Risk Solutions User Forum

1. Risk Solutions User Forum Jeff Bottari, VP Risk Solutions GroupCheckFree October 24, 2007

2. Welcome!!

3. User Conference Objectives • Very few CheckFree commercials • Shared experiences using CheckFree products • Shared industry concerns • A time to talk with other banks about issues • Advise CheckFree on what you like, don’t like, and would like to see • A feeling of community • An opportunity to advance best practices • It should be fun!

4. Jeff Bottari Compton Harry Debb Gordon Don Crosby Michael Bunyard Robert McCann

5. Pete Sullivan Karen Taylor Dee Millard Jeff S-S-Sargent Mark Steeber

6. Roger Snell Angela Bardowell Rich Rosner Dan Barta

7. Whatever happened to Carreker?

8. CheckFree / Carreker • Acquisition completed on April 1st, 2007 • CheckFree is a $1 billion company with 4,400 employees world-wide, located in more than 20 different cities • Carreker’s current solutions are being integrated into CheckFree’s current product structure • The combination of the two predecessor companies makes CheckFree an industry leader in software applications that cross the traditional check-based & ACH payments arena • We are uniquely qualified to help banks balance customer needs with needs for greater efficiency and profitability, as an already diverse payments environment continues to evolve and change

9. CheckFree Snapshot • Premier provider of financial electronic commerce services and software products • Founded by current Chairman & CEO Pete Kight in 1981 • Became a publicly traded company in 1995 • 26 years in operation • 2006 in Review: • Revenue of $972.6 million • Nearly 1.3 billion transactions processed • Nearly 226 million electronic bills delivered • Nearly 2.7 million portfolios under management at year end

10. Whatever happened to CheckFree? … Soon to be a part of

11. Carreker/CheckFree’s Risk Management Solutions • We are the premier supplier of Enterprise Risk and Fraud Mitigation Solutions. • Our Pragmatic Convergence approach provides financial institutions with maximum protection via multi-channel transaction monitoring and customer behavior modeling.

12. Pragmatic Approach Defined • The destiny: An enterprise risk mitigation platform which correlates fraud across access points and channels by customer • Allows you to leverage your existing investments to create an achievable strategic plan • Stay ahead of the fraudsters while gradually adding functionality • Each step provides a return on investment in months not years prag·mat·ic [prag-mat-ik] -adjective: Concerned with practical matters; “a matter-of-fact approach to the problem” — Webster

13. Weaknesses of Current Risk Management Models • Largely a Day 2 Process… Limited Day 1 and Day 0 Analytics • Day 0: Real time instantaneous transaction monitoring at Customer Access Point — Proactive • Day 1: Same-day analysis of transactions before posting (near real time or multiple batch runs) — Reactive • Day 2: Batch analysis after Posting — Reactive • Different capabilities in different silos • No ability to correlate transactions in multiple customer access points in multiple timeframes • Multiple analysts working same accounts in different channels

14. On-Us / Deposit ACH Internet / ATM Wires Scoring Engines, Models, Rules Scoring Engines, Models, Rules Scoring Engines, Models, Rules Scoring Engines, Models, Rules Shared Data Shared Data Shared Data Shared Data Alert MgmtSystem Alert MgmtSystem Alert MgmtSystem Alert MgmtSystem Results in: • Duplication of solution investments • High/unnecessary IT overhead • Duplication of data and resource expenses • No leverage of cross-silo alerts Sophisticated Fraudsters Will Find The Weakest Link Example of Fraud Detection in Individual Silos

15. The Growing Complexity of Fraud Customer Access Points Telephone Banking Branch Lockbox Wires Merchants Web Call Center ATM Bank’s Challenges Compliance Increased Fraud Loss High False Positives Maintaining Silo Fraud Systems Achieving Risk Management Best Practice Constrained Budgets Balancing Customer Satisfaction With Risk Employee Fraud Transaction Monitoring Customer Behavior Enterprise Risk Management Proactively identify fraud in and across channels to mitigate financial and reputational loss

16. Industry Best Practice:Enterprise Risk Management • Holistic View of transactions, accounts, and relationships • Monitor all transactions for suspicious behavior • Analyze monetary and non-monetary data • Enable creating rules containing cross-channel variables • Manage potential fraud cases effectively, from detection through law enforcement reporting • Move to Proactive vs. Reactive

17. Alerts Fraud On-Us Deposit Wires Fraud Manager Workflow Manager Syfact Investigator ACH Other Detection Credit Accounts Other Detection Investment Accounts Other Detection Carreker/CheckFree Enterprise Risk Management DetectionManagement AlertManagement CaseManagement Liability Accounts Acquire Investigation Research Link Analysis Decision Reporting Analyze Day 0, Day 1 or Day 2 Capabilities

