Fraud detection using predictive modeling

• US 5,819,226 A
• Filed: 09/08/1992
• Issued: 10/06/1998
• Est. Priority Date: 09/08/1992
• Status: Expired due to Term

• Current Assignee: Fair Isaac Corporation
• Original Assignee: HNC Software Inc. (Fair Isaac Corporation)
• Inventors: Lazarus, Michael A., Biafore, Louis S., Pathria, Anu K., Ferguson, William M., Jost, Allen, Gopinathan, Krishna M.
• Primary Examiner(s): Hayes, Gail O.
• Application Number:
  US07/941,971
• Time in Patent Office: 2,219 Days
• Field of Search: 364/401, 364/406, 364/408, 395/21, 395/23, 235/23, 235/380, 705/35, 705/1
• US Class Current: 705/44
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 20/403 Solvency checks
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof
• CPC Class Codes: G07F 7/08 by coded identity card or credit card or other personal identification means without personal verification means G07F7/02
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means

Abstract

An automated system and method detects fraudulent transactions using a predictive model such as a neural network to evaluate individual customer accounts and identify potentially fraudulent transactions based on learned relationships among known variables. The system may also output reason codes indicating relative contributions of various variables to a particular result. The system periodically monitors its performance and redevelops the model when performance drops below a predetermined level.

Claims

1. In a computer having a processor and storage, a computer-implemented process for detecting a fraudulent transaction in a customer account, comprising the steps of:

obtaining past transaction data for processing by the computer

pre-processing the past transaction data to derive past fraud related variables;

generating a predictive model with the processor from the past fraud related variables;

storing a representation of the predictive model in the computer storage;

receiving current transaction data for processing by the processor;

receiving customer data for processing by the processor; and

generating a computer signal indicative of the likelihood of fraud in the current transaction, wherein the processor generates the computer signal by applying the current transaction data and the customer data to the stored predictive model.

2. The computer-implemented process of claim 1, wherein the step of obtaining customer data comprises accessing a computer database containing general customer data and a computer database containing customer transactional pattern data.

3. The computer-implemented process of claim 1, wherein the step of obtaining customer data comprises accessing no more than one profile computer database record containing customer transactional pattern data.

4. The computer-implemented process of claim 3, wherein the profile computer database record further contains general customer data.

5. The computer-implemented process of claim 1, wherein the current transaction data and the customer data each comprise a plurality of elements and the computer processes each element by:

determining a relative contribution of the element to the determined likelihood of fraud;

determining from each relative contribution thus determined a reason code value; and

generating a computer signal indicative of the reason code value.

6. The computer-implemented process of claim 1, further comprising the steps of:

comparing the computer signal indicative of the likelihood of fraud with a preset threshold value; and

responsive to the computer signal exceeding the preset threshold value, generating a computer signal indicating fraud.

7. The computer-implemented process of claim 1, further comprising the iterative steps of:

determining a cascade threshold value;

comparing the computer signal indicative of the likelihood of fraud with the cascade threshold value; and

responsive to the computer signal exceeding the cascade threshold value, generating another computer signal indicative of the likelihood of fraud in the current transaction by applying the current transaction data and the customer data to another predictive model.

8. The computer-implemented process of claim 1, further comprising the steps of:

monitoring a performance metric of the computer generated predictive model, wherein the processor monitors the performance metric;

comparing the performance metric with a predetermined performance level; and

generating and storing a new predictive model from past transaction data responsive to the performance level exceeding the performance metric, wherein the new predictive model is generated by the processor and stored in the computer storage.

9. the computer-implemented process of claim 8, wherein the performance metric comprises:

a fraud detection rate measurement; and

a false positive rate measurement.

10. The computer-implemented process of claim 1, further comprising the steps of:

pre-processing the current transaction data to derive current fraud-related variables; and

pre-processing the customer data to derive customer fraud-related variables;

wherein the computer signal representing the likelihood of fraud is generated responsive to application of the current fraud-related variables and the customer fraud-related variables to the stored predictive model.

11. The computer-implemented process of claim 10, wherein the past fraud-related variables and the current fraud-related variables each comprise at least:

factors obtained from data referring to transaction dollar amounts related to fraud;

factors obtained from data referring to transaction dates and times related to fraud;

factors obtained from data referring to transaction approvals and declines related to fraud; and

factors obtained from data referring to risk groups related to fraud.

12. The computer-implemented process of claim 10, wherein the past fraud-related variables and the current fraud-related variables each comprise at least:

factors obtained from data referring to customers related to fraud; and

factors obtained from data referring to merchants related to fraud.

