User fraud detection and prevention of access to a distributed network communication system

• US 20040236702A1
• Filed: 05/21/2003
• Published: 11/25/2004
• Est. Priority Date: 05/21/2003
• Status: Active Grant

• Current Assignee: Wayport, Inc. (AT&T, Inc.)
• Original Assignee: Wayport, Inc. (AT&T, Inc.)
• Inventors: Keeler, James D., Fink, Ian M.
• Granted Patent: US 8,108,916 B2
• Time in Patent Office: Days
• US Class Current: 705/73
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud

Abstract

A system and method are disclosed for user fraud protection and prevention of access to a distributed network communication system. A first set of identification data associated with a first network access are stored. A second set of identification data associated with a second network access are stored. The first and second sets of identification data comprise a first computing device identification and a second computing device identification, respectively. If one or more fraud indicators are determined in the two sets of identification data, then the first and/or second network access may be revoked. The fraud indicators may include, e.g., use of the same username with different computing device identifications, use of the same computing device identification at different geographical locations, violation of a threshold for computing device identifications, violation of a threshold for authentication failures, and violation of a threshold for rate of network propagation by a user account.

Claims

1. A method for determining fraud in accessing a network, the method comprising:

initiating a first network access with a network provider;

storing a first set of identification data associated with the first network access in response to the first network access, wherein the first set of identification data comprises a first computing device identification;

initiating a second network access with the network provider;

storing a second set of identification data associated with the second network access in response to the second network access, wherein the second set of identification data comprises a second computing device identification;

determining one or more fraud indicators in the first set of identification data and the second set of identification data; and

revoking the first network access and/or the second network access in response to the determining the one or more fraud indicators.

2. The method of claim 1,

wherein the first set of identification data comprises a first username;

wherein the second set of identification data comprises a second username;

wherein the first username and the second username are associated with a same user account;

wherein the first computing device identification and the second computing device identification comprise different computing device identifications; and

wherein the one or more fraud indicators comprise a use of the same user account with both the first computing device identification and the second computing device identification.

3. The method of claim 2,

wherein the first username equals the second username.

4. The method of claim 1,

wherein the first set of identification data comprises a first geographic location;

wherein the second set of identification data comprises a second geographic location which is different from the first geographic location;

wherein the first computing device identification and the second computing device identification comprise a same computing device identification; and

wherein the one or more fraud indicators comprise a use of the same computing device identification at both the first geographical location and the second geographical location.

5. The method of claim 1,

wherein the second network access is initiated during the first network access.

6. The method of claim 1,

wherein the second network access is initiated after the first network access has ended.

7. The method of claim 1,

wherein the determining one or more fraud indicators comprises using a fraud detection algorithm.

8. The method of claim 1,

wherein the network provider determines a threshold quantity of computing device identifications;

wherein the one or more fraud indicators comprise a use of the first computing device identification and/or the second computing device identification in violation of the threshold quantity of computing device identifications.

9. The method of claim 1,

wherein the network provider determines a threshold quantity of authentication failures;

wherein the one or more fraud indicators comprise one or more authentication failures during the initiating the first network access and/or the second network access in violation of the threshold quantity of authentication failures.

10. The method of claim 1,

wherein the one or more fraud indicators comprise an abnormal rate increase of subscriber usage by a roaming partner.

11. The method of claim 1, further comprising:

determining a rate of network propagation by comparing the first set of identification data and the second set of identification data;

wherein the one or more fraud indicators comprise a violation of a threshold rate of network propagation by the determined rate of network propagation.

12. The method of claim 1,

wherein the one or more fraud indicators comprise a use of one or more RF channels for wireless access during the first network access or the second network access.

13. The method of claim 1, further comprising:

suspending a user account in response to the determining the one or more fraud indicators.

14. The method of claim 1, further comprising:

de-activating a user account in response to the determining the one or more fraud indicators.

15. The method of claim 14, further comprising:

verifying an owner identification associated with the de-activated user account; and

re-activating the de-activated user account in response to the verifying the owner identification.

16. The method of claim 15,

wherein the re-activating the de-activated user account is performed by the network provider.

17. The method of claim 15,

wherein the re-activating the de-activated user account is performed by a roaming partner.

18. The method of claim 15, further comprising

assigning a new identification to the re-activated user account.

19. The method of claim 1,

wherein the second set of identification data is received from a broadcast.

20. The method of claim 1,

wherein the second set of identification data is received from a multicast.