18. Enterprise Risk Management Data Acquisition Data Staging Workflow Manager Detection Disposition External Data Sources Data Acquisition Engine Alert Packager On-Us Real Time Modeling Alert Management DepositReal Time Segments Research All Trans-actions File On-Us Day 1 & 2 Suspect Database DepositDay 1 & 2 Profiles Decisioning/ Fraud Analyst Workstation Case Management Internal Data Sources ACH User Defined Rules Reporting ATM FraudLink On-Us Mainframe Internet Banking Filter Queries / Dashboard Wires FraudLink Deposit Mainframe Work Distribution Lists Other Credit LRM ATM/Cards Treasury Mgmt

19. Dashboard Example Customer Enterprise Region Frauds On-Us Deposit ACH Wires Loans Online Internal Number of Alerts Process per FTE per Hour Total Customers Alerted (000)’s Total Fraud Volume YTD

20. Benefits of Enterprise Risk Management • Efficiency • Automated processes • Review fraud-rich pool of suspects with no addition to staff • Single platform for all fraud mitigation • Effectiveness • Improved fraud detection • Lower false positives, reduce false negatives • Improved analyst job satisfaction • Flexibility • Dynamic creation of rules • Image-based workflow • Champion vs. Challenger

21. Agenda Day One

22. Agenda Day One, continued

23. Agenda Day Two

24. Questions?

25. Enterprise Alert Management:Managing Alerts More Effectively Silvia Sarra, Sovereign Bank Dan Barta, CheckFree October 24, 2007

26. What is Enterprise Alert Management? en·ter·prise [en'-ter-prahyz]−noun: 1) a project or undertaking that is especially difficult, complicated, or risky 2) readiness to engage in daring or difficult action: initiative<showed great enterprise in dealing with the crisis> 3) a unit of economic organization or activity; especially: a) a business organization b) a systematic purposeful activity <agriculture is the main economic enterprise among these people> — Webster

27. What “Enterprise” will we be Discussing Today? • Enterprise Definition and Scope • Focus on transaction accounts (DDA & SAV) • Focus on payment transactions and account opening • Limited inclusion of money laundering analysis • Focus on fraud and loss prevention activities • Other areas that could be included • Mortgage and other lending transactions • Investment accounts (brokerage, mutual funds, etc.) • Insurance • Other Industries

28. Enterprise Alert Management Payment Channels Check ACH Debit Credit Wires ATM Detection Tools FraudLinkOn-Us/Deposit FraudLinkACHeCK Falcon Falcon Fraud MgrWires Other Tools SuspectReport SuspectReport SuspectReport SuspectReport SuspectReport SuspectReport

29. Enterprise Alert Management Payment Channels Check ACH Debit Credit Wires ATM Detection Tools FraudLinkOn-Us/Deposit FraudLinkACHeCK Falcon Falcon Fraud MgrWires Other Tools SuspectReport SuspectReport SuspectReport SuspectReport SuspectReport SuspectReport Workflow Tool

30. Workflow Management Functions • Elimination of Paper Reports FraudLink On-Us • Aggregation of Suspects by Account or Relationship FraudLink Deposit CORE Workflow Manager • Suspect/Alert Priorization Early Warning ANF & RNF • Work Assignment Earns • Record Resolution/Action Information Bank Specific Suspect/Alert Tools • Statistical and Other Reporting Kite • Data Mining

31. Workflow Management Functions • Elimination of Paper Reports FraudLink On-Us Mainframe Communication • Aggregation of Suspects by Account or Relationship FraudLink Deposit CORE Workflow Manager • Suspect/Alert Priorization Early Warning ANF & RNF • Work Assignment Earns • Record Resolution/Action Information Bank Specific Suspect/Alert Tools • Statistical and Other Reporting Kite • Data Mining DocumentGeneration

32. Benefits of Enterprise Alerts Management • Utilization of Database software • More complete view of risk at the account/customer level • Better Prioritization of Suspect/transaction Activity • Elimination of Redundant Effort • Smarter/Faster Decisions • Historical Picture of Suspect/Alert Activity • Research capability • Elimination of Paper Reports

33. Sovereign Bank – Company Overview • Sovereign’s headquarters in Wyomissing, PA • $82 billion financial institution • Markets primarily in the Northeast United States • 750 Community Banking Offices (CBOs) & 2,250 ATMs • 18th largest banking institution in the United States • Successfully completed two dozen acquisitions since the late 1980s

34. Loss Prevention – Operational Overview • Centralized Loss Prevention Unit • Team of 44 • Check fraud prevention (Deposit & On-Us) • Case Management case input • Centralized check fraud claims • Debit card (signature and pinned) • Fraud claims • Single point of contact for ID Theft • CBOs, customers, and other Sovereign units’ support via a toll free response line • Elderly Abuse