13. The computer-implemented process of claim 10, further comprising the steps of, for each variable in the set of derived current fraud-related variables and derived customer fraud-related variables:

determining a relative contribution of the variable to the determined likelihood of fraud;

determining from each relative contribution thus determined a reason code value; and

generating a computer signal indicative of the reason code value.

14. A computer-implemented process for detecting fraud for a transaction on a customer account, comprising the steps of:

obtaining past transaction data for processing by the computer;

pre-processing the past transaction data to derive past fraud-related variables;

training a neural network on the computer with the derived past fraud-related variables;

storing the neural network in storage associated with the computer;

obtaining current transaction data for processing by the computer;

pre-processing the current transaction data to derive current fraud-related variables;

obtaining customer data for processing by the computer;

pre-processing the customer data to derive customer fraud-related variables; and

generating a computer signal representing the likelihood of fraud responsive to application of the current fraud-related variables and the customer fraud-related variables to the stored neural network.

15. In a computer having a processor and storage, a computer-implemented process of training a neural network, the neural network for predicting fraudulent transactions in a customer account based on selected data, the neural network being represented on the computer and stored in the computer storage and comprising a plurality of interconnected processing elements, each processing element comprising:

a plurality of inputs;

a plurality of weights, wherein each weight is associated with a corresponding input by the processor to generate weighted inputs;

means for combining the weighted inputs; and

a transfer function for processing the combined weighted inputs on the processor to produce an output;

the training process comprising the iterative steps of;

applying input data to the neural network to generate output data, wherein the processor applies the input data to the neural network and generates the output data;

comparing the generated output data to a desired output, wherein the processor performs the comparison;

adjusting operation of the neural network responsive to the results of the comparing step; and

after the iterative steps of applying, comparing, and adjusting, storing the neural network in the computer storage.

16. The computer-implemented process of claim 15, wherein the step of adjusting operation of the neural network comprises the substeps of:

selecting a subset of the weights to be decayed; and

decaying the selected subset of weights.

17. The computer-implemented process of claim 16, wherein the substep of selecting a subset of the weights to be decayed comprises applying and minimizing a cost function including an interlayer gain multiplier which varies a decay rate responsive to the location of a weight within the network.

18. The computer-implemented process of claim 17, wherein the cost function is of the form:

##EQU3## wherein;

D represents a data set;

target_k represents a target value for element k of the data set;

output_k represents a network output for element k of the data set;

g represents the interlayer gain multiplier;

λ

represents the relative importance of the complexity term;

W represents a weight set;

ω

_i represents a value of weight i; and

c₁ represents a constant.

19. A system for detecting a fraudulent transaction in a customer account, comprising:

a computer processor for executing programmed instructions and for storing and retrieving data;

program memory, coupled to the processor, for storing program instruction steps for execution by the processor;

a predictive model component, coupled to the processor, for determining the likelihood of a fraudulent transaction;

past transaction data storage, coupled to the processor, for receiving, storing, and sending past transaction data;

a model development component, coupled to the processor, for training the predictive model based on the past transaction data in accordance with program instructions in the program memory and executed by the processor, thereby generating a trained predictive model;

current transaction data storage, coupled to the processor, for receiving, storing, and sending current transaction data;

customer data storage, coupled to the processor, for receiving, storing, and sending customer data; and

an output device, coupled to the processor, for outputting a computer signal indicative of the likelihood of fraud in a transaction, wherein the processor generates the computer signal in accordance with program instructions in the program memory and executed by the processor, said computer signal being responsive to the application of the current transaction data and the customer data to the trained predictive model.

20. The system of claim 19, wherein the model development component derives past fraud-related variables as a function of the past transaction data, and said past fraud-related variables are used to train the predictive model.

21. The system of claim 19, wherein:

the predictive model component comprises a neural network, coupled to the processor; and

the model development component trains the neural network based on the past transaction data in accordance with program instructions in the program memory and executed by the processor, thereby generating a trained neural network;

wherein the processor generates the computer signal by applying the current transaction data and the customer data to the trained neural network.

22. The system of claim 19, further comprising:

a past transaction data pre-processor, coupled to the processor, for deriving past fraud-related variables from the past transaction data;

wherein the model development component trains the predictive model based on the past fraud-related variables in accordance with program instructions in the program memory and executed by the processor, thereby generating the trained predictive model;

a current transaction data pre-processor, coupled to the processor, for deriving current fraud-related variables from the current transaction data; and

a customer data pre-processor, coupled to the processor, for deriving customer fraud-related variables from the customer data;

wherein the processor generates the computer signal by applying the current fraud-related variables and the customer fraud-related variables to the trained predictive model.