21. A method for determining fraud in accessing a network, the method comprising:

initiating a first network access with a network provider;

storing a first set of identification data associated with the first network access in response to the first network access, wherein the first set of identification data comprises a first username and a first computing device identification;

initiating a second network access with the network provider;

storing a second set of identification data associated with the second network access in response to the second network access, wherein the second set of identification data comprises a second username and a second computing device identification, wherein the first username and the second username are associated with a same user account, and wherein the first computing device identification and the second computing device identification comprise different computing device identifications;

determining one or more fraud indicators in the first set of identification data and the second set of identification data, wherein the one or more fraud indicators comprise a use of the same user account with both the first computing device identification and the second computing device identification; and

revoking the first network access and/or the second network access in response to the determining the one or more fraud indicators.

22. The method of claim 21,

wherein the first username equals the second username.

23. The method of claim 21,

wherein the second network access is initiated during the first network access.

24. The method of claim 21,

wherein the second network access is initiated after the first network access has ended.

25. The method of claim 21, further comprising:

suspending the user account in response to the determining the one or more fraud indicators.

26. The method of claim 21, further comprising:

de-activating the user account in response to the determining the one or more fraud indicators.

27. The method of claim 26, further comprising:

verifying an owner identification associated with the de-activated user account; and

re-activating the de-activated user account in response to the verifying the owner identification.

28. The method of claim 27,

wherein the re-activating the de-activated user account is performed by the network provider.

29. The method of claim 27,

wherein the re-activating the de-activated user account is performed by a roaming partner.

30. The method of claim 27, further comprising

assigning a new identification to the re-activated user account.

31. The method of claim 21,

wherein the second set of identification data is received from a broadcast.

32. The method of claim 21,

wherein the second set of identification data is received from a multicast.

33. A method for determining fraud in accessing a network, the method comprising:

initiating a first network access with a network provider;

storing a first set of identification data associated with the first network access in response to the first network access, wherein the first set of identification data comprises a first geographical location and a computing device identification;

initiating a second network access with the network provider;

storing a second set of identification data associated with the second network access in response to the second network access, wherein the second set of identification data comprises a second geographical location and the computing device identification;

determining one or more fraud indicators in the first set of identification data and the second set of identification data, wherein the one or more fraud indicators comprise a use of the computing device identification at both the first geographical location and the second geographical location; and

revoking the first network access and/or the second network access in response to the determining the one or more fraud indicators.

34. The method of claim 33,

wherein the second network access is initiated during the first network access.

35. The method of claim 33,

wherein the second network access is initiated after the first network access has ended.

36. The method of claim 33, further comprising:

suspending a user account in response to the determining the one or more fraud indicators.

37. The method of claim 33, further comprising:

de-activating a user account in response to the determining the one or more fraud indicators.

38. The method of claim 37, further comprising:

verifying an owner identification associated with the de-activated user account; and

re-activating the de-activated user account in response to the verifying the owner identification.

39. The method of claim 38,

wherein the re-activating the de-activated user account is performed by the network provider.

40. The method of claim 38,

wherein the re-activating the de-activated user account is performed by a roaming partner.

41. The method of claim 38, further comprising

assigning a new identification to the re-activated user account.

42. The method of claim 33,

wherein the second set of identification data is received from a broadcast.

43. The method of claim 33,

wherein the second set of identification data is received from a multicast.

44. A carrier medium comprising program instructions for determining fraud in accessing a network, wherein the program instructions are computer-executable to implement:

storing a first set of identification data associated with a first network access with a network provider, wherein the first set of identification data comprises a first computing device identification;

storing a second set of identification data associated with a second network access with the network provider, wherein the second set of identification data comprises a second computing device identification;

determining one or more fraud indicators in the first set of identification data and the second set of identification data; and

revoking the first network access and/or the second network access in response to the determining the one or more fraud indicators.

45. The carrier medium of claim 44,

wherein the first set of identification data comprises a first username;

wherein the second set of identification data comprises a second username;

wherein the first username and the second username are associated with a same user account;

wherein the first computing device identification and the second computing device identification comprise different computing device identifications; and

wherein the one or more fraud indicators comprise a use of the same user account with both the first computing device identification and the second computing device identification.

46. The carrier medium of claim 45,

wherein the first username equals the second username.

47. The carrier medium of claim 44,

wherein the first set of identification data comprises a first geographic location;

wherein the second set of identification data comprises a second geographic location which is different from the first geographic location;

wherein the first computing device identification and the second computing device identification comprise a same computing device identification; and

wherein the one or more fraud indicators comprise a use of the same computing device identification at both the first geographical location and the second geographical location.

