ANTI-FRAUD EVENT CORRELATION

• US 20110251951A1
• Filed: 04/13/2011
• Published: 10/13/2011
• Est. Priority Date: 04/13/2010
• Status: Abandoned Application

• Current Assignee: IdentityMind Global, Inc. (GB Group Plc)
• Original Assignee: IdentityMind Global, Inc. (GB Group Plc)
• Inventors: Kolkowitz, Dan, Elgamal, Taher
• Application Number:
  US13/085,819
• Publication Number:
  US 20110251951A1
• Time in Patent Office: Days
• US Class Current: 705/39
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03

Abstract

Methods, systems, appliances and/or apparati related to identifying potential fraud associated with financial transactions are provided. An example system for identifying potentially fraudulent financial transactions may include transaction-model databases, a fraud assessment engine operably coupled to the transaction-model databases, and a reporting engine operably coupled to the fraud assessment engine. The transaction-model databases may be configured to store transaction-model data associated with a plurality of historical financial transactions. The transaction-model data may include a plurality of attribute data corresponding to a respective attribute of the historical financial transactions. The fraud assessment engine may generate a fraud assessment based (at least in part) on a comparison of current financial transaction attribute data (and/or or the values thereof) with at least a portion of the transaction-model data. The reporting engine may generate a fraud assessment report and/or a fraud alert signal based (at least in part) on the fraud assessment.

Claims

1. A system for identifying potentially fraudulent financial transactions, comprising:

one or more transaction-model databases configured to store transaction-model data associated with a plurality of historical financial transactions, the transaction-model data including a plurality of attribute data corresponding to a respective attribute of the plurality of historical financial transactions;

a fraud assessment engine operably coupled to the one or more transaction-model databases, the fraud assessment engine configured to generate a fraud assessment based, at least in part, on a comparison of one or more current financial transaction attribute data with at least a portion of the transaction-model data; and

a reporting engine operably coupled to the fraud assessment engine, the reporting engine configured to generate at least one of a fraud assessment report and a fraud alert signal based, at least in part, on the fraud assessment.

2. The system of claim 1,

wherein the current financial transaction attribute data comprises values associated with the current financial transaction attribute data;

wherein the plurality of attribute data comprises values associated with the plurality of attribute data corresponding to the respective attribute of the plurality of historical financial transactions; and

wherein the fraud assessment engine generates the fraud assessment based, at least in part, on a comparison of the values of the one or more current financial transaction attribute data with the values of at least a portion of the plurality of attribute data corresponding to a respective attribute of the plurality of historical financial transactions.

3. The system of claim 1,

wherein the current financial transaction attribute data comprises values associated with the current financial transaction attribute data;

and

wherein the fraud assessment engine generates the fraud assessment based, at least in part, on a comparison of the values of the one or more current financial transaction attribute data with values of at least a plurality of currently observed transactions within a predetermined period of time, without considering the plurality of historical financial transactions.

4. The system of claim 1, further comprising:

a correlation engine operably coupled to the one or more transaction-model databases, the correlation engine configured to correlate values of attribute data corresponding to values of respective attributes of the plurality of historical financial transactions to generate one or more correlated attribute data groups; and

wherein the fraud assessment engine generates the fraud assessment based, at least in part, on a comparison of the one or more current financial transaction attribute data with at least a portion of the one or more correlated attribute data groups.

5. The system of claim 1,

wherein the plurality of attribute data comprises at least one of payment instrument identification data, transaction amount data, transaction description data, payment instrument security data, payment instrument user data, transaction identification data, originating computer data, internet protocol (IP) address data, payment gateway data, payment gateway identification data, payment instrument issuer identification data and payment instrument issuer data;

and

wherein the one or more current financial transaction attribute data comprises at least one of payment instrument identification data, transaction amount data, transaction description data, payment instrument security data, payment instrument user data, transaction identification data, originating computer data, internet protocol (IP) address data, payment gateway data, payment gateway identification data, payment instrument issuer identification data and payment instrument issuer data.

6. The system of claim 1, wherein the fraud assessment engine is further configured to generate a plurality of statistical models associated with values of the plurality of attribute data, each statistical model corresponding to at least one attribute data of the plurality of attribute data.

7. The system of claim 6, wherein the fraud assessment engine is further configured to generate the fraud assessment based, at least in part, on a comparison of at least one of the plurality of statistical models with current financial transaction attribute data associated with the one or more current financial transactions.

8. The system of claim 7, wherein the fraud assessment engine is further configured to generate the fraud assessment based, at least in part, on a predetermined amount of deviation in the values of at least one of the current financial transaction attribute data from at least one of the plurality of statistical models.

9. The system of claim 8, wherein the at least one of the plurality of statistical models is developed from monitoring the values of current financial transaction attribute data.

10. The system of claim 8, wherein the predetermined amount of deviation comprises a predetermined deviation of a number of credit card approvals for the same credit card occurring over a predetermined period of time.

11. The system of claim 8, wherein the predetermined amount of deviation comprises a predetermined deviation of a financial transaction amount.

