Automated fraud management in transaction-based networks

• US 6,163,604 A
• Filed: 04/01/1999
• Issued: 12/19/2000
• Est. Priority Date: 04/03/1998
• Status: Expired due to Term

• Current Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Original Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Inventors: Ferrara, Virginia Kay, Cahill, Michael H., Baulier, Gerald Donald, Lambert, Diane
• Primary Examiner(s): SMITH, CREIGHTON H
• Application Number:
  US09/283,672
• Time in Patent Office: 628 Days
• Field of Search: 379/189, 379/145, 379/111, 379/112, 379/113
• US Class Current: 379/189
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 15/58 based on statistics of usage or network monitoring
• CPC Class Codes: H04M 2203/6027 Fraud preventions
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0188 Network monitoring; statistics on usage on called/calling number
• CPC Class Codes: H04M 3/2218 Call detail recording
• CPC Class Codes: H04M 3/36 Statistical metering, e.g. recording occasions when traffic exceeds capacity of trunks
• CPC Class Codes: H04M 3/382 using authorisation codes or passwords
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

Fraud losses in a communication network are substantially reduced by automatically generating fraud management recommendations in response to suspected fraud and by deriving the recommendations as a function of selected attributes of the fraudulent activity. More specifically, a programmable rules engine automatically generates recommendations based on call-by-call fraud scoring so that the recommendations correspond directly to the type and amount of suspected fraudulent activity. Using telecommunications fraud as an example, an automated fraud management system receives call detail records that have been previously scored to identify potentially fraudulent calls. Fraud scoring estimates the probability of fraud for each call based on the learned behavior of an individual subscriber as well as that of fraud perpetrators. Scoring also provides an indication of the contribution of various elements of the call detail record to the fraud score for that call. A case analysis is initiated and previously scored call detail records are separated into innocuous and suspicious groups based on fraud scores. Each group is then characterized according to selected variables and scoring for its member calls. These characterizations are combined with subscriber information to generate a set of decision variables. A set of rules is then applied to determine if the current set of decision variables meets definable conditions. When a condition is met, prevention measures associated with that condition are recommended for the account. As one example, recommended prevention measures may be automatically implemented via provisioning functions in the telecommunications network.

Claims

1. A computer-implemented method for managing fraud in a telecommunications network, comprising the step of:

automatically generating one or more recommendations for responding to suspected fraudulent activity in the telecommunications network, wherein the recommendations are derived as a function of calls scored for the likelihood of fraud, and wherein the recommendations correspond to attributes of the suspected fraudulent activity so that a recommended response to the suspected fraudulent activity is targeted to the type of fraud that is occurring.

2. The computer-implemented method of claim 1, wherein scoring is done on a call-by-call basis.

3. The computer-implemented method of claim 2, further comprising the steps of:

receiving call detail records which have been scored to identify potentially fraudulent activity, wherein a scored call detail record provides an indication of the contribution of a plurality of predetermined call variables to the fraud score; and

initiating a case analysis based on predetermined criteria relating to changes in fraud scores.

4. The computer-implemented method of claim 3, wherein the step of initiating a case analysis comprises the steps of:

a) separating a plurality of scored call detail records, based on fraud scores, into at least a first group representative of non-suspicious activity and a second group representative of suspicious activity;

b) characterizing each group according to predetermined variables and fraud scores for individual calls in the respective groups;

c) generating one or more decision variables based on step b) and subscriber information;

d) applying one or more rules to the one or more decision variables to determine if a predefined condition is met; and

e) when a predefined condition is met, recommending one or more prescribed fraud responses corresponding to that condition.

5. The computer-implemented method of claim 4, wherein a fraud score of an individual call is representative of the likelihood of fraud based on the learned behavior of a subscriber comprising a subscriber signature and the learned behavior of fraudulent calling activity comprising a fraud signature.

6. The computer-implemented method of claim 5, wherein the one or more prescribed fraud responses includes prevention measures.

7. The computer-implemented method of claim 6, wherein one of the prevention measures includes implementing provisioning-based fraud prevention.

8. The computer-implemented method of claim 1, wherein the recommendations further correspond to attributes of legitimate activity.

9. The computer-implemented method of claim 8, wherein the recommendations further correspond to subscriber information and attributes associated with a case.

10. The computer-implemented method according to claim 3, wherein the plurality of predetermined call variables are variables selected from the group consisting of day of week, time of day, duration of call, time between consecutive calls, origination, destination, use of special call features, appearance of network security alert, carrier selection, and use of international completion services.

11. The method according to claim 4, wherein a case is capable of being updated on a iterative and adaptive basis as a function of newly scored calls and newly generated fraud response recommendations.

12. The computer-implemented method according to claim 5, wherein the subscriber signature is derived from attributes of calling behavior selected from the group consisting of calling rate, day of week timing, hour of day timing, call duration, method of billing, and geographical associations.

