Method and system for detecting payment account fraud

• US 20040039686A1
• Filed: 01/10/2003
• Published: 02/26/2004
• Est. Priority Date: 01/10/2002
• Status: Active Grant

• Current Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Original Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Inventors: Klebanoff, Victor Franklin
• Granted Patent: US 7,428,509 B2
• Time in Patent Office: Days
• US Class Current: 705/38
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 20/403 Solvency checks
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof

Abstract

A method and system for identifying patterns of payment account (e.g., credit card account) transactions that have a high probability of being part of a fraudulent scheme. Certain merchant accounts and payment accounts may have been obtained under false pretenses. For example, the payment accounts may have been obtained with the intention of never paying the bills with a true instrument. Merchant accounts may have been obtained in order to perform transactions either with payment accounts obtained under false pretenses or with stolen payment account information. To detect suspicious patterns of account activity, payment accounts that are new or exhibit a substantial increase in account activity are first identified. Merchant accounts having an unusually large number or value of transactions with such new or newly active payment accounts are also identified. Such merchants and payment accounts can then be subjected to further scrutiny by the affected institutions.

Claims

1. A method for detecting payment account fraud, comprising:

a. selecting one or more new or newly active payment accounts from a set of payment accounts, the step of selecting the one or more new or newly active payment accounts comprising, for each payment account of the set of payment accounts, excluding the payment account from the one or more new or newly active payment accounts if a transaction activity increase factor of the payment account, from a first time period to a second time period, was less than a threshold increase factor, the second time period being subsequent to the first time period; and

b. selecting one or more suspect merchant accounts from a set of merchant accounts, the step of selecting the one or more suspect merchant accounts comprising at least one of the following steps for each merchant account of the set of merchant accounts;

i. excluding the merchant account from the one or more suspect merchant accounts if a number of the one or more new or newly active payment accounts used to conduct at least one transaction with the merchant account during a third time period is less than a first threshold number or greater than an upper limit,

ii. excluding the merchant account from the one or more suspect merchant accounts if a first fraction is less than a first threshold fraction, the first fraction comprising;

(A) a number of transactions conducted with the merchant account during the third time period using at least one of the one or more new or newly active payment accounts, divided by (B) a total number of transactions conducted with the merchant account during the third time period,

iii. excluding the merchant account from the one or more suspect merchant accounts if a second fraction is less than a second threshold fraction, the second fraction comprising;

(C) a combined monetary value of the transactions conducted with the merchant account during the third time period using at least one of the one or more new or newly active payment accounts, divided by (D) a total combined monetary value of the transactions conducted with the merchant account during the third time period, and

iv. excluding the merchant account from the one r more suspect merchant accounts if the transactions conducted with the merchant account during the third time period account using at least one of the one or more new or newly active payment accounts have a combined monetary value that is less than a first threshold monetary value.

2. A method according to claim 1, wherein the including step comprises:

selecting a first set of transactions conducted using the payment account, each transaction of the first set of transactions conducted using the payment account having a monetary value that is no greater than a second threshold monetary value, each transaction of the first set of transactions conducted using the payment account having been conducted during the first time period;

selecting a second set of transactions conducted using the payment account, each transaction of the second set of transactions conducted using the payment account having a monetary value that is no less than a third threshold monetary value, each transaction of the second set of transactions conducted using the payment account having been conducted during the second time period;

computing a first monetary value associated with the payment account, the first monetary value associated with the payment account comprising a total monetary value of the first set of transactions conducted using the payment account;

computing a second monetary value associated with the payment account, the second monetary value associated with the payment account comprising a total monetary value of the second set of transactions conducted using the payment account;

computing a ratio of;

(E) the second monetary value associated with the payment account, to (F) the first monetary value associated with the payment account, for deriving the transaction activity increase factor of the payment account; and

determining whether the transaction activity increase factor of the payment account is no less than the threshold increase factor.

3. A method according to claim 1, wherein the including step comprises computing the transaction activity increase factor based on high-value transactions conducted using the payment account, the high-value transactions being identified based on a minimum transaction value.