48. The carrier medium of claim 44,

wherein the second network access is initiated during the first network access.

49. The carrier medium of claim 44,

wherein the second network access is initiated after the first network access has ended.

50. The carrier medium of claim 44,

wherein the determining one or more fraud indicators comprises using a fraud detection algorithm.

51. The carrier medium of claim 44,

wherein the network provider determines a threshold quantity of computing device identifications;

wherein the one or more fraud indicators comprise a use of the first computing device identification and/or the second computing device identification in violation of the threshold quantity of computing device identifications.

52. The carrier medium of claim 44,

wherein the network provider determines a threshold quantity of authentication failures;

wherein the one or more fraud indicators comprise one or more authentication failures during the first network access and/or the second network access in violation of the threshold quantity of authentication failures.

53. The carrier medium of claim 44,

wherein the one or more fraud indicators comprise an abnormal rate increase of subscriber usage by a roaming partner.

54. The carrier medium of claim 44, wherein the program instructions are further computer-executable to implement:

determining a rate of network propagation by comparing the first set of identification data and the second set of identification data;

wherein the one or more fraud indicators comprise a violation of a threshold rate of network propagation by the determined rate of network propagation.

55. The carrier medium of claim 44,

wherein the one or more fraud indicators comprise a use of one or more RF channels for wireless access during the first network access or the second network access.

56. The carrier medium of claim 44, wherein the program instructions are further computer-executable to implement:

suspending a user account in response to the determining the one or more fraud indicators.

57. The carrier medium of claim 44, wherein the program instructions are further computer-executable to implement:

de-activating a user account in response to the determining the one or more fraud indicators.

58. The carrier medium of claim 57, wherein the program instructions are further computer-executable to implement:

verifying an owner identification associated with the de-activated user account; and

re-activating the de-activated user account in response to the verifying the owner identification.

59. The carrier medium of claim 58,

wherein the re-activating the de-activated user account is performed by the network provider.

60. The carrier medium of claim 58,

wherein the re-activating the de-activated user account is performed by a roaming partner.

61. The carrier medium of claim 58, wherein the program instructions are further computer-executable to implement:

assigning a new identification to the re-activated user account.

62. The carrier medium of claim 44,

wherein the second set of identification data is received from a broadcast.

63. The carrier medium of claim 44,

wherein the second set of identification data is received from a multicast.

64. A carrier medium comprising program instructions for determining fraud in accessing a network, wherein the program instructions are computer-executable to implement:

storing a first set of identification data associated with a first network access with a network provider, wherein the first set of identification data comprises a first username and a first computing device identification;

storing a second set of identification data associated with a second network access with the network provider, wherein the second set of identification data comprises a second username and a second computing device identification, wherein the first username and the second username are associated with a same user account, and wherein the first computing device identification and the second computing device identification comprise different computing device identifications;

determining one or more fraud indicators in the first set of identification data and the second set of identification data, wherein the one or more fraud indicators comprise a use of the same user account with both the first computing device identification and the second computing device identification; and

revoking the first network access and/or the second network access in response to the determining the one or more fraud indicators.

65. The carrier medium of claim 64,

wherein the first username equals the second username.

66. The carrier medium of claim 64,

wherein the second network access is initiated during the first network access.

67. The carrier medium of claim 64,

wherein the second network access is initiated after the first network access has ended.

68. The carrier medium of claim 64, wherein the program instructions are further computer-executable to implement:

suspending the user account in response to the determining the one or more fraud indicators.

69. The carrier medium of claim 64, wherein the program instructions are further computer-executable to implement:

de-activating the user account in response to the determining the one or more fraud indicators.

70. The carrier medium of claim 69, wherein the program instructions are further computer-executable to implement:

verifying an owner identification associated with the de-activated user account; and

re-activating the de-activated user account in response to the verifying the owner identification.

71. The carrier medium of claim 70,

wherein the re-activating the de-activated user account is performed by the network provider.

72. The carrier medium of claim 70,

wherein the re-activating the de-activated user account is performed by a roaming partner.

73. The carrier medium of claim 70, wherein the program instructions are further computer-executable to implement:

assigning a new identification to the re-activated user account.

74. The carrier medium of claim 64,

wherein the second set of identification data is received from a broadcast.

75. The carrier medium of claim 64,

wherein the second set of identification data is received from a multicast.

