System and method of detecting fraud

• US 7,668,769 B2
• Filed: 10/03/2006
• Issued: 02/23/2010
• Est. Priority Date: 10/04/2005
• Status: Active Grant

• Current Assignee: Corelogic Solutions LLC (CoreLogic Incorporated)
• Original Assignee: BasePoint Analytics LLC (CoreLogic Incorporated)
• Inventors: Baker, James C., Liao, Yuansong, Spoelstra, Jacob
• Primary Examiner(s): Trammell; James P
• Assistant Examiner(s): Tran; Hai
• Application Number:
  US11/543,271
• Publication Number:
  US 20070106582A1
• Time in Patent Office: 1,239 Days
• Field of Search: 705 35- 44, 700/90, 704/231
• US Class Current: 705/35
• CPC Class Codes: G06Q 10/067 Enterprise or organisation modelling
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/108 Remote banking, e.g. home banking
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 20/403 Solvency checks
• CPC Class Codes: G06Q 30/0185 Product, service or business identity fraud
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof
• CPC Class Codes: G06Q 40/08 Insurance
• CPC Class Codes: G06Q 40/12 Accounting

Abstract

Embodiments include systems and methods of detecting fraud. In particular, one embodiment includes a system and method of detecting fraud in transaction data such as payment card transaction data. For example, one embodiment includes a computerized method of detecting that comprises receiving data associated with a financial transaction and at least one transacting entity, wherein the data associated with the transacting entity comprises at least a portion of each of a plurality of historical transactions of the transacting entity, applying the data to at least one first model, generating a score based on the first model, and generating data indicative of fraud based at least partly on the score. Other embodiments include systems and methods of generating models for use in fraud detection systems.

Claims

1. A computerized method of detecting fraud, the method comprising:

receiving, on at least one processor, data associated with a financial transaction and at least one transacting entity, wherein the data associated with the transacting entity comprises respective values of at least one data field of each of a plurality of historical transactions of the transacting entity;

applying the data to at least one first model;

generating a score based on the first mode; and

generating data indicative of fraud based at least partly on the score.

2. The method of claim 1, further comprising:

authorizing the financial transaction based on the data indicative of fraud.

3. The method of claim 1, further comprising:

associating an indicator of fraud with at least one of the transacting entity and an account associated with the transacting entity.

4. The method of claim 1, further comprising:

identifying the transaction data for review based on in part on the indicator of fraud.

5. The method of claim 1, further comprising:

selecting the at least one first model based on the at least a portion of each of the plurality of historical transactions.

6. The method of claim 5, further comprising:

selecting at least a second model based on the data associated with the financial transaction.

7. The method of claim 1, wherein the at least one first model comprises a plurality of models.

8. The method of claim 7, wherein generating the data indicative of the fraud comprises combining outputs of the plurality of models using at least one of a committee or panel of experts.

9. The method of claim 7, wherein each of the plurality of models comprises an independent software module.

10. The method of claim 1, wherein the plurality of historical transactions comprise a time series.

11. The method of claim 1, wherein the at least one transacting entity comprises at least one of an account holder, a merchant, a point of sale terminal, or an automated teller machine.

12. The method of claim 1, wherein the at least one first model comprises at least one of:

a neural network, a cascaded neural network, a support vector machine, a genetic algorithm, a fuzzy logic model, a case-based reasoning model, a decision tree, a naï

ve Bayesian model, a logistic regression model, and a scorecard model.

13. The method of claim 1, further comprising:

applying at least one second model to the at least a portion of each of the plurality of historical transactions; and

identifying a first cluster with the transacting entity based on the at least one second model.

14. The method of claim 13, further comprising:

selecting the at least one first model based at least partly on data associated with the first data cluster.

15. The method of claim 14, wherein applying the data to the at least one first model comprises applying data indicative of historical transactions of at least one other transacting entity associated with the first cluster to the at least one model.

16. The method of claim 14, further comprising:

identifying a second data cluster associated with the transacting entity based on the at least one second model, wherein generating data indicative of fraud is based at least partly on the second cluster.

17. The method of claim 16, further comprising:

identifying a transition from the first cluster to the second cluster.

18. The method of claim 17, wherein generating data indicative of fraud is based at least partly on the identified transition.

19. The method of claim 16, wherein the at least one second model comprises at least one of:

a neural network, a cascaded neural network, a support vector machine, a genetic algorithm, a fuzzy logic model, a case-based reasoning model, a decision tree, a naï

ve Bayesian model, a logistic regression model, and a scorecard model.

20. The method of claim 1, wherein generating data indicative of fraud is performed substantially in real time.

21. The method of claim 1, wherein generating data indicative of fraud is performed in a batch mode.

41. The method of claim 1, wherein the transacting entity is an account, wherein the method further comprises:

applying the received data to at least one second model;

identifying the transacting entity as being associated with a plurality of clusters, wherein each of the clusters associates with a plurality of accounts based on the application of the received data to the at least one second model and the received data;

identifying a transition associated with the transacting entity between at least two of the clusters; and

generating data indicative of fraud based at least partly on the score and at least partly on the identified transition.

