Method and apparatus for evaluating fraud risk in an electronic commerce transaction

• US 7,865,427 B2
• Filed: 05/08/2002
• Issued: 01/04/2011
• Est. Priority Date: 05/30/2001
• Status: Active Grant

• Current Assignee: Cybersource Corporation (Visa, Inc.)
• Original Assignee: Cybersource Corporation (Visa, Inc.)
• Inventors: Hu, Hung-Tzaw, Wright, William
• Primary Examiner(s): Kramer; James A
• Assistant Examiner(s): Gottschalk; Martin A
• Application Number:
  US10/142,271
• Publication Number:
  US 20020194119A1
• Time in Patent Office: 3,163 Days
• Field of Search: 705/38, 705/35, 705/39
• US Class Current: 705/38
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 20/403 Solvency checks
• CPC Class Codes: G06Q 30/0609 Buyer or seller confidence or verification
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof
• CPC Class Codes: G06Q 40/08 Insurance
• CPC Class Codes: G07F 7/08 by coded identity card or credit card or other personal identification means without personal verification means G07F7/02

Abstract

According to one aspect, transaction information is received and applied to multiple fraud risk mathematical models that each produce a respective raw score, which are transformed with respective sigmoidal transform functions to produce optimized likelihood of fraud risk estimates to provide to a merchant. In one embodiment, the respective fraud risk estimates are combined using fusion proportions that are associated with the respective risk estimates, producing a single point risk estimate, which is transformed with a sigmoidal function to produce an optimized single point risk estimate for the transaction. The sigmoidal functions are derived to approximate a relationship between risk estimates produced by fraud risk detection models and a percentage of transactions associated with respective risk estimates, where the relationship is represented in terms of real-world distributions of fraudulent transaction and non-fraudulent transaction. One embodiment is directed to computing respective risk test penalties for multiple risk tests in one or more of the multiple fraud risk mathematical models used to estimate the likelihood of fraud, given a certain pattern of events represented by the transaction information, wherein the respective risk test penalties are computed as the inverse of the sum of one and a false positive ratio for the respective risk test.

Claims

1. A method for evaluating fraud risk in an electronic commerce transaction and providing a representation of the fraud risk to a merchant using electronic communication, the method comprising:

generating and storing two or more fraud risk mathematical models, each model having a corresponding distribution of fraudulent transactions and a corresponding distribution of non-fraudulent transactions;

generating for each mathematical model of the two or more mathematical models, a pair of corresponding sigmoidal functions, wherein one sigmoidal function of the pair of corresponding sigmoidal functions approximates a relationship between a set of raw scores produced by said each mathematical model and a percentage of fraudulent transactions associated with each raw score of the set of raw scores, and another sigmoidal function of the pair of corresponding sigmoidal functions approximates a relationship between said each raw score and a percentage of non-fraudlent transactions associated with said each raw score;

defining for each mathematical model a first point at which a number of transactions that represent mistaken sales begin to have a positive count;

a second point at which a number of transactions that represent mistaken rejections begin to have a zero count; and

a third point at which the fraudulent and non-fraudulent transaction distributions for said each mathematical model intersect, wherein the third point corresponds to a particular raw score for which a percentage of fraudulent transactions equals a percentage of non-fraudulent transactions;

receiving transaction information and performing;

applying the transaction information to the two or more fraud risk mathematical models, wherein each mathematical model produces a corresponding raw score; and

transforming the two or more corresponding raw scores into a single corresponding risk estimate using a first transform function when a raw score falls within a range of values between raw scores corresponding to the first point and the third point respectively, or a second transform function when the raw score falls within a range of values between raw scores corresponding to the third point and the second point respectively;

wherein the first transform function is different from the second transform function;

wherein the method is performed by a computer system.

2. The method claim 1 wherein two or more fraud risk mathematical models are applied to the transaction information to generate corresponding risk estimates, the method comprising the steps of:

combining two or more of the corresponding risk estimates, using fusion proportions that are associated with the two or more fraud risk mathematical models that generate the corresponding risk estimates, to produce a single point risk estimate for the transaction; and

transforming the single point risk estimate with a sigmoidal function to produce an optimized single point risk estimate for the transaction.

