Method and apparatus for evaluating fraud risk in an electronic commerce transaction

• US 7,970,701 B2
• Filed: 02/20/2008
• Issued: 06/28/2011
• Est. Priority Date: 07/28/1997
• Status: Expired due to Fees

• Current Assignee: Cybersource Corporation (Visa, Inc.)
• Original Assignee: Cybersource Corporation (Visa, Inc.)
• Inventors: Lewis, Michael, Arnold, Thomas, Pettit, John, King, Frank, Wright, William
• Primary Examiner(s): PATEL, JAGDISH
• Application Number:
  US12/034,447
• Publication Number:
  US 20080140576A1
• Time in Patent Office: 1,224 Days
• Field of Search: 705/35, 705/39, 705/38
• US Class Current: 705/38
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 30/0185 Product, service or business identity fraud
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof

Abstract

A technique for evaluating fraud risk in e-commerce transactions between consumer and a merchant is disclosed. The merchant requests service from the system using a secure, open messaging protocol. An e-commerce transaction or electronic purchase order is received from the merchant, the level of risk associated with each order is measured, and a risk score is returned. In one embodiment, data validation, highly predictive artificial intelligence pattern matching, network data aggregation and negative file checks are used. The system performs analysis including data integrity checks and correlation analyses based on characteristics of the transaction. Other analysis includes comparison of the current transaction against known fraudulent transactions, and a search of a transaction history database to identify abnormal patterns, name and address changes, and defrauders. In one alternative, scoring algorithms are refined through use of a closed-loop risk modeling process enabling the service to adapt to new or changing fraud patterns.

Claims

1. A method of evaluating fraud risk of an electronic commerce transaction, the method comprising the computer-implemented steps of:

receiving transaction data that defines the electronic commerce transaction;

determining a first fraud risk score value associated with the electronic commerce transaction based on applying a plurality of tests to the transaction data, wherein each of the plurality of tests determines whether the transaction data appears to represent a genuine transaction based on specified criteria;

determining a second fraud risk score value associated with the electronic commerce transaction based on a comparison of the transaction data to historical transaction data;

combining the first fraud risk score value and the second fraud risk score value using a statistical model to result in creating a model score value; and

blending the model score value with one or more merchant-specific threshold values to result in creating and storing a final fraud risk score value for the electronic commerce transaction;

wherein the step of blending the model score value comprises the steps of;

determining in which fraud risk zone, of two or more fraud risk zones, the boundaries of which are determined by the one or more merchant-specific threshold values, the model score value belongs; and

applying a policy corresponding to the determined fraud risk zone, wherein the policy dictates a magnitude and an allowable direction of influence applied by a heuristic model and a statistical model,

wherein the method is performed by one or more computing devices.

2. A method as recited in claim 1, wherein receiving transaction data comprises the steps of receiving transaction data that defines the electronic commerce transaction for a particular Internet identity, and wherein determining a second fraud risk score value comprises the steps of determining a second fraud risk score value associated with the electronic commerce transaction based on a comparison of the transaction data to historical transaction data for other electronic commerce transactions pertaining to the same Internet identity.

3. A method as recited in claim 2, wherein the particular Internet identity comprises a first hash value of an email address of a prospective purchaser carried in combination with a second hash value of a card bank identification number of the prospective purchaser and with a third hash value based on a shipping address of the prospective purchaser.

4. A method as recited in claim 2, wherein the particular Internet identity comprises a first hash value of an prospective purchaser'"'"'s host IP address, in combination with a second hash value of an email address of a prospective purchaser carried, in combination with a third hash value of a card bank identification number of the prospective purchaser and a fourth hash value based on a shipping address of the prospective purchaser.

5. A method as recited in claim 2, wherein the particular Internet identity comprises a first hash value of a prospective purchaser'"'"'s hardware device ID value, in combination with a second hash value of either the email address or user ID of the prospective purchaser, in combination with a third hash value of a card bank identification number of the prospective purchaser and with a fourth hash value based on a shipping address of the prospective purchaser.

