System and method for detecting and managing fraud

• US 7,433,855 B2
• Filed: 07/24/2003
• Issued: 10/07/2008
• Est. Priority Date: 04/21/1995
• Status: Expired due to Fees

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: MCI Communications Corporation (Verizon Communications Inc.)
• Inventors: Paul, Kevin, Gavan, John, Mahone, Saralyn, Richards, Jim, Herrington, Cheryl, Dallas, Charles A, Van Arkel, Hans, Wagner, James J, Curtis, Terrell J
• Primary Examiner(s): Fischer; Andrew J.
• Assistant Examiner(s): Agwumezie; Charles C
• Application Number:
  US10/627,033
• Publication Number:
  US 20040111305A1
• Time in Patent Office: 1,902 Days
• Field of Search: 705/50, 705/35, 706/47, 379/111, 379/141.11
• US Class Current: 706/47
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: H04J 3/175 Speech activity or inactivity detectors echo suppressors H04B3/20
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/08 Metering calls to called party , i.e. B-party charged for the communication
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/62 Called party billing, e.g. reverse billing, freephone, collect call, 0800 or 0900
• CPC Class Codes: H04M 3/2218 Call detail recording
• CPC Class Codes: H04M 3/36 Statistical metering, e.g. recording occasions when traffic exceeds capacity of trunks
• CPC Class Codes: H04Q 3/0062 Provisions for network management

Abstract

A system, method and computer program product for processing event records. The present invention includes a detection layer, an analysis layer, an expert systems layer and a presentation layer. The layered system includes a core infrastructure and a configurable, domain-specific implementation. The detection layer employs one or more detection engines, such as, for example, a rules-based thresholding engine and a profiling engine. The detection layer can include an AI-based pattern recognition engine for analyzing data records, for detecting new and interesting patterns and for updating the detection engines to insure that the detection engines can detect the new patterns. In one embodiment, the present invention is implemented as a telecommunications fraud detection system. When fraud is detected, the detection layer generates alarms which are sent to the analysis layer. The analysis layer filters and consolidates the alarms to generate fraud cases. The analysis layer preferably generates a probability of fraud for each fraud case. The expert systems layer receives fraud cases and automatically initiates actions for certain fraud cases. The presentation layer also receives fraud cases for presentation to human analysts. The presentation layer permits the human analysts to initiate additional actions.

Claims

1. A method for detecting fraud in one of a credit card or debit card system, the system generating network event records, each network event record being generated in response to an event in the system, the method comprising:

performing, via one or more servers, at least a first fraud detection test and a second different fraud detection test on the network event records, the first fraud detection test and the second fraud detection test being performed based on fraud detection rules, the fraud detection rules being dynamically reconfigured in accordance with changing patterns of fraud;

generating a first fraud alarm upon detection of suspected fraud by the first fraud detection test;

generating a second different fraud alarm upon detection of suspected fraud by the second different fraud detection test;

correlating the generated first fraud alarm with the generated second different fraud alarm based on common aspects of the first fraud alarm and the second different fraud alarm, the correlated fraud alarms being consolidated into a fraud case, the fraud case being assigned a priority based on a severity of the suspected fraud; and

responding to the fraud case with a fraud prevention action, the fraud prevention action being based on the priority assigned to the fraud case.

2. The method of claim 1, wherein the method is performed by computer executable instructions disposed on at least one computer readable medium.

3. The method of claim 2, wherein the computer executable instructions are distributed among a plurality of hardware platforms.

4. The method of claim 2, wherein at least a portion of the computer executable instructions are implemented in a core infrastructure.

5. The method of claim 1, wherein the first fraud detection test or the second different fraud detection test includes normalizing the network event records such that the network event records conform to a predetermined format.

6. The method of claim 1, wherein the first fraud detection test or the second different fraud detection test includes enhancing the network event records such that an enhanced network event records include data obtained from at least one external system.

7. The method of claim 6, wherein the enhanced network event record includes data obtained from at least one database.

8. The method of claim 7, wherein the at least one database includes at least one of a configuration database, an event database, a billing database, a history database, and/or a records database.

9. The method of claim 1, wherein the first fraud detection test or the second different fraud detection test includes a comparison of at least a portion of the network event records to a threshold rule, the first fraud alarm or second different fraud alarm being generated if one network event record violates the threshold rule.

