System and architecture for electronic fraud detection

• US 10,339,527 B1
• Filed: 10/30/2015
• Issued: 07/02/2019
• Est. Priority Date: 10/31/2014
• Status: Active Grant

• Current Assignee: Experian Information Solutions Incorporated (Experian plc)
• Original Assignee: Experian Information Solutions Incorporated (Experian plc)
• Inventors: Coleman, Neli, Laudorn, Lloyd, Boileau, Raymond Martin
• Primary Examiner(s): Norman, Samica L
• Application Number:
  US14/928,770
• Time in Patent Office: 1,341 Days
• Field of Search: 705 35, 705 16, 705 30, 705 38, 705325, 726 22
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 40/123 Tax preparation or submission

Abstract

Embodiments of an electronic fraud analysis platform system are disclosed which may be used to analyze tax returns for potential fraud. Analysis of tax return data using the tax return analysis platform computing systems and methods discussed herein may provide insight into whether a tax return may be fraudulent based on, for example, an initial screening component configured to filter tax returns which appear fraudulent due to missing or inaccurate information provided with the return; a device activity analysis component configured to identify whether a device used to submit a tax return or to provide further authentication information needed to complete processing of the return may have been used in other fraudulent activities; and a knowledge-based authentication component configured to identify potential fraudsters using dynamically generated questions for which fraudsters typically do not know the answers.

Claims

1. A system for generating fraud indicators, the system comprising:

a network interface configured to send and receive secure, encrypted electronic messages with a remote tax agency server, the remote tax agency server comprising a first electronic data store configured to store tax return filing data and tax return device data associated with a plurality of consumers and at least one tax agency, wherein access to the first electronic data store is provided by a tax agency computing system;

a second electronic data store comprising electronic consumer data records associated with the plurality of consumers;

a third electronic data store comprising consumer device activity data associated with a plurality of consumer devices, the plurality of consumer devices associated with the plurality of consumers;

a computing device configured to electronically communicate with the second electronic data store and the third electronic data store, the computing device comprising one or more processors programmed to execute software instructions to cause the system to;

send an electronic request, to the remote tax agency server via the network interface, for a first set of tax return data and a first set of consumer device data from the first electronic data store, the first set of tax return data and the first set of consumer device data associated with a first set of consumers from within the plurality of consumers;

receive, from the remote tax agency server via the network interface, the first set of tax return data and the first set of consumer device data, the first set of tax return data including one or more individual consumer attributes associated with each respective consumer within the first set of consumers, and the first set of consumer device data associated with each respective consumer within the first set of consumers;

access the second electronic data store to obtain a first set of consumer data associated with the first set of consumers and comprising consumer data corresponding to each of the consumers within the first set of consumers;

generate a set of tax fraud indicators comprising a corresponding tax fraud indicator for each of the tax return data within the first set of tax return data where each of tax return data corresponds to each respective consumer within the first set of consumers, the set of tax fraud indicators generated based at least in part on a comparison of;

(a) the one or more consumer attributes associated with the respective consumer, and (b) corresponding consumer data within the first set of consumer data associated with the respective consumer;

determine a tax fraud subset of the first set of tax return data as potentially fraudulent based at least on the set of tax fraud indicators;

access the third electronic data store to obtain a first set of device activity data associated with the first set of consumers and comprising device activity data corresponding to each of the consumers within the first set of consumers;

generate a set of device fraud indicators comprising a corresponding tax fraud indicator for each of the tax return data within the first set of tax return data where each tax return data corresponds to each respective consumer within the first set of consumers, the set of device fraud indicators generated based at least in part on a comparison of;

(a) consumer device data within the first set of consumer device data corresponding to the respective consumer and (b) device activity data within the first set of device activity data corresponding to the respective consumer;

determine a device fraud subset of the first set of tax return data as potentially fraudulent based at least on the set of device fraud indicator;

generate an encrypted data packet storing at least a subset of the tax fraud indicators based at least on the tax fraud subset and the device fraud subset, the subset of the tax fraud indicators comprising an electronic indication to suspend processing of tax returns for consumer associated with the subset of initial tax fraud indicators; and

send the encrypted data to the remote tax agency via the network interface.

2. The system of claim 1, wherein the system is further programmed via executable instructions to:

generate, based on the consumer data associated with the first set of consumers, a set of one or more authentication questions;

provide the set of one or more authentication questions to a subset of the first set of consumers associated with the tax fraud subset;

receive sets of responses from the subset of the first set of consumers associated with the tax fraud subset; and

determine accuracy of the sets of responses.

3. The system of claim 2, wherein the tax fraud indicators are generated based as least on the accuracy of the sets of responses.

