Method and System for Performing Fraud Detection for Users with Infrequent Activity

• US 20110125658A1
• Filed: 11/25/2009
• Published: 05/26/2011
• Est. Priority Date: 11/25/2009
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: VeriSign, Inc.
• Inventors: Raz, Shay, Lanxner, Eyal S.
• Granted Patent: US 10,467,687 B2
• Time in Patent Office: Days
• US Class Current: 705/318
• CPC Class Codes: G06Q 30/0185 Product, service or business identity fraud
• CPC Class Codes: G06Q 30/0282 Rating or review of business operators or products
• CPC Class Codes: G06Q 30/0603 Catalogue ordering
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety

Abstract

A method of categorizing a recent transaction as anomalous includes a) receiving information about a recent transaction and b) accessing information about one or more historical transactions. The one or more historical transactions have at least one party in common with the recent transaction. The method also includes c) determining a similarity value between the recent transaction and a transaction i of the one or more historical transactions and d) determining if the similarity value is greater than or equal to a predetermined threshold value. The method further includes e) if the similarity is greater than or equal to the predetermined threshold value, categorizing the recent transaction as not anomalous or f) if the similarity is less than the predetermined threshold value, determining if there are additional transactions. If there are additional transactions, incrementing counter i and repeating steps c) through f).

Claims

1. A method of categorizing a recent transaction as anomalous, the method comprising:

a) receiving information about a recent transaction;

b) accessing information about one or more historical transactions, wherein the one or more historical transactions have at least one party in common with the recent transaction;

c) determining a similarity value between the recent transaction and a transaction i of the one or more historical transactions;

d) determining if the similarity value is greater than or equal to a predetermined threshold value;

e) if the similarity is greater than or equal to the predetermined threshold value, categorizing the recent transaction as not anomalous;

f) if the similarity is less than the predetermined threshold value, determining if there are additional transactions; and

g) if there are additional transactions, incrementing counter i and repeating steps c) through f).

2. The method of claim 1 further comprising if there are no additional transactions and the recent transaction was not categorized as anomalous, categorizing the recent transaction as not anomalous.

3. The method of claim 2 further comprising determining a confidence in the categorization of the recent transaction as anomalous.

4. The method of claim 1 wherein the recent transaction is an Internet log-in.

5. The method of claim 1 wherein the party comprises an Internet user.

6. The method of claim 1 further comprising determining a confidence in the categorization of the recent transaction as anomalous.

7. A method of computing a confidence in a determination of a recent transaction as not anomalous, the method comprising:

a) determining a similarity value between the recent transaction and transaction i of one or more historical transactions;

b) if the similarity is greater than or equal to a predetermined threshold;

c) obtaining at least one of an age or a status of transaction i;

d) determining a factor for transaction i based on either the age or the status;

e) computing a rank for transaction i based on the similarity value and the factor; and

f) storing the computed rank;

g) determining if there are additional historical transactions of the one or more historical transactions;

h) if there are additional historical transactions, incrementing counter i and repeating steps a) through g); and

if there are no additional historical transactions;

determining a maximum of the stored ranks; and

computing the confidence as the maximum of the stored ranks.

8. The method of claim 7 wherein the one or more historical transactions comprises ten or fewer transactions.

9. The method of claim 8 wherein the one or more historical transactions comprise three or more transactions.

10. The method of claim 7 wherein the status of the historical transaction comprises a rejected status.

11. The method of claim 10 wherein the factor for transaction i is equal to one for the rejected status.

12. The method of claim 7 wherein the factor for transaction i increases with the age of transaction i.

13. A method of computing a confidence in a determination of a recent transaction as anomalous, the method comprising:

a) determining a similarity value between the recent transaction and transaction i of one or more historical transactions;

b) obtaining at least one of an age or a status of transaction i;

c) determining a factor for transaction i based on either the age or the status;

d) computing a rank for transaction i based on the similarity value and the factor;

e) storing the computed rank;

f) determining if there are additional historical transactions of the one or more historical transactions;

if there are additional historical transactions, incrementing counter i and repeating steps a) through f);

if there are no additional historical transactions;

determining a maximum of the stored ranks; and

computing the confidence as one minus the maximum of the stored ranks.

14. The method of claim 13 wherein the one or more historical transactions comprises ten or fewer transactions.

15. The method of claim 14 wherein the one or more historical transactions comprise three or more transactions.

16. The method of claim 13 wherein the status of the historical transaction comprises a rejected status.

17. The method of claim 16 wherein the factor for transaction i is equal to one for the rejected status.

18. The method of claim 13 wherein the factor for transaction i increases with the age of transaction i.

19. The method of claim 13 wherein the rank is a function of the similarity value times the factor.

20. A system for categorizing a recent transaction as anomalous, the system comprising:

a data processor;

a communications module coupled to the data processor; and

a computer readable medium coupled to the data processor and storing a plurality of instructions for controlling the data processor to categorize the recent transaction as anomalous, the plurality of instructions comprising;

a) instructions that cause the data processor to receive information about a recent transaction;

b) instructions that cause the data processor to access information about one or more historical transactions, wherein the one or more historical transactions have at least one party in common with the recent transaction;

c) instructions that cause the data processor to determine a similarity value between the recent transaction and a transaction i of the one or more historical transactions;

d) instructions that cause the data processor to determine if the similarity value is greater than or equal to a predetermined threshold value;

e) instructions that cause the data processor, if the similarity is greater than or equal to the predetermined threshold value, to categorize the recent transaction as not anomalous;

f) instructions that cause the data processor, if the similarity is less than the predetermined threshold value, to determine if there are additional transactions; and

g) instructions that cause the data processor, if there are additional transactions, to increment counter i and repeat steps c) through f).

21. The system of claim 20 further comprising instructions that cause the data processor, if there are no additional transactions and the recent transaction was not categorized as anomalous, to categorize the recent transaction as not anomalous.

22. The system of claim 21 further comprising instructions that cause the data processor to determine a confidence in the categorization of the recent transaction as anomalous.

23. The system of claim 20 wherein the recent transaction is an Internet log-in.

24. The system of claim 20 wherein the party comprises an Internet user.

25. The system of claim 20 further comprising instructions that cause the data processor to determine a confidence in the categorization of the recent transaction as anomalous.