76. A carrier medium comprising program instructions for determining fraud in accessing a network, wherein the program instructions are computer-executable to implement:

storing a first set of identification data associated with a first network access with a network provider, wherein the first set of identification data comprises a first geographical location and a computing device identification;

storing a second set of identification data associated with a second network access with the network provider, wherein the second set of identification data comprises a second geographical location and the computing device identification;

determining one or more fraud indicators in the first set of identification data and the second set of identification data, wherein the one or more fraud indicators comprise a use of the computing device identification at both the first geographical location and the second geographical location; and

revoking the first network access and/or the second network access in response to the determining the one or more fraud indicators.

77. The carrier medium of claim 76,

wherein the second network access is initiated during the first network access.

78. The carrier medium of claim 76,

wherein the second network access is initiated after the first network access has ended.

79. The carrier medium of claim 76, wherein the program instructions are further computer-executable to implement:

suspending a user account in response to the determining the one or more fraud indicators.

80. The carrier medium of claim 76, wherein the program instructions are further computer-executable to implement:

de-activating a user account in response to the determining the one or more fraud indicators.

81. The carrier medium of claim 80, wherein the program instructions are further computer-executable to implement:

verifying an owner identification associated with the de-activated user account; and

re-activating the de-activated user account in response to the verifying the owner identification.

82. The carrier medium of claim 81,

wherein the re-activating the de-activated user account is performed by the network provider.

83. The carrier medium of claim 81,

wherein the re-activating the de-activated user account is performed by a roaming partner.

84. The carrier medium of claim 81, wherein the program instructions are further computer-executable to implement:

assigning a new identification to the re-activated user account.

85. The carrier medium of claim 76,

wherein the second set of identification data is received from a broadcast.

86. The carrier medium of claim 76,

wherein the second set of identification data is received from a multicast.

87. A system for determining fraud in accessing a network, the system comprising:

a CPU coupled to a network;

a memory coupled to the CPU, wherein the memory stores program instructions which are executable by the CPU to;

store a first set of identification data associated with a first network access with a network provider, wherein the first set of identification data comprises a first computing device identification;

store a second set of identification data associated with a second network access with the network provider, wherein the second set of identification data comprises a second computing device identification;

determine one or more fraud indicators in the first set of identification data and the second set of identification data; and

revoke the first network access and/or the second network access in response to the determination of the one or more fraud indicators.

88. The system of claim 87,

wherein the first set of identification data comprises a first username;

wherein the second set of identification data comprises a second username;

wherein the first username and the second username are associated with a same user account;

wherein the first computing device identification and the second computing device identification comprise different computing device identifications; and

wherein the one or more fraud indicators comprise a use of the same user account with both the first computing device identification and the second computing device identification.

89. The system of claim 88,

wherein the first username equals the second username.

90. The system of claim 87,

wherein the first set of identification data comprises a first geographic location;

wherein the second set of identification data comprises a second geographic location which is different from the first geographic location;

wherein the first computing device identification and the second computing device identification comprise a same computing device identification; and

wherein the one or more fraud indicators comprise a use of the same computing device identification at both the first geographical location and the second geographical location.

91. The system of claim 87,

wherein the second network access is initiated during the first network access.

92. The system of claim 87,

wherein the second network access is initiated after the first network access has ended.

93. The system of claim 87,

wherein the determination of one or more fraud indicators comprises use of a fraud detection algorithm.

94. The system of claim 87,

wherein the network provider determines a threshold quantity of computing device identifications;

wherein the one or more fraud indicators comprise a use of the first computing device identification and/or the second computing device identification in violation of the threshold quantity of computing device identifications.

95. The system of claim 87,

wherein the network provider determines a threshold quantity of authentication failures;

wherein the one or more fraud indicators comprise one or more authentication failures during the first network access and/or the second network access in violation of the threshold quantity of authentication failures.

96. The system of claim 87,

wherein the one or more fraud indicators comprise an abnormal rate increase of subscriber usage by a roaming partner.

97. The system of claim 87, wherein the program instructions are further executable by the CPU to:

determine a rate of network propagation by comparing the first set of identification data and the second set of identification data;

wherein the one or more fraud indicators comprise a violation of a threshold rate of network propagation by the determined rate of network propagation.

98. The system of claim 87,

wherein the one or more fraud indicators comprise a use of one or more RF channels for wireless access during the first network access or the second network access.

99. The system of claim 87, wherein the program instructions are further executable by the CPU to:

suspend a user account in response to the determining the one or more fraud indicators.

