Method and apparatus for evaluating fraud risk in an electronic commerce transaction

• US 20020194119A1
• Filed: 05/08/2002
• Published: 12/19/2002
• Est. Priority Date: 05/30/2001
• Status: Active Grant

• Current Assignee: Cybersource Corporation (Visa, Inc.)
• Original Assignee: Cybersource Corporation (Visa, Inc.)
• Inventors: Hu, Hung-Tzaw, Wright, William
• Granted Patent: US 7,865,427 B2
• Time in Patent Office: Days
• US Class Current: 705/38
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 20/403 Solvency checks
• CPC Class Codes: G06Q 30/0609 Buyer or seller confidence or verification
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof
• CPC Class Codes: G06Q 40/08 Insurance
• CPC Class Codes: G07F 7/08 by coded identity card or credit card or other personal identification means without personal verification means G07F7/02

Abstract

According to one aspect, transaction information is received and applied to multiple fraud risk mathematical models that each produce a respective raw score, which are transformed with respective sigmoidal transform functions to produce optimized likelihood of fraud risk estimates to provide to a merchant. In one embodiment, the respective fraud risk estimates are combined using fusion proportions that are associated with the respective risk estimates, producing a single point risk estimate, which is transformed with a sigmoidal function to produce an optimized single point risk estimate for the transaction. The sigmoidal functions are derived to approximate a relationship between risk estimates produced by fraud risk detection models and a percentage of transactions associated with respective risk estimates, where the relationship is represented in terms of real-world distributions of fraudulent transaction and non-fraudulent transaction. One embodiment is directed to computing respective risk test penalties for multiple risk tests in one or more of the multiple fraud risk mathematical models used to estimate the likelihood of fraud, given a certain pattern of events represented by the transaction information, wherein the respective risk test penalties are computed as the inverse of the sum of one and a false positive ratio for the respective risk test.

Claims

1. A method for evaluating fraud risk in an electronic commerce transaction and providing a representation of the fraud risk to a merchant using electronic communication, the method comprising:

receiving transaction information;

applying the transaction information to one or more fraud risk mathematical models wherein each mathematical model produces a respective raw score; and

transforming the one or more respective raw scores with respective sigmoidal functions to generate respective risk estimates.

2. The method claim 1 wherein two or more fraud risk mathematical models are applied to the transaction information to generate respective risk estimates, the method comprising the steps of:

combining two or more of the respective risk estimates, using fusion proportions that are associated with the two or more fraud risk mathematical models that generate the respective risk estimates, to produce a single point risk estimate for the transaction; and

transforming the single point risk estimate with a sigmoidal function to produce an optimized single point risk estimate for the transaction.

3. The method of claim 2 wherein each of the two or more respective risk estimates is based on a respective statistical mathematical model from a set of one or more statistical mathematical models or on a respective heuristic mathematical model from a set of one or more heuristic mathematical models, and wherein at least one respective risk estimate is based on a respective statistical mathematical model and at least one other respective risk estimate is based on a respective heuristic mathematical model, and wherein the step of combining two or more of the respective risk estimates comprises the steps of:

establishing either the respective statistical mathematical model or the respective heuristic mathematical model as a first scoring authority for establishing the boundaries of fraud risk zones from a set of fraud risk zones;

establishing the first scoring authority with authority to modify at least one respective risk estimate, from the two or more respective risk estimates, that is in a first particular fraud risk zone from the set of fraud risk zones, based on an intent of the first scoring authority with respect to transaction information;

establishing as a second scoring authority the other of the respective statistical and heuristic mathematical models that is not the first scoring authority; and

establishing the second scoring authority with authority to modify at least one respective risk estimate, from the two or more respective risk estimates, that is in a second particular fraud risk zone from the set of fraud risk zones that is different than the first particular fraud risk zone, based on an intent of the second scoring authority with respect to transaction information.

4. The method of claim 2 wherein the step of combining two or more of the respective risk estimates comprises the steps of:

analyzing performance characteristics of the two or more fraud risk mathematical models in view of distribution characteristics of a set of fraud risk zones, wherein the distribution characteristics are in terms of a relationship between fraudulent and non-fraudulent transactions and a percentage of transactions associated with a risk estimate; and

determining a respective contribution from each of the two or more fraud risk mathematical models to the single point risk estimate for the transaction, based on the analyzed performance characteristics of the two or more fraud risk mathematical models.

