System and method for identity-based fraud detection through graph anomaly detection

• US 7,562,814 B1
• Filed: 12/30/2004
• Issued: 07/21/2009
• Est. Priority Date: 05/12/2003
• Status: Active Grant

• Current Assignee: LexisNexis Risk Solutions, Inc. (RELX PLC)
• Original Assignee: ID Analytics, Inc. (Gen Digital Inc.)
• Inventors: Hong, Tao, Xie, Jianjun, Shao, Xuhui, Jost, Allen
• Primary Examiner(s): Labaze; Edwyn
• Application Number:
  US11/026,556
• Time in Patent Office: 1,664 Days
• Field of Search: 235/380, 235/375, 235/379, 235/382.5, 235/487, 705/44, 705/39, 705/38, 705/42, 705/75, 705/1
• US Class Current: 235/380
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes

Abstract

A method for identifying a fraudulent account application includes receiving a new account application comprising a plurality of identity-related fields and linking the identity-related fields associated with the new account application with identity-related fields associated with a plurality of historical account applications. The links form a graphical pattern on which statistical analysis can be performed to determine the likelihood that the new account application is fraudulent. The statistical analysis can comprise comparing the graphical pattern to a known, or normal graphical pattern in order to detect differences, or anomalies occurring in the graphical pattern associated with the new account application.

Claims

1. A method for identifying a fraudulent account application, comprising:

receiving, at an identity records interface, a new account application comprising a plurality of identity-related fields;

linking, at a fraud detection processor, the identity-related fields associated with the new account application with identity-related fields associated with a plurality of historical account applications stored in a database, the links forming a graphical pattern; and

performing statistical analysis of the graphical pattern to determine a likelihood that the new account application is fraudulent, wherein the statistical analysis comprises analyzing the graphical pattern to determine whether the graphical pattern is anomalous when considered in relation to a normal graphical pattern.

2. The method of claim 1, further comprising determining a fraud score based on the statistical analysis.

3. The method of claim 1, wherein the identity-related fields associated with the new account application and the plurality of historical account applications include a social security number.

4. The method of claim 1, wherein the identity-related fields associated with the new account application and the plurality of historical account applications include a name.

5. The method of claim 1, wherein the identity-related fields associated with the new account application and the plurality of historical account applications include an address.

6. The method of claim 1, wherein the identity-related fields associated with the new account application and the plurality of historical account applications include a telephone number.

7. The method of claim 1, wherein the statistical analysis comprises analyzing the graphical pattern to determine whether the graphical pattern is consistent with a fraudulent graphical pattern.

8. The method of claim 1, further comprising determining whether information contained in the identity-related fields associated with the new account application are valid.

9. A method for identifying a fraudulent account application, comprising:

receiving, at an identity records interface, a new account application comprising a plurality of identity-related fields;

linking, at a fraud detection processor, the identity-related fields associated with the new account application with identity-related fields associated with a plurality of historical account applications stored in a database, the links forming a graphical pattern;

performing statistical analysis of the graphical pattern; and

applying a plurality of anomaly rules to the graphical pattern, wherein one of the plurality of anomaly rules is derived by analyzing graphical patterns associated with a plurality of non-fraudulent historical identity records.

10. The method of claim 9, further comprising determining a fraud score based on the plurality of anomaly rules.

11. The method of claim 9, wherein a statistical model comprises a neighborhood of links between identity-related fields within the historical account applications.

12. A method for identifying a fraudulent account application, comprising:

receiving, at an identity records interface, a new account application comprising a plurality of identity-related fields;

linking, at a fraud detection processor, the identity-related fields associated with the new account application with identity-related fields associated with a plurality of historical account applications stored in a database, the links forming a graphical pattern;

performing statistical analysis of the graphical pattern; and

applying a plurality of anomaly rules to the graphical pattern, wherein one of the plurality of anomaly rules is derived from statistical analysis of fraud cases.

13. The method of claim 12, wherein the plurality of anomaly rules comprise rules related to multiple names under a single social security number.

14. The method of claim 12, wherein one of the plurality of anomaly rules comprises rules related to multiple names under a single address or home residence.

15. In a system comprising a database of historical account applications, a method for detecting a fraudulent account application, the method comprising:

analyzing the historical account applications stored in a database to identify a normal pattern of identity-related information and links;

developing a statistical model of the identified normal pattern;

receiving, at an identity records interface, a new account application comprising a plurality of identity-related fields;

linking, at a fraud detection processor, the identity-related fields associated with the new account application with identity-related fields associated with the historical account applications stored in the database, the links forming a graphical pattern;

performing statistical analysis of the graphical pattern based on the developed statistical model of a normal pattern; and

applying a plurality of anomaly rules to the graphical pattern.

