System and method for systematic detection of fraud rings

• US 9,280,658 B2
• Filed: 03/15/2013
• Issued: 03/08/2016
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: LexisNexis Risk Solutions, Inc. (RELX PLC)
• Original Assignee: ID Analytics, LLC (Gen Digital Inc.)
• Inventors: Coggeshall, Stephen, Shaw, Bilal, Villagomez, Darwin, Zhao, Wenzhong
• Primary Examiner(s): LE, CHAU D
• Application Number:
  US13/840,532
• Publication Number:
  US 20140283094A1
• Time in Patent Office: 1,089 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 30/0609 Buyer or seller confidence or verification
• CPC Class Codes: G06Q 50/01 Social networking
• CPC Class Codes: G06Q 50/26 Government or public services business processes related to the transportation industry G06Q50/40
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety

Abstract

The present invention provides, in at least one embodiment, a system, and method for detecting fraud rings. The system gathers a small group of highly likely fraudsters. The system then looks for groups of these likely fraudsters who are interconnected. When the interconnections are strong, these groups are likely to be fraud rings. Once fraud rings are detected, the links can be applied to better prevent fraud and to help in criminal investigations.

Claims

1. A system comprising:

an events database comprising a plurality of events comprising at least fraudulent events;

an identity resolution module comprising an identity resolution machine adapted to assign a specific person, represented by a PIN number, to a plurality of events in said events database, and sorts the events by the resulting PIN numbers for output to the fraud database, and configured to assign a person number to at least one of the plurality of events;

a fraud database comprising people linked to the fraudulent events;

a false positive database comprising identity information that should not be included in linking people;

a search module that searches for matches between the identity information in the false positive database and the identity information of the people linked to the fraudulent events; and

a fraud ring database comprising subgroups of connected fraudulent people connected by links, wherein the links are based on matching identity information, comprising a list of a plurality of discovered fraud rings.

2. The system of claim 1 further comprising a predictive module which computes a risk score based on the matching identity information, wherein the risk score represents a chance that a fraudulent first person and a fraudulent second person form a fraud ring.

3. The system of claim 1 further comprising an application module, wherein the application module compares the matching identity information to a current event.

4. The system of claim 1 further comprising an application module, wherein the application module compares the matching identity information to a portfolio.

5. The system of claim 1 further comprising an application module, wherein the application module creates a rank-ordered list of discovered fraud rings along with summary information to be provided to interested parties such as law enforcement.

6. The system of claim 1 further comprising an application module, wherein the application module compares the matching identity information to people with non-fraud related attributes.

7. The system of claim 6, wherein the non-fraud related attributes comprise felonies, registered sex offenses, or credit delinquencies.

8. The system of claim 6, wherein the non-fraud related attributes comprise a particular level of income, a particular level of education, household characteristics, affinity to a particular product or service, or a product cancellation.

9. A method comprising:

receiving a plurality of events at an events database comprising at least fraudulent events;

assigning, by an identity resolution machine, a person number to at least one of the plurality of events;

linking people to the fraudulent events;

forming a false positive database comprising identity information that links a plurality of people who do not form a fraud ring;

searching for matches between the identity information in the false positive database and the identity information of the people linked to the fraudulent events; and

linking fraudulent people, wherein the links are based on matching identity information, comprising a list of a plurality of discovered fraud rings.

10. The method of claim 9 further comprising computing a risk score based on the matching identity information, wherein the risk score represents a chance that the fraudulent first person and the fraudulent second person form a fraud ring.

11. The method of claim 9 further comprising comparing the matching identity information to a current event.

12. The method of claim 9 further comprising the matching identity information to a portfolio.