Apparatus and method for detecting fraudulent telecommunication activity

• US 5,345,595 A
• Filed: 11/12/1992
• Issued: 09/06/1994
• Est. Priority Date: 11/12/1992
• Status: Expired due to Term

• Current Assignee: Authorize Net LLC (Visa, Inc.)
• Original Assignee: Coral Systems, Inc. (Visa, Inc.)
• Inventors: Liss, Michael D., Jensen, Flemming B., Johnson, Eric A.
• Primary Examiner(s): Urban, Edward F.
• Application Number:
  US07/975,512
• Time in Patent Office: 663 Days
• Field of Search: 455/33.1, 455/34.1, 455/34.2, 455/56.1, 455/67.1, 455/67.7, 455/53.1, 379/58, 379/59, 379/145, 379/60
• US Class Current: 455/410
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/41 Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 15/88 Provision for limiting connection, or expenditure
• CPC Class Codes: H04M 15/887 limit per user or user related number
• CPC Class Codes: H04M 17/00 Prepayment of wireline communication systems, wireless communication systems or telephone systems using a coded card to authorise calls from a telephone set H04M1/675
• CPC Class Codes: H04M 2203/6027 Fraud preventions
• CPC Class Codes: H04M 2215/0116 Provision for limiting expenditure, e.g. limit on call expenses or account
• CPC Class Codes: H04M 2215/014 Limit per user or user related number
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0164 Billing record, e.g. Call Data Record [CDR], Toll Ticket[TT], Automatic Message Accounting [AMA], Call Line Identifier [CLI], details, i.e. parameters, identifiers, structure
• CPC Class Codes: H04M 2215/32 Involving wireless systems
• CPC Class Codes: H04M 3/38 Graded-service arrangements, i.e. some subscribers prevented from establishing certain connections queuing arrangements H04Q3/64
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 4/24 Accounting or billing
• CPC Class Codes: H04W 60/00 Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration

Abstract

An apparatus for detecting potentially fraudulent telecommunication activity, comprising a digital computer; interface, operatively connected to the digital computer, for receiving a call information record for each call involving a particular subscriber; comparator operating within the digital computer, for comparing a parameter of the particular subscriber'"'"'s current usage with a subscriber-specific pattern of the particular subscriber'"'"'s historical usage; and an output for outputting an indication of a potentially fraudulent call based upon a result of the comparison performed by the comparator.

Claims

1. An apparatus for detecting potentially fraudulent telecommunication activity, comprising:

a digital computer;

interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber;

pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity;

comparison means, operating within said digital computer, for comparing the particular subscriber'"'"'s current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and

output means, operating within said digital computer, for outputting an indication of a potentially fraudulent call activity based upon a result of the comparison performed by said comparison means;

wherein said information relating to said subscriber-specific pattern of historical call usage includes a subscriber-specific five-day moving average call velocity threshold and said comparison means compares the particular subscriber'"'"'s current five day moving average call velocity usage with said subscriber-specific five-day moving average call velocity threshold.

2. An apparatus for detecting potentially fraudulent telecommunication activity, comprising:

a digital computer;

interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber;

pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity;

comparison means, operating within said digital computer, for comparing the particular subscriber'"'"'s current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and

output means, operating within said digital computer, for outputting an indication of a potential fraudulent call activity based upon a result of the comparison performed by said comparison means;

wherein said information relating to said subscriber-specific pattern of historical call usage includes a subscriber-specific ten-day moving average call velocity threshold and said comparison means compares the particular subscriber'"'"'s current ten day moving average call usage with said subscriber-specific ten-day moving average call velocity threshold.

3. An apparatus for detecting potentially fraudulent telecommunication activity, comprising:

a digital computer;

interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber;

pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity;

comparison means, operating within said digital computer, for comparing the particular subscriber'"'"'s current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and

output means, operating within said digital computer, for outputting an indication of a potentially fraudulent call activity based upon a result of the comparison performed by said comparison means;

wherein said comparison means compares the particular subscriber'"'"'s current usage with a combination of at least two of the following of said information relating to said subscriber-specific pattern of historical call usage;

a subscriber-specific pattern of historical call duration usage, a subscriber-specific pattern of historical call velocity usage, and a subscriber-specific pattern of historical call velocity usage that includes subscriber-specific call velocity thresholds.

4. An apparatus for detecting potentially fraudulent telecommunication activity, comprising:

a digital computer;

interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber;

pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity;

comparison means, operating within said digital computer, for comparing the particular subscriber'"'"'s current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and

output means, operating within said digital computer, for outputting an indication of a potentially fraudulent call activity based upon a result of the comparison performed by said comparison means;

wherein at least one of said current call usage and said information relating to said subscriber-specific pattern of historical call usage includes a plurality of moving averages, and said comparison means performs a comparison using said plurality of moving averages.