3. The method of claim 2 wherein each of the two or more corresponding risk estimates is based on a corresponding statistical mathematical model from a set of one or more statistical mathematical models or on a corresponding heuristic mathematical model from a set of one or more heuristic mathematical models, and wherein at least one corresponding risk estimate is based on a corresponding statistical mathematical model and at least one other corresponding risk estimate is based on a corresponding heuristic mathematical model, and wherein the step of combining two or more of the corresponding risk estimates comprises the steps of:

establishing either the corresponding statistical mathematical model or the corresponding heuristic mathematical model as a first scoring authority for establishing the boundaries of fraud risk zones from a set of fraud risk zones;

establishing the first scoring authority with authority to modify at least one corresponding risk estimate, from the two or more corresponding risk estimates, that is in a first particular fraud risk zone from the set of fraud risk zones, based on an intent of the first scoring authority with respect to transaction information;

establishing as a second scoring authority the other of the corresponding statistical and heuristic mathematical models that is not the first scoring authority; and

establishing the second scoring authority with authority to modify at least one corresponding risk estimate, from the two or more corresponding risk estimates, that is in a second particular fraud risk zone from the set of fraud risk zones that is different than the first particular fraud risk zone, based on an intent of the second scoring authority with respect to transaction information.

4. The method of claim 2 wherein the step of combining two or more of the corresponding risk estimates comprises the steps of:

analyzing performance characteristics of the two or more fraud risk mathematical models in view of distribution characteristics of a set of fraud risk zones, wherein the distribution characteristics are in terms of a relationship between fraudulent and non-fraudulent transactions and a percentage of transactions associated with a risk estimate; and

determining a corresponding contribution from each of the two or more fraud risk mathematical models to the single point risk estimate for the transaction, based on the analyzed performance characteristics of the two or more fraud risk mathematical models.

5. The method of claim 4 comprising the step of:

adjusting the corresponding contributions from the two or more fraud risk mathematical models based on a merchant preference for one fraud risk type in relation to another fraud risk type.

6. The method of claim 2 comprising the steps of:

determining intermediate fusion proportions that are associated with the corresponding risk estimates from a perspective of each of the two or more fraud risk mathematical models; and

reducing the intermediate fusion proportions to the fusion proportions that are associated with the two or more fraud risk mathematical models that generate the corresponding risk estimates, based on a non-linear classification algorithm.

7. The method of claim 1 wherein the two or more fraud risk mathematical models each include a plurality of risk tests, the method comprising:

computing a corresponding risk test penalty for at least some of the plurality of risk tests of the two or more fraud risk mathematical models, wherein the corresponding risk test penalty is equal to the inverse of the sum of one and a false positive ratio for a corresponding risk test and wherein the false positive ratio is a ratio of correct risk detections of fraudulent transactions to incorrect referrals of fraudulent transactions generated by the corresponding risk test; and

computing a weighted summation of the risk test penalties to produce the corresponding raw score for the transaction.

8. The method of claim 1 wherein the step of generating the corresponding sigmoidal functions is performed by aligning inflection points of corresponding sigmoidal functions to the first, second, and third points.

9. The method of claim 1 wherein the step of generating the corresponding sigmoidal functions comprises the step of generating corresponding sigmoidal functions that are dynamically adjustable based on a change to the relationship.

10. A computer-readable volatile or non-volatile medium storing one or more sequences of instructions for evaluating fraud risk in an electronic commerce transaction and providing a representation of the fraud risk to a merchant using electronic communication, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

generating and storing two or more fraud risk mathematical models, each model having a corresponding distribution of fraudulent transactions and a corresponding distribution of non-fraudulent transactions;

generating for each mathematical model of the two or more mathematical models, a pair of corresponding sigmoidal functions, wherein one sigmoidal function of the pair of corresponding sigmoidal functions approximates a relationship between a set of raw scores produced by said each mathematical model and a percentage of fraudulent transactions associated with each raw score of the set of raw scores, and another sigmoidal function of the pair of corresponding sigmoidal functions approximates a relationship between said each raw score and a percentage of non-fraudulent transactions associated with said each raw score;

defined by defining for each mathematical model a first point at which a number of transactions that represent mistaken sales begin to have a positive count;

a second point at which a number of transactions that represent mistaken rejections begin to have a zero count; and

a third point at which the fraudulent and non-fraudulent transaction distributions for said each mathematical model intersect, wherein the third point corresponds to a particular raw score for which a percentage of fraudulent transactions equals a percentage of non-fraudulent transactions;

receiving transaction information and performing;

applying the transaction information to the two or more fraud risk mathematical models, wherein each mathematical model produces a corresponding raw score; and

transforming the two or more corresponding raw scores into a single corresponding risk estimate using a first transform function when a raw score falls within a range of values between raw scores corresponding to the first point and the third point respectively, or a second transform function when the raw score falls within a range of values between raw scores corresponding to the third point and the second point respectively;

wherein the first transform function is different from the second transform function.

