Welcome to Understanding Link Analysis. The purpose of my site is to discuss the methods behind leveraging visual analytics to discover answers and patterns buried within data sets.

Visual analytics provides a proactive response to threats and risks by holistically examining information. As opposed to traditional data mining, by visualizing information, patterns of activity that run contrary to normal activity surface within very few occurances.

We can dive into thousands of insurance fraud claims to discover clusters of interrelated parties involved in a staged accident ring.

We can examine months of burglary reports to find a pattern leading back to a suspect.

With the new generation of visualization software our team is developing, we can dive into massive data sets and visually find new trends, patterns and threats that would take hours or days using conventional data mining.

The eye processes information much more rapidly when information is presented as images, this has been true since children started learning to read. As our instinct develops over time so does our ability to process complex concepts through visual identification. This is the power of visual analysis that I focus on in my site.

All information and data used in articles on this site is randomly generated with no relation to actual individuals or companies.

Call Center and BPO Fraud Visual Analytics

Outsourced customer service and Back Office Processing (BPO) organizations process an ever increasing number of transactions and contacts every day. Agents have access to large amounts of sensitive customer information and access to company inventory to perform their operations. Every operation that is granted to outsourced agents allows for potential theft, abuse or breach of sensitive information or goods and services.

Threats within these industries range from misappropriation of inventory through internal theft to breach of sensitive and protected customer and account holder information. Any adverse event has a substantial impact on the company and the client's reputation and opens both to potential regulatory and legal action.

With an ever increasing trend of companies outsourcing operations that carry substantial risk to both the BPO and the client, both have the responsibility of establishing protocols that prevent contractors and employees alike from utilizing systems for personal gain.

Considering the amount of transactions and customer interactions which are logged on a daily basis, the amount of information which must be analyzed is daunting. A large BPO may average in excess of 100,000 customer transactions per day. Each transaction can be logged in many different locations from the telecommunication system which records data from the call to the account management system which maintains the access and permission logs.

With the amount of information that must be examined to audit the activities of many disbursed locations throughout the world, visual analytics provides the most intuitive and effective way to identify problematic trends and threats across multiple data sources.

Call Center Visualization

For this example lets take a scenario where an analyst is performing an audit on all call centers within a specific country. This country maintains multiple call center locations tasked with providing customer support for a large electronics company. Each call center agent is has the ability to address customer issues with products purchased by the company through warranty replacement or providing free or gratis replacements parts or incentive products to resolve customer complaints.

The internal auditor within the BPO or call center wants to holistically view the activities of each call center within the country to determine if there are any patterns or unusual velocities occurring with the production environment which could indicate an agent is involved in the theft of good or services from the client inventory. Alternatively, the analyst or investigator from the contracting company may want to do the same, although they will be visualizing activity across several different contracted BPO's.

For this example we are going to leverage SynerScope for the visualization of call center to product and part fulfillment to holistically examine all the of the customer service data for the past six months across the Philippines (the company used for our example).

We will begin by importing the customer service system data into SynerScope establishing a hierarchy for the data of call country origination, call center Geo-location, call center name or identifier and call center agent identifier. For the relationship view, we are establishing a link between the call center agent and the products from the company that the agent sends to customers for fulfillment of the request. The hierarchy used for the product and customer include the customer shipping location (country, state), the fulfillment purpose (warranty, customer complaint resolution) and the product SKU or item number.

This visualization will allow us to examine the relationships and velocities between agents in multiple call center locations and the products that are being sent to customers. The analyst will be looking for any unusual patterns of relationships which may indicate a call center agent is sending an unusual velocity of particular items to a certain area or customer which may be indicative of internal fraud.

An added benefit is that the visualization also provides business intelligence to both the company and the BPO indicating distribution of call volume along with velocities around certain parts which may indicate defect or lack of customer satisfaction.

The analyst will start by drilling into a time period to closely examine the relationship view for any unusual patterns forming around certain call center agents who have an increased relationship between certain parts going to the same areas. This is indicated visually within SynerScope through increase node or entity size and bundle width.

Once an outlying pattern is visually identified within SynerScope, the analyst can then examine the underlying data to confirm or further investigate if the pattern is irregular or suspicious or an outlier or false positive. Trends such as one call center agent sending out a high price product to the same customer over a short time period would be a theft concern, especially if no other agent during that time period was performing the same activity across the country.

As calls into the centers are completely random and assigned to agents at random by the telephony system, any particular agent in the visualization who has a concentrated relationship between a specific customer should not naturally occur and will need to be investigated. By utilizing visual analytics within SynerScope, the analyst can drill into specific time ranges to look for concentrations of linked events between call center agents, products and customers which fall outside the normal pattern of operations experienced by the BPO.