6. A method as recited in claim 1, wherein the step of determining the second fraud risk score value comprises the steps of:

retrieving one or more records of historic transaction data pertaining to past transactions associated with the transaction data;

when one of the records of historic transaction data is found to contain a fraud list tag, discontinuing further retrieval of such records;

determining the second fraud risk score value associated with the electronic commerce transaction based on only the retrieved records of historical transaction data in comparison to the transaction data.

7. A method as recited in claim 1, wherein the step of determining the second fraud risk score value comprises the steps of:

retrieving one or more records of historic transaction data pertaining to past electronic commerce transactions associated with the transaction data;

when a specified amount of the records of historic transaction data is retrieved and further records of historic transaction data remain to be retrieved, discontinuing further retrieval of such records;

determining the second fraud risk score value associated with the electronic commerce transaction based on only the retrieved records of historical transaction data in comparison to the transaction data.

8. The method as recited in claim 1, wherein the step of blending the model score value comprises the steps of blending the model score value with one or more merchant-specific threshold values to result in creating and storing a final fraud risk score value for the electronic commerce transaction and one or more return code values that signal specified risk issues that have been detected with respect to the transaction.

9. The method as recited in claim 1, wherein determining the first fraud risk score value comprises the steps of determining a first fraud risk score value associated with the electronic commerce transaction based on applying a plurality of tests to the transaction data, wherein one of the plurality of tests determines whether an Internet identity in the transaction data is found in a list of parties to known past fraudulent transactions.

10. The method as recited in claim 1, wherein determining the first fraud risk score value comprises the steps of determining a first fraud risk score value associated with the electronic commerce transaction based on applying a plurality of tests to the transaction data, wherein one of the plurality of tests determines whether an Internet identity in the transaction data is found in a list of trusted parties.

11. A method as recited in claim 1, wherein determining the first fraud risk score value comprises the steps of determining a first fraud risk score value associated with the electronic commerce transaction based on applying a plurality of tests to the transaction data, wherein one of the plurality of tests comprises the steps of:

receiving the text value;

for each bi-gram in the text value, retrieving from a table of bi-gram probability values a probability value that represents a probability that the bi-gram is found in a genuine text value;

generating a penalty value when the retrieved probability values indicate that the text value comprises a combination of bi-grams that are not likely to represent a genuine text value.

12. A method as recited in claim 1, wherein determining the first fraud risk score value comprises the steps of determining a first fraud risk score value associated with the electronic commerce transaction based on applying a plurality of tests to the transaction data, by the steps of:

receiving the name value;

for each bi-gram in the text value, retrieving from a table of bi-gram probability values a probability value that represents a probability that the bi-gram is found in a genuine name value, wherein the table of bi-gram probability values is created based on an actual frequency of occurrences of bi-grams in a large sample of genuine names;

generating a penalty value when the retrieved probability values indicate that the text value comprises a combination of bi-grams that are not likely to represent a genuine name value.

13. A method as recited in claim 1, wherein determining the first fraud risk score value comprises the steps of determining a first fraud risk score value associated with the electronic commerce transaction based on applying a plurality of tests to the transaction data, wherein one of the plurality of tests automatically determines whether a city value in the transaction data is within an area code value of the transaction data, by the steps of:

receiving the city value and the area code value as part of the transaction data;

determining a latitude value and a longitude value that represent a position of a city identified in the city value;

determining a range of latitude values and a range of longitude values associated with an area code identified in the area code value;

based on the latitude value, the longitude value, the range of latitude values, and the range of longitude values, determining whether the city identified in the city value is within the area code identified in the area code value;

applying a penalty to the electronic commerce transaction when the city identified in the city value is not within the area code identified in the area code value.