5. The method of claim 4 comprising the step of:

adjusting the respective contributions from the two or more fraud risk mathematical models based on a merchant preference for one fraud risk type in relation to another fraud risk type.

6. The method of claim 2 comprising the steps of:

determining intermediate fusion proportions that are associated with the respective risk estimates from a perspective of each of the two or more fraud risk mathematical models; and

reducing the intermediate fusion proportions to the fusion proportions that are associated with the two or more fraud risk mathematical models that generate the respective risk estimates, based on a non-linear classification algorithm.

7. The method of claim 1 wherein the one or more fraud risk mathematical models each include a plurality of risk tests, the method comprising:

computing a respective risk test penalty for at least some of the plurality of risk tests of the one or more fraud risk mathematical models, wherein the respective risk test penalty is equal to the inverse of the sum of one and a false positive ratio for a respective risk test and wherein the false positive ratio is a ratio of correct risk detections to incorrect referrals generated by the respective risk test; and

computing a weighted summation of the risk test penalties to produce the respective raw score for the transaction.

8. The method of claim 1 comprising:

deriving the respective sigmoidal functions to approximate a relationship between risk estimates produced by one or more fraud risk detection models and a percentage of transactions associated with a risk estimate, in terms of distributions of fraudulent and non-fraudulent transactions; and

wherein the step of transforming is based on the respective sigmoidal functions.

9. The method of claim 8 wherein the relationship is defined by:

a first point at which the slope of the fraudulent transaction distribution becomes mathematically trivial in proximity to a zero percentage of transactions;

a second point at which the slope of the non-fraudulent transaction distribution becomes mathematically trivial in proximity to a zero percentage of transactions; and

a third point at which the fraudulent and non-fraudulent transaction distributions intersect.

10. The method of claim 9 wherein the step of deriving the respective sigmoidal functions is performed by constraining the respective sigmoidal functions to the abscissas of the first, second, and third points.

11. The method of claim 8 wherein the step of deriving the respective sigmoidal functions comprises the step of deriving respective sigmoidal functions that are dynamically adjustable based on a change to the relationship.

15. The computer-readable medium of claim 14 wherein two or more fraud risk mathematical models are applied to the transaction information to generate respective risk estimates, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of:

combining two or more of the respective risk estimates, using fusion proportions that are associated with the respective risk estimates, to produce a single point risk estimate for the transaction; and

transforming the single point risk estimate with a sigmoidal function to produce an optimized single point risk estimate for the transaction.

16. The computer-readable medium of claim 15 wherein each of the two or more respective risk estimates is based on a respective statistical mathematical model from a set of one or more statistical mathematical models or on a respective heuristic mathematical model from a set of one or more heuristic mathematical models, and wherein at least one respective risk estimate is based on a respective statistical mathematical model and at least one other respective risk estimate is based on a respective heuristic mathematical model, and wherein the instructions for combining two or more of the respective risk estimates comprises instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of:

establishing either the respective statistical mathematical model or the respective heuristic mathematical model as a first scoring authority for establishing the boundaries of fraud risk zones from a set of fraud risk zones;

establishing the first scoring authority with authority to modify at least one respective risk estimate, from the two or more respective risk estimates, that is in a first particular fraud risk zone from the set of fraud risk zones, based on an intent of the first scoring authority with respect to transaction information;

establishing as a second scoring authority the other of the respective statistical and heuristic mathematical models that is not the first scoring authority; and

establishing the second scoring authority with authority to modify at least one respective risk estimate, from the two or more respective risk estimates, that is in a second particular fraud risk zone from the set of fraud risk zones that is different than the first particular fraud risk zone, based on an intent of the second scoring authority with respect to transaction information.

17. The computer-readable medium of claim 15 wherein the instructions for combining two or more of the respective risk estimates comprises instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of:

analyzing performance characteristics of the two or more fraud risk mathematical models in view of distribution characteristics of a set of fraud risk zones, wherein the distribution characteristics are in terms of a relationship between fraudulent and non-fraudulent transactions and a percentage of transactions associated with a risk estimate; and

determining a respective contribution from each of the two or more fraud risk mathematical models to the single point risk estimate for the transaction, based on the analyzed performance characteristics of the two or more fraud risk mathematical models.

18. The computer-readable medium of claim 17, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of:

adjusting the respective contributions from the two or more fraud risk mathematical models based on a merchant preference for one fraud risk type in relation to another fraud risk type.

