System and method for identity-based fraud detection for transactions using a plurality of historical identity records

• US 7,793,835 B1
• Filed: 07/07/2009
• Issued: 09/14/2010
• Est. Priority Date: 05/12/2003
• Status: Active Grant

• Current Assignee: LexisNexis Risk Solutions, Inc. (RELX PLC)
• Original Assignee: ID Analytics, Inc. (Gen Digital Inc.)
• Inventors: Dichiara, Christer J., Cook, Mike, Coggeshall, Stephen, Jost, Allen, Shao, Xuhul, Blue, Joseph
• Primary Examiner(s): Labaze; Edwyn
• Application Number:
  US12/499,048
• Time in Patent Office: 434 Days
• Field of Search: 235/380, 235/375, 235/379, 235/382.5, 235/487, 705/44, 705/39, 705/38, 705/1, 705/42
• US Class Current: 235/380
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes

Abstract

A method for using transaction records to detect fraud, including receiving a plurality of identity records comprising identity related information; receiving a plurality of transaction records comprising transaction information from a plurality of client institutions; linking the plurality of identity records with each other based on the identity related information; linking the plurality of transaction records with the identity records, wherein a link between a transaction record and an identity record is created when a characteristic of the transaction information of the transaction record is similar to a characteristic of the identity related information of the identity record, the links forming a graphical pattern; and performing statistical analysis of the graphical pattern to detect fraud, wherein the statistical analysis comprises analyzing the graphical pattern to determine whether the graphical pattern is anomalous when considered in relation to a normal graphical pattern.

Claims

1. A method for using transaction records to detect fraud, comprising:

receiving an identity record comprising identity related information;

receiving a plurality of transaction records comprising transaction information from a plurality of client institutions;

linking the plurality of transaction records with the identity record, wherein a link between a transaction record and the identity record is created when a characteristic of the transaction information of the transaction record is similar to a characteristic of the identity related information of the identity record, the links forming a graphical pattern; and

performing statistical analysis of the graphical pattern to detect fraud, wherein the statistical analysis comprises analyzing the graphical pattern to determine whether the graphical pattern is anomalous when considered in relation to a normal graphical pattern.

2. The method of claim 1, further comprising:

linking the plurality of transaction records with each other, wherein a link between a first transaction record and a second transaction record is created when a characteristic of the transaction information of the first transaction record is similar to a characteristic of the transaction information of the second transaction record; and

storing the plurality of linked identity and transaction records and link information for use in detecting fraud.

3. The method of claim 2, wherein identity record comprises fields configured to store the identity related information, and wherein each of the plurality of transaction records comprise fields configured to store the transaction information.

4. The method of claim 3, wherein the fields associated with the plurality of identity records and the fields associated with the plurality of transaction records form nodes, and wherein the graphical pattern comprises a plurality of graphs defined by sets of nodes and sets of edges composed of pairs of nodes sharing a common characteristic.

5. The method of claim 4, wherein the plurality of graphs are combined into a single graph.

6. The method of claim 4, further comprising linking nodes where the characteristic associated with the nodes are identical.

7. The method of claim 4, further comprising linking nodes where the characteristic associated with the nodes are substantially similar.

8. The method of claim 4, wherein the edges connecting the nodes are given fuzzy values.

9. The method of claim 8, further comprising linking nodes based on a comparison of the fuzzy values associated with the edges.

10. The method of claim 4, wherein the graphical pattern is stored as an adjacency matrix.

11. The method of claim 10, wherein only the non-zero elements of the adjacency matrix are stored.

12. The method of claim 4, further comprising storing auxiliary information with at least some of the nodes in the graphical pattern.

13. The method of claim 4, further comprising storing auxiliary information with at least some of the edges comprising the graphical pattern.

14. The method of claim 2, further comprising receiving a new identity record, using the stored, linked identity and transaction records to evaluate the new identity record, and updating the stored, linked identity and transaction records with the new identity record.

15. The method of claim 2, further comprising receiving a new transaction record, using the plurality of stored, linked identity and transaction records to evaluate the new transaction record, and updating the stored, linked identity and transaction records with the new transaction record.