12. The system of claim 8, wherein the predetermined amount of deviation comprises a predetermined deviation of a number of financial transaction denials for the same account occurring over a predetermined period of time.

13. The system of claim 8, wherein the predetermined amount of deviation comprises a predetermined deviation of a number of different merchants transacted with for the same account over a predetermined period of time.

14. The system of claim 8, wherein the predetermined amount of deviation comprises a predetermined deviation of a number of internet protocol (IP) addresses from which financial transactions occur for the same account over a predetermined period of time.

15. The system of claim 8, wherein the predetermined amount of deviation comprises a predetermined deviation of a number of substantially similar financial transaction amounts occurring for the same account over a predetermined period of time.

16. The system of claim 8, wherein the predetermined amount of deviation comprises a predetermined deviation of a number of different accounts used for transactions on the same internet protocol (IP) address over a predetermined period of time.

17. The system of claim 8, wherein the predetermined amount of deviation comprises a predetermined deviation of a number of a group of internet protocol (IP) addresses used for a predetermined number of financial transactions over a predetermined period of time.

18. The system of claim 8, wherein the predetermined amount of deviation comprises a predetermined deviation of a number of a combination of approved and declined financial transactions for the same account occurring over a predetermined period of time.

19. The system of claim 8, wherein the predetermined amount of deviation comprises a predetermined deviation of a number of financial transactions utilizing a predetermined set of distinct bank identification numbers seen at a merchant over a predetermined period of time.

20. The system of claim 8, wherein the predetermined amount of deviation comprises a predetermined deviation of a number of descending financial transaction amounts attempted for the same account over a predetermined period of time.

21. The system of claim 8, wherein the predetermined amount of deviation comprises a predetermined deviation of a number of the same financial transaction amounts attempted and declined with a merchant over a predetermined period of time.

22. The system of claim 8, wherein the predetermined amount of deviation comprises a predetermined deviation of a number of different billing addresses reported for the same account over a predetermined period of time.

23. The system of claim 1, wherein the fraud assessment engine is further configured to generate the fraud assessment based, at least in part, on a frequency of the historical financial transactions compared with the frequency of the one or more current financial transactions;

and

wherein the frequency of the historical financial transactions includes the frequency of historical financial transactions associated with at least one of a payment instrument user, a shipping address, a billing address, a zip code, a geographical region, a payment instrument issuer, a payment gateway, a computing device, a plurality of computing devices, an internet protocol (IP) address and a range of IP addresses.

24. The system of claim 1, wherein the fraud assessment engine is further configured to generate the fraud assessment based, at least in part, on a frequency of the attribute data of the plurality of historical financial transactions compared with the frequency of the current financial transaction attribute data;

and

wherein the frequency of the historical financial transactions includes the frequency of historical financial transactions associated with at least one of a payment instrument user, a shipping address, a billing address, a zip code, a geographical region, a payment instrument issuer, a payment gateway, a computing device, a plurality of computing devices, an internet protocol (IP) address and a range of IP addresses.

25. The system of claim 1, further comprising:

a monitoring engine configured to monitor the current financial transaction attribute data to determine if the current financial transaction attribute data is associated with one or more fraudulent financial transactions.

26. The system of claim 1, wherein the assessment engine is further configured to generate the fraud assessment based, at least in part, on the current financial transaction attribute data being associated with an abnormal frequency of the attribute data of the plurality of historical financial transactions.

27. The system of claim 1, wherein the assessment engine is further configured to generate the fraud assessment based, at least in part, on the current financial transaction attribute data associated with attribute data previously identified as potentially fraudulent.

28. The system of claim 1, wherein the assessment engine is further configured to generate the fraud assessment based, at least in part, on at least one of an amount of historical financial transactions originating from a computing device and an amount of current financial transactions originating from the computing device.

29. The system of claim 1, wherein the plurality of attribute data comprises a plurality of name/value pairs, each of the name/value pairs being associated with a respective attribute of the plurality of historical financial transactions.

30. The system of claim 1, wherein the assessment engine is further configured to assemble the one or more current financial transactions as a collection of name/value pairs, each of the name/value pairs being associated with a respective attribute of the one or more current financial transactions.

31. The system of claim 1,

wherein the assessment engine is configured to generate the fraud assessment in at least one of real-time and near real-time;

and

wherein the reporting engine is configured to generate at least one of a fraud assessment report and a fraud alert signal in at least one of real-time and near real-time.

32. A method of assessing financial transactions for fraudulent activity, the method comprising:

receiving, by a fraud assessment appliance, one or more current financial transaction data associated with one or more current financial transactions, the one or more current financial transaction data including a plurality of current attribute data corresponding to a respective attribute of the one or more current financial transactions;

comparing, by the fraud assessment appliance, at least one current attribute data of the plurality of current attribute data to historical attribute data corresponding to a respective attribute of a plurality of historical financial transactions;

generating, by the fraud assessment appliance, a fraud assessment based, at least in part, on the comparing operation; and

generating, by the fraud assessment appliance, at least one of a fraud assessment report and a fraud alert signal based, at least in part, on the fraud assessment.