4. A method according to claim 1, wherein the step of selecting the one or more suspect merchant accounts comprises excluding from consideration all transactions except high-value transactions conducted with merchant accounts in the set of merchant accounts, the high-value transactions being identified based on a minimum transaction value.

5. A method according to claim 1, further comprising selecting:

(a) a refined set of payment accounts from the one or more new or newly active payment accounts, and (b) a refined set of merchant accounts from the one or more suspect merchant accounts, each payment account in the refined set of payment accounts having been used for conducting transactions with no fewer than a threshold number of merchant accounts in the refined set of merchant accounts, the threshold number of merchant accounts in the refined set of merchant accounts being greater than or equal to two, each merchant account in the refined set of merchant accounts having been used for conducting transactions with no fewer than a threshold number of payment accounts in the refined set of payment accounts, the threshold number of payment accounts in the refined set of payment accounts being greater than or equal to two, the step of selecting the refined set of payment accounts and the refined set of merchant accounts comprising iteratively performing the following steps;

excluding from the refined set of payment accounts any payment accounts which have been used for conducting transactions with fewer than the threshold number of merchant accounts in the refined set of merchant accounts; and

excluding from the refined set of merchant accounts any merchant accounts which have been used for conducting transactions with fewer than the threshold number of payment accounts in the refined set of payment accounts.

6. A method according to claim 5, further comprising forming one or more merchant account cliques, each clique of the one or more merchant account cliques comprising at least first and second merchant accounts of the refined set of merchant accounts, wherein one or more transactions have been conducted with the first merchant account of the clique using a particular account of the refined set of payment accounts, the particular account of the refined set of payment accounts being associated with the clique, wherein one or more transactions have been conducted with the second merchant account of the clique using the particular account of the refined set of payment accounts.

7. A method according to claim 6, further comprising the following steps for each clique of the one or more merchant account cliques:

computing a merchant account clique score of the clique, the merchant account clique score of the clique comprising C₆+C₇(Avg_trx_hi)+C₈(Sales_Ratio)−

C₉(P90)−

C₁₀(P25_cutoff), wherein C₆, C₇, C₈, C₉, and C₁₀ are, respectively, sixth, seventh, eighth, ninth, and tenth coefficients, Avg_trx_hi comprising a non-zero value if and only if an average transaction value of the clique is greater than a second threshold monetary value, Sales_Ratio comprising a ratio of;

(G) a total monetary value of transactions conducted with the clique, to (H) a monetary value of high-value transactions conducted with the clique, P90 comprising a 90th percentile statistical value of respective numbers of days between first and last high-value transactions conducted with the clique using respective payment accounts, P25_cutoff comprising a lesser of a cutoff value and P25, P25 comprising a 25th percentile statistical value of respective lengths of time intervals during which high-value transactions were conducted with the clique using the respective payment accounts; and

excluding the clique from a further refined set of merchant accounts if the merchant account clique score is less than a threshold merchant account clique score.

8. A method according to claim 1, further comprising forming one or more merchant account cliques, each clique of the one or more merchant account cliques comprising at least first and second merchant accounts of the one or more suspect merchant accounts, wherein one or more transactions have been conducted with the first merchant account of the clique using a particular account of the one or more new or newly active payment accounts, the particular account of the one or more new or newly active payment accounts being associated with the clique, wherein one or more transactions have been conducted with the second merchant account of the clique using the particular account of the one or more new or newly active payment accounts.

9. A method according to claim 1, wherein the step of selecting one or more new or newly active payment accounts further comprises the following steps for each payment account of the set of payment accounts:

computing a payment account score of the payment account, the payment account score of the payment account comprising C₁−

C₂(Dlr_Tot)+C₃(Dlr_Avg)+C₄(Amount_of Trailing_Time)+C₅(Trans_Last2_Frc), wherein C₁, C₂, C₃, C₄, and C₅ are, respectively, first, second, third, fourth, and fifth coefficients, Dlr_Tot comprising a total monetary value of transactions having at least a minimum value per transaction and having been conducted using the payment account during a fourth time period, Dlr_Avg comprising an average monetary value of transactions conducted using the payment account during a fifth time period, Amount_of Trailing_Time comprising a length of a sixth time period, wherein a net value of transactions having at least the minimum value per transaction and having been conducted during the sixth time period using the payment account is no greater than zero, Trans_Last2_Frc comprising the greater of a minimum fraction and a ratio of;

(E) a net monetary value of transactions conducted using the payment account during a most recent time period, to (F) a net monetary value of transactions conducted using the payment account during a longer time period comprising both the most recent time period and a time period preceding the most recent time period; and

including the payment account in the one or more new or newly active payment accounts if the payment account score of the payment account is greater than a threshold payment account score.