10. The method of claim 9, wherein the first fraud alarm or second different fraud alarm is generated if a value in one network event record exceeds a threshold value specified by the threshold rule.

11. The method of claim 9, wherein the first fraud alarm or second different fraud alarm is generated if a value in one network event record does not equal a value specified by the threshold rule.

12. The method of claim 1, wherein the first fraud detection test or the second different fraud detection test includes a comparison of at least a portion of the network event records to a profile detection rule, the first fraud alarm or second different fraud alarm being generated if one network event record violates the profile detection rule.

13. The method of claim 12, wherein the one network event record is compared to a normal usage profile.

14. The method of claim 12, wherein the one network event record is compared to a fraudulent usage profile.

15. The method of claim 12, wherein the profile detection rule is based on historical network event records.

16. The method of claim 1, wherein the first fraud detection test or the second different fraud detection test includes a comparison of at least a portion of the network event records to a predetermined pattern to identify a normal usage and/or a fraudulent usage.

17. The method of claim 16, wherein the predetermined pattern is based on history data.

18. The method of claim 16, wherein the predetermined pattern is generated by a neural network.

19. The method of claim 16, wherein the comparison is performed using tree-based algorithms that generate discrete output values.

20. The method of claim 16, wherein the comparison is performed using statistical based algorithms that that employ iterative numerical processing techniques.

21. The method of claim 1, wherein the correlating includes enhancing a network event record by obtaining relevant data from an external source.

22. The method of claim 1, wherein the correlating includes applying at least one predetermined fraud analysis rule to the network event records to decide if a fraud case is appropriate.

23. The method of claim 1, wherein the correlating includes applying at least one predetermined prioritization rule to the fraud case to obtain the priority of the fraud case.

24. The method of claim 1, wherein the fraud prevention action may be performed automatically, semi-automatically, or manually based on the priority.

25. The method of claim 1, wherein the fraud prevention action is selected from a group that is comprised of at least one of a card deactivation, a usage modification, an account deactivation, a range modification, and/or a privilege modification.

26. The method of claim 1, wherein the first fraud alarm or second different fraud alarm is selected from a group that is comprised of at least one of a pin hacking alarm or a geographic alarm.

27. A system for monitoring one or more of a plurality of credit card or debit card networks, each network being configured to generate network event records, each network event record being generated in response to an event occurring in the network, the system comprising:

one or more servers programmed to implement;

a detection element configured to generate a first fraud alarm when a network event record is in violation of a first fraud detection rule, the detection element generating a second different fraud alarm when a network event record is in violation of a second different fraud detection rule, the first fraud alarm and the second different fraud alarm having at least one common aspect, the detection element being dynamically reconfigured to adjust fraud detection rules in accordance with changing patterns of fraud;

an analysis element configured to correlate the first fraud alarm and the second different fraud alarm, and generate a fraud case based on the correlated fraud alarms; and

an expert element configured to assign a priority to the generated fraud case, and to perform a fraud prevention action in accordance with the priority.

28. The system of claim 27, wherein the priority is based on a severity of suspected fraud.

29. The system of claim 27, wherein the detection element includes at least one software processing engine comprising computer executable instructions disposed on at least one computer readable medium.

30. The system of claim 29, wherein the at least one software processing engine is distributed among a plurality of hardware platforms.

31. The system of claim 29, wherein the at least one software processing engine includes a rules based thresholding engine configured to read the network event record and compare data in the network event record to a predetermined threshold.

32. The system of claim 31, wherein the rules based thresholding engine further comprises:

at least one rules database;

a normalizer configured to configure the network event record into a standardized format;

an enhancer component coupled to the normalizer, the enhancer component being configured to insert additional data in the network event record; and

a threshold detector coupled to the enhancer component, the threshold detector being configured to compare a network event record to at least one threshold rule obtained from the at least one rules database, whereby the alarm is generated if the network event record violates the at least one threshold rule.

33. The system of claim 32, wherein the enhancer component is coupled to an external systems interface, the additional data including data received from an external system.

34. The system of claim 32, wherein the network event record includes an event key and at least one feature, the event key identifying the network event and the at least one feature including event measurement data.

35. The system of claim 34, wherein the measurement data includes a count of a number of occurrences of an event during a predetermined time period.

36. The system of claim 34, wherein the measurement data includes a count of a number of like events occurring simultaneously.

