DEVICE FRAUD INDICATOR DETECTION AND REPORTING

• US 20160351022A1
• Filed: 05/29/2015
• Published: 12/01/2016
• Est. Priority Date: 05/29/2015
• Status: Active Grant

• Current Assignee: NCR Atleos Corp.
• Original Assignee: NCR Corporation (NCR Voyix Corporation)
• Inventors: Ghafoor, Gameelah
• Granted Patent: US 10,332,360 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/18 involving self-service terminals [SST], vending machines, kiosks or multimedia terminals
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G07F 19/209 Monitoring, auditing or diagnose of functioning of ATMs
• CPC Class Codes: G07F 9/026 for alarm, monitoring and auditing in vending machines or means for indication, e.g. when empty
• CPC Class Codes: G07G 3/006 False operation

Abstract

Various embodiments herein each include at least one of systems, devices and methods for detection of abnormal operation of a Self-Service Terminal (SST). One such embodiment, in the form of a method performed by a SST or remote system, includes receiving information relating to the operation of a SST. The method further includes evaluating the information to identify abnormal operation of the SST.

Claims

1. A method of identifying abnormal operation of a Self-Service Terminal (SST), comprising:

receiving information relating to the operation of a SST; and

evaluating the information to identify abnormal operation of the SST.

2. The method of claim 1, wherein evaluating the information to identify abnormal operation of the SST comprises identifying a sequence of events, or absence of events from a sequence, that indicate a departure from normal operation.

3. The method of claim 1, wherein receiving information relating to the operation of a SST comprises receiving at least two qualitatively distinct pieces of information relating to the operation of the SST, and evaluating the information to identify abnormal operation of the SST comprises evaluating the at least two qualitatively distinct pieces of information in combination.

4. The method of claim 3, wherein evaluating the at least two qualitatively distinct pieces of information comprises evaluating at least two of:

system reboot;

initiation of new services;

removal of a hard disk

detection of a new hard disk;

memory usage greater than a known threshold;

memory footprint;

logging behavior;

events within a transaction;

usage of a prepaid card; and

supervisor access.

5. The method of claim 1, wherein evaluating the information to identify abnormal operation of the SST comprises monitoring for an increase in memory footprint when no transactions have occurred in a specified period of time and no software download is taking place.

6. The method of claim 1, further comprising sending information relating to the operation of a SST to a remote system for further analysis or review, and receiving a command from the remote system to initiate preventative action to interrupt potentially-unauthorized activity.

7. The method of claim 1, further comprising, when abnormal operation of the SST is identified, at least one of evaluating additional information relating to the operation of the SST, triggering capture of additional information relating to the operation of the SST, transferring information about operation of the SST to a another device or system for further analysis, shutting down or blocking access to the SST, and entering a specified mode of operation.

8. The method of claim 1, further comprising, when abnormal operation of the SST is identified, entering an interactive mode wherein a user may interact with a remote user to complete a transaction.

9. The method of claim 1, further comprising, when abnormal operation of the SST is identified, changing the behavior of other SSTs in a specific geographic region around the SST.

10. A method of detecting abnormal activity relating to Self-Service Terminal (SST) comprising:

receiving data relating to at least two operational parameters of the SST;

evaluating the data to identify an activity pattern; and

declaring an alert when an identified activity pattern deviates from an expected set of operational states.

11. The method of claim 10, wherein evaluating the data to identify an activity pattern comprises ascertaining whether an expected series of events occur before a specified event.

12. The method of claim 11, wherein the specified event is the dispensing of an item and the expected series of events comprise expected authorizing activity leading up to the dispensing of an item.

13. The method of claim 10, wherein the evaluating the data comprises evaluating at least two of changes in state, memory usage, and hardware configuration.

14. The method of claim 10, further comprising capturing data relating to the operational parameters of the SST using the SST and transferring the data from the SST to a remote system, wherein the receiving data, evaluating the data, and declaring an alert occur on the remote system.

15. A Self-Service Terminal (SST) comprising:

a memory;

a processor executing instructions to monitor for abnormal activity on the SST, the processor operable to evaluate activity of at least two operational parameters of the SST in combination and execute a responsive action when abnormal activity is detected.

16. The self-service terminal of claim 15, wherein the processor is operable to initiate capture of additional information in response to detection of abnormal activity.

17. The self-service terminal of claim 15, wherein the processor is operable to, prior to dispensing cash, evaluate whether the activity of the at least two operational parameters of the SST indicate abnormal activity, and refrain from dispensing cash when abnormal activity is detected.

18. The SST of claim 15, further comprising a network connection, wherein the processor is further operable to initiate transfer of information to a remote system when abnormal activity is detected.

19. The SST of claim 18, wherein the processor is further operable to receive an instruction from a remote system to change the behavior of the SST, the change in behavior comprising at least one evaluating additional information relating to the operation of the SST, triggering capture of additional information relating to the operation of the SST, sending information about operation of the SST to a remote device or system for further analysis, shutting down or blocking access to the SST, and entering an interactive mode

20. The SST of claim 15, wherein the SST is an Automated Teller Machine (ATM).