10. A system for detecting payment account fraud, comprising a processing arrangement configured to perform the steps of:

a. selecting one or more new or newly active payment accounts from a set of payment accounts, the step of selecting the one or more new or newly active payment accounts comprising, for each payment account of the set of payment accounts, excluding the payment account from the one or more new or newly active payment accounts if a transaction activity increase factor of the payment account, from a first time period to a second time period, was less than a threshold increase factor, the second time period being subsequent to the first time period; and

b. selecting one or more suspect merchant accounts from a set of merchant accounts, the step of selecting the one or more suspect merchant accounts comprising at least one of the following steps for each merchant account of the set of merchant accounts;

i. excluding the merchant account from the one or more suspect merchant accounts if a number of the one or more new or newly active payment accounts used to conduct at least one transaction with the merchant account during a third time period is less than a first threshold number or greater than an upper limit,

ii. excluding the merchant account from the one or more suspect merchant accounts if a first fraction is less than a first threshold fraction, the first fraction comprising;

(A) a number of transactions conducted with the merchant account during the third time period using at least one of the one or more new or newly active payment accounts, divided by (B) a total number of transactions conducted with the merchant account during the third time period,

iii. excluding the merchant account from the one or more suspect merchant accounts if a second fraction is less than a second threshold fraction, the second fraction comprising;

(C) a combined monetary value of the transactions conducted with the merchant account during the third time period using at least one of the one or more new or newly active payment accounts, divided by (D) a total combined monetary value of the transactions conducted with the merchant account during the third time period, and

iv. excluding the merchant account from the one or more suspect merchant accounts if the transactions conducted with the merchant account during the third time period using at least one of the one or more new or newly active payment accounts have a combined monetary value that is less than a first threshold monetary value.

11. A system according to claim 10, wherein the including step comprises:

selecting a first set of transactions conducted using the payment account, each transaction of the first set of transactions conducted using the payment account having a monetary value that is no greater than a second threshold monetary value, each transaction of the first set of transactions conducted using the payment account having been conducted during the first time period;

selecting a second set of transactions conducted using the payment account, each transaction of the second set of transactions conducted using the payment account having a monetary value that is no less than a third threshold monetary value, each transaction of the second set of transactions conducted using the payment account having been conducted during the second time period;

computing a first monetary value associated with the payment account, the first monetary value associated with the payment account comprising a total monetary value of the first set of transactions conducted using the payment account;

computing a second monetary value associated with the payment account, the second monetary value associated with the payment account comprising a total monetary value of the second set of transactions conducted using the payment account;

computing a ratio of;

(E) the second monetary value associated with the payment account, to (F) the first monetary value associated with the payment account, for deriving the transaction activity increase factor of the payment account; and

determining whether the transaction activity increase factor of the payment account is no less than the threshold increase factor.

12. A system according to claim 10, wherein the including step comprises computing the transaction activity increase factor based on high-value transactions conducted using the payment account, the high-value transactions being identified based on a minimum transaction value.

13. A system according to claim 10, wherein the step of selecting the one or more suspect merchant accounts comprises excluding from consideration all transactions except high-value transactions conducted with merchant accounts in the set of merchant accounts, the high-value transactions being identified based on a minimum transaction value.