4. The system of claim 1 wherein each of the one or more consumer attributes includes at least five unique consumer attributes.

5. The system of claim 2 wherein the sets of responses are received from consumer computing devices associated with the subset of the first set of consumers associated with the tax fraud subset.

6. A computer-implemented method under the control of one or more computer systems configured with executable instructions, the method comprising:

as implemented by one or more computing devices configured with specific executable instructions,

sending an electronic request, to a remote tax agency server via a network interface, for a first set of tax return data and a first set of consumer device data, the remote tax agency server comprising a first electronic data store configured to store tax return filing data and consumer device data associated with a plurality of consumers and at least one tax agency;

receiving, from the remote tax agency server via the network interface, the first set of tax return data and the first set of consumer device data, the first set of tax return data and the first set of consumer device data associated with a first set of consumers from within the plurality of consumers, the first set of tax return data including one or more individual consumer attributes associated with each respective consumer within the first set of consumers, and the first set of consumer device data associated with each respective consumer within the first set of consumers;

accessing, from a second electronic data store comprising electronic consumer data records associated with the plurality of consumers, a first set of consumer data associated with the first set of consumers, and the first set of consumer device data associated with each respective consumer within the first set of consumers;

generating a first set of tax fraud indicators comprising a corresponding tax fraud indicator for each tax return data within the first set of tax return data where each of tax return data corresponds to each respective consumer within the first set of consumers, the first set of tax fraud indicator generated based at least in part on a comparison of;

(a) the one or more consumer attributes associated with the respective consumer, and (b) corresponding consumer data within the first set of consumer data associated with the respective consumer;

determining a tax fraud subset of the first set of tax return data as potentially fraudulent based at least on the first set of tax fraud indicator;

accessing a third electronic data store to obtain a first set of device activity data associated with the first set of consumer and comprising device activity data corresponding to each of the consumers within the first set of consumers;

generating a second set of tax fraud indicators comprising a corresponding tax fraud indicator for each of the tax return data within the first set of tax return data where each tax return data corresponds to each respective consumer within the first set of consumers, the second tax fraud indicator generated based at least in part on a comparison of;

(a) consumer device data within the first set of consumer device data corresponding to the respective consumer, and (b) device activity data within the first set of device activity data corresponding to the respective consumer;

determining a device fraud subset for the first set of tax return data as potentially fraudulent based on at least the set of device fraud indicator;

generating an encrypted data packet storing at least a subset of the tax fraud indicators based at least on the tax fraud subset and the device fraud subset, the subset of initial tax fraud indicators comprising an electronic indication to suspend processing of tax returns for consumers associated with the subset of initial tax fraud indicators; and

sending the encrypted data to the remote tax agency server via the network interface.

7. The computer-implemented method of claim 6, further comprising:

generating, based on the consumer data associated with the first set of consumers, a set of one or more authentication questions;

providing the set of one or more authentication questions to a subset of the first set of consumers associated with the tax fraud subset;

receiving sets of responses from the subset of the first set of consumers associated with the tax fraud subset;

determining accuracy of the sets of responses.

8. The computer-implemented method of claim 7, wherein generating the encrypted data comprises generating the tax fraud indicators based at least on the accuracy of the sets of responses.

9. The computer-implemented method of claim 6, each of the one or more set of consumer attributes includes at least five unique consumer attributes.

10. The computer-implemented method of claim 7, the system receiving the sets of response from consumer computing devices associated with the subset of the first set of consumers associated with the tax fraud subset.

11. Non-transitory computer storage having stored thereon a computer program, the computer program including executable instructions that instruct a computer system to at least:

send an electronic request, to a remote tax agency server via a network interface, for a first set of tax return data and a first set of consumer device data, the remote tax agency server comprising a first electronic data store configured to store tax return filing data and consumer device data associated with a plurality of consumers and at least on tax agency;

receive, from the remote tax agency server via the network interface, the first set of tax return data and the first set of consumer device data, the first set of tax return data and the first set of consumer device data associated with a first set of consumers from within the plurality of consumers, the first set of tax return data including at least one or more individual consumer attributes associated with each respective consumer within the first set of consumers, and the first set of consumer device data associated with each respective consumer within the first set of consumers;

access, from a second electronic data store comprising electronic consumer data records associated with the plurality of consumers, a first set of consumer data associated with the first set of consumers, and the first set of consumer device data associated with each respective consumer within the first set of consumers;

generate a first set of tax fraud indicators comprising a corresponding tax fraud indicator for each of the tax return data within the first set of tax return data where each of tax return data corresponds to each respective consumer within the first set of consumers, the first set of tax fraud indicator generated based at least in part on a comparison of;

