Armand Rossouw | Case Studies

Key metric

R109M

the publicly reported cyber-attack loss I quantified — and defended against.

Responding to a national cyber-attack — from raw, fragmented data

The problem: a high-impact, publicly reported cyber-attack at national scale — and only raw, fragmented data to investigate it with, no enterprise tooling available.

My action: forensically catalogued tens of thousands of transactions — terminal IDs, beneficiaries, geolocation — reconstructed the loss picture from immutable records, and built behavioural detection logic from the attack's fingerprints.

The result: KPMG Forensic used my analysis as their source-of-truth check before sign-off, and the bank's executives accepted my fraud calculation as the true reflection of fraudulent activity in the business.

Key metric

~92%

reduction in annual fraud case volume — ≈21,000 fewer cases a year.

Cutting institutional fraud by ~92%

The problem: a national institution absorbing tens of thousands of fraud cases a year, with no enterprise detection tooling available.

My action: led detection and controls work combining biometric controls, early-fraud-detection systems and behavioural-analytics anomaly detection — architected from raw, fragmented data with SQL, Python, advanced Excel/Power Query, Power BI and Graylog.

The result: annual fraud case volume fell ~92% — roughly 21,000 fewer cases a year.

Key outcome

Sworn deponent

supporting SAPS, NPA and Hawks casework and prosecutions.

Prosecution-grade evidence chains for national casework

The problem: syndicate fraud only ends in court — and court demands evidence discipline most detection work never reaches.

My action: forensically catalogued tens of thousands of transactions — terminal IDs, beneficiaries, geolocation — into prosecution-grade evidence chains, authored multiple Final Investigation Reports, and provided real-time transaction intelligence supporting national grant-fraud operations.

The result: served as sworn deponent supporting SAPS, NPA and Hawks prosecutions. SASSA's Manager: Fraud Investigations later drafted a CEO-level request for my return, describing the role as "critical scarce skill functions".

Key technique

Cloning clusters

sequential-DOB anomalies and terminal clustering revealing organised targeting.

Proving a systemic card-cloning risk before it detonated

The problem: a large legacy magnetic-stripe card estate exposed to cloning — a systemic risk with no formal remediation roadmap.

My action: detected cloning clusters through sequential-DOB anomaly analysis and terminal clustering — evidence of organised targeting from a precompiled dataset — built the exposure model, and escalated the quantified risk to executive leadership.

The result: the risk was proven, quantified and placed on the executive record — forward-looking fraud analytics surfacing an enterprise threat before it was widely exploited.

Key metric

200 / 200

scripted reliability checks passing on a seeded harness — re-runnable with one command.

AI systems, tested like bank controls

The problem: since 2023 the market is full of AI that demos well and fails quietly — almost nobody proves reliability.

My action: built production AI systems and the evaluation machinery around them: a multi-model assistant with deterministic routing and mechanical validators; a 444k+-record synthetic South African fraud dataset with seeded reproducibility; validation protocols using frozen holdouts, calibration scoring and adversarial red-team suites; and geospatial forensics reconstructing money-runner corridors and cloning clusters.

The result: 200 of 200 scripted reliability checks pass — seeded, so anyone can re-run the entire suite with one command — with 90% of traffic served by local models. The same evidence discipline as fraud casework, applied to AI.