19. The computer-readable medium of claim 15 further comprising instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of:

determining intermediate fusion proportions that are associated with the respective risk estimates from a perspective of each of the two or more fraud risk mathematical models; and

reducing the intermediate fusion proportions to the fusion proportions that are associated with the two or more fraud risk mathematical models that generate the respective risk estimates, based on a non-linear classification algorithm.

20. The computer-readable medium of claim 14 wherein the one or more fraud risk mathematical models each include a plurality of risk tests, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of:

computing a respective risk test penalty for at least some of the plurality of risk tests of the one or more fraud risk mathematical models, wherein the respective risk test penalty is equal to the inverse of the sum of one and a false positive ratio for a respective risk test and wherein the false positive ratio is a ratio of correct risk detections to incorrect referrals generated by the respective risk test; and

computing a weighted summation of the risk test penalties to produce the respective raw score for the transaction.

21. The computer-readable medium of claim 14, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of:

deriving the respective sigmoidal functions to approximate a relationship between risk estimates produced by one or more fraud risk detection models and a percentage of transactions associated with a risk estimate, in terms of distributions of fraudulent and non-fraudulent transactions; and

wherein the step of transforming is based on the respective sigmoidal functions.

22. The computer-readable of claim 21 wherein the relationship is defined by:

a first point at which the slope of the fraudulent transaction distribution becomes mathematically trivial in proximity to a zero percentage of transactions;

a second point at which the slope of the non-fraudulent transaction distribution becomes mathematically trivial in proximity to a zero percentage of transactions; and

a third point at which the fraudulent and non-fraudulent transaction distributions intersect.

23. The computer-readable medium of claim 22 wherein the instructions for deriving the respective sigmoidal functions comprises instructions for constraining the respective sigmoidal functions to the abscissas of the first, second, and third points.

24. The computer-readable medium of claim 21 wherein the instructions for deriving the respective sigmoidal functions comprises instructions for deriving respective sigmoidal functions that are dynamically adjustable based on a change to the relationship.

30. The apparatus of claim 29 wherein two or more fraud risk mathematical models are applied to the transaction information to generate respective risk estimates, wherein the one or more stored sequences of instructions, when executed by the processor, cause the processor to carry out the steps of:

combining two or more of the respective risk estimates, using fusion proportions that are associated with the two or more fraud risk mathematical models that generate the respective risk estimates, to produce a single point risk estimate for the transaction; and

transforming the single point risk estimate with a sigmoidal function to produce an optimized single point risk estimate for the transaction.

31. The apparatus of claim 30 wherein each of the two or more respective risk estimates is based on a respective statistical mathematical model from a set of one or more statistical mathematical models or on a respective heuristic mathematical model from a set of one or more heuristic mathematical models, and wherein at least one respective risk estimate is based on a respective statistical mathematical model and at least one other respective risk estimate is based on a respective heuristic mathematical model, and wherein the instructions for carrying out the step of combining two or more of the respective risk estimates comprises instructions, when executed by the processor, that cause the processor to carry out the steps of:

establishing either the respective statistical mathematical model or the respective heuristic mathematical model as a first scoring authority for establishing the boundaries of fraud risk zones from a set of fraud risk zones;

establishing the first scoring authority with authority to modify at least one respective risk estimate, from the two or more respective risk estimates, that is in a first particular fraud risk zone from the set of fraud risk zones, based on an intent of the first scoring authority with respect to transaction information;

establishing as a second scoring authority the other of the respective statistical and heuristic mathematical models that is not the first scoring authority; and

establishing the second scoring authority with authority to modify at least one respective risk estimate, from the two or more respective risk estimates, that is in a second particular fraud risk zone from the set of fraud risk zones that is different than the first particular fraud risk zone, based on an intent of the second scoring authority with respect to transaction information.

32. The apparatus of claim 30 wherein the instructions for carrying out the step of combining two or more of the respective risk estimates comprises instructions, when executed by the processor, that cause the processor to carry out the steps of:

analyzing performance characteristics of the two or more fraud risk mathematical models in view of distribution characteristics of a set of fraud risk zones, wherein the distribution characteristics are in terms of a relationship between fraudulent and non-fraudulent transactions and a percentage of transactions associated with a risk estimate; and

determining a respective contribution from each of the two or more fraud risk mathematical models to the single point risk estimate for the transaction, based on the analyzed performance characteristics of the two or more fraud risk mathematical models.

