Outgoing communication scam prevention

• US 10,757,058 B2
• Filed: 02/17/2017
• Issued: 08/25/2020
• Est. Priority Date: 02/17/2017
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Baracaldo Angel, Nathalie, Chowdhary, Pawan R., Ludwig, Heiko H., Moore, Robert J., Safavi, Amir J.
• Primary Examiner(s): Wang, Liang Che A
• Application Number:
  US15/436,365
• Publication Number:
  US 20180241647A1
• Time in Patent Office: 1,285 Days
• Field of Search: 709206, 709223, 709224
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

One embodiment provides a method comprising intercepting an incoming communication for a user, and determining whether to classify the incoming communication as a suspicious incoming communication based on content of the incoming communication and a learned classification model or learned signatures. The method further comprises monitoring one or more outgoing communications from the user, and invoking an action relating to scam prevention in response to determining an outgoing communication from the user is linked to a suspicious incoming communication.

Claims

1. A method comprising:

intercepting an incoming communication for a user;

classifying the incoming communication as a suspicious incoming communication or a standard incoming communication that is not suspicious by;

determining, via a learned classification model trained using machine learning, a risk assessment metric for the incoming communication based on content of the incoming communication, wherein the risk assessment metric represents a confidence level the incoming communication is predicted as a scam via the learned classified model, and the learned classification model is trained based on training data comprising information indicative of known scams; and

determining whether the risk assessment metric exceeds a pre-determined threshold, wherein the incoming communication is classified as a suspicious incoming communication in response to determining the risk assessment metric exceeds the pre-determined threshold; and

in response to classifying the incoming communication as a suspicious incoming communication;

further classifying the incoming communication with a corresponding classification class indicative of a type of scam that the incoming communication involves and further indicative of an individual or an entity that a scammer from which the incoming communication originates is impersonating;

generating and providing, to the user for review, a risk report comprising one or more risk assessment results for the incoming communication based on the risk assessment metric and the corresponding classification class;

monitoring one or more outgoing communications from the user; and

invoking an action relating to scam prevention in response to determining an outgoing communication from the user is linked to the incoming communication.

2. The method of claim 1, wherein:

the incoming communication comprises one of an incoming phone call, an incoming voicemail, an incoming electronic message, an incoming email, or a digitized copy of incoming mail; and

the outgoing communication comprises one of an outgoing phone call, an outgoing electronic message, an outgoing email, or a digitized copy of outgoing mail.

3. The method of claim 1, wherein the incoming communication is classified as a standard incoming communication that is not suspicious in response to determining the risk assessment metric does not exceed the pre-determined threshold.

4. The method of claim 1,

wherein the risk report comprises follow-up contact information for responding to the incoming communication, the risk assessment metric, and a recommendation.

5. The method of claim 4, further comprising:

in response to classifying the incoming communication as a suspicious incoming communication, storing the incoming communication and the risk report in a database indexed by the follow-up contact information for responding to the incoming communication.

6. The method of claim 1, wherein:

the training data further comprises information indicative of at least one of the following;

unwanted solicitations, benign conversations, or social engineering tactics scammers employ.

7. The method of claim 5, wherein invoking an action relating to scam prevention in response to determining an outgoing communication from the user is linked to the incoming communication comprises:

determining whether contact information for the outgoing communication matches the follow-up contact information for responding to the incoming communication; and

in response to determining the contact information for the outgoing communication matches the follow-up contact information for responding to the incoming communication, reminding the user of the risk report.

8. The method of claim 1, wherein invoking an action relating to scam prevention comprises:

if the outgoing communication comprises an outgoing phone call, invoking a real-time analysis of a conversation between the user and a recipient of an outgoing phone call to detect attributes that indicate phishing, scams, or telemarketing.

9. The method of claim 1, wherein invoking an action relating to scam prevention comprises:

if the outgoing communication comprises one of an outgoing email, an outgoing electronic message, or a digitized copy of outgoing mail, performing an intervention or providing a warning to the user based on a set of rules.

10. The method of claim 9, wherein the intervention comprises at least one of:

delaying the outgoing communication, triggering a warning to warn the user of risks, informing a third party, or canceling the outgoing communication.

