Fraud risk advisor

• US 20060149580A1
• Filed: 08/23/2005
• Published: 07/06/2006
• Est. Priority Date: 09/17/2004
• Status: Active Grant

• Current Assignee: Digital Envoy, Inc. (Landmark Media Enterprises LLC)
• Original Assignee: Digital Envoy, Inc. (Landmark Media Enterprises LLC)
• Inventors: Helsper, David, Maicon, Dennis
• Granted Patent: US 7,497,374 B2
• Time in Patent Office: Days
• US Class Current: 235/383
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety

Abstract

A fraudulent business transaction application (FBTA) is provided for monitoring application based fraud. When a consumer supplies account access information in order to carry out an Internet business transaction, the FBTA uses an online fraud mitigation engine to detect phishing trusions and identity theft. Methods are also provided for calculating travel velocity and transcation frequency, which are useful for determining a fraudulent transaction.

Claims

1. A method for calculating a travel velocity between a first access location and a second access location, comprising the steps of:

a. determining the first access location based on a first IP address;

b. determining a first access time;

c. determining the second access location based on a second IP address;

d. determining a second access time; and

e. calculating the travel velocity between the first access location and the second access location as a function of the first access location and the first access time and the second access location and the second access time.

2. The method of claim 1, wherein the calculating step comprises the steps of:

a. computing a distance between the first access location and the second access location;

b. computing a time difference between the first access time and the second access time; and

c. calculating the travel velocity between the first access location and the second access location by dividing the computed distance by the computed time difference.

3. A method for calculating a user'"'"'s travel velocity between a first access location and a second access location, comprising the steps of:

a. determining for the user the first access location and a first access time;

b. determining for the user the second access location based on the IP address of the user;

c. determining for the user a second access time; and

d. calculating the travel velocity of the user as a function of the first access location and the first access time and the second access location and the second access time.

4. The method of claim 3, wherein the first access location and the first access time are determined from a behavior profile associated with the user.

5. The method of claim 3, wherein the first access location is determined as a function of the user'"'"'s IP address at the first access location.

6. The method of claim 3, wherein the second access location is stored in a behavior profile associated with the user.

7. The method of claim 3, wherein the first access location is based on the user'"'"'s last valid access location.

8. The method of claim 3, wherein the second access location and the second access time are the user'"'"'s current access location and current access time.

9. A method for determining if an online transaction is fraudulent, comprising the steps of:

a. computing one or more factors based on the IP address of the user, wherein at least one factor is the travel velocity of the user between a first access location and a second access location; and

b. determining whether the transaction is fraudulent based on the one or more factors.

10. The method of claim 9, wherein the determining step comprises determining whether the transaction is fraudulent by applying one or more rules to at least one factor.

11. The method of claim 9, wherein the user'"'"'s travel velocity is determined according to the steps of:

a. determining for the user the first access location based a first IP address;

b. determining for the user a first access time;

c. determining for the user the second access location based on a second IP address;

d. determining for the user a second access time; and

e. calculating the user'"'"'s travel velocity between the first access location and the second access location as a function of the first access location and the first access time and the second access location and the second access time.

12. The method of claim 11, wherein the calculating the user'"'"'s travel velocity step comprises the steps of:

a. computing a distance between the first access location and the second access location;

b. computing a time difference between the first access time and the second access time; and

c. calculating the travel velocity between the first access location and the second access location by dividing the computed distance by the computed time difference.

13. The method of claim 9, further comprising forwarding the determination to a client for further processing by the client.

14. The method of claim 9, further comprising generating a report based on the determination.

15. The method of claim 9, further comprising generating a risk score associated with the transaction.

16. The method of claim 15, further comprising storing the risk score in a database.

17. The method of claim 15, wherein a client assigns a threshold level for comparison with the risk score.

18. The method of claim 17, wherein the transaction is determined to be fraudulent when the risk score exceeds the threshold level.

19. The method of claim 15, wherein the risk score is generated in real time.

20. The method of claim 9, further comprising accessing the determination by a client.

21. The method of claim 9, wherein the client may designate whether or not the transaction is fraudulent.

22. The method of claim 9, wherein at least one of the one or more factors is static or dynamic.

23. The method of claim 9, wherein a factor comprises a country, region or city associated with the IP address.

24. The method of claim 9, wherein a factor is a proximity of the user in comparison to a purported location of the user associated with the IP address.

25. The method of claim 9, wherein a factor is an address supplied by a client for comparison with an address associated with the IP address.

26. The method of claim 9, wherein a factor is an area code and a telephone number supplied by a client for comparison with an area code and a telephone number stored in a database that is associated with the client.

27. The method of claim 9, wherein a factor is an email address supplied by a client for validation.

28. The method of claim 9, wherein a factor is an access behavior associated with the user based on transaction habits stored in a database that are compared with a current transaction.

29. The method of claim 9, wherein a factor is a frequency in which the transaction is attempted within a predetermined period of time.

30. The method of claim 9, wherein a factor is a velocity with which a single IP address accesses or uses multiple unique identifiers within a specified period of time.

31. The method of claim 9, wherein a client may assign a threshold level for at least one of the one or more factors.

32. The method of claim 9, wherein a client may create one or more user defined factors.

33. The method of claim 9, wherein a client may define constraint rules for at least one of the one or more factors.

34. The method of claim 9, wherein the first access location is determined from a behavior profile associated with the user.

35. The method of claim 9, wherein the first access location is based on the user'"'"'s last valid access location.

36. The method of claim 9, wherein the second access location and the second access time are the user'"'"'s current access location and current access time.

37. The method of claim 9, wherein information about the second access location is stored in a behavior profile associated with the user.

38. The method of claim 9, wherein information about the first access location and the second access location is stored in a database.

39. The method of claim 9, wherein a factor comprises a connection type associated with the IP address, where connection type includes dial-up, Integrated Services Digital Network (ISDN), cable modem, Digital Subscriber Line (DSL), Digital Signal 1 (T1), or Optical Carrier 3 (OC3).

40. The method of claim 9, wherein a factor comprises a connection type stored in a behavior profile associated with the user, where connection type includes dial-up, Integrated Services Digital Network (ISDN), cable modem, Digital Subscriber Line (DSL), Digital Signal 1 (T1), or Optical Carrier 3 (OC3).

41. The method of claim 9, wherein a factor comprises a host type associated with the IP address of the user, where host type includes network end point, network proxy, or network firewall.

42. The method of claim 9, wherein a factor comprises a domain name stored in a behavior profile associated with the user.

43. A method for determining if one or more online transactions are fraudulent, comprising the steps of:

a. computing a transaction frequency with which the one or more transactions are attempted or executed from an IP address within a predetermined period of time;

b. determining the host type associated with the IP address; and

c. executing a function to determine if the one or more transactions are fraudulent, the function having as its input at least the transaction frequency and the host type.

44. The method of claim 43, wherein host type is network end point, network proxy, or network firewall.

45. The method of claim 44, wherein the function generates a risk score and the one or more transactions are determined to be fraudulent when the risk score exceeds a threshold level.

46. The method of claim 45, wherein the function compares the transaction frequency to the host type in order to optimize the risk score.

47. The method of claim 46, wherein for a predetermined transaction frequency, the function generates a relatively higher risk score when the host type is a network end point then when the host type is a network proxy or a network firewall.