14. A method as recited in claim 1, wherein determining the first fraud risk score value comprises the steps of determining a first fraud risk score value associated with the electronic commerce transaction based on applying a plurality of tests to the transaction data, wherein one of the plurality of tests automatically determines whether a city value in the transaction data is within an email domain of the transaction data, by the steps of:

receiving the city value and an email address value as part of transaction data;

determining a latitude value and a longitude value that represent a position of a city identified in the city value;

determining a range of latitude values and a range of longitude values associated with an email domain portion of the email address value;

based on the latitude value, longitude value, the range of latitude values, and the range of longitude values, determining whether the city identified in the city value is within the email domain indicated in the email address value;

applying a penalty to the electronic commerce transaction when the city identified in the city value is not within the area code identified in the area code value.

15. A method as recited in claim 14, further comprising the steps of creating and storing an email domain location table comprising a plurality of records that associate email domain values with city values associated with shipping addresses of past non-fraudulent transactions.

16. The method as recited in claim 15, wherein determining whether the city identified in the city value is within the email domain comprises the steps of determining whether the city value is for a city that is outside the email domain as indicated by the records in the email domain location table.

17. A method as recited in claim 1, wherein determining the first fraud risk score value comprises the steps of determining a first fraud risk score value associated with the electronic commerce transaction based on applying a plurality of tests to the transaction data, wherein one of the plurality of tests automatically determines whether a country value in the transaction data is proximate to a bank referenced in a bank identification number of a credit card number in the transaction data, by the steps of:

receiving the country value and a bank identification number of a credit card number as part of the transaction data;

determining a relative distance between a country identified in the country value and a bank associated with the bank identification number;

based on the relative distance between the country and the bank, determining whether the country is greater than a specified relative distance from the bank;

applying a penalty to the electronic commerce transaction when the country is greater than the specified relative distance from the bank.

18. A method as recited in claim 17, further comprising the steps of creating and storing a bank location table comprising a plurality of records, wherein each record associates a bank identification number with a country value representing a country in which a headquarters of the bank is located.

19. A method as recited in claim 18, further comprising the steps of creating and storing a bank location table comprising a plurality of records that associate bank identification numbers with country values associated with shipping addresses of past non-fraudulent transactions.

20. The method as recited in claim 19, wherein determining whether the country identified in the country value is greater than the specified relative distance from the bank comprises the steps of determining whether the country value is for a country that is greater than the specified relative distance from the bank as indicated by the records in the bank domain location table.

21. A method as recited in claim 1, wherein:

receiving the transaction data is performed by a first apparatus that is linked to a second apparatus by a network; and

blending the model score value is performed by the second apparatus.

22. A non-transitory computer-readable storage medium carrying one or more sequences of instructions for evaluating fraud risk of an electronic commerce transaction, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

receiving transaction information that defines the electronic commerce transaction;

determining a first fraud risk score value associated with the electronic commerce transaction based on applying a plurality of tests to the transaction data, wherein each of the plurality of tests determines whether the transaction data appears to represent a genuine transaction based on specified criteria;

determining a second fraud risk score value associated with the electronic transaction based on a comparison of the transaction information to historical transaction information;

combining the first fraud risk score value and the second fraud risk score value using a statistical model to result in creating a model score value; and

blending the model score value with one or more merchant-specific threshold values to result in creating and storing a final fraud risk score value for the electronic commerce transaction;

wherein the step of blending the model score value comprises the steps of;

determining in which fraud risk zone, of two or more fraud risk zones, the boundaries of which are determined by the one or more merchant-specific threshold values, the model score value belongs; and

applying a policy corresponding to the determined fraud risk zone, wherein the policy dictates a magnitude and an allowable direction of influence applied by a heuristic model and a statistical model.

23. A non-transitory computer-readable storage medium as recited in claim 22, wherein the instructions which when executed cause receiving transaction data comprise instructions which when executed cause receiving transaction data that defines the electronic commerce transaction for a particular Internet identity, and wherein the instructions which when executed cause determining a second fraud risk score value comprise instructions which when executed cause determining a second fraud risk score value associated with the electronic commerce transaction based on a comparison of the transaction data to historical transaction data for other electronic commerce transactions pertaining to the same Internet identity.