13. The computer-implemented method according to claim 5, wherein the attributes of calling behavior are derived from information in call detail records.

14. The computer-implemented method according to claim 5, wherein the fraud signature is derived from attributes of calling behavior associated with suspected and confirmed fraudulent calls.

15. The computer-implemented method of claim 5, wherein suspected fraudulent activity is indicated by factors selected from the group consisting of a fraud score that exceeds a predetermined value, a fraud score indicative of a change in fraud score of a prescribed amount over a prescribed number of calls, a collision event indicated by an overlap in time for two or more calls, and a velocity violation event indicated by an inconsistent change in origination point for each of two or more calls given the amount of time between the two or more calls.

16. A computer-implemented method for managing fraud in a network where transactions occur, comprising the step of:

automatically generating one or more recommendations for responding to suspected fraudulent activity in the network, wherein the recommendations are derived as a function of transactions scored for the likelihood of fraud, and wherein the recommendations correspond to selected attributes of the suspected fraudulent activity so that a recommended response to the suspected fraudulent activity is targeted to the type of fraud that is occurring.

17. The computer-implemented method of claim 16, further comprising the steps of:

receiving transaction records which have been scored to identify potentially fraudulent activity, wherein a scored transaction record provides an indication of the contribution of a plurality of predetermined transaction variables to the fraud score; and

initiating a case analysis based on predetermined criteria relating to changes in fraud scores.

18. The computer-implemented method of claim 17, wherein the step of initiating a case analysis comprises the steps of:

a) separating a plurality of scored transaction records, based on fraud scores, into at least a first group representative of non-suspicious activity and a second group representative of suspicious activity;

b) characterizing each group according to predetermined variables and fraud scores for individual transactions in the respective groups;

c) generating one or more decision variables based on step b) and subscriber information;

d) applying one or more rules to the one or more decision variables to determine if a predefined condition is met; and

e) when a predefined condition is met, recommending one or more prescribed fraud responses corresponding to that condition.

19. The computer-implemented method of claim 18, wherein a fraud score of an individual transaction is representative of the likelihood of fraud based on the learned behavior of a subscriber comprising a subscriber signature and the learned behavior of fraudulent activity comprising a fraud signature.

20. The computer-implemented method of claim 19, wherein the one or more prescribed fraud responses includes prevention measures.

21. The computer-implemented method of claim 20, wherein one of the prevention measures includes implementing provisioning-based fraud prevention in the network.

22. The computer-implemented method of claim 16, wherein scoring is done on a transaction-by-transaction basis.

23. The computer-implemented method of claim 16, wherein the recommendations further correspond to attributes of legitimate transaction activity.

24. The computer-implemented method of claim 23, wherein the recommendations further correspond to subscriber information.

25. The computer-implemented method of claim 24, wherein the recommendations further correspond to attributes associated with a case.

26. A system for managing fraud in a network where transactions occur, comprising:

means for deriving one or more recommendations for responding to suspected fraudulent activity in the network as a function of transactions scored for the likelihood of fraud; and

means for automatically generating the one or more recommendations,

wherein the recommendations correspond to selected attributes of the suspected fraudulent activity so that a recommended response to the suspected fraudulent activity is targeted to the type of fraud that is occurring.

27. A system for managing fraud in a telecommunications network, comprising:

at least one memory device for receiving, storing, and supplying call detail records that have been scored to identify potentially fraudulent activity, wherein a scored call detail record provides an indication of the contribution to the fraud score of a plurality of predetermined call variables; and

a computer processor, coupled to the at least one memory device, for executing programmed instructions to automatically generate one or more recommendations for responding to suspected fraudulent activity in the telecommunications network, wherein the recommendations are derived as a function of the scored call detail records, and wherein the recommendations correspond to selected attributes of the suspected fraudulent activity so that a recommended response to the suspected fraudulent activity is targeted to the type of fraud that is occurring.

28. A system for managing fraud in a telecommunication network, comprising:

a call scoring element responsive to call detail records generated within the network for scoring a call to determine the likelihood of fraud; and

a case analysis element responsive to scored call detail records and subscriber account information for analyzing a case of suspected fraud and for automatically generating recommendations for responding to the suspected fraud, wherein recommended fraud responses correspond to attributes of the suspected fraud so that management of the suspected fraud is targeted to the type of fraud that is occurring.

29. The computer-implemented method according to claim 28, wherein the case analysis element includes a programmable rules-based engine for generating recommendations.

30. The system according to claim 28, further comprising a provisioning function for implementing one or more of the recommended fraud responses.

31. The system according to claim 30, wherein the one or more recommended fraud responses are selected from the group of responses consisting of blocking the call, disabling one or more call features for a particular account associated with the suspected fraud, and forwarding a next call on the particular account to an attendant.