5. An apparatus for detecting potentially fraudulent telecommunication activity, comprising:

a digital computer;

interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber;

pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity;

comparison means, operating within said digital computer, for comparing the particular subscriber'"'"'s current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and

output means, operating within said digital computer, for outputting an indication of a potentially fraudulent call activity based upon a result of the comparison performed by said comparison means;

wherein said current call usage includes a five-day moving average and said information relating to said subscriber-specific pattern of historical call usage includes a ten-day moving average, and said comparison means performs a comparison using said five-day moving average and said ten-day moving average.

6. An apparatus for detecting potentially fraudulent telecommunication activity, comprising:

a digital computer;

interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber;

pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity;

comparison means, operating within said digital computer, for comparing the particular subscriber'"'"'s current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and

output means, operating within said digital computer, for outputting an indication of a potentially fraudulent call activity based upon a result of the comparison performed by said comparison means;

wherein said pattern means further comprises means for characterizing the particular subscriber'"'"'s current call usage as a first moving average and said subscriber-specific pattern of historical call usage as a second moving average, each calculated over a different specified number of days, wherein said comparison means compares the first moving average to said second moving average to determine if a meaningful increase in usage has occurred.

7. A telecommunication fraud detection apparatus according to claim 6, wherein said second moving average is calculated over a greater number of days than said first moving average, and

wherein said output means outputs an indication of potentially fraudulent call activity, when each of the following two conditions are satisfied:

(1) the first moving average is greater than the second moving average; and

(2) a percentage increase between the first moving average calculated on day (t) and the first moving average calculated on day (t-1) exceeds a predetermined amount.

8. An apparatus for detecting potentially fraudulent telecommunication activity, comprising:

a digital computer;

interface means, operating within said digital computer, for receiving a call information record for each of at least two calls associated with a particular subscriber and derived from a switching center that establishes calls between telecommunication devices;

detection means, operating within said digital computer, for detecting an occurrence of overlapped calls using said call information record for each of said at least two calls, said detection of overlapped calls indicating that calls associated with said particular subscriber were placed in an improbable time sequence that is indicative of potentially fraudulent call activity; and

output means, operating within said digital computer, for outputting an indication of overlapped calls based upon a result of the analysis performed by said analysis means.

9. A telecommunication fraud detection apparatus according to claim 8, wherein said detection means detects an occurrence of overlapped calls that are substantially simultaneous calls.

10. A telecommunication fraud detection apparatus according to claim 8, wherein said detection means detects an occurrence of overlapped calls after consideration of geographic dispersion related information derived from said call information record for each of said at least two calls.

11. A telecommunication fraud detection apparatus according to claim 8, wherein said detection means further comprises adjusting means for adjusting information derived from at least one of said call information record to account for geographic dispersion between locations of said at least two calls.

12. A telecommunication fraud detection apparatus according to claim 8, wherein said detection means comprises adjusting means for adjusting information derived from at least one of said call information record to account for geographic dispersion using an airline formula that provides an estimate of the distance between the locations at which said at least two calls are initiated.

13. An apparatus for detection potentially fraudulent telecommunication activity, comprising:

a digital computer;

interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber;

pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity;

comparison means, operating within said digital computer, for comparing the particular subscriber'"'"'s current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and

output means, operating within said digital computer, for outputting an indication of a potentially fraudulent call activity based upon a result of the comparison performed by said comparison means;

wherein said current call usage includes a first average of call usage over a first period of time extending from a first starting point in time, said information relating to said subscriber-specific pattern of historical call usage includes a second average of call usage, said comparison means compares said first average of call usage to said second average of call usage to determine if said first average of call usage exceeds said second average of call usage and, if so, whether said first average exceeds a third average of call usage relating to said subscriber-specific pattern of historical call usage over a second period of time extending from a second starting point in time by a predetermined amount, wherein said first and second periods of time are substantially equal, but said first starting point in time is different than said second starting point in time.

14. An apparatus for detecting potentially fraudulent telecommunication activity, comprising:

a digital computer;

interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber, said call information record derived from a switching center that establishes connections between telecommunication devices;

analysis mean, operating within said digital computer, for receiving said call information record from said interface means and using said call information record in analyzing the particular subscriber'"'"'s call usage to identify potentially fraudulent call activity; and

output means, operating within said digital computer, for outputting an indication of said potentially fraudulent call activity;

said analysis means includes pattern means for using a plurality of said call information record for said particular subscriber to develop information relating to a subscriber-specific pattern of historical call usage, and means for comparing current call usage of the particular subscriber to said information relating to said subscriber-specific pattern of historical call usage;

wherein said current call usage includes a first average of call usage over a first period of time that extends from a first starting point, said information relating to said subscriber-specific pattern of historical call usage includes a second average of call usage, and said comparison means compares said first average of call usage to said second average of call usage to determine if said first average of call usage exceeds said second average of call usage and, if so, whether said first average exceeds a third average of call usage relating to said subscriber-specific pattern of historical call usage that extends over a second period of time extending from a second starting point by a predetermined amount, wherein said first and second periods of time are substantially equal, but said first starting point in time is different from said second starting point in time.