COMPREHENSIVE SUSPICIOUS ACTIVITY MONITORING AND ALERT SYSTEM

• US 20110131123A1
• Filed: 10/29/2010
• Published: 06/02/2011
• Est. Priority Date: 12/01/2009
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Shiflet, Robert George JR., Griffin, Maura Louise, Stigler, Teresa Hegdahl, Turner, David G., Turner, Donna Dee, Harman, Mary Palmer
• Granted Patent: US 8,412,605 B2
• Time in Patent Office: Days
• US Class Current: 705/35
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof
• CPC Class Codes: G06Q 40/08 Insurance

Abstract

Embodiments of the present invention relate to systems, apparatus, methods and computer program products for integrated risk management. More specifically, embodiments of the present invention provide for monitoring financial institution data from a plurality of financial institutions, including transactional data associated with multiple products and channels, to identify suspicious activity potentially associated with identity theft incidents and, in specific embodiments, communicate suspicious activity and/or identity theft alerts and/or reports in response to identifying the suspicious activities and/or confirming an identity theft incident associated with the suspicious activity. In further embodiments, the monitored financial institution may include one or more, and in some embodiments all of, account data, asset data, liability data, negative file data, customer data, device data, credit data, or biometric data. In addition, in certain embodiments, the monitored data may include non-financial institution data.

Claims

1. An apparatus for risk management, the apparatus comprising:

a computing platform including at least one processor and a memory;

a risk database stored in the memory and configured to receive financial institution data, from a plurality of financial institutions, wherein the financial institution data includes transaction data associated with a plurality of financial institution products and a plurality of financial institution channels; and

a suspicious activity monitoring routine stored in the memory, executable by the processor and configured to analytically monitor the financial institution data to identify suspicious activity potentially associated with an identity theft incident.

2. The apparatus of claim 1, wherein the risk database is further configured to receive the financial institution data and wherein the financial institution data includes customer account data.

3. The apparatus of claim 2, wherein the risk database is further configured to receive the financial institution data and wherein the customer account data includes account opening data and account closing data.

4. The apparatus of claim 1, wherein the risk database is further configured to receive the financial institution data and wherein the financial institution data includes asset data.

5. The apparatus of claim 4, wherein the risk database is further configured to receive the financial institution data and wherein the asset data includes deposit data and investment data.

6. The apparatus of claim 1, wherein the risk database is further configured to receive the financial institution data and wherein the financial institution data includes liability data.

7. The apparatus of claim 6, wherein the risk database is further configured to receive the financial institution data and wherein the liability data includes outstanding credit data, credit limit data and credit payment data.

8. The apparatus of claim 1, wherein the risk database is further configured to receive the financial institution data, wherein the financial institution data includes customer biometric data.

9. The apparatus of claim 1, wherein the risk database is further configured to receive the financial institution data and wherein the financial institution data includes negative file data.

10. The apparatus of claim 1, wherein the risk database is further configured to receive the financial institution data and wherein the financial institution data includes customer data.

11. The apparatus of claim 1, wherein the risk database is further configured to receive non-financial institution data from one or more non-financial institution entities and the suspicious activity monitoring routine is further configured to analytically monitor the non-financial institution data to identify suspicious activity potentially associated with an identity theft incident.

12. The apparatus of claim 11, wherein the risk database is further configured to receive the non-financial institution data from the one or more non-financial institution entities, wherein the entities include one or more of merchants, businesses, utilities, government agencies, health care organizations, social networks, telephone service providers or Internet service providers.

13. The apparatus of claim 11, wherein the risk database is further configured to receive the non-financial institution data and wherein the non-financial institution data includes one or more of transaction data, product data, channel data, account data, credit data, asset data, customer data, device data or biometric data.

14. The apparatus of claim 11, wherein the risk database is further configured to receive at least a portion of the financial institution data and at least a portion of the non-financial institution data from one or more data aggregators.

15. The apparatus of claim 1, wherein the risk database is further configured to receive linking data that links the data received in the risk database to one or more customers.

16. The apparatus of claim 1, wherein the suspicious activity monitoring routine is further configured to receive an identity theft query from at least one of a financial institution, non-financial institution entity or a customer, and determine whether a queried one of a transaction, a behavior, a person or an entity represents a likely identity theft incident.

17. The apparatus of claim 1, wherein the suspicious activity monitoring routine is further configured to receive an identity validation query from at least one of a financial institution, non-financial institution entity or a customer to validate a person'"'"'s or an entity'"'"'s identity.

18. The apparatus of claim 1, wherein the suspicious activity monitoring routine is further configured to generate and initiate communication of a suspicious activity alert based on an identified suspicious activity potentially associated with an identity theft incident.