16. The method of claim 15, further comprising determining a fraud score based on the plurality of anomaly rules.

17. The method of claim 15, wherein the statistical model comprises a neighborhood of links between identity-related fields within the historical account applications, and wherein the method further comprises detecting deviations from the normal identity patterns established in the statistical model.

18. The method of claim 15, wherein one of the plurality of anomaly rules is derived by statistically analyzing graphical patterns associated with a plurality of non-fraudulent historical identity records.

19. The method of claim 15, wherein one of the plurality of anomaly rules is derived from statistical analysis of fraud cases.

20. The method of claim 15, wherein the plurality of anomaly rules comprise rules related to multiple names under a single social security number.

21. The method of claim 15, wherein one of the plurality of anomaly rules comprises rules related to multiple names under a single address or home residence.

22. The method of claim 15, wherein developing the statistical model comprises using case studies of historical account applications.

23. The method of claim 15, wherein developing the statistical model comprises statistically analyzing a plurality of historical account applications.

24. A fraud detection system, comprising:

a database configured to store a plurality of historical account applications, each of the plurality of historical account applications comprising a plurality of identity-related fields;

an identity records interface configured to receive a new account application comprising a plurality of identity-related fields; and

a fraud detection processor interfaced with the database and the new identity records interface, the fraud detection processor configured to;

link the identity-related fields associated with the new account application with identity-related fields associated with a plurality of historical account applications, the links forming a graphical pattern;

perform statistical analysis of the graphical pattern; and

apply a plurality of anomaly rules to the graphical pattern.

25. The fraud detection system of claim 24, wherein the fraud detection processor is further configured to determine a fraud score based on the plurality of anomaly rules.

26. The fraud detection system of claim 24, wherein the statistical model comprises a neighborhood of links between identity-related fields within the historical account applications, and wherein the fraud detection processor is further configured to detect deviations from the normal identity patterns established in the statistical model.

27. The fraud detection system of claim 24, wherein one of the plurality of anomaly rules is derived by statistically analyzing graphical patterns associated with a plurality of non-fraudulent historical identity records.

28. The fraud detection system of claim 24, wherein one of the plurality of anomaly rules is derived from statistical analysis of fraud cases.

29. The fraud detection system of claim 24, wherein the plurality of anomaly rules comprise rules related to multiple names under a single social security number.

30. The fraud detection system of claim 24, wherein one of the plurality of anomaly rules comprises rules related to multiple names under a single address or home residence.

31. A fraud detection system, comprising:

a database configured to store a plurality of historical account applications, each of the plurality of historical account applications comprising a plurality of identity-related fields;

an identity records interface configured to receive a new account application comprising a plurality of identity-related fields; and

a fraud detection processor interfaced with the database and the new identity records interface, the fraud detection processor configured to;

analyze the historical account applications to identify a normal pattern of identity-related information and links;

develop a statistical model of the identified normal pattern;

link the identity-related fields associated with the new account application with identity-related fields associated with the historical account applications, the links forming a graphical pattern;

perform statistical analysis of the graphical pattern based on the developed statistical model of a normal pattern; and

apply a plurality of anomaly rules to the graphical pattern.

32. The fraud detection system of claim 31, wherein the fraud processor is further configured to determine a fraud score based on the plurality of anomaly rules.

33. The fraud detection system of claim 31, wherein the statistical model comprises a neighborhood of historical links between identity-related fields within the historical account applications, and wherein the fraud detection processor is further configured to detect deviations from the normal identity patterns established in the statistical model.

34. The fraud detection system of claim 31, wherein one of the plurality of anomaly rules is derived by statistically analyzing graphical patterns associated with a plurality of non-fraudulent historical identity records.

35. The fraud detection system of claim 31, wherein one of the plurality of anomaly rules is derived from statistical analysis of fraud cases.

36. The fraud detection system of claim 31, wherein the plurality of anomaly rules comprise rules related to multiple names under a single social security number.

37. The fraud detection system of claim 31, wherein one of the plurality of anomaly rules comprises rules related to multiple names under a single address or home residence.

38. The fraud detection system of claim 31, wherein developing the statistical model comprises using case studies of historical account applications.

39. The fraud detection system of claim 31, wherein developing the statistical model comprises statistically analyzing a plurality of historical account applications.