Method and system for user contributed aggregated fraud identification

• US 8,799,122 B1
• Filed: 03/31/2008
• Issued: 08/05/2014
• Est. Priority Date: 03/31/2008
• Status: Active Grant

• Current Assignee: Intuit, Inc.
• Original Assignee: Intuit, Inc.
• Inventors: Del Favero, James R., Rukonic, Marko
• Primary Examiner(s): Ebersman, Bruce I
• Assistant Examiner(s): ANDERSON, JOHN A
• Application Number:
  US12/060,092
• Time in Patent Office: 2,318 Days
• Field of Search: 705/35
• US Class Current: 705/35
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03

Abstract

A method for identifying an origin of fraudulent activity including receiving a first affirmative fraud flag from a first user for a financial transaction associated with a first user account and obtaining financial transaction information for the first user account, which includes a first financial transaction entry listing a payee and a first time. The method further includes receiving a second affirmative fraudulent flag from a second user corresponding to a financial transaction and a second user account and obtaining financial transaction information for the second user account, which includes a second financial transaction entry listing the payee and a second time. The method further includes determining an intersection between the first and the second financial transaction entries, identifying a potential origin of fraud from the intersection, and alerting the first and the second user of the potential origin of fraud.

Claims

1. A method for identifying an origin of fraudulent activity, comprising:

receiving, from a first user, a first fraud flag identifying a first financial transaction between the first user and a payee as fraudulent, wherein the first user sets the first fraud flag;

obtaining, by a computer processor, a fraud score for the payee from a fraud aggregation table,

wherein the fraud score is based on a plurality of fraud flags set by a plurality of users and identifying a plurality of transactions between the plurality of users and the payee as fraudulent, and

wherein the fraud score is further based on the plurality of fraud flags associated with the payee within a time span;

obtaining, by the computer processor, a fraud score threshold associated with the payee;

incrementing, in response to receiving the first fraud flag, the fraud score to obtain an incremented fraud score;

making a determination that the incremented fraud score exceeds the fraud score threshold;

retrieving, in response to the determination, a financial transaction entry associated with a second financial transaction between a second user and the payee after the second financial transaction is complete, wherein the financial transaction entry associated with the second financial transaction comprises a date within the time span; and

alerting the second user, based on the determination, that the payee is a potential origin of fraud after the second financial transaction is complete.

2. The method of claim 1, further comprising:

identifying, prior to alerting the second user, a previous transaction entry associated with the payee and the second user; and

decreasing the fraud score threshold in response to identifying the previous transaction entry.

3. The method of claim 1, further comprising:

determining, prior to alerting the second user, that no previous transaction entry associated with the payee and the second user exists; and

increasing the fraud score threshold in response to determining that no previous transaction entry associated with the payee and the second user exists.

4. A non-transitory computer readable storage medium comprising executable instructions for performing a method for identifying an origin of fraudulent activity, the method comprising:

receiving, from a first user, a first fraud flag identifying a first financial transaction between the first user and a payee as fraudulent, wherein the first user sets the first fraud flag;

obtaining a fraud score for the payee from a fraud aggregation table,

wherein the fraud score is based on a plurality of fraud flags set by a plurality of users and identifying a plurality of transaction between the plurality of users and the payee as fraudulent, and

wherein the fraud score is further based on the plurality of fraud flags associated with the payee within a time span;

obtaining a fraud score threshold associated with the payee;

incrementing, in response to receiving the first fraud flag, the fraud score to obtain an incremented fraud score;

making a determination that the incremented fraud score exceeds the fraud score threshold;

retrieving, in response to the determination, a financial transaction entry associated with a second financial transaction between a second user and the payee after the second financial transaction is complete, wherein the financial transaction entry associated with the second financial transaction comprises a date within the time span; and

alerting the second user, based on the determination, that the payee is a potential origin of fraud after the second transaction is complete.

5. The non-transitory computer readable storage medium of claim 4, the method further comprising:

identifying, prior to alerting the second user, a previous transaction entry associated with the payee and the second user; and

decreasing the fraud score threshold in response to identifying the previous transaction entry.

6. The non-transitory computer readable storage medium of claim 4, the method further comprising:

determining, prior to alerting the second user, that no previous transaction entry associated with the payee and the second user exists; and

increasing the fraud score threshold in response to determining that no previous transaction entry associated with the payee and the second user exists.

7. A system for identifying an origin of fraudulent activity, comprising:

a computer processor;

a data store storing a financial transaction table comprising a plurality of financial transaction entries and a fraud aggregation table comprising a plurality of fraud scores for a plurality of payees; and

a fraud detection engine executing on the computer processor and configured to;

receive, from a first user, a first fraud flag identifying a first financial transaction between the first user and a payee as fraudulent, wherein the first user sets the first fraud flag;

obtain a fraud score for the payee from the fraud aggregation table,

wherein the fraud score is based on a plurality of fraud flags set by a plurality of users and identifying a plurality of transactions between the plurality of users and the payee as fraudulent, and

wherein the fraud score is further based on the plurality of fraud flags associated with the payee within a time span;

obtain a fraud score threshold associated with the payee;

increment, in response to receiving the first fraud flag, the fraud score to obtain an incremented fraud score;

make a determination that the incremented fraud score exceeds the fraud score threshold;

retrieve, from the financial transaction table and in response to the determination, a financial transaction entry associated with a second financial transaction between a second user and the payee after the second financial transaction is complete, wherein the financial transaction entry associated with the second financial transaction comprises a date within the time span; and

alert the second user, based on the determination, that the payee is a potential origin of fraud after the second financial transaction is complete.

8. The system of claim 7, wherein the fraud detection engine is further configured to:

identify, prior to alerting the second user, a previous transaction entry associated with the payee and the second user; and

decrease the fraud score threshold in response to identifying the previous transaction entry.

9. The system of claim 7, wherein the fraud detection engine is further configured to:

determine, prior to alerting the second user, that no previous transaction entry associated with the payee and the second user exists; and

increase the fraud score threshold in response to determining that no previous transaction entry associated with the payee and the second user exists.