35. Business Drivers to Implement Enterprise Alert Management • Mergers and Acquisitions • Standardize staff training • Establish a suspect/victim model • Inability to prioritize highest risk alerts • Analysts working in silos i.e. same suspects in multiple reports • Manual processes • Customer notifications (Reg CC) • Re-keying same info in several applications • Unable to identify new trends • Lack of audit trails • Paper driven

36. Staff Efficiency & Operational Gains • Prioritization of highest risk accounts • Elimination of manual processes • Customer notifications • Connection to host system eliminating re-keying of same date • Audit trail (tracks every keystroke) • On average it takes 5 minutes vs. 10 minutes to make a decision to pay/return/hold/freeze • Holistic review of suspects • At a glance history of suspect transactions • Detection rate of alerts reviewed year to date averages 90% • Return on investment (ROI) year to date averages 22:1 • 4 FTE reduction

37. Customer Service Impacts • Standardize notification to customers • Info populating by pulling from host systems hence less chance for typos • Any Analyst can assist customer that calls inquiring about a notification they received, less time spent on the phone

38. Questions?

39. Citibank and CheckFreeFraud Manager Deposit: A Case Study Gail O’Brien, Citibank David Fapohunda, Citibank Debb Gordon, CheckFree October 24, 2007

40. Citibank Business Background • Successfully used FraudLink for both On-Us and Deposit Fraud Detection • However, false positive and false negative rates were becoming a continuing burden to the operation • Current priority: Improve the efficiency of Deposit fraud detection • Deposit False positive alerts were 683 to 1 for the sample period (8/1/2005 to 9/29/2005) tested • FraudLink Deposit (ASI-19) was missing on average 52% of the Fraudulent transactions (false negatives) and these missed transactions accounted for an average of 62% of the Actual Losses • The Goal for Carreker/CheckFree’s Risk Solutions Analytic Team: • Reduce total alerts by 50% and capture at least 98% of the current fraud alerted • Enable the current rules set to be relaxed to alert the missed fraud with the same volumes currently used

41. Analytic Project Background • Early 2006, Carreker/CheckFree approached Citibank to perform a validation of the statistical models created from pooled bank data • Citibank initially provided FraudLink Deposit Transaction alert data from 8/1/2005 thru 9/29/2005 • The Risk Solutions Analytic Team scored the transactions on the Generic model and developed a Custom Model for Citibank • Following the Development process, Citibank provided three months of blind data (11/1/2005 thru 1/31/2006) to be scored and returned to their analysts • The model was successfully able to meet the project criteria of a total alert reduction of 50% while maintaining a fraud detection rate of at least 98% • 21 months later, the validation was repeated and replicated the results

42. Advanced Analytics • System Capabilities • Modeling • Statistical fraud models designed and tailored to fit behavior in each institution • Rules • Custom defined rules written and published by the operation • Lists • Can be imported from an outside source, or created by the operation • Segmentation • Create segments that can be serviced with different logic • Filters • Filters limit what you want to alert

43. Advanced Analytics • The Score • Each transaction is scored based on good customer profiles • Scores range from Zero to 1,000, the higher the score the more likely it’s fraud • Scores are presented in a distribution, you pick the cut-off score that best fits you • Use the score to prioritize workflow, or use a combination of score and any other information you use today

44. Analytic Study Results • Deposit Model and Blind Testing • False Positives were reduced by 51% • Fraud Capture with existing FraudLink alerts was 98% • 21 Months later • False Positives were still showing a reduction on average of 45% • Fraud Dollar Capture with existing FraudLink alerts was 98.3% • The reduction in total alerts allows for relaxing existing FraudLink rule sets to allow for more of the false negative frauds to be scored

45. Citibank’s Business Application • Scored transactions • Defined rules • Prioritization in Workflow • Combining different information for better decisioning

46. Conclusion • Based on these Model Validation studies, Citi expects a significant reduction in alert volume • Combining the use of the score with other user written rules can improve these results even more. • Citi is looking forward to greater operational efficiency in Day 2 Batch • Future releases will bring the detection to Day 0 Real Time, allowing for automated holds and returns at the point of Deposit

47. Questions?

48. Comerica’s Experience with FraudLink DepositReducing False Positives:Effectively using Account Types and Period Parameters Lisa M. Zarzycki, Comerica October 24, 2007

49. Comerica Overview* • $58.6 Billion in total assets • 401 Banking Centers in 5 States • Michigan, • California, • Texas, • Florida, and • Arizona • Select businesses operating in several other states, as well as Canada, Mexico, and China • Among the 20 largest U.S. banking companies *As of July 18, 2007

50. FraudLink Deposit History • Comerica installed FraudLink Deposit v2.0 in October 2003. • With the exception of “home grown” ATM deposit fraud reports, Comerica had no deposit fraud prevention tool. • Comerica estimated $375,000 in loss avoidance in the first year. • Actual Loss Avoidance: $1.8 M • Total At Risk: $1.9 M • 230 Cases • Average Prevention: $7,800