(a) the one or more consumer attributes associated with the respective consumer, and (b) corresponding consumer data within the first set of consumer data associated with the respective consumer;

determine a tax fraud subset of the first set of tax return data as potentially fraudulent based at least on the first set of tax fraud indicator;

access a third electronic data store to obtain a first set of device activity data associated with the first set of consumer and comprising device activity data corresponding to each of the consumers within the first set of consumers;

generate a second set of tax fraud indicators comprising a corresponding tax fraud indicator for each of the tax return data within the first set of tax return data where each tax return data corresponds to each respective consumer within the first set of consumers, the second tax fraud indicator generated based at least in part on a comparison of;

(a) consumer device data within the first set of consumer device data corresponding to the respective consumer, and (b) device activity data within the first set of device activity data corresponding to the respective consumer;

determine a device fraud subset for the first set of tax return data as potentially fraudulent based on at least the set of device fraud indicator;

generate an encrypted data packet storing at least a subset of the tax fraud indicators based at least on the tax fraud subset and the device fraud subset, the subset of initial tax fraud indicators comprising an electronic indication to suspend processing of tax returns for consumers associated with the subset of initial tax fraud indicators; and

send the encrypted data to the remote tax agency server via the network interface.

12. The non-transitory computer storage of claim 11, wherein the executable instructions further instruct a computer system to:

generate, based on the consumer data associated with the first set of consumers, a set of one or more authentication questions;

provide the set of one or more authentication questions to a subset of the first set of consumers associated with the tax fraud subset;

receive sets of responses from the subset of the first set of consumers associated with the tax fraud subset; and

determine accuracy of the sets of responses.

13. The non-transitory computer storage of claim 12, wherein tax fraud indicators are generated based as least on the accuracy of the sets of responses.

14. The non-transitory computer storage of claim 11, wherein each of the one or more consumer attributes include at least five unique consumer attributes.

15. The non-transitory computer storage of claim 12, wherein the sets of responses are received from consumer computing devices associated with the subset of the first set of consumers associated with the tax fraud subset.

16. An electronic fraud detection system for automated analysis of electronic tax return generating indication of fraud, the system comprising:

a fraud detection server comprising one or more processors programmed to execute instructions and configured to communicate with at least a first electronic data store, a second electronic data store, and a third electronic data store, the fraud detection server comprising;

an electronic data interface module configured to, by the one or more processors, electronically communicate with the first electronic data store configured to at least store tax return filing data associated with a plurality of consumers and at least one tax agency, wherein access to the first electronic data store is provided by a tax agency computing system, the second electronic data store configured to at least store consumer data associated with the plurality of consumers, and the third electronic data store configured to at least store consumer device activity data associated with a plurality of consumer devices associated with the plurality of consumers;

an initial screening module configured to, by the one or more processors;

receive the tax return filing data from the first electronic data store;

apply filters to the tax return filing data, including at least one or more consumer attributes associated with each respective consumer and received from the electronic data interface module; and

generate a set of electronic tax fraud indications that represent whether consumer records within the tax return filing data are likely fraudulent due to missing or inaccurate information; and

a knowledge-based authentication module configured to, by the one or more processors;

dynamically generate authentication questions associated with a consumer associated with one of the consumer records identified as likely fraudulent, the generated questions based on consumer credit data corresponding to the consumer that is received from the electronic data interface module, for which the answers are confidential and based on credit data;

provide the authentication questions to the consumer;

receive authentication response information corresponding to the authentication questions; and

generate an electronic authentication indication representing an accuracy level of the authentication response information; and

a device authentication module configured to, by the one or more processors;

dynamically analyze whether a computing device used to provide the authentication response information may have been used in fraudulent activities or is related to other devices that have been used in fraudulent activities using a unique device identifier associated with the computing device, the unique device identifier generated using information collected from the computing device; and

generate an electronic device indication representing a risk level that the device associated with fraud; and

an accuracy reporting module configured to, by the one or more processors, make the electronic authentication indication and the electronic device indication available to the tax agency computing system.

17. The electronic fraud detection system of claim 16 wherein the device authentication module is further configured to generate a fraud risk score based on at least an indication of the accuracy authentication response information corresponding to the authentication questions, and the electronic device indication.

18. The electronic fraud detection system of claim 16 wherein the computing device is a same device used by the consumer to electronically submit the tax return to the tax agency computing system.

19. The electronic fraud detection system of claim 16 wherein the information collected from the computing device includes at least ten unique device identifier attributes.

20. The electronic fraud detection system of claim 16 wherein authentication response information corresponding to the authentication questions is received from the computing device.