GO-FOOD Fraud

Analyst Take Home

Test Assessment
BY ACHMAD RAMLAN
BUSINESS RISK ANALYST
Problem A
Assessment
Ricky and Mamat got the highest
performances, significantly different
from the others whom just achieved
<= 125 drivers.
On the first day, at 11 AM,
anomaly happened on all Agents
except Mamat, every agents got a
spike of registration on the 12th and
14th minute within 11AM. But there
is still a good chance that 11 AM of
the 8th of May is just naturally the
peak of driver registration traffic.
Here we see the chart of their daily performances, Ricky and Mamat are the ones whom
performance metrics are scattered, then there's Mamat, with the lowest performance in the
first 5 days, suddenly Mamat's performance spiked in the last 2 days, resulting Mamat's
performance to be ranked 2nd of all at the last day, with 191 registered drivers, topped by
Ricky with 365 drivers. While the others daily performances never spiked. Strangely, Ricky and
Mamat are the only ones registering driver in the last 2 days.
  On the 11th of May, Ricky registered 49 drivers at 11PM, almost midnight,
spesifically 44 registered drivers in under 1 minute, on 11:18PM.
 Mamat’s performance peaked on 14th of May at 11PM, 29 registered drivers
under 1 minute at 11:16 PM.
 Both facts are to be considered anomalies.

Range[Age Range[Drive
Range[Ag Range[Driver nt Name] Range[Timestamp] r ID]
ent Name] Range[Timestamp] ID] Mamat 14/05/2017 23:16 1000998
Ricky 11/05/2017 23:18 1000556 Mamat 14/05/2017 23:16 1001006
Ricky 11/05/2017 23:18 1000561
Mamat 14/05/2017 23:16 1000999
Ricky 11/05/2017 23:18 1000563
Mamat 14/05/2017 23:16 1001007
Ricky 11/05/2017 23:18 1000564
Mamat 14/05/2017 23:16 1001005
Ricky 11/05/2017 23:18 1000560
Mamat 14/05/2017 23:16 1001013
Ricky 11/05/2017 23:18 1000557
Mamat 14/05/2017 23:16 1001003
Ricky 11/05/2017 23:18 1000558
Mamat 14/05/2017 23:16 1001008
Ricky 11/05/2017 23:18 1000559
Ricky 11/05/2017 23:18 1000555 Mamat 14/05/2017 23:16 1001010
Ricky 11/05/2017 23:18 1000562 Mamat 14/05/2017 23:16 1001011
Ricky 11/05/2017 23:18 1000566 Mamat 14/05/2017 23:16 1001002
Ricky 11/05/2017 23:18 1000568 Mamat 14/05/2017 23:16 1001000
Ricky 11/05/2017 23:18 1000583 Mamat 14/05/2017 23:16 1001001
Ricky 11/05/2017 23:18 1000579 Mamat 14/05/2017 23:16 1001004
 date reg_count
 However, the daily volume of total 8-May 150
registered drivers/day never deviates 9-May 167
highly from the average, it's like they are 10-May 140

keeping some standard number of daily 11-May 145

12-May 145
KPI.
13-May 120
14-May 170
Grand Total 1037
Daily Avg 148
Proposal of Initiatives :
 Ricky and Mamat should be under further investigations on every occurrence of anomaly, such as
the near-midnight spike of registration, a face to face/phone call/email conversations with the
agents should be commenced by Ops if it is deemed necessary.
 Is it really possible to register that many drivers in under 1 minute?
 If possible, how did they operate?
 If it’s not possible in any way, and was caused by Operational/Technical loophole, we have to
immediately mitigate it by communicating with cross-functional teams.
 Further data extraction for further analysis would be helpful, such as each driver’s KYC/Region, each
Agent’s historical data, etc.
 If every evidence indicates fraud activities, then each Agents and Drivers (if involved) should be
given penalty based on agreed terms and conditions, based on severity of violations.
 name data
driver_name HARRY