14. A system according to claim 10, wherein the processing arrangement is further configured to perform the step of selecting:

(a) a refined set of payment accounts from the one or more new or newly active payment accounts, and (b) a refined set of merchant accounts from the one or more suspect merchant accounts, each payment account in the refined set of payment accounts having been used for conducting transactions with no fewer than a threshold number of merchant accounts in the refined set of merchant accounts, the threshold number of merchant accounts in the refined set of merchant accounts being greater than or equal to two, each merchant account in the refined set of merchant accounts having been used for conducting transactions with no fewer than a threshold number of payment accounts in the refined set of payment accounts, the threshold number of payment accounts in the refined set of payment accounts being greater than or equal to two, the step of selecting the refined set of payment accounts and the refined set of merchant accounts comprising iteratively performing the following steps;

excluding from the refined set of payment accounts any payment accounts which have been used for conducting transactions with fewer than the threshold number of merchant accounts in the refined set of merchant accounts; and

excluding from the refined set of merchant accounts any merchant accounts which have been used for conducting transactions with fewer than the threshold number of payment accounts in the refined set of payment accounts.

15. A system according to. Claim 14, wherein the processing arrangement is further configured to perform the step of forming one or more merchant account cliques, each clique of the one or more merchant account cliques comprising at least first and second merchant accounts of the refined set of merchant accounts, wherein one or more transactions have been conducted with the first merchant account of the clique using a particular account of the refined set of payment accounts, the particular account of the refined set of payment accounts being associated with the clique, wherein one or more transactions have been conducted with the second merchant account of the clique using the particular account of the refined set of payment accounts.

16. A system according to claim 15, wherein the processing arrangement is further configured to perform the following steps for each clique of the one or more merchant account cliques:

computing a merchant account clique score of the clique, the merchant account clique score of the clique comprising C₆+C₇(Avg_trx_hi)+C₈(Sales_Ratio)−

C₉(P90)−

C₁₀(P25_cutoff), wherein C₆, C₇, C₈, C₉, and C₁₀ are, respectively, sixth, seventh, eighth, ninth, and tenth coefficients, Avg_trx_hi comprising a non-zero value if and only if an average transaction value of the clique is greater than a second threshold monetary value, Sales_Ratio comprising a ratio of;

(G) a total monetary value of transactions conducted with the clique, to (H) a monetary value of high-value transactions conducted with the clique, P90 comprising a 90th percentile statistical value of respective numbers of days between first and last high-value transactions conducted with the clique using respective payment accounts, P25_cutoff comprising a lesser of a cutoff value and P25, P25 comprising a 25th percentile statistical value of respective lengths of time intervals during which high-value transactions were conducted with the clique using the respective payment accounts; and

excluding the clique from a further refined set of merchant accounts if the merchant account clique score is less than a threshold merchant account clique score.

17. A system according to claim 10, wherein the processing arrangement is further configured to perform the step of forming one or more merchant account cliques, each clique of the one or more merchant account cliques comprising at least first and second merchant accounts of the one or more suspect merchant accounts, wherein one or more transactions have been conducted with the first merchant account of the clique using a particular account of the one or more new or newly active payment accounts, the particular account of the one or more new or newly active payment accounts being associated with the clique, wherein one or more transactions have been conducted with the second merchant account of the clique using the particular account of the one or more new or newly active payment accounts.

18. A system according to claim 10, wherein the step of selecting one or more new or newly active payment accounts further comprises the following steps for each payment account of the set of payment accounts:

computing a payment account score of the payment account, the payment account score of the payment account comprising C₁−

C₂(Dlr_Tot)+C₃(Dlr_Avg)+C₄(Amount_of Trailing_Time)+C₅(Trans_Last2_Frc), wherein C₁, C₂, C₃, C₄, and C₅ are, respectively, first, second, third, fourth, and fifth coefficients, Dlr_Tot comprising a total monetary value of transactions having at least a minimum value per transaction and having been conducted using the payment account during a fourth time period, Dlr_Avg comprising an average monetary value of transactions conducted using the payment account during a fifth time period, Amount_of Trailing_Time comprising a length of a sixth time period, wherein a net value of transactions having at least the minimum value per transaction and having been conducted during the sixth time period using the payment account is no greater than zero, Trans_Last2_Frc comprising the greater of a minimum fraction and a ratio of;

(E) a net monetary value of transactions conducted using the payment account during a most recent time period, to (F) a net monetary value of transactions conducted using the payment account during a longer time period comprising both the most recent time period and a time period preceding the most recent time period; and

including the payment account in the one or more new or newly active payment accounts if the payment account score of the payment account is greater than a threshold payment account score.