33. The apparatus of claim 32 wherein the one or more stored sequences of instructions, when executed by the processor, cause the processor to carry out the steps of:

adjusting the respective contributions from the two or more fraud risk mathematical models based on a merchant preference for one fraud risk type in relation to another fraud risk type.

34. The apparatus of claim 30 wherein the one or more stored sequences of instructions, when executed by the processor, cause the processor to carry out the steps of:

determining intermediate fusion proportions that are associated with the respective risk estimates from a perspective of each of the two or more fraud risk mathematical models; and

reducing the intermediate fusion proportions to the fusion proportions that are associated with the two or more fraud risk mathematical models that generate the respective risk estimates, based on a non-linear classification algorithm.

35. The apparatus of claim 29 wherein the one or more fraud risk mathematical models each include a plurality of risk tests, and wherein the one or more stored sequences of instructions, when executed by the processor, cause the processor to carry out the steps of:

computing a respective risk test penalty for at least some of the plurality of risk tests of the one or more fraud risk mathematical models, wherein the respective risk test penalty is equal to the inverse of the sum of one and a false positive ratio for a respective risk test and wherein the false positive ratio is a ratio of correct risk detections to incorrect referrals generated by the respective risk test; and

computing a weighted summation of the risk test penalties to produce the respective raw score for the transaction.

36. The apparatus of claim 29 wherein the one or more stored sequences of instructions, when executed by the processor, cause the processor to carry out the steps of:

deriving the respective sigmoidal functions to approximate a relationship between risk estimates produced by one or more fraud risk detection models and a percentage of transactions associated with a risk estimate, in terms of distributions of fraudulent and non-fraudulent transactions; and

wherein the step of transforming is based on the respective sigmoidal functions.

37. The apparatus of claim 36 wherein the relationship is defined by:

a first point at which the slope of the fraudulent transaction distribution becomes mathematically trivial in proximity to a zero percentage of transactions;

a second point at which the slope of the non-fraudulent transaction distribution becomes mathematically trivial in proximity to a zero percentage of transactions; and

a third point at which the fraudulent and non-fraudulent transaction distributions intersect.

38. The apparatus of claim 37 wherein the instructions for deriving the respective sigmoidal functions comprises instructions, when executed by the processor, cause the processor to carry out the step of constraining the respective sigmoidal functions to the abscissas of the first, second, and third points.

39. The apparatus of claim 36 wherein the instructions for deriving the respective sigmoidal functions comprises instructions, when executed by the processor, cause the processor to carry out the step of deriving respective sigmoidal functions that are dynamically adjustable based on a change to the relationship.

12. A method for assessing the likelihood of fraud given a fraud detection response from a fraud risk test in a fraud risk detection mathematical model, the method comprising the step of:

computing a fraud risk test penalty equal to the inverse of the sum of one and a false positive ratio for the fraud risk test, wherein the false positive ratio is a ratio of correct risk detections to incorrect referrals generated by the fraud risk test.

13. A method for programmatically evaluating fraud risk in an electronic commerce transaction and providing a representation of the fraud risk to a merchant via a network, the method comprising:

receiving purchasing information at a server via the network, wherein at least some of the purchasing information is provided by a prospective purchaser of goods or services or goods and services from the merchant;

computing a respective raw score from one or more fraud risk mathematical models, wherein each respective raw score is based at least in part on the purchasing information;

accessing first transformation information from a database to generate one or more first sigmoidal functions that are based at least in part on historical transaction information;

computing a respective risk estimate by transforming a raw score with a respective sigmoidal function;

if there are multiple risk estimates, combining respective risk estimates using fusion proportions to produce a single point risk estimate for the electronic transaction;

accessing second transformation information from a database to generate a second sigmoidal function;

computing an optimized single point risk estimate for the transaction by transforming the single point risk estimate with the second sigmoidal function; and

transmitting a representation of the optimized single point risk estimate to the merchant via the network.

14. A computer-readable medium carrying one or more sequences of instructions for evaluating fraud risk in an electronic commerce transaction and providing a representation of the fraud risk to a merchant using electronic communication, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

receiving transaction information;

applying the transaction information to one or more fraud risk mathematical models wherein each mathematical model produces a respective raw score; and

transforming the one or more respective raw scores with respective sigmoidal functions to generate respective risk estimates.

