System and method for identity protection using mobile device signaling network derived location pattern recognition

• US 9,603,023 B2
• Filed: 07/30/2014
• Issued: 03/21/2017
• Est. Priority Date: 03/16/2007
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Ferguson, William M., Snyder, Randall A., Miller, Devin P.
• Primary Examiner(s): Iqbal, Khawar
• Application Number:
  US14/446,626
• Publication Number:
  US 20150017947A1
• Time in Patent Office: 965 Days
• Field of Search: 455/410, 455/411, 455419-420, 455/432.1, 455/433, 4554561-4566
• US Class Current: 1/1
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 8/04 Registration at HLR or HSS [Home Subscriber Server]
• CPC Class Codes: H04W 8/06 Registration at serving network Location Register, VLR or user mobility server
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A system and method for recognizing patterns in wireless device locations using wireless device location data derived from a communications signaling network is provided. By using wireless network supported signaling operations and messages, location data concerning the whereabouts of wireless devices, and hence wireless device users, may be obtained. The location data derived from the communications signaling network may be statistically analyzed to reveal potential geographic patterns that may indicate meaningful behaviors of the purported users of the wireless devices.

Claims

1. A method for detecting fraud of an entity based on an entity'"'"'s wireless device location obtained from a communications network, comprising:

obtaining first data from a home location register associated with a home network pertaining to the entity'"'"'s wireless device based upon a unique identifier of the entity'"'"'s wireless device, the unique identifier comprising a directory number of the entity'"'"'s wireless device;

obtaining second data from a visitor location register associated with a visited network pertaining to the entity'"'"'s wireless device based upon the unique identifier of the entity'"'"'s wireless device, the first data and second data comprising a combination of location data and subscriber data associated with the entity'"'"'s wireless device, the location data comprising a country code identifier of the directory number; and

generating a pattern value based on the first data, based on the second data, and based on a time that at least one of the first data or the second data was obtained, wherein the generated pattern value indicates a likelihood of fraud.

2. The method for detecting fraud according to claim 1, further comprising:

receiving a request for information pertaining to an electronic activity of interest from a transaction entity, wherein the request for information includes at least information identifying the entity; and

identifying the unique identifier of the entity'"'"'s wireless device based on the information identifying the entity.

3. The method for detecting fraud according to claim 2, wherein the information identifying the entity includes a name of the entity, and wherein identifying the unique identifier of the entity'"'"'s wireless device is based on the name of the entity.

4. The method for detecting fraud according to claim 1, wherein the time that the data was obtained from the home location register associated with the home network and the visitor location register associated with the visited network corresponds to a time of interest pertaining to an electronic activity of interest.

5. The method for detecting fraud according to claim 1, wherein generating the pattern value comprises:

statistically correlating data representing a location of the home network and a data representing the location of the visited network with a location of the entity'"'"'s wireless device.

6. The method for detecting fraud according to claim 1, wherein an age of the first data obtained from the home location register associated with the home network is employed to generate the pattern value.

7. The method for detecting fraud according to claim 1, wherein an age of the second data obtained from the visitor location register associated with the visited network is employed to generate the pattern value.

8. The method for detecting fraud according to claim 1, wherein the location data further comprises a national destination code identifier of the directory number, the national destination code being employed to generate the pattern value.

9. The method for detecting fraud according to claim 1, wherein the location data further comprises a mobile country code identifier of the directory number, the mobile country code identifier being employed to generate the pattern value.

10. The method for detecting fraud according to claim 1, wherein the location data further comprises a mobile network code identifier of the directory number, the mobile network code identifier being employed to generate the pattern value.

11. The method for detecting fraud according to claim 1, wherein the location data comprises an International Mobile Equipment Identity (IMEI) of the entity'"'"'s wireless device, the IMEI being employed to generate the pattern value.

12. The method for detecting fraud according to claim 1, wherein the location data comprises an Electronic Serial Number (ESN) of the entity'"'"'s wireless device, the ESN being employed to generate the pattern value.

13. The method for detecting fraud according to claim 1, wherein an identity of a cell site of a network serving the entity'"'"'s wireless device is employed to generate the pattern value.

14. The method for detecting fraud according to claim 1, wherein the location data comprises a state of the entity'"'"'s wireless device, the state being employed to generate the pattern value.

15. The method for detecting fraud according to claim 1, wherein the subscriber data comprises at least one of a network operator, an age associated with a network subscription, an age associated with a directory number of the entity'"'"'s wireless device, a duration of association between the directory number and the entity, one or more network operators previously associated with the directory number, a type of network subscription, or a type of network device.

16. The method for detecting fraud according to claim 1, wherein generating the pattern value is further based on a difference between a first time at which the first data was obtained and a second time at which the second data was obtained.

17. The method for detecting fraud according to claim 1, wherein the first time is associated with a first location and the second time is associated with a second location.

18. A method for verifying an electronic activity of interest based on information pertaining to an entity'"'"'s wireless device, comprising:

communicating a request for information to a home location register associated with a home network of the entity'"'"'s wireless device, wherein the request communicated to the home location register associated with the home network includes a unique identifier of the entity'"'"'s wireless device, the unique identifier comprising a directory number of the entity'"'"'s wireless device;

communicating a request for information to a visitor location register associated with a visited network, wherein the request communicated to the visitor location register associated with the visited network includes the unique identifier of the entity'"'"'s wireless device;

receiving location information and subscriber information pertaining to the entity'"'"'s wireless device from at least one of the home location register associated with the home network and the visitor location register associated with the visited network in response to communicating the request for information, the location information comprising a country code identifier of the directory number;

receiving information pertaining to the electronic activity of interest; and

statistically correlating the received home network information, the received visited network information, and the electronic activity of interest information; and

generating a pattern value based on the statistical correlation, wherein the pattern value indicates likelihood that the electronic activity of interest is valid.

19. A system that verifies an electronic activity of interest based on information pertaining to an entity'"'"'s wireless device, comprising:

a communications interface configured to communicatively interconnect to a communications signaling network, and configured to receive a request from a transaction entity for information pertaining to the likelihood that the electronic activity of interest is valid;

a memory component configured to store a wireless device location module and at least one location recognition logic resource; and

a processor communicatively coupled to the communications interface and the memory component,

where in response to receiving the request from the transaction entity, the processor retrieves and executes the wireless device location module to generate a request for information to a home location register associated with a home network of the entity'"'"'s wireless device and a request for information to a visitor location register associated with a visited network, wherein the request for information to the home location register associated with the home network and the visitor location register associated with the visited network includes a unique identifier of the entity'"'"'s wireless device, the unique identifier comprising a directory number of the entity'"'"'s wireless device;

wherein the request for information to the home location register associated with the home network and the visitor location register associated with the visited network is communicated from the communications interface to the home location register associated with the home network and the visitor location register associated with the visited network via a communications signaling network,

wherein the communications interface receives the location data and subscriber data from the home location register associated with the home network and the visitor location register associated with the visited network via the communications signaling network, the location information comprising a country code identifier of the directory number;

wherein the processing system retrieves and executes the location recognition logic resource to statistically correlate the received information from the home location register associated with the home network, the received information from the visitor location register associated with the visited network, and information pertaining to the electronic activity of interest, and

wherein the processing system generates a pattern value based on the statistical correlation, wherein the pattern value indicates likelihood that the electronic activity of interest is valid.