19. A computer-readable medium for detecting payment account fraud, the computer-readable medium having a set of instructions operable to direct a processor to perform the steps of:

a. selecting one or more new or newly active payment accounts from a set of payment accounts, the step of selecting the one or more new or newly active payment accounts comprising, for each payment account of the set of payment accounts, excluding the payment account from the one or more new or newly active payment accounts if a transaction activity increase factor of the payment account, from a first time period to a second time period, was less than a threshold increase factor, the second time period being subsequent to the first time period; and

b. selecting one or more suspect merchant accounts from a set of merchant accounts, the step of selecting the one or more suspect merchant accounts comprising at least one of the following steps for each merchant account of the set of merchant accounts;

i. excluding the merchant account from the one or more suspect merchant accounts if a number of the one or more new or newly active payment accounts used to conduct at least one transaction with the merchant account during a third time period is less than a first threshold number or greater than an upper limit,

ii. excluding the merchant account from the one or more suspect merchant accounts if a first fraction is less than a first threshold fraction, the first fraction comprising;

(A) a number of transactions conducted with the merchant account during the third time period using at least one of the one or more new or newly active payment accounts, divided by (B) a total number of transactions conducted with the merchant account during the third time period,

iii. excluding the merchant account from the one or more suspect merchant accounts if a second fraction is less than a second threshold fraction, the second fraction comprising;

(C) a combined monetary value of the transactions conducted with the merchant account during the third time period using at least one of the one or more new or newly active payment accounts, divided by (D) a total combined monetary value of the transactions conducted with the merchant account during the third time period, and

iv. excluding the merchant account from the one or more suspect merchant accounts if the transactions conducted with the merchant account during the third time period using at least one of the one or more new or newly active payment accounts have a combined monetary value that is less than a first threshold monetary value.

20. A computer-readable medium according to claim 19, wherein the including step comprises:

selecting a first set of transactions conducted using the payment account, each transaction of the first set of transactions conducted using the payment account having a monetary value that is no greater than a second threshold monetary value, each transaction of the first set of transactions conducted using the payment account having been conducted during the first time period;

selecting a second set of transactions conducted using the payment account, each transaction of the second set of transactions conducted using the payment account having a monetary value that is no less than a third threshold monetary value, each transaction of the second set of transactions conducted using the payment account having been conducted during the second time period;

computing a first monetary value associated with the payment account, the first monetary value associated with the payment account comprising a total monetary value of the first set of transactions conducted using the payment account;

computing a second monetary value associated with the payment account, the second monetary value associated with the payment account comprising a total monetary value of the second set of transactions conducted using the payment account;

computing a ratio of;

(E) the second monetary value associated with the payment account, to (F) the first monetary value associated with the payment account, for deriving the transaction activity increase factor of the payment account; and

determining whether the transaction activity increase factor of the payment account is no less than the threshold increase factor.

21. A computer-readable medium according to claim 19, wherein the including step comprises computing the transaction activity increase factor based on high-value transactions conducted using the payment account, the high-value transactions being identified based on a minimum transaction value.

22. A computer-readable medium according to claim 19, wherein the step of selecting the one or more suspect merchant accounts comprises excluding from consideration all transactions except high-value transactions conducted with merchant accounts in the set of merchant accounts, the high-value transactions being identified based on a minimum transaction value.

23. A computer-readable medium according to claim 19, wherein the set of instructions is further operable to direct the processor to perform the step of selecting:

(a) a refined set of payment accounts from the one or more new or newly active payment accounts, and (b) a refined set of merchant accounts from the one or more suspect merchant accounts, each payment account in the refined set of payment accounts having been used for conducting transactions with no fewer than a threshold number of merchant accounts in the refined set of merchant accounts, the threshold number of merchant accounts in the refined set of merchant accounts being greater than or equal to two, each merchant account in the refined set of merchant accounts having been used for conducting transactions with no fewer than a threshold number of payment accounts in the refined set of payment accounts, the threshold number of payment accounts in the refined set of payment accounts being greater than or equal to two, the step of selecting the refined set of payment accounts and the refined set of merchant accounts comprising iteratively performing the following steps;

excluding from the refined set of payment accounts any payment accounts which have been used for conducting transactions with fewer than the threshold number of merchant accounts in the refined set of merchant accounts; and

excluding from the refined set of merchant accounts any merchant accounts which have been used for conducting transactions with fewer than the threshold number of payment accounts in the refined set of payment accounts.