16. The method of claim 1 further comprising building variables as inputs to the statistical analysis using the graphical pattern.

17. A method for detecting fraud, comprising:

receiving a plurality of transaction records comprising transaction information from a plurality of client institutions;

linking the plurality of transaction records with each other, wherein a link between a first transaction record and a second transaction record is created when a characteristic of the transaction information of the first transaction record is similar to a characteristic of the transaction information of the second transaction record, the links forming a transaction graphical pattern; and

performing statistical analysis of the transaction graphical pattern to detect fraud, wherein the statistical analysis comprises analyzing the transaction graphical pattern to determine whether the transaction graphical pattern is anomalous when considered in relation to a normal graphical pattern.

18. The method of claim 17, further comprising:

receiving a plurality of identity records, each comprising identity related information, from a plurality of client institutions;

linking the plurality of identity records with each other, wherein a link between a first identity record and a second identity record is created when a characteristic of the identity related information of the first identity record is similar to a characteristic of the identity related information of the second identity record; and

storing the plurality of linked identity records and the plurality of linked transaction records and link information for use in detecting fraud;

wherein the plurality of linked identity records are stored as an identity graphical pattern and the plurality of linked transaction records are stored as a transaction graphical pattern.

19. The method of claim 18, wherein each of the plurality of identity records comprise fields configured to store the identity related information, and wherein each of the plurality of transaction records comprise fields configured to store the transaction information.

20. The method of claim 19, wherein the fields associated with the plurality of identity records and the fields associated with the plurality of transaction records form nodes, and wherein the identity and transactional graphical patterns comprise a plurality of graphs defined by sets of nodes and sets of edges composed of pairs of nodes sharing a common characteristic.

21. The method of claim 20, wherein the plurality of graphs comprising the identity graphical pattern and the plurality of graphs comprising the transaction graphical pattern are combined into single graphs.

22. The method of claim 20, further comprising linking nodes associated with the plurality of identity records where the characteristic associated with the nodes are identical.

23. The method of claim 20, further comprising linking nodes associated with the plurality of transaction records where the characteristic associated with the nodes are identical.

24. The method of claim 20, further comprising linking nodes associated with the plurality of identity records where the characteristic associated with the nodes are substantially similar.

25. The method of claim 20, further comprising linking nodes associated with the plurality of transaction records where the characteristic associated with the nodes are substantially similar.

26. The method of claim 20, wherein the edges connecting the nodes are given fuzzy values.

27. The method of claim 26, further comprising linking nodes associated with the plurality of identity records based on a comparison of the fuzzy values associated with the edges.

28. The method of claim 27, further comprising linking nodes associated with the plurality of transaction records based on a comparison of the fuzzy values associated with the edges.

29. The method of claim 20, wherein the identity and transaction graphical patterns are stored as adjacency matrices.

30. The method of claim 29, wherein only the non-zero elements of the adjacency matrices are stored.

31. The method of claim 20, further comprising storing auxiliary information with at least some of the nodes in at least one of the identity and transactional graphical patterns.

32. The method of claim 20, further comprising storing auxiliary information with at least some of the edges comprising the least one of the identity and transaction graphical patterns.

33. The method of claim 18, further comprising receiving a new identity record, using the plurality of stored, linked identity and transaction records to evaluate the new identity record, and updating the plurality of stored, linked identity records with the new identity record.

34. The method of claim 18, further comprising receiving a new transaction record, using the plurality of stored, linked identity and transaction records to evaluate the new transaction record, and updating the plurality of stored, linked transaction records with the new transaction record.

35. The method of claim 18 further comprising building variables as inputs to the statistical analysis using the identity graphical pattern.

36. The method of claim 17 further comprising building variables as inputs to the statistical analysis using the transactional graphical pattern.

37. A method for detecting fraud, comprising:

receiving a plurality of transaction records comprising transaction information from a plurality of client institutions;

linking the plurality of transaction records with each other, wherein a link between a first transaction record and a second transaction record is created when a characteristic of the transaction information of the first transaction record is similar to a characteristic of the transaction information of the second transaction record, the links forming a transaction graphical pattern;

performing statistical analysis of the transaction graphical pattern; and

applying a plurality of anomaly rules to the transaction graphical pattern, wherein one of the plurality of anomaly rules is derived by analyzing graphical patterns associated with a plurality of non-fraudulent historical identity records.

