System and method for presenting suspect activity within a timeline

• US 10,460,377 B2
• Filed: 10/20/2010
• Issued: 10/29/2019
• Est. Priority Date: 10/20/2010
• Status: Active Grant

• Current Assignee: Fis Financial Compliance Solutions LLC (Fidelity National Information Services Incorporated)
• Original Assignee: Fis Financial Compliance Solutions LLC (Fidelity National Information Services Incorporated)
• Inventors: Waks, Mark Jeffrey, Harris, Katherine Beck, Leibon, Gregory David
• Primary Examiner(s): Sheikh, Asfand M
• Application Number:
  US12/908,674
• Publication Number:
  US 20120101919A1
• Time in Patent Office: 3,296 Days
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/12 Accounting

Abstract

Systems and methods for presenting fraud detection information are presented. In one example, a computer system analyzes empirical data to detect potentially fraudulent activity and alerts users of the potentially fraudulent activity via a fraud detection user interface. The fraud detection user interface determines a set of user interface components to suitable to present the potentially fraudulent activity and presents facts associated with the potentially fraudulent activity to a user for further analysis and investigation.

Claims

1. A computer system for fraud detection, the system comprising:

a processor;

a presentation engine;

an analytics engine;

a memory;

storing data describing;

activity data of a suspect activity, the suspect activity being associated with an account; and

account data of at least one balance metric for the account, the account data including at least two of;

a ledger balance representing an amount of money reported to a customer of the account,

an available balance representing an accessible amount of money, and

a collected balance representing an amount of money collected by a financial institution; and

storing executable instructions that when executed by the processor cause the presentation engine and the analytics engine to perform operations comprising;

receiving, via the analytics engine, an indication of a suspect activity;

displaying, via the presentation engine, a representation of the suspect activity on a graphical user interface, based on the indication of the suspect activity;

displaying, via the presentation engine, a representation of differences on the graphical user interface, the representation comprising differences between at least two of a ledger balance, an available balance, and a collected balance;

determining, by the analytics engine, local minimums of the representation of differences;

displaying, via the presentation engine, a lower concave hull between the local minimums of the representation of differences on the graphical user interface;

determining, by the analytics engine, a set of user interface components associated with at least one reason code, wherein the reason code is indicative of the suspect activity;

selecting, by the analytics engine, based on the at least one reason code, one of the representations of the suspect activity, the representation of the differences, or the representation of a timeline;

selecting, by the analytics engine, a period of time based on the at least one reason code associated with the suspect activity and indicative of at least one basis for classifying the activity as suspect;

determining, by the analytics engine, a priority order of the representation of the suspect activity, the representation of the differences, and the representation of the timeline to reflect the selection;

displaying, via the presentation engine, based on the priority order, a representation of the timeline on the graphical user interface, the timeline comprising an indication of activity during the period of time identified as potentially fraudulent; and

emphasizing a subset of data displayed on the graphical user interface, based on one or more determinations for an improved end-user workflow.

2. The system according to claim 1, wherein the indication of any previous activity identified as potentially fraudulent includes a time period and the representation of the timeline spans the time period.

3. The system according to claim 2, wherein the time period extends beyond a time associated with the suspect activity and a time associated with any previous activity identified as potentially fraudulent.

4. The system according to claim 3, wherein the representation of the timeline is configured to receive an adjustment of the time period from a user, and the presentation engine is further configured to:

receive an adjustment of the time period via the representation of the timeline; and

display another representation of the timeline on the graphical user interface, the another representation of the timeline including an indication of activity identified as potentially fraudulent and associated with the account during the adjusted time period.

5. The system according to claim 1, wherein the lower concave hull represents a trend of the balance metric.

6. The system according to claim 1, wherein the indication of at least one previous activity is embedded in the timeline.

7. The system according to claim 1, wherein the analytics engine is further configured to:

determine whether the indication of the suspect activity contains a reason code indicating deposit fraud; and

select the representation of the suspect activity when the reason code indicates deposit fraud.

8. The system according to claim 1, wherein the at least one reason code comprises a primary reason code and one or more secondary reason codes.

9. The system according to claim 1, wherein the analytics engine is further configured to:

read the ledger balance, available balance, and collected balance from the account data in the memory;

detect a divergence between the ledger balance, the available balance, and the collected balance;

generate the indication of the suspect activity based on detecting the divergence.

10. The system according to claim 1, wherein the presentation engine is configured to:

generate a first frame, a second frame, and a third frame for display on the graphical user interface;

display the first frame, second frame, and third frame on the graphical user interface;

display the representation of differences, the lower concave hull, and the representation of the timeline in the first frame of the graphical user interface;

display selectable information related to at least one suspect activity in the second frame of the graphical user interface;

display the representation of a suspect activity, selected in the second frame, in the third frame of the graphical user interface.

11. The system according to claim 10, wherein the timeline is configured to receive an adjustment of the time period from a user, and the first frame is further configured to:

receive an adjustment of the time period; and

display another representation of the timeline in the first frame, the another representation timeline including an indication of activity identified as potentially fraudulent and associated with the account during the adjusted time period.

