Method and system for preventing illicit use of a telephony platform

• US 10,469,670 B2
• Filed: 03/05/2018
• Issued: 11/05/2019
• Est. Priority Date: 07/24/2012
• Status: Active Grant

• Current Assignee: Twilio, Inc.
• Original Assignee: Twilio, Inc.
• Inventors: Ballai, Adam, Hagemann, III, Robert C., Zarick, Daniel
• Primary Examiner(s): Cai, Wayne H
• Application Number:
  US15/911,737
• Publication Number:
  US 20180198923A1
• Time in Patent Office: 610 Days
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A system and method for preventing illicit use of a telephony platform that includes enrolling a plurality of accounts on a telecommunications platform, wherein an account includes account configuration; at a fraud detection system of the telecommunications platform, receiving account usage data, wherein the usage data includes at least communication configuration data and billing configuration data of account configuration and further includes communication history of the plurality of accounts; calculating fraud scores of a set of fraud rules from the usage data, wherein at least a sub-set of the fraud rules include conditions of usage data patterns between at least two accounts; detecting when the fraud scores of an account satisfy a fraud threshold; and initiating an action response when a fraud score satisfies the fraud threshold.

Claims

1. A method comprising:

calculating, based on sub-account usage data of at least a first sub-account and a second sub-account managed by a parent account of a communication platform, a fraud score for the first sub-account, the sub-account usage data including at least sub-account configuration data and communication history data, wherein calculating the fraud score comprises;

generating a first fingerprint from a first image transmitted using the first sub-account;

generating a second fingerprint from a second image transmitted using the second sub-account;

calculating the fraud score at least partially based on a comparison of the first fingerprint and the second fingerprint, the comparison of the first fingerprint and the second fingerprint to determine a similarity between the first image and the second image;

in response to determining that the fraud score satisfies a threshold, providing an external service provider system of the parent account with a notification of illicit behavior of the first sub-account.

2. The method of claim 1, wherein the first sub-account is an account of an external system that uses a service of the external service provider system and a service of the communication platform.

3. The method of claim 1, wherein calculating the fraud score further comprises:

determining a first hash value based on first payment data associated with the first sub-account;

determining a second hash value based on second payment data associated with the second sub-account; and

calculating the fraud score at least partially based on a comparison of the first hash value and the second hash value, the comparison of the first hash value and the second hash value to determine a similarity between the first payment data matches the second payment data.

4. The method of claim 1, wherein calculating the fraud score further comprises:

calculating the fraud score at least partially based on a similarity between first account configurations of the first sub-account and second account configurations of the second sub-account.

5. The method of claim 1, wherein calculating the fraud score further comprises:

calculating the fraud score at least partially based on a similarity between a first Uniform Resource Identifier (URI) designated for use by the first sub-account and a second URI designated for use by the second sub-account.

6. The method of claim 1, further comprising:

restricting at least one type of communications from being initiated by the first sub-account in response to determining that the fraud score satisfies the threshold.

7. The method of claim 1, further comprising:

notifying an analyst of the communication platform of the illicit behavior of the first sub-account.

8. A system comprising:

one or more computer processors; and

one or more computer-readable mediums storing instructions that, when executed by the one or more computer processors, cause the system to perform operations comprising;

calculating, based on sub-account usage data of at least a first sub-account and a second sub-account managed by a parent account of a communication platform, a fraud score for the first sub-account, the sub-account usage data including at least sub-account configuration data and communication history data, wherein calculating the fraud score comprises;

generating a first fingerprint from a first image transmitted using the first sub-account;

generating a second fingerprint from a second image transmitted using the second sub-account;

calculating the fraud score at least partially based on a comparison of the first fingerprint and the second fingerprint, the comparison of the first fingerprint and the second fingerprint to determine a similarity between the first image and the second image;

in response to determining that the fraud score satisfies a threshold, providing an external service provider system of the parent account with a notification of illicit behavior of the first sub-account.

9. The system of claim 8, wherein the first sub-account is an account of an external system that uses a service of the external service provider system and a service of the communication platform.

10. The system of claim 8, wherein calculating the fraud score further comprises:

determining a first hash value based on first payment data associated with the first sub-account;

determining a second hash value based on second payment data associated with the second sub-account; and

calculating the fraud score at least partially based on a comparison of the first hash value and the second hash value, the comparison of the first hash value and the second hash value to determine a similarity between the first payment data matches the second payment data.

11. The system of claim 8, wherein calculating the fraud score further comprises:

calculating the fraud score at least partially based on a similarity between first account configurations of the first sub-account and second account configurations of the second sub-account.

12. The system of claim 8, wherein calculating the fraud score further comprises:

calculating the fraud score at least partially based on a similarity between a first Uniform Resource Identifier (URI) designated for use by the first sub-account and a second URI designated for use by the second sub-account.

13. The system of claim 8, the operations further comprising:

restricting at least one type of communications from being initiated by the first sub-account in response to determining that the fraud score satisfies the threshold.

14. The system of claim 8, the operations further comprising:

notifying an analyst of the communication platform of the illicit behavior of the first sub-account.

15. A non-transitory computer-readable medium storing instructions that, when executed by one or more computer processors of a computing device, cause the computing device to perform operations comprising:

calculating, based on sub-account usage data of at least a first sub-account and a second sub-account managed by a parent account of a communication platform, a fraud score for the first sub-account, the sub-account usage data including at least sub-account configuration data and communication history data, wherein calculating the fraud score comprises;

generating a first fingerprint from a first image transmitted using the first sub-account;

generating a second fingerprint from a second image transmitted using the second sub-account;

calculating the fraud score at least partially based on a comparison of the first fingerprint and the second fingerprint, the comparison of the first fingerprint and the second fingerprint to determine a similarity between the first image and the second image;

in response to determining that the fraud score satisfies a threshold, providing an external service provider system of the parent account with a notification of illicit behavior of the first sub-count.

16. The non-transitory computer-readable medium of claim 15, wherein the first sub-account is an account of an external system that uses a service of the external service provider system and a service of the communication platform.

17. The non-transitory computer-readable medium of claim 15, wherein calculating the fraud score further comprises:

determining a first hash value based on first payment data associated with the first sub-account;

determining a second hash value based on second payment data associated with the second sub-account; and

calculating the fraud score at least partially based on a comparison of the first hash value and the second hash value, the comparison of the first hash value and the second hash value to determine a similarity between the first payment data matches the second payment data.

18. The non-transitory computer-readable medium of claim 15, wherein calculating the fraud score further comprises:

calculating the fraud score at least partially based on a similarity between first account configurations of the first sub-account and second account configurations of the second sub-account.

19. The non-transitory computer-readable medium of claim 15, wherein calculating the fraud score further comprises:

calculating the fraud score at least partially based on a similarity between a first Uniform Resource Identifier (URI) designated for use by the first sub-account and a second URI designated for use by the second sub-account.

20. The non-transitory computer-readable medium of claim 15, the operations further comprising:

restricting at least one type of communications from being initiated by the first sub-account in response to determining that the fraud score satisfies the threshold.