33. The method of claim 32, wherein the comparing operation further comprises comparing, by the fraud assessment appliance, a value of at least one current attribute data of the plurality of current attribute data to a value of historical attribute data corresponding to a respective attribute of a plurality of historical financial transactions;

34. The method of claim 32, wherein the comparing operation further comprises comparing, by the fraud assessment appliance, at least one current attribute data of the plurality of current attribute data with one or more statistical models based, at least in part, on a corresponding historical attribute data.

35. The method of claim 34, wherein the fraud assessment comprises a fraudulent activity notification when the at least one current attribute data exceeds a predetermined amount of deviation from the one or more statistical models.

36. The method of claim 32, wherein the comparing operation further comprises comparing, by the fraud assessment appliance, at least one current attribute data of the plurality of current attribute data with a frequency of the plurality of historical financial transactions.

37. The method of claim 36, wherein the frequency of the plurality of historical financial transactions includes the frequency of historical financial transactions associated with at least one of a payment instrument user, a shipping address, a billing address, a zip code, a geographical region, a payment instrument issuer, a payment gateway, a computing device, a plurality of computing devices, an internet protocol (IP) address and a range of IP addresses.

38. The method of claim 32, wherein the comparing operation further comprises comparing the plurality of current attribute data with a predetermined frequency value.

39. The method of claim 32, wherein the comparing operation further comprises comparing the plurality of current attribute data with historical attribute data previously identified as potentially fraudulent.

40. The method of claim 32, wherein the comparing operation further comprises comparing least one of an amount of historical financial transactions originating from a computing device and an amount of current financial transactions originating from the computing device with a predetermined value.

41. The method of claim 32, wherein the plurality of current attribute data comprises a plurality of name/value pairs, each of the name/value pairs being associated with a respective attribute of the plurality of historical financial transactions.

42. The method of claim 32, wherein the one or more current financial transactions corresponds to a collection of name/value pairs, each of the name/value pairs being associated with a respective attribute of the one or more current financial transactions.

43. An appliance for identifying potentially fraudulent financial transactions, comprising:

one or more attribute databases configured to store attribute data corresponding to respective attributes of a plurality of historical financial transactions;

a correlation component operably coupled to the one or more attribute databases, the correlation component configured to generate one or more correlated attribute data groups, and further configured to generate a plurality of statistical models, each statistical model associated with a respective one of the one or more correlated attribute data groups;

a fraud assessment component operably coupled to the correlation component, the fraud assessment component configured to generate a fraud assessment based, at least in part, on a comparison of an attribute data of one or more current financial transactions to at least one of the plurality of statistical models; and

a reporting component operably coupled to the fraud assessment component, the reporting component configured to generate at least one of a fraud assessment report and a fraud alert signal based, at least in part, on the fraud assessment.

44. The appliance of claim 43, wherein the attribute data comprises at least one of payment instrument identification data, transaction amount data, transaction description data, payment instrument security data, payment instrument user data, transaction identification data, originating computer data, internet protocol (IP) address data, payment gateway data, payment gateway identification data, payment instrument issuer identification data and payment instrument issuer data.

45. The appliance of claim 43, wherein the fraud assessment comprises a fraudulent activity notification when the attribute data of at least one of the current financial transactions exceeds a predetermined amount of deviation from the respective statistical model of the plurality of statistical models.

46. A system for identifying potentially fraudulent financial transactions, comprising:

one or more attribute databases configured to store a plurality of attribute data corresponding to respective attributes of a plurality of financial transactions;

a fraud assessment engine operably coupled to the one or more attribute databases, the fraud assessment engine configured to generate a fraud assessment based, at least in part, on an anomalous distribution of at least one of the plurality of attribute data; and

a reporting engine operably coupled to the fraud assessment engine, the reporting engine configured to generate at least one of a fraud assessment report and a fraud alert signal based, at least in part, on the fraud assessment.

47. The system of claim 46,

wherein the plurality of attribute data comprises payment instrument issuer data;

and

wherein the anomalous distribution of at least one of the plurality of attribute data comprises more than a predetermined percentage of financial transactions associated with a payment instrument issuer.

48. A system for identifying potentially fraudulent financial transactions, comprising:

one or more attribute databases configured to store a plurality of attribute data corresponding to respective attributes of a plurality of financial transactions;

a fraud assessment engine operably coupled to the one or more attribute databases, the fraud assessment engine configured to generate a fraud assessment based, at least in part, on one or more statistical trends of at least one of the plurality of attribute data; and

a reporting engine operably coupled to the fraud assessment engine, the reporting engine configured to generate at least one of a fraud assessment report and a fraud alert signal based, at least in part, on the fraud assessment.

49. The system of claim 48,

wherein the one or more statistical trends of at least one of the plurality of attribute data comprises at least one of financial transactions originating from a single computer, financial transactions originating from a network of computers, financial transactions originating from a single internet protocol (IP) address, and financial transactions originating from a range of internet protocol (IP) addresses.