11. The computer-readable volatile or non-volatile medium of claim 10 wherein two or more fraud risk mathematical models are applied to the transaction information to generate corresponding risk estimates, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of:

combining two or more of the corresponding risk estimates, using fusion proportions that are associated with the corresponding risk estimates, to produce a single point risk estimate for the transaction; and

transforming the single point risk estimate with a sigmoidal function to produce an optimized single point risk estimate for the transaction.

12. The computer-readable volatile or non-volatile medium of claim 11 wherein each of the two or more corresponding risk estimates is based on a corresponding statistical mathematical model from a set of one or more statistical mathematical models or on a corresponding heuristic mathematical model from a set of one or more heuristic mathematical models, and wherein at least one corresponding risk estimate is based on a corresponding statistical mathematical model and at least one other corresponding risk estimate is based on a corresponding heuristic mathematical model, and wherein the instructions for combining two or more of the corresponding risk estimates comprises instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of:

establishing either the corresponding statistical mathematical model or the corresponding heuristic mathematical model as a first scoring authority for establishing the boundaries of fraud risk zones from a set of fraud risk zones;

establishing the first scoring authority with authority to modify at least one corresponding risk estimate, from the two or more corresponding risk estimates, that is in a first particular fraud risk zone from the set of fraud risk zones, based on an intent of the first scoring authority with respect to transaction information;

establishing as a second scoring authority the other of the corresponding statistical and heuristic mathematical models that is not the first scoring authority; and

establishing the second scoring authority with authority to modify at least one corresponding risk estimate, from the two or more corresponding risk estimates, that is in a second particular fraud risk zone from the set of fraud risk zones that is different than the first particular fraud risk zone, based on an intent of the second scoring authority with respect to transaction information.

13. The computer-readable volatile or non-volatile medium of claim 11 wherein the instructions for combining two or more of the corresponding risk estimates comprises instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of:

analyzing performance characteristics of the two or more fraud risk mathematical models in view of distribution characteristics of a set of fraud risk zones, wherein the distribution characteristics are in terms of a relationship between fraudulent and non-fraudulent transactions and a percentage of transactions associated with a risk estimate; and

determining a corresponding contribution from each of the two or more fraud risk mathematical models to the single point risk estimate for the transaction, based on the analyzed performance characteristics of the two or more fraud risk mathematical models.

14. The computer-readable volatile or non-volatile medium of claim 13, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of:

adjusting the corresponding contributions from the two or more fraud risk mathematical models based on a merchant preference for one fraud risk type in relation to another fraud risk type.

15. The computer-readable volatile or non-volatile medium of claim 11 further comprising instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of:

determining intermediate fusion proportions that are associated with the corresponding risk estimates from a perspective of each of the two or more fraud risk mathematical models; and

reducing the intermediate fusion proportions to the fusion proportions that are associated with the two or more fraud risk mathematical models that generate the corresponding risk estimates, based on a non-linear classification algorithm.

16. The computer-readable volatile or non-volatile medium of claim 10 wherein the two or more fraud risk mathematical models each include a plurality of risk tests, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of:

computing a corresponding risk test penalty for at least some of the plurality of risk tests of the two or more fraud risk mathematical models, wherein the corresponding risk test penalty is equal to the inverse of the sum of one and a false positive ratio for a corresponding risk test and wherein the false positive ratio is a ratio of correct risk-detections of fraudulent transactions to incorrect referrals of fraudulent transactions generated by the respective risk test; and

computing a weighted summation of the risk test penalties to produce the respective raw score for the transaction.

17. The computer-readable volatile or non-volatile medium of claim 10 wherein the instructions for generating the corresponding sigmoidal functions is performed by aligning inflection points of corresponding sigmoidal functions to the first, second, and third points.

18. The computer-readable volatile or non-volatile medium of claim 10 wherein the instructions for generating the corresponding sigmoidal functions comprises the step of generating corresponding sigmoidal functions that are dynamically adjustable based on a change to the relationship.