38. The method of claim 37, further comprising:

receiving a plurality of identity records, each comprising identity related information, from a plurality of client institutions;

linking the plurality of identity records with each other, wherein a link between a first identity record and a second identity record is created when a characteristic of the identity related information of the first identity record is similar to a characteristic of the identity related information of the second identity record; and

storing the plurality of linked identity records and the plurality of linked transaction records and link information for use in detecting fraud;

wherein the plurality of linked identity records are stored as an identity graphical pattern and the plurality of linked transaction records are stored as the transaction graphical pattern.

39. The method of claim 38, wherein each of the plurality of identity records comprise fields configured to store the identity related information, and wherein each of the plurality of transaction records comprise fields configured to store the transaction information.

40. The method of claim 39, wherein the fields associated with the plurality of identity records and the fields associated with the plurality of transaction records form nodes, and wherein the identity and transactional graphical patterns comprise a plurality of graphs defined by sets of nodes and sets of edges composed of pairs of nodes sharing a common characteristic.

41. The method of claim 40, wherein the plurality of graphs comprising the identity graphical pattern and the plurality of graphs comprising the transaction graphical pattern are combined into single graphs.

42. The method of claim 40, further comprising linking nodes associated with the plurality of identity records where the characteristic associated with the nodes are identical.

43. The method of claim 40, further comprising linking nodes associated with the plurality of transaction records where the characteristic associated with the nodes are identical.

44. The method of claim 40, further comprising linking nodes associated with the plurality of identity records where the characteristic associated with the nodes are substantially similar.

45. The method of claim 40, further comprising linking nodes associated with the plurality of transaction records where the characteristic associated with the nodes are substantially similar.

46. The method of claim 40, wherein the edges connecting the nodes are given fuzzy values.

47. The method of claim 46, further comprising linking nodes associated with the plurality of identity records based on a comparison of the fuzzy values associated with the edges.

48. The method of claim 46, further comprising linking nodes associated with the plurality of transaction records based on a comparison of the fuzzy values associated with the edges.

49. The method of claim 40, wherein the identity and transaction graphical patterns are stored as adjacency matrices.

50. The method of claim 49, wherein only the non-zero elements of the adjacency matrices are stored.

51. The method of claim 40, further comprising storing auxiliary information with at least some of the nodes in at least one of the identity and transactional graphical patterns.

52. The method of claim 40, further comprising storing auxiliary information with at least some of the edges comprising the least one of the identity and transaction graphical patterns.

53. The method of claim 38, further comprising receiving a new identity record, using the plurality of stored, linked identity and transaction records to evaluate the new identity record, and updating the plurality of stored, linked identity records with the new identity record.

54. The method of claim 38, further comprising receiving a new transaction record, using the plurality of stored, linked identity and transaction records to evaluate the new transaction record, and updating the plurality of stored, linked transaction records with the new transaction record.

55. The method of claim 37 further comprising building variables as inputs to the statistical analysis using the identity graphical pattern.

56. The method of claim 37 further comprising building variables as inputs to the statistical analysis using the transactional graphical pattern.

57. A method for using transaction records to detect fraud, comprising:

receiving a plurality of identity records comprising identity related information;

receiving a plurality of transaction records comprising transaction information from a plurality of client institutions;

linking the plurality of identity records with each other based on the identity related information;

linking the plurality of transaction records with the identity records, wherein a link between a transaction record and an identity record is created when a characteristic of the transaction information of the transaction record is similar to a characteristic of the identity related information of the identity record, the links forming a graphical pattern; and

performing statistical analysis of the graphical pattern to detect fraud, wherein the statistical analysis comprises analyzing the graphical pattern to determine whether the graphical pattern is anomalous when considered in relation to a normal graphical pattern.

58. The method of claim 57 further comprising building variables as inputs to the statistical analysis using the graphical pattern.