37. The system of claim 34, wherein the measurement data includes geographic velocity data.

38. The system of claim 32, wherein the at least one rules database comprises:

an enhancement rules database coupled to the enhancer component, the enhancer component obtaining an enhancement rule from the enhancement rules database based on data in the network event record; and

a threshold detection rules database coupled to the threshold detector, the threshold detector obtaining a threshold rule in accordance with data in the network event record.

39. The system of claim 38, wherein the enhancement rule directs the enhancer component to select external data from a selected external source.

40. The system of claim 38, wherein the threshold rule stipulates that an alarm is generated when data in the network event record exceeds a threshold value.

41. The system of claim 38, wherein the threshold rule stipulates that an alarm is generated when data in the network event record does not equal a threshold value.

42. The system of claim 32, wherein the enhancer component provides the threshold detector with a feature vector, the feature vector including an event key and a plurality of feature event values, the event key including suspected fraud event identifying data, each feature event value of the plurality of feature event values providing fraud event measurement data.

43. The system of claim 42, wherein the feature event value includes a threshold value.

44. The system of claim 42, wherein the feature vector includes a name field, a value field, and a generating event field for each feature.

45. The system of claim 44, wherein the feature vector is implemented as a data structure, the data structure being stored on a computer readable medium.

46. The system of claim 44, wherein the feature vector includes at least one contributing event field for each feature.

47. The system of claim 29, wherein the at least one software processing engine in the detection element further comprises:

a profiling database including at least one profile detection rule; and

a profiling engine configured to compare the network event record with at least one profile in accordance with the at least one profile detection rule, the profiling engine generating the first fraud alarm or second different fraud alarm if the network event record substantially violates the profile detection rule.

48. The system of claim 47, wherein the profile includes a normal use profile and/or a fraudulent use profile.

49. The system of claim 47, wherein the profile is based on historical network event records.

50. The system of claim 29, wherein the at least one software processing engine in the detection element comprises a pattern recognition engine configured to identify normal and/or fraudulent patterns of usage.

51. The system of claim 50, wherein the pattern recognition engine compares the network event record to history data obtained from a history database.

52. The system of claim 50, wherein the pattern recognition engine includes a neural network configured to identify fraudulent patterns of usage.

53. The system of claim 50, wherein the pattern recognition engine includes tree-based algorithms.

54. The system of claim 50, wherein the pattern recognition engine includes statistical based algorithms that employ iterative numerical processing techniques.

55. The system of claim 27, wherein the analysis element further comprises:

an external systems interface component configured to obtain data from external systems relevant to the first fraud alarm or the second different fraud alarm;

a configuration database configured to specify additional data for fraud alarm analysis;

an alarm enhancement component coupled to the external systems interface and the configuration database, the alarm enhancement component being configured to add the additional data and external system data to the first fraud alarm or the second different fraud alarm; and

a fraud case builder component coupled to the alarm enhancement component, the fraud case builder being configured to correlate and consolidate fraud alarms.

56. The system of claim 55, wherein the fraud case builder is coupled to a rules database, the rules database providing the fraud case builder with parameters for generating fraud cases.

57. The system of claim 27, wherein the expert element further comprises:

a configuration database configured to specify additional data for alarm analysis based on an alarm configuration;

an external systems interface component configured to obtain data from external systems relevant to at least one of the first fraud alarm or second different fraud alarm; and

a prioritizer component coupled to the configuration database and the external systems interface, the prioritizer component being configured to direct the external system interface to obtain the additional data from at least one external system based on configuration data obtained from the configuration database, the prioritizer adding the additional data to the fraud case.

58. The system of claim 57, wherein the prioritizer component receives prioritization rules from the configuration database and prioritizes the fraud case eases in accordance with the prioritization rules.

59. The system of claim 58, wherein the prioritization rules specify the fraud prevention action.

60. The system of claim 59, further comprising an enforcement component coupled to the prioritizer component, the enforcement component performing the fraud prevention action based on the priority of the fraud case.

61. The system of claim 27, wherein the fraud prevention action includes at least one of a card deactivation, a usage modification, an account deactivation, a range modification, and/or a privilege modification.

62. The system of claim 27, wherein the first fraud alarm or second different fraud alarm includes at least one of a pin hacking alarm or a geographic alarm.