Fraud detection based on call attempt velocity on originating number

• US 6,947,532 B1
• Filed: 05/22/2000
• Issued: 09/20/2005
• Est. Priority Date: 05/22/2000
• Status: Expired due to Fees

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: MCI Incorporated (Verizon Communications Inc.)
• Inventors: Marchand, Dean C., Jackman, Erin C.
• Primary Examiner(s): TRAN, QUOC DUC
• Application Number:
  US09/575,469
• Time in Patent Office: 1,947 Days
• Field of Search: 379/114.01, 379/114.03, 379/114.04, 379/114.14, 379/114.15, 379/114.17, 379/114.18, 379/114.19, 379/114.2, 379/127.01, 379/127.02, 379/127.03, 379/127.04, 379/128, 379/129, 379/133, 379/145, 379/188, 379/189, 379/190, 379/191, 379/192
• US Class Current: 379/114.14
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 3/42059 Making use of the calling party identifier
• CPC Class Codes: H04M 3/4228 in networks

Abstract

A method of identifying fraud in a telecommunications system. The method includes receiving data related to a current call placed from an originating automatic number indicator (ANI), where the received data includes at least the originating ANI, a billing number and an identification code. A threshold number and a time interval corresponding to the identification code for the originating ANI are retrieved, for example, from a memory. In addition, billing numbers for prior calls from the originating ANI, if any, and corresponding indicia of the times of the calls are retrieved. A determination is made of whether the number of billing numbers used for the current and prior calls from the originating ANI over a prior period of time equal to or less than the time interval exceeds the threshold number. If the threshold number is exceeded, a fraud alert is generated.

Claims

1. A system for identifying fraud in a telecommunications system, the system comprising at least one processor, memory and related software,

the at least one processor receiving data related to a current call placed from an originating automatic number indicator (ANI), the received data including at least the originating ANI, a billing number and an identification code,

the processor retrieving a threshold number and a time interval corresponding to the identification code from the memory, the processor also retrieving from memory billing numbers for prior calls from the originating ANI, if any, and an indicia of the time of the call, and

the processor also determining whether the number of different billing numbers used for the current and prior calls from the originating ANI over a prior period of time equal to or less than the time interval exceeds the threshold number, wherein the prior period of time spans from the time of the current call backwards in time equal to the time interval for the identification code, the processor counting the number of different billing numbers for the current call and all prior calls for the originating ANI that fall within the prior period of time, a fraud alert being generated if the threshold number is exceeded.

2. The system as in claim 1, wherein the billing numbers and indicia of time for prior calls for the originating ANI are included in calling records stored in the memory, each calling record containing data for one prior call from the originating ANI, the calling record referenced by originating ANI and including the billing number used for the call and an indicia of the time of the call.

3. The system as in claim 2, wherein a calling record is created for the current call.

4. The system as in claim 1, wherein threshold number of different billing numbers and the time interval corresponding to the identification code is included in a look-up table stored in the memory.

5. The system as in claim 1, wherein data related to the current call is received by the at least one processor from components that receive and process special services calls.

6. The system as in claim 1, wherein the processor also determines whether the number of billing numbers used for current and prior calls from the originating ANI over a prior period of time equal to or less than the time interval equals the threshold number and a fraud alert is also generated if the threshold number is met.

7. A method of identifying fraud in a telecommunications system, the method comprising the steps of

a) receiving data related to a current call placed from an originating ANI, the received data including the originating ANI, a billing number and an identification code;

b) retrieving a threshold number and a time interval corresponding to the identification code for originating ANI;

c) retrieving billing numbers for prior calls from the originating ANI, if any, and corresponding indicia of the times of the calls;

d) determining whether the number of different billing numbers used for the current and prior calls from the originating ANI over a prior period of time equal to or less than the time interval exceeds the threshold;

counting the number of different billing numbers for the current call and all prior calls for the originating ANI spanning from the time of the current call backwards in time equal to the time interval for the identification code;

comparing the count of different billing numbers with the threshold number for the identification code; and

e) generating a fraud alert if the threshold number is exceeded.