24. A computer-readable medium according to claim 23, wherein the set of instructions is further operable to direct the processor to perform the step of forming one or more merchant account cliques, each clique of the one or more merchant account cliques comprising at least first and second merchant accounts of the refined set of merchant accounts, wherein one or more transactions have been conducted with the first merchant account of the clique using a particular account of the refined set of payment accounts, the particular account of the refined set of payment accounts being associated with the clique, wherein one or more transactions have been conducted with the second merchant account of the clique using the particular account of the refined set of payment accounts.

25. A computer-readable medium according to claim 24, wherein the set of instructions is further operable to direct the processor to perform the following steps for each clique of the one or more merchant account cliques:

computing a merchant account clique score of the clique, the merchant account clique score of the clique comprising C₆+C₇(Avg_trx_hi)+C₈(Sales_Ratio)−

C₉(P90)−

C₁₀(P25_cutoff), wherein C₆, C₇, C₈, C₉, and C₁₀ are, respectively, sixth, seventh, eighth, ninth, and tenth coefficients, Avg_trx_hi comprising a non-zero value if and only if an average transaction value of the clique is greater than a second threshold monetary value, Sales_Ratio comprising a ratio of;

(G) a total monetary value of transactions conducted with the clique, to (H) a monetary value of high-value transactions conducted with the clique, P90 comprising a 90th percentile statistical value of respective numbers of days between first and last high-value transactions conducted with the clique using respective payment accounts, P25_cutoff comprising a lesser of a cutoff value and P25, P25 comprising a 25th percentile statistical value of respective lengths of time intervals during which high-value transactions were conducted with the clique using the respective payment accounts; and

excluding the clique from a further refined set of merchant accounts if the merchant account clique score is less than a threshold merchant account clique score.

26. A computer-readable medium according to claim 19, wherein the set of instructions is further operable to direct the processor to perform the step of forming one or more merchant account cliques, each clique of the one or more merchant account cliques comprising at least first and second merchant accounts of the one or more suspect merchant accounts, wherein one or more transactions have been conducted with the first merchant account of the clique using a particular account of the one or more new or newly active payment accounts, the particular account of the one or more new or newly active payment accounts being associated with the clique, wherein one or more transactions have been conducted with the second merchant account of the clique using the particular account of the one or more new or newly active payment accounts.

27. A computer-readable medium according to claim 19, wherein the step of selecting one or more new or newly active payment accounts further comprises the following steps for each payment account of the set of payment accounts:

computing a payment account score of the payment account, the payment account score of the payment account comprising C₁−

C₂(Dlr_Tot)+C₃(Dlr_Avg)+C₄(Amount_of_Trailing_Time)+C₅(Trans_Last2_Frc), wherein C₁, C₂, C₃, C₄, and C₅ are, respectively, first, second, third, fourth, and fifth coefficients, Dlr_Tot comprising a total monetary value of transactions having at least a minimum value per transaction and having been conducted using the payment account during a fourth time period, Dlr_Avg comprising an average monetary value of transactions conducted using the payment account during a fifth time period, Amount_of Trailing_Time comprising a length of a sixth time period, wherein a net value of transactions having at least the minimum value per transaction and having been conducted during the sixth time period using the payment account is no greater than zero, Trans_Last2_Frc comprising the greater of a minimum fraction and a ratio of;

(E) a net monetary value of transactions conducted using the payment account during a most recent time period, to (F) a net monetary value of transactions conducted using the payment account during a longer time period comprising both the most recent time period and a time period preceding the most recent time period; and

including the payment account in the one or more new or newly active payment accounts if the payment account score of the payment account is greater than a threshold payment account score.