Method and system for detecting, monitoring and addressing data compromises

• US 8,386,381 B1
• Filed: 12/16/2009
• Issued: 02/26/2013
• Est. Priority Date: 12/16/2009
• Status: Active Grant

• Current Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Original Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Inventors: Barton, Thomas C., Paulson, Harold Jr., Kumar, Sandhya, Mehta, Charu, Vaidyanathan, Geetha, Wu, Jiun-Ming
• Primary Examiner(s): Patel, Jagdish
• Assistant Examiner(s): POE, KEVIN T
• Application Number:
  US12/639,415
• Time in Patent Office: 1,168 Days
• Field of Search: 705/39
• US Class Current: 705/39
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes

Abstract

According to an embodiment of the present invention, an automated computer implemented method for detecting one or more data compromises comprises the steps of detecting an activity indicative of a data compromise based at least in part on a compromise detection report involving at least one of merchant compromise report, region compromise report and acquirer compromise report, wherein the compromise detection report is generated by an automated detection algorithm; classifying the activity based on a combination of risk level, size of data compromise and fraud severity; and identifying a specific mitigation response to the activity through an interface. Another embodiment of the present invention determines whether one or more accounts associated with the activity have been probed or tested by a fraudster to determine if the one or more accounts are valid.

Claims

1. An automated computer implemented method for detecting one or more data compromises, wherein the method is executed by a programmed computer processor which communicates with a user via a network, the method comprising the steps of:

detecting, via a computer processor, an activity indicative of a data compromise based at least in part on a compromise detection report involving at least one of merchant compromise report, region compromise report and acquirer compromise report, wherein the compromise detection report is generated by an automated detection algorithm using account data associated with at least one merchant;

classifying, via a computer processor, the activity based on a combination of risk level, size of data compromise and fraud severity; and

identifying a specific mitigation response to the activity through an interface.

2. The method of claim 1, further comprising the step of:

determining whether one or more accounts associated with the activity have been probed by a fraudster to determine if the one or more accounts are valid.

3. The method of claim 1, wherein the merchant compromise report identities one or more common merchants where authorizations were swiped with one or more counterfeit cards.

4. The method of claim 3, wherein an account fraud rate is calculated for each common merchant, wherein the account fraud rate represents a number of counterfeit fraud accounts as compared to a total of accounts transacted at a merchant.

5. The method of claim 1, wherein the merchant compromise report identifies merchant identifier, sales card count, fraud card count, fraud loss and account fraud rate.

6. The method of claim 1, wherein the region compromise report identifies one or more non-U.S. countries having an increase in account fraud rate for a predetermined time period.

7. The method of claim 6, wherein one or more card transactions that have turned fraud during a predetermined time period occurred in the identified one or more countries.

8. The method of claim 1, wherein the region compromise report identifies region risk group, one or more non-U.S. countries, fraud indicator and account fraud rate.

9. The method of claim 1, wherein the acquirer compromise report identities one or more common acquirers with authorizations involving one or more fraud card numbers.

10. The method of claim 1, wherein the acquirer compromise report identifies acquirer identifier, sales time period and fraud data.

11. An automated computer implemented system for detecting one or more data compromises, the system comprising:

a detection module, comprising a computer processor, configured to detect an activity indicative of a data compromise based at least in part on a compromise detection report involving at least one of merchant compromise report, region compromise report and acquirer compromise report, wherein the compromise detection report is generated by an automated detection algorithm using account data associated with at least one merchant;

a classification module, comprising a computer processor, configured to classify the activity based on a combination of risk level, size of data compromise and fraud severity; and

a mitigation module, comprising a computer processor, configured to identify a specific mitigation response to the activity through an interface.

12. The system of claim 11, wherein whether one or more accounts associated with the activity have been probed by a fraudster is assessed to determine if the one or more accounts are valid.

13. The system of claim 11, wherein the merchant compromise report identities one or more common merchants where authorizations were swiped with one or more counterfeit cards.

14. The system of claim 13, wherein an account fraud rate is calculated for each common merchant, wherein the account fraud rate represents a number of counterfeit fraud accounts as compared to a total of accounts transacted at a merchant.

15. The system of claim 11, wherein the merchant compromise report identifies merchant identifier, sales card count, fraud card count, fraud loss and account fraud rate.

16. The system of claim 11, wherein the region compromise report identifies one or more non-U.S. countries having an increase in account fraud rate for a predetermined time period.

17. The system of claim 16, wherein one or more card transactions that have turned fraud during a predetermined time period occurred in the identified one or more countries.

18. The system of claim 11, wherein the region compromise report identifies region risk group, one or more non-U.S. countries, fraud indicator and account fraud rate.

19. The system of claim 11, wherein the acquirer compromise report identities one or more common acquirers with authorizations involving one or more fraud card numbers.

20. The system of claim 11, wherein the acquirer compromise report identifies acquirer identifier, sales time period and fraud data.

21. An automated computer implemented method for detecting one or more data compromises, wherein the method is executed by a programmed computer processor which communicates with a user via a network, the method comprising the steps of:

detecting, via a computer processor, an activity indicative of a data compromise based at least in part on a compromise detection report involving at least one of merchant compromise report, region compromise report and acquirer compromise report, wherein the compromise detection report is generated by an automated detection algorithm using account data associated with at least one merchant;

determining, via a computer processor, whether one or more accounts associated with the activity have been probed by a fraudster to determine if the one or more accounts are valid;

classifying, via a computer processor, the activity based on a combination of risk level, size of data compromise and fraud severity; and

identifying, via a computer processor, a specific mitigation response to the activity through an interface;

wherein the merchant compromise report identities one or more common merchants where authorizations were swiped with one or more counterfeit cards;

wherein an account fraud rate is calculated for each common merchant, wherein the account fraud rate represents a number of counterfeit fraud accounts as compared to a total of accounts transacted at a merchant;

wherein the region compromise report identifies one or more non-U.S. countries having an increase in account fraud rate for a predetermined time period;

wherein one or more card transactions that have turned fraud during a predetermined time period occurred in the identified one or more countries; and

wherein the acquirer compromise report identities one or more common acquirers with authorizations involving one or more fraud card numbers.