8. The method as in claim 7, wherein the billing numbers and indicia of time for prior calls for the originating ANI are retrieved from stored calling records, each calling record containing data for one prior call from the originating ANI, the calling record referenced by originating ANI and including the billing number used for the call and an indicia of the time of the call.

9. The method as in claim 8, the method including the additional step of creating a calling record for the current call and storing the calling record, the calling record including the originating ANI, the billing number and an indicia of the time of the call, the calling record referenced in the memory by the originating ANI.

10. The method as in claim 7, wherein the step of retrieving billing numbers for prior calls from the originating ANI, if any, and corresponding indicia of the times of the calls includes retrieving an identification code of the originating ANI.

11. The method as in claim 7, wherein the received identification code is a Bell Core information digit corresponding to the originating ANI.

12. The method as in claim 7, wherein the generation of a fraud alert initiates processing related to prevention of fraudulent calling from the originating ANI.

13. The method as in claim 7, wherein the step of determining whether the number of different billing numbers used for current and prior calls from the originating ANI over a prior period of time equal to or less than the time interval exceeds the threshold number includes determining whether the number of billing numbers equals the threshold number and the step of generating a fraud alert if the threshold number is exceeded includes generating a fraud alert if the threshold number is met.

14. A method of identifying fraud in a telecommunications system, the method comprising the steps of:

a) receiving data related to a current call placed from an originating ANI, the received data including the originating ANI, a billing number and an identification code;

b) storing the received data for the originating ANI;

c) at an initiating event, retrieving the billing numbers and corresponding indicia of times of calls from the originating ANI and the identification code for the originating ANI;

d) retrieving a threshold number and a time interval corresponding to the identification code for the originating ANI;

e) determining whether the number of different billing numbers used for calls from the originating ANI over a prior period of time equal to or less than the time interval exceeds the threshold number;

counting the number of different billing numbers for the current call and all prior calls for the originating ANI spanning from the time of the current call backwards in time equal to the time interval for the identification code; and

f) generating a fraud alert if the threshold number is exceeded.

15. The method as in claim 14, wherein the initiating event is the receipt of data related to the current call placed from the originating ANI.

16. The method as in claim 14, wherein the initiating event is the elapse of a period of time.

17. The method as in claim 14, wherein the step of determining whether the number of different billing numbers used for calls from the originating ANI over a prior period of time equal to or less than the time interval exceeds the threshold number includes determining whether the number of different billing numbers equals the threshold number and the step of generating a fraud alert if the threshold number is exceeded includes generating a fraud alert if the threshold number is met.

18. A system for identifying fraud, the system comprising at least one processor, memory and related software,

the at least one processor receiving data related to a current call request placed from an originating ANI, the received data including at least the originating ANI and a billing number, the processor retrieving from memory billing numbers for prior calls from the originating ANI, if any, and an indicia of the time of the call, and

the processor also determining whether the number of different billing numbers used for the current and prior calls from the originating ANI over a prior period of time equal to or less than a time interval exceeds a threshold number, wherein the prior period of time spans from the time of the current call backwards in time equal to the time interval for the identification code, a fraud alert being generated if the threshold number is exceeded.

19. The system as in claim 18, wherein the system is operated by a billing product company and the data related to the current call request is received from a telecommunications company.

20. The system as in claim 18, wherein the billing number included in the data related to the current call is a billing number for a billing product issued by the billing card company.

21. The system as in claim 18, wherein the processor also determines whether the number of different billing numbers used for current and prior calls from the originating ANI over a prior period of time equal to or less than the time interval equals the threshold number and a fraud alert is also generated if the threshold number is met.

22. A method of detecting fraud in a telecommunications system, the method comprising:

receiving data related to a current call placed from an originating telephone number, the data specifying a billing number and an identification code, wherein the identification code is associated with a threshold number and a time interval;

counting the number of different billing numbers for the current call and prior calls for the originating telephone number spanning from the time of the current call back to a time based on the time interval for the identification code;

comparing the count of different billing numbers with the threshold number for the identification code; and

generating a fraud alert if the threshold number is exceeded.