19. The apparatus of claim 18, wherein the suspicious activity monitoring routine is further configured to generate and initiate communication of the suspicious activity alert to one or more of financial institutions, non-financial institutions or customers.

20. The apparatus of claim 1, wherein the suspicious activity monitoring routine is further configured to generate and initiate communication of an identity theft alert based on confirmation that the suspicious activity is associated with an identity theft incident.

21. The apparatus of claim 20, wherein the suspicious activity monitoring routine is further configured to generate and initiate communication of the identity theft alert to one or more of financial institutions, non-financial institutions or customers.

22. The apparatus of claim 1, wherein the suspicious activity monitoring routine is further configured to generate and initiate communication of a suspicious activity report based on one or more identified suspicious activities.

23. The apparatus of claim 1, wherein the suspicious activity monitoring routine is further configured to generate and initiate communication of an identity theft report based on confirmation of one or more identity theft incidents.

24. A method for risk management, the method comprising:

receiving, at a risk database stored in computing device memory, financial institution data from a plurality of financial institutions, including transaction data associated with a plurality of financial institution products and a plurality of financial institution channels;

monitoring, via a computing device processor, the risk database to identify a suspicious activity potentially associated with an identity theft incident; and

initiating, via a computing device processor, a risk management action in response to identification of the suspicious activity.

25. The method of claim 24, wherein receiving further comprises receiving, at the risk database stored in computing device memory, the financial institution data including customer account data.

26. The method of claim 25, wherein receiving further comprises receiving, at the risk database stored in computing device memory, the financial institution data including the customer account data, wherein the customer account data includes account opening data and account closing data.

27. The method of claim 24, wherein receiving further comprises receiving, at the risk database stored in computing device memory, the financial institution data including customer asset data.

28. The method of claim 27, wherein receiving further comprises receiving, at the risk database stored in computing device memory, the financial institution data including the customer asset data, wherein the customer asset data includes deposit data and investment data.

29. The method of claim 24, wherein receiving further comprises receiving, at the risk database stored in computing device memory, the financial institution data including customer liability data.

30. The method of claim 29, wherein receiving further comprises receiving, at the risk database stored in computing device memory, the financial institution data including the customer liability data, wherein the customer liability data includes outstanding credit data, credit limit data and credit payment data.

31. The method of claim 24, wherein receiving further comprises receiving, at the risk database stored in computing device memory, the financial institution data including customer biometric data.

32. The method of claim 24, wherein receiving further comprises receiving, at the risk database stored in computing device memory, the financial institution data including negative file data.

33. The method of claim 24, wherein receiving further comprises receiving, at the risk database stored in computing device memory, the financial institution data including customer data.

34. The method of claim 24, wherein receiving further comprises receiving non-financial institution data from one or more non-financial institution entities, and monitoring further comprises monitoring the non-financial institution data to identify suspicious activity potentially associated with an identity theft incident.

35. The method of claim 34, wherein receiving further comprises receiving non-financial institution data from one or more non-financial institution entities wherein the non-financial institution entities include one or more of merchants, businesses, utilities, government agencies, health care organizations, social networks, telephone service providers or Internet service providers.

36. The method of claim 34, wherein receiving further comprises receiving the non-financial institution data, including at least one of transaction data, product data, channel data, account data, credit data, asset data, customer data, device data or biometric data.

37. The method of claim 34, wherein receiving further comprises receiving, at the risk database stored in computing device memory, at least a portion of the financial institution data and at least a portion of the non-financial institution data from one or more data aggregators.

38. The method of claim 24, wherein receiving further comprises receiving linking data that links the data received in the risk database to one or more customers.

39. The method of claim 24, further comprising receiving an identity theft query from at least one of a financial institution, non-financial institution entity or a customer and determining whether a queried one of a transaction, a behavior, a person or an entity represents a likely identity theft incident.

40. The method of claim 24, further comprising receiving an identity validation query from at least one of a financial institution, non-financial institution entity or a customer and validating a person'"'"'s or entity'"'"'s identity based on the query.

41. The method of claim 24, wherein initiating further comprises generating and initiating communication of a suspicious activity alert based on an identified suspicious activity potentially associated with an identity theft incident.

42. The method of claim 41, wherein generating further comprises generating and initiating communication of the suspicious activity alert to one or more of financial institutions, non-financial institutions or customers.

43. The method of claim 24, wherein initiating further comprises generating and initiating communication of an identity theft alert based on confirmation that the suspicious activity is associated with an identity theft incident.

44. The method of claim 43, wherein generating further comprises generating and initiating communication of the identity theft alert to one or more of financial institutions, non-financial institutions or customers.

45. The method of claim 24, wherein initiating further comprises generating and initiating communication of a suspicious activity report based on one or more identified suspicious activities potentially associated with one or more identity theft incidents.