22. A system for detecting fraud, the system comprising:

a storage configured to receive data associated with at least one transacting entity, wherein the data associated with the transacting entity comprises respective values of at least one data field of each of a plurality of historical transactions of the transacting entity; and

a processor configured to;

apply transaction data and the data associated with the at least one transacting entity to at least one first model;

generate a score based on the first model; and

generate data indicative of fraud based at least partly on the score.

23. The system of claim 22, wherein the processor is further configured to associate an indicator of fraud with at least one of the transacting entity and an account associated with the transacting entity.

24. The system of claim 22, wherein the processor is further configured to select the at least one first model based on the at least a portion of each of the plurality of historical transactions.

25. The system of claim 24, wherein the processor is further configured to select at least a second model based on the data associated with the financial transaction.

26. The system of claim 22, wherein the at least one first model comprises a plurality of models.

27. The system of claim 26, wherein the processor is configured to generate the data indicative of the fraud at least in part by combining outputs of the plurality of models using at least one of a committee or panel of experts.

28. The system of claim 26, wherein each of the plurality of models comprises an independent software module.

29. The system of claim 22, wherein the plurality of historical transactions comprise a time series.

30. The system of claim 22, wherein the at least one transacting entity comprises at least one of an account holder, a merchant, a point of sale terminal, or an automated teller machine.

31. The system of claim 22, wherein the at least one first model comprises at least one of:

a neural network, a cascaded neural network, a support vector machine, a genetic algorithm, a fuzzy logic model, a case-based reasoning model, a decision tree, a naï

ve Bayesian model, a logistic regression model, and a scorecard model.

32. The system of claim 22, wherein the processor is further configured to:

apply at least one second model to the at least a portion of each of the plurality of historical transactions; and

identify a first cluster with the transacting entity based on the at least one second model.

33. The system of claim 32, wherein the processor is further configured to select the at least one first model based at least partly on data associated with the first data cluster.

34. The system of claim 33, wherein the processor is further configured to apply the data to the at least one first model at least in part by applying data indicative of historical transactions of at least one other transacting entity associated with the first cluster to the at least one model.

35. The system of claim 33, wherein the processor is further configured to identify a second data cluster associated with the transacting entity based on the at least one second model, wherein the processor is further configured to generate data indicative of fraud is based at least partly on the second cluster.

36. The system of claim 35, wherein the processor is further configured to identify a transition from the first cluster to the second cluster.

37. The system of claim 36, wherein the processor is further configured to generate the data indicative of fraud based at least partly on the identified transition.

38. The system of claim 35, wherein the at least one second model comprises at least one of:

a neural network, a cascaded neural network, a support vector machine, a genetic algorithm, a fuzzy logic model, a case-based reasoning model, a decision tree, a naï

ve Bayesian model, a logistic regression model, and a scorecard model.

42. The system of claim 22, wherein the transacting entity is an account, wherein the processor is further configured to:

apply the received data to at least one second model;

identify the transacting entity as being associated with a plurality of clusters, wherein each of the clusters associates with a plurality of accounts based on the application of the received data to the at least one second model and the received data;

identify a transition associated with the transacting entity between at least two of the clusters; and

generate data indicative of fraud based at least partly on the score and at least partly on the identified transition.

39. A system for detecting fraud, the system comprising:

means for receiving data associated with at least one transacting entity, wherein the data associated with the transacting entity comprises respective values of at least one data field of each of a plurality of historical transactions of the transacting entity; and

means for processing transaction data, said processing means configured to;

apply transaction data and the data associated with the at least one transacting entity to at least one first model;

generate a score based on the first model; and

generate data indicative of fraud based at least partly on the score.

43. The system of claim 39, wherein the transacting entity is an account, wherein the processing means is further configured to:

apply the received data to at least one second model;

identify the transacting entity as being associated with a plurality of clusters, wherein each of the clusters associates with a plurality of accounts based on the application of the received data to the at least one second model and the received data;

identify a transition associated with the transacting entity between at least two of the clusters; and

generate data indicative of fraud based at least partly on the score and at least partly on the identified transition.

40. A computerized method of detecting fraud, the method comprising:

receiving, on a processor, data associated with a financial transaction and at least one account, wherein the data associated with the account comprises respective values of at least one data field of each of a plurality of historical transactions of the account;

applying the received data to at least one first model;

generating a score based on the first model;

applying the received data to at least one second model;

identifying the account as being associated with a plurality of clusters,

wherein each of the clusters is identified as being associated with a plurality of accounts based on the application of the received data to the at least one second model and the received data and

wherein the at least one cluster is based at least in part on respective data values of the at least one data field of each of the plurality of historical transactions associated with each of the plurality of historical transactions of each of the plurality of accounts;

identifying a transition associated with the account between at least two of the clusters; and

generating data indicative of fraud based at least partly on the score and at least partly on the identified transition.

44. The method of claim 40, wherein the plurality of historical transactions of the account comprise a time series.

45. The method of claim 40, wherein the at least one transacting entity comprises at least one of an account holder, a merchant, a point of sale terminal, or an automated teller machine.