100. The system of claim 87, wherein the program instructions are further executable by the CPU to:

de-activate a user account in response to the determining the one or more fraud indicators.

101. The system of claim 100, wherein the program instructions are further executable by the CPU to:

verify an owner identification associated with the de-activated user account; and

re-activate the de-activated user account in response to verification of the owner identification.

102. The system of claim 101,

wherein re-activation of the de-activated user account is performed by the network provider.

103. The system of claim 101,

wherein re-activation of the de-activated user account is performed by a roaming partner.

104. The system of claim 101, wherein the program instructions are further executable by the CPU to:

assign a new identification to the re-activated user account.

105. The system of claim 87,

wherein the second set of identification data is received from a broadcast.

106. The system of claim 87,

wherein the second set of identification data is received from a multicast.

107. A system for determining fraud in accessing a network, the system comprising:

a CPU coupled to a network;

a memory coupled to the CPU, wherein the memory stores program instructions which are executable by the CPU to;

store a first set of identification data associated with a first network access in with a network provider, wherein the first set of identification data comprises a first username and a first computing device identification;

store a second set of identification data associated with a second network access with the network provider, wherein the second set of identification data comprises a second username and a second computing device identification, wherein the first username and the second username are associated with a same user account, and wherein the first computing device identification and the second computing device identification comprise different computing device identifications;

determine one or more fraud indicators in the first set of identification data and the second set of identification data, wherein the one or more fraud indicators comprise a use of the same user account with both the first computing device identification and the second computing device identification; and

revoke the first network access and/or the second network access in response to the determining the one or more fraud indicators.

108. The system of claim 107,

wherein the first username equals the second username.

109. The system of claim 107,

wherein the second network access is initiated during the first network access.

110. The system of claim 107,

wherein the second network access is initiated after the first network access has ended.

111. The system of claim 107, wherein the program instructions are further executable by the CPU to:

suspend the user account in response to the determining the one or more fraud indicators.

112. The system of claim 107, wherein the program instructions are further executable by the CPU to:

de-activate the user account in response to the determining the one or more fraud indicators.

113. The system of claim 112, wherein the program instructions are further executable by the CPU to:

verify an owner identification associated with the de-activated user account; and

re-activate the de-activated user account in response to verification of the owner identification.

114. The system of claim 113,

wherein re-activation of the de-activated user account is performed by the network provider.

115. The system of claim 113,

wherein re-activation of the de-activated user account is performed by a roaming partner.

116. The system of claim 113, wherein the program instructions are further executable by the CPU to:

assign a new identification to the re-activated user account.

117. The system of claim 107,

wherein the second set of identification data is received from a broadcast.

118. The system of claim 107,

wherein the second set of identification data is received from a multicast.

119. A system for determining fraud in accessing a network, the system comprising:

a CPU coupled to a network;

a memory coupled to the CPU, wherein the memory stores program instructions which are executable by the CPU to;

store a first set of identification data associated with a first network access with a network provider, wherein the first set of identification data comprises a first geographical location and a computing device identification;

store a second set of identification data associated with a second network access with the network provider, wherein the second set of identification data comprises a second geographical location and the computing device identification;

determine one or more fraud indicators in the first set of identification data and the second set of identification data, wherein the one or more fraud indicators comprise a use of the computing device identification at both the first geographical location and the second geographical location; and

revoke the first network access and/or the second network access in response to the determining the one or more fraud indicators.

120. The system of claim 119,

wherein the second network access is initiated during the first network access.

121. The system of claim 119,

wherein the second network access is initiated after the first network access has ended.

122. The system of claim 119, wherein the program instructions are further executable by the CPU to:

suspend a user account in response to the determining the one or more fraud indicators.

123. The system of claim 119, wherein the program instructions are further executable by the CPU to:

de-activate a user account in response to the determining the one or more fraud indicators.

124. The system of claim 123, wherein the program instructions are further executable by the CPU to:

verify an owner identification associated with the de-activated user account; and

re-activate the de-activated user account in response to verification of the owner identification.

125. The system of claim 124,

wherein re-activation of the de-activated user account is performed by the network provider.

126. The system of claim 124,

wherein re-activation of the de-activated user account is performed by a roaming partner.

127. The system of claim 124, wherein the program instructions are further executable by the CPU to:

assign a new identification to the re-activated user account.

128. The system of claim 119,

wherein the second set of identification data is received from a broadcast.

129. The system of claim 119,

wherein the second set of identification data is received from a multicast.