25. A computer-readable medium carrying one or more sequences of instructions for assessing the likelihood of fraud given a fraud detection response from a fraud risk test in a fraud risk detection mathematical model, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

computing a fraud risk test penalty equal to the inverse of the sum of one and a false positive ratio for the fraud risk test, wherein the false positive ratio is a ratio of correct risk detections to incorrect referrals generated by the fraud risk test.

26. A computer-readable medium carrying one or more sequences of instructions for programmatically evaluating fraud risk in an electronic commerce transaction and providing a representation of the fraud risk to a merchant via a network, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

receiving purchasing information at a server via the network, wherein at least some of the purchasing information is provided by a prospective purchaser of goods or services or goods and services from the merchant;

computing a respective raw score from one or more fraud risk mathematical models, wherein each respective raw score is based at least in part on the purchasing information;

accessing first transformation information from a database to generate one or more first sigmoidal functions that are based at least in part on historical transaction information;

computing a respective risk estimate by transforming a raw score with a respective sigmoidal function;

if there are multiple risk estimates, combining respective risk estimates using fusion proportions to produce a single point risk estimate for the electronic transaction;

accessing second transformation information from a database to generate a second sigmoidal function;

computing an optimized single point risk estimate for the transaction by transforming the single point risk estimate with the second sigmoidal function; and

transmitting a representation of the optimized single point risk estimate to the merchant via the network.

27. An apparatus for evaluating fraud risk in an electronic commerce transaction and providing a representation of the fraud risk to a merchant using electronic communication, comprising:

means for receiving transaction information;

means for applying the transaction information to one or more fraud risk mathematical models wherein each mathematical model produces a respective raw score, and

means for transforming the one or more respective raw scores with respective sigmoidal functions to generate respective risk estimates.

28. An apparatus for programmatically evaluating fraud risk in an electronic commerce transaction and providing a representation of the fraud risk to a merchant via a network, comprising:

means for receiving purchasing information at a server via the network, wherein at least some of the purchasing information is provided by a prospective purchaser of goods or services or goods and services from the merchant;

means for computing a respective raw score from one or more fraud risk mathematical models, wherein each respective raw score is based at least in part on the purchasing information;

means for accessing first transformation information from a database to generate one or more first sigmoidal functions that are based at least in part on historical transaction information;

means for computing a respective risk estimate by transforming a raw score with a respective sigmoidal function;

means for combining respective risk estimates using fusion proportions to produce a single point risk estimate for the electronic transaction, if there are multiple risk estimates;

means for accessing second transformation information from a database to generate a second sigmoidal function;

means for computing an optimized single point risk estimate for the transaction by transforming the single point risk estimate with the second sigmoidal function; and

means for transmitting a representation of the optimized single point risk estimate to the merchant via the network.

29. An apparatus for evaluating fraud risk in an electronic commerce transaction and providing a representation of the fraud risk to a merchant using electronic communication, comprising:

a network interface that is coupled to the data network for receiving one or more packet flows therefrom;

a processor;

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of;

receiving transaction information;

applying the transaction information to one or more fraud risk mathematical models wherein each mathematical model produces a respective raw score; and

transforming the one or more respective raw scores with respective sigmoidal functions to generate respective risk estimates.

40. An apparatus for programmatically evaluating fraud risk in an electronic commerce transaction and providing a representation of the fraud risk to a merchant via a network, comprising:

a network interface that is coupled to the data network for receiving one or more packet flows therefrom;

a processor;

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of;

receiving purchasing information at a server via the network, wherein at least some of the purchasing information is provided by a prospective purchaser of goods or services or goods and services from the merchant;

computing a respective raw score from one or more fraud risk mathematical models, wherein each respective raw score is based at least in part on the purchasing information;

accessing first transformation information from a database to generate one or more first sigmoidal functions that are based at least in part on historical transaction information;

computing a respective risk estimate by transforming a raw score with a respective sigmoidal function;

if there are multiple risk estimates, combining respective risk estimates using fusion proportions to produce a single point risk estimate for the electronic transaction;

accessing second transformation information from a database to generate a second sigmoidal function;

computing an optimized single point risk estimate for the transaction by transforming the single point risk estimate with the second sigmoidal function; and

transmitting a representation of the optimized single point risk estimate to the merchant via the network.