerce over the past decade. Analysts use temporal versions of these tools to forecast market trends and evaluate risk.
In the fraud detection market however, early attempts to detect fraudulent behaviors using these same probabilistic engines have achieved limited success.
What makes detecting fraud different than detecting interests, values, and ideologies? The simple answer: Fraud is binary in nature–either a particular sequence of behaviors is fraud or it is not. For example, if an individual provider of medical services submits claims to an insurance company for 5,000 hours of services in a week (an instance from actual data), there had better be around 100 employees licensed to provide that service. If there are only three or four employees with the required licenses, the provider has committed fraud. Probabilistic engines struggle to detect fraud because they are not capable of modeling this“all or nothing”nature of violating a law.
At Pondera, we still make use of predictive analytics. But rather than detecting absolute fraud, we use the algorithms mostly to inform our fraud scores and to detect emerging fraud methods.
Once reliable methods of detecting fraud have been developed, predictive engines can also play an important part in helping insurance companies, financial institutions, and government agencies prioritize targets of investigation. Predictive models can identify the highest value targets that will recover the most money or disrupt the largest criminal organizations.
This week, my company is responding to an RFP for SaaS fraud detection services. While we are thankful for the opportunity to respond, the RFP and its process also illustrates the need for governments to adjust their procurement processes with the advent of cloud computing. After all, we responded to the RFI for this procurement over two years ago!
This means that the current solicitation is at least partly based on product capabilities from early 2014. While this might not be a big problem for traditional IT projects, this is a lifetime in SaaS. In fact, if a SaaS solution offered mostly similar functionality over a two-year period, I’d recommend not selecting that solution. Effective SaaS solutions push new features in days and weeks, not months or years.
With this background in mind, I’d like to propose that governments consider the following three modifications to their procurement policies. Some of these changes may require assistance from legislative bodies and funding organizations in addition to procurement professionals.
1. Reduce the time between RFI and RFP: This will help governments avoid building their requirements on functionality that has long since been replaced. SaaS functionality is a moving target – it’s supposed to be.
2. Smooth out funding over multiple years: Traditional IT projects required large upfront implementation costs followed by lower ongoing support, maintenance, and operations costs (assuming the initial implementation was successful). SaaS solutions spread the cost more evenly over time as the solution continues to improve.
3. Make sure your staff is ready when you award: True SaaS solutions can be implemented quickly, often in as few as 120 days. By the time you award a project, you should be ready to discuss security plans, access the required program data, assign staff (not just project staff but system users), and address many other details that could often be delayed in lengthy IT projects.
I bet you cna’t bvleiee taht you can uesdtannrd waht you are rdnaieg. Unisg the icndeblire pweor of the hmuan mnid, aocdcrnig to rseecrah at Cmabrigde Uinervtisy, it dseno't mttaer in waht oderr the lterets in a wrod are, the olny irpoamtnt tihng is taht the frsit and lsat ltteer be in the rhgit pclae. The rset can be a taotl mses and you can sitll raed it whoutit a pboerlm. Tihs is bucseae the huamn mnid deos not raed ervey ltteer by istlef, but the wrod as a wlohe.
The preceding paragraph, which has made its way around the Internet for years, can be really fun to share with friends. However, it also serves as a caution to anyone involved in fraud detection. In many ways, bad actors, knowingly or unknowingly, have depended on how the human mind works to perpetrate fraud schemes. Like the old expression goes, sometimes the best place for fraud to hide is in plain sight.
This is especially true in government programs that process massive amounts of transactions and must adhere to a staggering number of program regulations. Traditional “top down” systems can analyze large data sets and find nothing wrong (after all, the first and last letters are in the right place). “Bottom Up” systems, on the other hand, will identify individual problems (the word is scrambled) but may miss the patterns in the data (this entire paragraph is scrambled). A common example of this is the medical provider that always “flies just below the radar” by maximizing claim amounts and frequencies.
The best detection processes take both a “top down” and “bottom up” approach. They can identify individual transaction problems as well as identify patterns of bad behavior over time. In this way, you can make the old “80-20” rule work in your favor. 80% of improper payments are likely caused by 20% of program participants. If you only address each individual transaction, you’ll never run out of work but you also never really improve your program integrity efforts.
Click here for an infographic on the "80-20 rule".
Remember back to last year when the IRS announced that cyber thieves stole personal data from 100,000 taxpayers? This sophisticated scheme accumulated personal data from other sites and used it to answer identity validation questions on the IRS web site to gain access to taxpayer accounts.
The 100,000 taxpayers affected? The IRS revised that number later in the year to 334,000 Last week they raised the number again to more than 700,000! Combine this with the high-profile hacks at Sony, Target, Anthem, and other organizations and one thing becomes very clear: bad actors are rapidly improving their identity theft methods.
In response, government agencies need to prepare for an onslaught of fraudulent tax returns, unemployment claims, Medicaid treatments, and other services. In 2015, the IRS paid out $5.8 billion in fraudulent returns. Several of Pondera’s clients also saw dramatic increases in “ghost” beneficiaries, often paired with fictitious businesses, set up solely to defraud government programs. 2016 promises to be even more problematic.
As program integrity experts, we have to recognize that we are moving into a new age of identity theft problems. We can log on to YouTube and watch a music video about Unemployment Insurance Fraud. CNN has run stories on street gangs trading liquor store holdups for benefits fraud. The barbarians are at the gate and it’s our responsibility to strengthen the defenses.
In 2009, congress enacted the American Recovery and Reinvestment Act (ARRA), also known as the Stimulus, to bolster the economy and help America recover from the Great Recession. The idea was that various tax credits, business incentives, and public works projects would stimulate the economy while also improving the nation’s infrastructure. While arguments continue over the effectiveness of the program, it is estimated to cost nearly $100 million annually for 10 years.
Today, seven years after ARRA was enacted, I think about the economic impact we could achieve through the eradication of overpayments in government programs. The government estimates that over $125 billion in FY 2015 were paid improperly. This number, even after subtracting the underpayments that are also counted in improper payments, is larger than the highly controversial ARRA spending totals. In effect, by eliminating FWA from government programs, we could implement a permanent economic stimulus!
I know that it is unrealistic to think that we could completely eliminate improper payments. But I also know that we can make drastic improvements by increasing our support for program integrity efforts and by continuing to develop and implement innovative detection solutions. It would also help if legislative bodies approved processes to support agency collection and enforcement efforts. I realize this sounds like a lot of work. But it seems to me that a permanent economic stimulus is worth every bit of effort.