Analyzing voice characteristics to detect fraudulent call activity and take corrective action without using recording, transcription or caller ID

• US 9,232,052 B1
• Filed: 11/21/2014
• Issued: 01/05/2016
• Est. Priority Date: 11/21/2014
• Status: Active Grant

• Current Assignee: Marchex Incorporated
• Original Assignee: Marchex Incorporated
• Inventors: Flaks, Jason, Ismail, Ziad
• Primary Examiner(s): Tieu, Binh
• Application Number:
  US14/550,203
• Time in Patent Office: 410 Days
• Field of Search: 379/114.04, 379/114.14, 379/32.01, 379/32.04, 379/133, 379/134, 379/136, 379/138, 379/143, 379/144.03, 704/221, 704/240, 704/243, 704/250, 704/273, 704/274
• US Class Current: 1/1
• CPC Class Codes: G10L 15/00 Speech recognition G10L17/00 takes precedence
• CPC Class Codes: G10L 17/26 Recognition of special voice characteristics, e.g. for use in lie detectors; Recognition of animal voices
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2203/6027 Fraud preventions
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 3/38 Graded-service arrangements, i.e. some subscribers prevented from establishing certain connections queuing arrangements H04Q3/64

Abstract

A system and method for monitoring telephone calls to detect fraudulent activity and take corrective action is described. The system receives a first group of telephone calls having associated voice characteristics and analyzes the first group of telephone calls to identify and store a first set of distributions of voice characteristics that are indicative of normal activity, fraudulent activity, or indeterminate activity. The system receives a second group of telephone calls to be analyzed. The system analyzes the second group of telephone calls to identify a second set of distributions of voice characteristics associated with the second group of telephone calls. The system then compares the second set of distributions of voice characteristics to the stored first set of distributions of voice characteristics to assess a probability that one or more telephone calls in the second group of telephone calls represents normal, fraudulent, or indeterminate activity. If the assessed probability of fraudulent activity exceeds a threshold, the system takes appropriate corrective action, such a flagging the fraudulent call or withholding a financial incentive associated with the fraudulent call.

Claims

1. A method for monitoring telephone calls to detect fraudulent activity and take corrective action, comprising:

receiving a first group of telephone calls having associated voice characteristics;

analyzing the first group of telephone calls to identify a first set of distributions of voice characteristics that are indicative of normal activity, fraudulent activity, or indeterminate activity;

storing the identified first set of distributions of voice characteristics;

receiving a second group of telephone calls having associated voice characteristics;

analyzing the second group of telephone calls to identify a second set of distributions of voice characteristics associated with the second group of telephone calls, wherein the analysis is performed without transcription, caller identification or recording;

assessing a probability that the second group of telephone calls corresponds to normal activity, fraudulent activity, or indeterminate activity,

wherein the assessing comprises comparing the identified second set of distributions of voice characteristics to the stored first set of distributions of voice characteristics, and

wherein the assessed probability of fraudulent activity increases in response to detecting that the second group of telephone calls contains multiple telephone calls originating from the same caller within a determined period of time; and

executing a corrective action when the assessed probability that the second group of telephone calls represents fraudulent activity exceeds a threshold.

2. The method of claim 1, wherein the assessed probability is expressed as a numerical percentage.

3. The method of claim 1, wherein the corrective action is withholding a financial incentive from an entity that is associated with a telephone call in the second group of telephone calls.

4. The method of claim 1, wherein the corrective action is blacklisting an entity that is associated with a telephone call in the second group of telephone calls.

5. The method of claim 1, wherein the corrective action is providing a notice to a system operator.

6. The method of claim 5, wherein the notice includes an indication of the assessed probability.

7. The method of claim 1, wherein the received second group of telephone calls corresponds to a distribution channel and the corrective action is executed with respect to the distribution channel.

8. The method of claim 7, wherein the corrective action is flagging the distribution channel for heightened monitoring.

9. The method of claim 7, wherein the corrective action is disabling call activity on the distribution channel.

10. The method of claim 1, wherein the corrective action is taken with respect to a particular advertiser or a particular group of advertisers.

11. The method of claim 1, wherein the corrective action is storing an indication of the assessed probability of fraud to a log in non-volatile memory.

12. The method of claim 10, wherein the log includes two or more of the group consisting of:

the assessed probability of fraud, voice characteristics associated with the received telephone call, an advertiser associated with the received telephone call, and a distribution channel associated with the received telephone call.

13. The method of claim 1, wherein the corrective action is not charging an advertiser for activity associated with the received telephone call.