12. The system according to claim 1, wherein the emphasizing a subset of data displayed on the graphical user interface further comprises:

emphasizing the subset of the selected representation as a function of one or more reason codes included in the indication of the suspect activity.

13. The system according to claim 1, wherein the emphasizing a subset of data displayed on the graphical user interface further comprises:

emphasizing the subset of the selected user interface components that are useful in analyzing the potentially fraudulent activity.

14. The system according to claim 1, wherein the emphasizing a subset of data displayed on the graphical user interface further comprises:

emphasizing an indication that the suspect activity has a plurality of characteristics that, when analyzed as a whole by the analytics engine, indicate an outlier to an established pattern.

15. A computer implemented method, comprising:

storing, in a memory, activity data describing a suspect activity, the suspect activity being associated with an account;

storing, in the memory, account data describing at least one balance metric for the account, the account data including at least two of;

a ledger balance representing an amount of money reported to a customer of the account,

an available balance representing an accessible amount of money, and

a collected balance representing an amount of money collected by a financial institution;

receiving, via an analytics engine, an indication of a suspect activity;

displaying, via a presentation engine, a representation of the suspect activity on a graphical user interface, based on the indication of the suspect activity;

displaying, via the presentation engine, a representation of differences on the graphical user interface, the representation comprising differences between at least two of a ledger balance, an available balance, and a collected balance;

determining, via the analytics engine, local minimums of the representation of differences;

displaying, via the presentation engine, a lower concave hull between the local minimums of the representation of differences on the graphical user interface;

determining, by the analytics engine, a set of user interface components associated with at least one reason code, wherein the reason code is indicative of the suspect activity;

selecting, by the analytics engine, based on the at least one reason code, one of the representations of the suspect activity, the representation of the differences, or the representation of a timeline;

selecting, by the analytics engine, a period of time based on the at least one reason code associated with the suspect activity and indicative of at least one basis for classifying the activity as suspect;

determining, by the analytics engine, a priority order of the representation of the suspect activity, the representation of the differences, and the representation of the timeline to reflect the selection; and

displaying, by the presentation engine, based on the priority order, on the graphical user interface, the representation of a timeline, the timeline comprising an indication of activity during the period of time identified as potentially fraudulent; and

emphasizing a subset of data displayed on the graphical user interface, based on one or more determinations for an improved end-user workflow.

16. The method according to claim 15, wherein presenting, via the presentation engine, the representation of the timeline includes presenting a timeline that spans a time period associated with any previous activity identified as potentially fraudulent.

17. The method according to claim 16, wherein presenting the timeline that spans the time period includes presenting a timeline that extends beyond a time associated with the suspect activity and a time associated with any previous activity that is suspected of being fraudulent.

18. The method according to claim 17, further comprising:

receiving, by the presentation engine, a request to adjust the time period from a user via the representation of the timeline; and

adjusting, responsive to the request, the time period.

19. A non-transitory computer readable medium having instructions stored thereon that, when executed by at least one processor, cause an analytics engine and a presentation engine to perform operations comprising:

storing, in a memory, activity data describing a suspect activity, the suspect activity being associated with an account;

storing, in the memory, account data describing at least one balance metric for the account, the account data including at least two of;

a ledger balance representing an amount of money reported to a customer of the account,

an available balance representing an accessible amount of money, and

a collected balance representing an amount of money collected by a financial institution;

receiving, via the analytics engine, an indication of a suspect activity;

displaying, via a presentation engine, a representation of the suspect activity on a graphical user interface, based on the indication of the suspect activity;

displaying, by the presentation engine, a representation of differences on the graphical user interface, the representation comprising differences between at least two of a ledger balance, an available balance, and a collected balance;

determining, by the analytics engine, local minimums of the representation of differences;

displaying, by the analytics engine, a lower concave hull between the local minimums of the representation of differences on the graphical user interface;

determining, by the analytics engine, a set of user interface components associated with at least one reason code, wherein the reason code is indicative of the suspect activity;

selecting, by the analytics engine, based on the at least one reason code, one of the representations of the suspect activity, the representation of the differences, or the representation of the timeline;

selecting, by the analytics engine, a period of time based on the at least one reason code associated with the suspect activity and indicative of at least one basis for classifying the activity as suspect;

determining, by the analytics engine, a priority order of the representation of the suspect activity, the representation of the differences, and the representation of the timeline to reflect the selection; and

displaying, by the presentation engine, based on the priority order, the representation of a timeline, on the graphical user interface comprising an indication of activity during the period of time identified as potentially fraudulent; and

emphasizing a subset of data displayed on the graphical user interface, based on one or more determinations for an improved end-user workflow.

20. The computer readable medium according to claim 19, wherein the instructions instruct the at least one processor to receive the indication by receiving an indication including a time period and the instructions instruct the analytics engine and the presentation engine to present the representation of the timeline by presenting a timeline that spans the time period.