11. The method of claim 2, further comprising:

if the incoming communication comprises an incoming voicemail, obtaining a transcript of the voicemail.

12. The method of claim 2, wherein the digitized copy of incoming mail is obtained via one of a scanner or a camera.

13. The method of claim 2, further comprising:

extracting an image from the incoming communication, and determining whether the image is substantially similar to a company logo for a known company.

14. A system comprising:

at least one processor; and

a non-transitory processor-readable memory device storing instructions that when executed by the at least one processor causes the at least one processor to perform operations including;

intercepting an incoming communication for a user;

classifying the incoming communication as a suspicious incoming communication or a standard incoming communication that is not suspicious by;

determining, via a learned classification model trained using machine learning, a risk assessment metric for the incoming communication based on content of the incoming communication, wherein the risk assessment metric represents a confidence level the incoming communication is predicted as a scam via the learned classified model, and the learned classification model is trained based on training data comprising information indicative of known scams; and

determining whether the risk assessment metric exceeds a pre-determined threshold, wherein the incoming communication is classified as a suspicious incoming communication in response to determining the risk assessment metric exceeds the pre-determined threshold; and

in response to classifying the incoming communication as a suspicious incoming communication;

further classifying the incoming communication with a corresponding classification class indicative of a type of scam that the incoming communication involves and further indicative of an individual or an entity that a scammer from which the incoming communication originates is impersonating;

generating and providing, to the user for review, a risk report comprising one or more risk assessment results for the incoming communication based on the risk assessment metric and the corresponding classification class;

monitoring one or more outgoing communications from the user; and

invoking an action relating to scam prevention in response to determining an outgoing communication from the user is linked to the incoming communication.

15. The system of claim 14, wherein:

the incoming communication comprises one of an incoming phone call, an incoming voicemail, an incoming electronic message, an incoming email, or a digitized copy of incoming mail; and

the outgoing communication comprises one of an outgoing phone call, an outgoing electronic message, an outgoing email, or a digitized copy of outgoing mail.

16. The system of claim 14, wherein the incoming communication is classified as a standard incoming communication that is not suspicious in response to determining the risk assessment metric does not exceed the pre-determined threshold.

17. The system of claim 14,

wherein the risk report comprises follow-up contact information for responding to the incoming communication, the risk assessment metric, and a recommendation.

18. The system of claim 14, wherein:

the training data further comprises information indicative of at least one of the following;

unwanted solicitations, benign conversations, or social engineering tactics scammers employ.

19. The system of claim 14, wherein invoking an action relating to scam prevention comprises:

if the outgoing communication comprises an outgoing phone call, invoking a real-time analysis of a conversation between the user and a recipient of an outgoing phone call to detect attributes that indicate phishing, scams, or telemarketing; and

if the outgoing communication comprises one of an outgoing email, an outgoing electronic message, or a digitized copy of outgoing mail, performing an intervention or providing a warning to the user based on a set of rules.

20. A computer program product comprising a computer-readable hardware storage medium having program code embodied therewith, the program code being executable by a computer to implement a method comprising:

intercepting an incoming communication for a user;

classifying the incoming communication as a suspicious incoming communication or a standard incoming communication that is not suspicious by;

determining, via a learned classification model trained using machine learning, a risk assessment metric for the incoming communication based on content of the incoming communication, wherein the risk assessment metric represents a confidence level the incoming communication is predicted as a scam via the learned classified model, and the learned classification model is trained based on training data comprising information indicative of known scams; and

determining whether the risk assessment metric exceeds a pre-determined threshold, wherein the incoming communication is classified as a suspicious incoming communication in response to determining the risk assessment metric exceeds the pre-determined threshold; and

in response to classifying the incoming communication as a suspicious incoming communication;

further classifying the incoming communication with a corresponding classification class indicative of a type of scam that the incoming communication involves and further indicative of an individual or an entity that a scammer from which the incoming communication originates is impersonating;

generating and providing, to the user for review, a risk report comprising one or more risk assessment results for the incoming communication based on the risk assessment metric and the corresponding classification class;

monitoring one or more outgoing communications from the user; and

invoking an action relating to scam prevention in response to determining an outgoing communication from the user is linked to the incoming communication.