23. In a system for detecting fraud in a transaction on an account belonging to a customer, the system including a computer processor for executing programmed instructions and for storing and retrieving data, a computer readable memory storing thereon:

a neural network, coupled to the processor, for determining the likelihood of a fraudulent transaction;

past transaction data storage, coupled to the processor, for receiving, storing, and sending past transaction data;

a past transaction data pre-processor, coupled to the processor, for deriving past fraud-related variables from the past transaction data;

a model development component, coupled to the processor, for training the neural network based on the past fraud-related variables, thereby generating a trained neural network;

current transaction data storage, coupled to the processor, for receiving, storing, and sending current transaction data;

a current transaction data pre-processor, coupled to the processor, for deriving current fraud-related variables from the current transaction data;

customer data storage, coupled to the processor, for receiving, storing, and sending customer data; and

a customer data pre-processor, coupled to the processor, for deriving customer fraud-related variables from the customer data;

wherein the processor generates a computer signal indicative of the likelihood of fraud in a transaction, said computer signal being responsive to the application of the current fraud-related variables and the customer fraud-related variables to the trained neural network.

24. In a computer-controlled transaction processing system including predictive modeling means for receiving current transaction data, processing the current transaction data, and outputting a plurality of output values, including a score value representing a likelihood of a fraudulent transaction, an improved computer-implemented process for identifying and determining fraudulent transaction data, comprising the steps of:

prior to receiving the current transaction data for at least one current transaction;

generating a consumer profile for each of a plurality of consumers from a plurality of past fraud-related variables and from consumer data, each consumer profile describing historical spending patterns of a corresponding consumer, the past fraud-related variables being derived by pre-processing past transaction data, the past transaction data including values for a plurality of transaction variables for a plurality of past transactions, the consumer data including values for each consumer for a plurality of consumer variables;

training the predictive modeling means with the consumer profiles and with the past fraud-related variables to obtain a predictive model; and

storing the obtained predictive model in the computer;

receiving current transaction data for a current transaction of a consumer;

receiving consumer data associated with the consumer;

receiving the consumer profile associated with the consumer;

pre-processing the obtained current transaction data, consumer data, and consumer profile to derive current fraud-related variables for the current transaction;

determining the likelihood of fraud in the current transaction by applying the current fraud-related variables to the predictive model; and

outputting from the predictive modeling means an output signal indicating the likelihood that the current transaction is fraudulent.

25. The computer-implemented process of claim 24, wherein the generating step comprises the substeps of:

receiving past transaction data for a plurality of past transactions, the past transaction data providing values for a plurality of transaction variables;

receiving consumer data for each of a plurality of consumers, the consumer data providing values for a plurality of consumer variables for each consumer;

pre-processing the past transaction data to derive past fraud-related variables wherein at least some of the past fraud-related variables are not present in the plurality of variables in the past transaction data; and

generating a consumer profile for each consumer from the past fraud-related variables and the received consumer data, each consumer profile describing historical spending patterns of the consumer.

26. The computer-implemented process of claim 24, further comprising the step of updating the received consumer profile with the received current transaction data.

27. The computer-implemented process of claim 24, wherein the step of training the predictive modeling means comprises the substeps of:

applying the consumer profile and the derived past fraud-related variables to the predictive modeling means;

ranking output data from the predictive modeling means as a function of a quality measurement;

adjusting the predictive modeling means as a function of the ranking step; and

repeating the applying, ranking, and adjusting steps until the quality measurement exceeds a predetermined level indicating that the predictive modeling means is adequately trained.

28. The computer-implemented process of claim 27, wherein the step of training the neural network comprises the substeps of:

applying the consumer profile and the derived past fraud-related variables to the neural network;

ranking output data from the neural network as a function of a quality measurement;

adjusting the neural network as a function of the ranking step; and

repeating the applying, ranking, and adjusting steps until the quality measurement exceeds a predetermined level indicating that the neural network is adequately trained.

29. The computer-implemented process of claim 24, wherein the step of training the predictive modeling means comprises training a neural network organized as a plurality of input processing elements for receiving the plurality of data values in the transaction data, a plurality of hidden processing elements coupled to the input processing elements for processing the transaction data, and a plurality of output processing elements coupled to the hidden processing elements for outputting the plurality of output values.