46. The method of claim 24, wherein initiating further comprises generating and initiating communication of an identity theft report based on confirmation of one or more identity theft incidents.

47. A computer program product comprising:

a computer-readable medium comprising;

a first set of codes for causing a computer to receive financial institution data from a plurality of financial institutions, including transaction data associated with a plurality of financial institution products and a plurality of financial institution channels;

a second set of codes for causing a computer to monitor the risk database to identify a likelihood of a suspicious activity potentially associated with an identity theft incident; and

a third set of codes for causing a computer to initiate a risk management action in response to identification of the suspicious activity.

48. The computer program product of claim 47, wherein the first set of codes is further configured to cause the computer to receive the financial institution data, including customer account data.

49. The computer program product of claim 47, wherein the first set of codes is further configured to cause the computer to receive the financial institution data, including the customer account data, wherein the customer account data includes account opening data and account closing data.

50. The computer program product of claim 47, wherein the first set of codes is further configured to cause the computer to receive the financial institution data, including customer asset data.

51. The computer program product of claim 50, wherein the first set of codes is further configured to cause the computer to receive the financial institution data, including the customer asset data, wherein the customer asset data includes deposit data and investment data.

52. The computer program product of claim 47, wherein the first set of codes is further configured to cause the computer to receive the financial institution data, including customer liability data.

53. The computer program product of claim 52, wherein the first set of codes is further configured to cause the computer to receive the financial institution data, including the customer liability data, wherein the customer liability data includes outstanding credit data, credit limit data and credit payment data.

54. The computer program product of claim 47, wherein the first set of codes is further configured to cause the computer to receive the financial institution data, including customer biometric data.

55. The computer program product of claim 47, wherein the first set of codes is further configured to cause the computer to receive the financial institution data, including negative file data.

56. The computer program product of claim 47, wherein the first set of codes is further configured to cause the computer to receive the financial institution data, including customer data.

57. The computer program product of claim 47, wherein the first set of codes is further configured to cause the computer to receive non-financial institution data from one or more non-financial institution entities, and wherein the second set of codes is further configured to cause the computer to monitor the non-financial institution data to identify suspicious activity potentially associated with an identity theft incident.

58. The computer program product of claim 57, wherein the first set of codes is further configured to cause the computer to receive non-financial institution data from one or more non-financial institution entities and wherein the non-financial institution entities include one or more of merchants, businesses, utilities, government agencies, health care organizations, social networks, telephone service providers or Internet service providers.

59. The computer program product of claim 57, wherein the first set of codes is further configured to cause the computer to receive the non-financial institution data, including at least one of transaction data, product data, channel data, account data, credit data, asset data, customer data, device data or biometric data.

60. The computer program product of claim 57, wherein the first set of codes is further configured to cause the computer to receive at least a portion of the financial institution data and at least a portion of the non-financial institution data from one or more data aggregators.

61. The computer program product of claim 47, wherein the first set of codes is further configured to cause the computer to receive linking data that links data received in the risk database to one or more customers.

62. The computer program product of claim 47, further comprising a fourth set of codes for causing a computer to receive an identity theft query from at least one of a financial institution, non-financial institution entity or a customer, and a fifth set of codes for causing a computer to determine whether a queried one of a transaction, a behavior, a person or an entity represents a likely identity theft incident.

63. The computer program product of claim 47, further comprising a fourth set of codes for causing a computer to receive an identity validation query from at least one of a financial institution, non-financial institution entity or a customer, and a fifth set of codes for causing a computer to validate a person'"'"'s or an entity'"'"'s identity based on the query.

64. The computer program product of claim 47, wherein the third set of codes is further configured to cause the computer to generate and initiate communication of a suspicious activity alert based on an identified suspicious activity potentially associated with an identity theft incident.

65. The computer program product of claim 61, wherein the third set of codes is further configured to cause the computer to generate and initiate communication of the suspicious activity alert to one or more of financial institutions, non-financial institutions or customers.

66. The computer program product of claim 47, wherein the third set of codes is further configured to cause the computer to generate and initiate communication of an identity theft alert based on a confirmation of an identity theft incident.

67. The computer program product of claim 63, wherein the third set of codes is further configured to cause the computer to generate and initiate communication of the identity theft alert to one or more of financial institutions, non-financial institutions or customers.

68. The computer program product of claim 47, wherein the third set of codes is further configured to cause the computer to generate and initiate communication of a suspicious activity report based on one or more identified suspicious activities potentially associated with one or more identity theft incidents.

69. The computer program product of claim 47, wherein the third set of codes is further configured to cause the computer to generate and initiate communication of an identity theft report based on confirmation of one or more identity theft incidents.