14. The method of claim 1, wherein the first group of telephone calls corresponds to a single distribution channel.

15. The method of claim 1, wherein the first group of telephone calls corresponds to a plurality of distribution channels.

16. The method of claim 1, wherein the distributions of voice characteristics that are indicative of normal activity, fraudulent activity, or indeterminate activity are determined by a scoring function.

17. The method of claim 1, wherein the determined period of time is a windowed period of time.

18. The method of claim 1, wherein the determined period of time is a fixed period of time.

19. The method of claim 1, further comprising:

analyzing the second group of telephone calls to determine whether an attempt has been made to disguise a voice pattern contained in the second group of telephone calls; and

in response to determining that an attempt has been made to disguise a voice pattern contained in the second group of telephone calls, increasing the assessed probability of fraudulent activity.

20. A computer-readable storage medium with instructions stored thereon that, when executed by a computing system, cause the computing system to perform a method to monitor telephone calls to detect fraudulent activity and take corrective action, the method comprising:

receiving a first group of telephone calls having associated voice characteristics;

analyzing the first group of telephone calls to identify a first set of distributions of voice characteristics that are indicative of normal activity, fraudulent activity, or indeterminate activity;

storing the identified first set of distributions of voice characteristics;

receiving a second group of telephone calls having associated voice characteristics;

analyzing the second group of telephone calls to identify a second set of distributions of voice characteristics associated with the second group of telephone calls, wherein the analysis is performed without transcription, caller identification or recording;

assessing a probability that the second group of telephone calls corresponds to normal activity, fraudulent activity, or indeterminate activity,

wherein the assessing comprises comparing the identified second set of distributions of voice characteristics to the stored first set of distributions of voice characteristics, and

wherein the assessed probability of fraudulent activity increases in response to detecting that the second group of telephone calls contains multiple telephone calls originating from the same caller within a determined period of time; and

executing a corrective action when the assessed probability that the second group of telephone calls represents fraudulent activity exceeds a threshold.

21. The computer-readable storage medium of claim 20, wherein the assessed probability is expressed as a numerical percentage.

22. The computer-readable storage medium of claim 20, wherein the corrective action is withholding a financial incentive from an entity that is associated with a telephone call in the second group of telephone calls.

23. The computer-readable storage medium of claim 20, wherein the corrective action is blacklisting an entity that is associated with a telephone call in the second group of telephone calls.

24. The computer-readable storage medium of claim 20, wherein the corrective action is providing a notice to a system operator.

25. The computer-readable storage medium of claim 24, wherein the notice includes an indication of the assessed probability.

26. The computer-readable storage medium of claim 20, wherein the received second group of telephone calls corresponds to a distribution channel and the corrective action is executed with respect to the distribution channel.

27. The computer-readable storage medium of claim 26, wherein the corrective action is flagging the distribution channel for heightened monitoring.

28. The computer-readable storage medium of claim 26, wherein the corrective action is disabling call activity on the distribution channel.

29. The computer-readable storage medium of claim 20, wherein the corrective action is taken with respect to a particular advertiser or a particular group of advertisers.

30. The computer-readable storage medium of claim 20, wherein the corrective action is storing an indication of the assessed probability of fraud to a log in non-volatile memory.

31. The computer-readable storage medium of claim 30, wherein the log includes two or more of the group consisting of:

the assessed probability of fraud, voice characteristics associated with the received telephone call, an advertiser associated with the received telephone call, and a distribution channel associated with the received telephone call.

32. The computer-readable storage medium of claim 20, wherein the corrective action is not charging an advertiser for activity associated with the received telephone call.

33. The computer-readable storage medium of claim 20, wherein the first group of telephone calls corresponds to a single distribution channel.

34. The computer-readable storage medium of claim 20, wherein the first group of telephone calls corresponds to a plurality of distribution channels.

35. The computer-readable storage medium of claim 20, wherein the distributions of voice characteristics that are indicative of normal activity, fraudulent activity, or indeterminate activity are determined by a scoring function.

36. The computer-readable storage medium of claim 20, wherein the determined period of time is a windowed period of time.

37. The computer-readable storage medium of claim 20, wherein the determined period of time is a fixed period of time.

38. The computer-readable storage medium of claim 20, further comprising:

analyzing the second group of telephone calls to determine whether an attempt has been made to disguise a voice pattern contained in the second group of telephone calls; and

in response to determining that an attempt has been made to disguise a voice pattern contained in the second group of telephone calls, increasing the assessed probability of fraudulent activity.