Self-Calibrating Fraud Detection

• US 20080077515A1
• Filed: 09/18/2006
• Published: 03/27/2008
• Est. Priority Date: 09/18/2006
• Status: Active Grant

• Current Assignee: Fair Isaac Corporation
• Original Assignee: Fair Isaac Corporation
• Inventors: Zoldi, Scott M., Chen, Fei, Wu, Steven
• Granted Patent: US 8,027,439 B2
• Time in Patent Office: Days
• US Class Current: 705/35
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03

Abstract

A method for dynamically updating a model is described. The method includes accessing a model that specifies expected characteristics for a transaction. The model includes variables associated with fraud. The method also includes receiving at least one value for each of the variables while monitoring transactions, and updating a distribution of values for each variable based on the received value. The received value is compared with the updated distribution to determine a deviation from a threshold value associated with a percentile of the updated distribution that is indicative of fraud.

Claims

1. A method for dynamically updating a model comprising:

accessing a model that specifies expected characteristics for a transaction, wherein the model comprises variables associated with fraud;

receiving at least one value for each of the variables while monitoring transactions; and

updating a distribution of values for each variable based on the received value, wherein the received value is compared with the updated distribution to determine a deviation from a threshold value associated with a percentile of the updated distribution that is indicative of fraud.

2. The method of claim 1, further comprising scaling the determined deviation based on a variance range between the threshold value and a maximum expected value of the updated distribution.

3. The method of claim 2, wherein the scaled determined deviation is calculated based on an equation comprising:

$q<br><br>\left(x_i<br><br>\text{<br><br>}<br><br>\mathrm{\theta <br><br>}\right)\equiv <br><br>\frac{x_i-{\mathrm{\theta <br><br>}}_1}{{\mathrm{\theta <br><br>}}_2}\in <br><br>\left[0,C\right]$

where q is the scaled determined value, x_i is the received value for a variable, ⊖

₁ is the threshold value associated with the percentile of the updated distribution that is indicative of fraud, ⊖

₂ is the variance range, and C is a constant that defines a maximum value to which the scaled determined deviation can be scaled.

4. The method of claim 3, further comprising determining a score indicative of a probability of fraud for the transaction based on the scaled determined deviation.

5. The method of claim 4, wherein the score is calculated based on an equation comprising:

η

=Σ

q(x_i|θ

)

where η

is the score.

6. The method of claim 5, further comprising weighting each scaled determined deviation with a coefficient correlated to an assigned importance of each variable within the model.

7. The method of claim 5, further comprising applying an adaptive score calibration to the score so that scores between model segments are normalized.

8. The method of claim 1, further comprising scaling the determined deviation based on a variance range assigned or selected by a user.

9. The method of claim 1, further comprising scaling the determined deviation based on a variance range between the percentile of the updated distribution that is indicative for fraud and a percentile of the updated distribution that is indicative of a maximum significant value.

10. The method of claim 1, further comprising generating a preliminary distribution of values for each variable based on an aggregation of historical transactions, wherein generating the distribution of values occurs before updating the distribution of values.

11. The method of claim 1, wherein the model includes a global model that specifies expected characteristics for the transaction based on substantially all of the monitored transactions.

12. The method of claim 1, wherein the model comprises segment models.

13. The method of claim 12, wherein the segment is generated based on user input.

14. The method of claim 12, wherein the segment'"'"'s expected characteristics for the transaction differ from expected characteristics of other segments of the global model.

15. The method of claim 14, further comprising identifying the received value as associated with the segment and exclusively updating, relative to the other segments, the distribution of values for each variable of the segment based on the received value.

16. The method of claim 15, further comprising updating the distribution values for each variable of the global model based on the received value.

17. The method of claim 15, further comprising determining a score indicative of a probability of fraud for the transaction based on the updated segment.

18. The method of claim 16, further comprising determining a score indicative of a probability of fraud for the transaction based on the updated global model if substantially insufficient statistics have been gathered for the segment.

19. The method of claim 1, further comprising determining a score indicative of a probability of fraud for the transaction based on the deviation of the received value from the threshold.

20. The method of claim 1, wherein the percentile of the updated distribution that is indicative of fraud is different from percentiles of the updated distribution for other variables in the model.

21. The method of claim 1, wherein the variables are included in a service profile of the model, the service profile being associated with a party related to the transaction.

22. The method of claim 21, further comprising extracting a profile identifier from the transaction and identifying the service profile based on the profile identifier.

23. The method of claim 1, wherein the distribution of values for each variable are included in a model profile of the model, the model profile specifying the expected characteristics for the transaction.

24. A method for processing a transaction comprising:

receiving a value for a variable associated with a transaction, wherein the variable is indicative of fraud;

updating a distribution of values for the variable based on the received value, wherein the updated distribution is used to determine a deviation of the received value from a selected value in the updated distribution; and

determining a score indicative of a probability of fraud for the transaction based on the deviation of the received value.

25. The method of claim 24, wherein the selected value is based on a fixed percentage of the distribution values, and wherein the fixed percentage defines a threshold above which values are determined to be substantially atypical for the variable.

26. A system for determining fraud comprising:

an interface to receive values associated with a transaction, each value corresponding to a property correlated to fraudulent transactions;

a profile updater to modify a distribution of values for each property based on the corresponding received value; and

a score calculator to generate a fraud score for the transaction, wherein generating the fraud score comprises comparing the received value with the updated distribution to determine a deviation from a threshold value of the updated distribution that is indicative of fraud.

27. A method for generating a fraud indicator comprising:

generating a score indicative of a probability of fraud for a transaction, the generating comprising aggregating self-scaling variables, wherein the self-scaling variables are determined by

updating a distribution of values for each self-scaling variable with a received value for the self-scaling variable;

determining an updated threshold value based on the updated distribution, wherein the updated threshold value indicates a beginning of a range of values that are unusual relative to the updated distribution; and

scaling the received value based on the updated threshold value.

28. The method of claim 27, further comprising receiving values for the self-scaling variables associated with transactions during a monitoring of the transactions, wherein each self-scaling variable is an indicator of a probability of fraud.

29. The method of claim 27, further comprising weighting each of the self-scaling variables to indicate a contribution of the variable in the aggregation.

30. A computer program product tangibly embodied in an information carrier, the computer program product including instructions that, when executed, perform operations for determining a fraud indicator, the operations comprising:

accessing a model that specifies expected characteristics for a transaction, wherein the model comprises variables associated with fraud;

receiving at least one value for each of the variables while monitoring transactions; and

updating a distribution of values for each variable based on the received value, wherein the received value is compared with the updated distribution to determine a deviation from a threshold value of the updated distribution that is indicative of fraud.