30. The computer-implemented process of claim 29, wherein the neural network comprises a plurality of processing elements linked by connections characterized by weights, and the step of adjusting the predictive model comprises the steps of:

selecting a subset of the weights to be decayed; and

decaying the selected subset of weights.

31. The computer-implemented process of claim 30, wherein the substep of selecting a subset of the weights to be decayed comprises applying and minimizing a cost function including an interlayer gain multiplier which varies a decay rate responsive to the location of a weight within the network.

32. The computer-implemented process of claim 31, wherein the cost function is of the form:

##EQU4## wherein;

D represents a data set;

target_k represents a target value for element k of the data set;

output_k represents a network output for element k of the data set;

g represents the interlayer gain multiplier;

l represents the relative importance of the complexity term;

W represents a weight set;

w_i represents a value of weight i; and

c₁ represents a constant.

33. The computer-implemented process of claim 24, wherein the current transaction data, the consumer profile, and the consumer data each comprise a plurality of data elements, further comprising the steps of, for at least one of the data elements:

determining a relative contribution value of the data element to the output signal indicating the likelihood that the current transaction is fraudulent;

determining a reason code as a function of the relative contribution value;

retrieving an explanation associated with the determined reason code value; and

outputting a computer signal indicative of the reason code and the explanation.

34. The computer-implemented process of claim 24, further comprising the steps of:

monitoring a performance metric of the predictive modeling means, the performance metric comprising at least one of a fraud detection rate measurement and a false positive rate measurement;

comparing the performance metric with a predetermined performance level for the performance metric; and

responsive to the predetermined performance level exceeding the performance metric, repeating the step of training the predictive modeling means.

35. The computer-implemented process of claim 24, wherein the past fraud-related variables and the current fraud-related variables each comprise at least:

transaction dollar amounts of past transactions;

transaction dates and times of past transactions;

transaction approvals and declines of past transactions;

risk groups of past transactions; and

merchants of past transactions.

36. In a computer system comprising:

a computer-readable memory; and

a neural network stored in the computer readable memory, the neural network comprising a plurality of interconnected processing elements, each processing element being in a layer of the neural network, each layer having a distance to an input layer, each processing element comprising;

a plurality of inputs (x);

a plurality of weights (w), each weight w associated with a corresponding input (x) to form weighted inputs;

a summation function for combining the weighted inputs; and

,

a transfer function for processing the combined weighted inputs into an output (z);

an improved computer-implemented process for training the neural network characterized by;

iteratively decaying the weights of at least one processing element by a cost function that varies a decay rate for decaying the weights by a function of the distance of the input layer from the layer containing the processing element.

37. The computer-implemented process of claim 36, wherein the cost function is of the form:

##EQU5## wherein;

D represents a data set;

target_k represents a target value for an element k of the data set;

output_k represents a neural network output for element k of the data set;

g represents an interlayer gain multiplier that varies as a function of the distance between the input layer and the layer containing the processing element;

l represents the relative importance of the decay rate term;

W represents a weight set;

w_i represents a value of weight i; and

c₁ represents a constant.

38. In a computer-controlled transaction processing system including predictive modeling means for receiving current transaction data, processing the current transaction data, and outputting a plurality of output values, including a score value representing a likelihood of a fraudulent transaction, an improvement for identifying and determining fraudulent transaction data, comprising:

a model development component for developing a predictive model, comprising;

means for receiving past transaction data for a plurality of past transactions, the past transaction data providing values for a plurality of transaction variables;

means for receiving consumer data for each of a plurality of consumers, the consumer data providing values for a plurality of consumer variables for each consumer;

means for pre-processing the past transaction data to derive past fraud-related variables wherein at least some of the past fraud-related variables are not present in the plurality of variables in the past transaction data;

means for generating a consumer profile for each individual consumer, from the past fraud-related variables and the received consumer data, the consumer profile describing historical spending patterns of the consumer;

means for training the predictive model with the consumer profiles and with the past fraud-related variables; and

means for storing the trained predictive model in the computer; and

a model application component, for applying the trained predictive model, comprising;

means for receiving current transaction date for a transaction of a consumer;

means for receiving consumer data associated with the consumer;

means for receiving the consumer profile associated with the consumer;

a current transaction data pre-processor, for pre-processing the obtained current transaction data, consumer data, and consumer profile to derive current fraud-related variables for the current transaction;

means for determining the likelihood of fraud in the current transaction by applying the current fraud-related variables to the predictive model; and

means for outputting from the predictive model an output signal indicating the likelihood that the current transaction is fraudulent.