24. A non-transitory computer-readable storage medium as recited in claim 22, wherein of the instructions which when executed cause determining the second fraud risk score value comprise instructions which when executed cause:

retrieving one or more records of historic transaction data pertaining to past electronic commerce transactions associated with the transaction data;

discontinuing further retrieval of such records when a specified amount of the records of historic transaction data is retrieved and further records of historic transaction data remain to be retrieved; and

determining the second fraud risk score value associated with the electronic commerce transaction based on only the retrieved records of historical transaction data in comparison to the transaction data.

25. The non-transitory computer-readable storage medium as recited in claim 22, wherein the instructions which when executed cause blending the model score value comprise instructions which when executed cause blending the model score value with one or more merchant-specific threshold values to result in creating and storing a final fraud risk score value for the electronic commerce transaction and one or more return code values that signal specified risk issues that have been detected with respect to the transaction.

26. A non-transitory computer-readable storage medium as recited in claim 22, wherein the instructions which when executed cause determining the first fraud risk score value comprise instructions which when executed cause determining a first fraud risk score value associated with the electronic commerce transaction based on instructions which when executed cause applying a plurality of tests to the transaction data, wherein one of the plurality of tests comprise instructions which when executed cause:

receiving the text value;

retrieving, for each bi-gram in the text value, from a table of bi-gram probability values a probability value that represents a probability that the bi-gram is found in a genuine text value; and

generating a penalty value when the retrieved probability values indicate that the text value comprises a combination of bi-grams that are not likely to represent a genuine text value.

27. A non-transitory computer-readable storage medium as recited in claim 22, wherein the instructions which when executed cause determining the first fraud risk score value comprise instructions which when executed cause determining a first fraud risk score value associated with the electronic commerce transaction based on instructions which when executed cause applying a plurality of tests to the transaction data, wherein one of the plurality of tests automatically determines whether a city value in the transaction data is within an area code value of the transaction data, by instructions which when executed cause:

receiving the city value and the area code value as part of the transaction data;

determining a latitude value and a longitude value that represent a position of a city identified in the city value;

determining a range of latitude values and a range of longitude values associated with an area code identified in the area code value;

determining whether the city identified in the city value is within the area code identified in the area code value, based on the latitude value, the longitude value, the range of latitude values, and the range of longitude values; and

applying a penalty to the electronic commerce transaction when the city identified in the city value is not within the area code identified in the area code value.

28. A non-transitory computer-readable storage medium as recited in claim 22, wherein the instructions which when executed cause determining the first fraud risk score value comprise instructions which when executed cause determining a first fraud risk score value associated with the electronic commerce transaction based on instructions which when executed cause applying a plurality of tests to the transaction data, wherein one of the plurality of tests automatically determines whether a city value in the transaction data is within an email domain of the transaction data, by the instructions which when executed cause:

receiving the city value and an email address value as part of transaction data;

determining a latitude value and a longitude value that represent a position of a city identified in the city value;

determining a range of latitude values and a range of longitude values associated with an email domain portion of the email address value;

determining whether the city identified in the city value is within the email domain indicated in the email address value, based on the latitude value, longitude value, the range of latitude values, and the range of longitude values; and

applying a penalty to the electronic commerce transaction when the city identified in the city value is not within the area code identified in the area code value.

29. A non-transitory computer-readable storage medium as recited in claim 22, wherein the instructions which when executed cause determining the first fraud risk score value comprise instructions which when executed cause determining a first fraud risk score value associated with the electronic commerce transaction based on instructions which when executed cause applying a plurality of tests to the transaction data, wherein one of the plurality of tests automatically determines whether a country value in the transaction data is proximate to a bank referenced in a bank identification number of a credit card number in the transaction data, by the instructions which when executed cause:

receiving the country value and a bank identification number of a credit card number as part of the transaction data;

determining a relative distance between a country identified in the country value and a bank associated with the bank identification number;

determining whether the country is greater than a specified relative distance from the bank, based on the relative distance between the country and the bank; and

applying a penalty to the electronic commerce transaction when the country is greater than the specified relative distance from the bank.