Problem B order_cnt
distinct_date
197
2

Assessment
1km_radius_cnt 8
avg_per_day 99
avg_per_area 25
total_completion_minut
There are 3 entities with anomalies within es 104,8
this dataset. avg_completion_minut
es 0,531979695
Those are : Driver named Harry, every
avg_kmh 4331,245967
customers whom orders are mostly taken by
avg_distance 24,3380203
Harry, and the area vicinities of order
destinations taken by Harry.
Harry’s orders violates every common
sense, total of 197 orders from the same
merchant, only to 8 different areas (within 1
km vicinities), done in 2 days, average of 99
orders/day, average of 25 orders/area, with
average completion time (booking to
closing) of 30 seconds/order with avg 24 km
distance, and average kmh speed of 4331
km/h.
 Here we see that within the Warkop vicinity itself (Blue area), there are only total of 50 orders done in 7 days,
worth of IDR 1.172 Mio with avg shopping value of IDR 23k, 1 driver for each customer, took 72 hours and 8
minutes to complete, and total distance of 178 Km.
 Meanwhile, within the suspicious vicinity of Pancoran Mas, Depok (Red Area), there are total of 190 orders done
in 2 days worth of 7.590 Mio, done by only 6 customers using only 1 driver (Harry), took 1 hour and 40 minutes to
complete, and total distance of 4328 Km.
 It means that Blue area seems normal while Red area seems really fraudulent, in aspect of area, customers, and
driver.
 The rest of Harry’s booking doesn’t included in the red area, but still fraudulent based on completion time.
Proposal of Initiatives :
 Based on the single timeframe fact that Harry completes all the orders not more than 3 minutes each, with km/h
speed (distance / minutes(closing_time – booking date)) no less than 394 km/h, the fastest record being 5544
kmh, and average of 4331 km/h (seriously, GOFOOD drivers are riding motorbikes, not NASA spaceships), it is safe
to mark all bookings with Harry as driver, as Fraud Bookings.
 Added by the fact that almost all Harry’s bookings are delivered to the same area of Pancoran Mas, average of
90+ bookings/day from the same merchant, it just seem impossible to mark these bookings as non-fraudulent,
there are more than hundreds of Drivers within Bekasi (Merchant area).
 All the customers whom orders are carried by Harry (6 customers, 190 bookings, avg 32 bookings/customer),
should also marked as Fraud Customers.
 The Red area mentioned before, should be assessed further with more data, to know better about the fraud ratio
of the area. The Merchant (Warkop ABC) should also checked further, because if Harry is really doing this alone,
why pick a Merchant and Destination with distance of approximately 24 Km? He could pick a nearer distance.
 There’s also a good chance that Harry gets all those bookings with conditions of Merchant and Driver side of App
being abused. Assess together with Cross Functional teams especially the Product Team.
 Harry and the Customers should be suspended, denied of every subsidized incentive scheme, customer
voucher/cashback, and every other benefit that came from the fraudulent bookings, and other penalty as
stated on each terms and conditions.
Problem E Assessment
a) Fraudulent activities done with multiple accounts widely varies, considering the size of GO-JEK
Products. On the driver side, it is to be expected that there are abusive patterns around :
Ratings, Incentive Scheme, Prioritized orders in several area, while on the Customer side, it’s
expected to be : Promo/Voucher/Cashback scheme, Booking value for better chance of
doorprizes, and Money Laundering, there are a lot of Credit/Debit flows within GOJEK, there
are lots of ways for people to do Layering/Placement of illegal funds. There is also external
multiple entities that could cause reputational/financial harm towards GO-JEK, such as
massive account takeovers/scamming, etc.
b) Every datapoints there is should be counted, because there must be various different insights
that could be generated using various datapoints, but considering the importance, it should
be Area Concentration, KYC data (Email, Phone, KTP, etc), Online Credentials (Device, IP,
etc) within every log, Registration and Booking patterns.
c) A lot of recommendations, we could make simple predictions on which entities are about to
do fraudulent activities, therefore at the operational level, we could work together to
produce a prevention automated Product with Tech, alter the operation flow of field ops
personnel to reject these entities, and others. I would really love to share this if I were to get
the chance to expand my career at GO-JEK. PS : Proposal of Initiatives on Problem A and B
could be an example.
END