Another scenario for the analyst would be incorporating visual analysis within SynerScope to look for unusual velocities of call center agents accessing customer information. Because visual analysis looks holistically across all the data, adverse trends surface much more rapidly. For example a call center agent who is looking across 20 different customer accounts within a one hour period where others in the same center with the same client are only accessing 10 accounts within one hour will surface within the visualization. This could be a strong indicator that a call center agent is compromising customer account information to sell on the black market to identity theft rings.

Early identification of these trends are essential in mitigating potential threats within BPO's. The primary difference in visual analytics is that it offers a proactive method for much earlier identification of trends then through traditional data mining through the use of multiple attribute relationships. Due to the size of the data being examined, in traditional data mining for an outlining pattern to be realized, a differential of 1% or more is required. If the analyst is examining 500,000 records an outlier of 1% is 5,000 similar events while in visual analysis, patterns of abnormal activity surface within 3 to 4 events when examined on top of normal activity.

From the illustration you can see that within this specific time period selected by the analyst, activity around a specific call center agent with an unusual relationship pattern to a specific item surfaced in only 3 transactions within approximately 50,000 events.


Since the volume of such transactions are often extremely large, SynerScope provides an alternative to finding such patterns much more rapidly. Quick identification of threats is the key to threat mitigation. It is impossible to prevent every fraud scenario from occurring but failing to detect fraud or theft until it is discovered by the customer, company or a law enforcement agency exposes the client and the BPO to potential brand reputation damage and costly regulatory and legal consequences.

While a completely fool proof method of fraud and theft prevention is impractical, a process for early identification of threats is expected. Visual analytics provides a key ingredient to fraud, theft and compromise detection that preserves the reputation and operational integrity of the organization.

For an interactive example of visual analytics for call center fraud and threat click the video below:

Use Visual Analytics to Detect Medical Fraud

Discovering fraudulent trends and patterns within medical data is the modern day equivalent of finding a needle in a haystack. Private medical and property/causality insurers as well as government agencies are tasked with discovering and preventing medical fraud from within millions of submitted bills daily.

With health care and medical fraud costing consumers over $100 billion dollars in the United States alone, there has never been a more important time for fraud prevention. The question has always remained, how can I as an analyst proactively identify emerging trends across large volumes of medical billing.

By leveraging visual analytics, analysts gain the ability to holistically examine large amounts of medical billing across geographies, allowing for the intuitive identification of medical billing and provider to claimant trends which are indicators of fraud. It is through an holistic visual analytic approach that adverse trends surface within visual analysis when compared against normal medical billing traffic.

Medical Fraud Visual Analysis

To provide an example of leveraging visual analytics for medical fraud we will utilize SynerScope to examine volumes of medical billing data across a specific geography to surface any irregular patterns.

The process begins by importing and holistically examining the providers, claimants and CPT codes within the relationship diagram to look for any unusual relationships or velocities which may exist. From a wide view, we can determine which providers have the highest velocity of medical billing by CPT code for this area.

Next, by leveraging the sequence diagram within SynerScope, we can hover over the relationships between providers and claimants either by the provider as a whole or isolating specific CPT codes to determine when in time the treatments are taking place. As an analyst this helps me understand any unusual velocities of billing from short time spans that would be impractical under normal circumstances.

As an analyst, I want to confirm that the association being viewed within the relationship diagram is suspect. Within SynerScope I can quickly view the underlying medical billing data that is represented within the relationship at the bottom of the user interface. This provides me a preview of all the relevant data attributes that exist within the actual billing database for validation of my analysis.

By focusing on the individual claimants and their corresponding relationships, within SynerScope I can highlight and compare the treatments being rendered across multiple claimants to individual providers. As an analyst this helps me understand if multiple claimants are receiving identical treatments regardless of injury or diagnosis code (ICD9). I also want to understand that if multiple claimants are receiving the same treatments, if they are receiving them in the same time periods. Within my SynerScope visualization, I can interactively compare the relationship between claimant, provider and CPT code billed within the relationship diagram and also view within the sequence diagram if treatments are being rendered in the same velocity or span of time.

Sequence of events are just as important as the relationships as it assists the analyst in understanding if a provider is attempting not only to bill for services not required or rendered, but also if treatments billed are in a condensed time period in an effort to maximize or exhaust policy limits.


As compared to traditional data mining or statistical analysis, by leveraging visual analytics we can identify adverse trends more rapidly and through fewer occurrences by providing an holistic visual representation of all medical billing for an area which causes abnormal trends to surface against normal billing patterns within SynerScope. These trends can be discovered in as few as three or more occurrences, where within statistical analysis from the same number of records would require a deviation of at least 2% or more. This means by leveraging visual analysis, fewer occurrences of fraudulent billing must occur before detection and intervention by the insurer resulting in a significant risk reduction.

For an interactive example of this principal, please view the video below: