Event manager for use in fraud detection

• US 6,535,728 B1
• Filed: 11/18/1999
• Issued: 03/18/2003
• Est. Priority Date: 11/18/1998
• Status: Expired due to Term

• Current Assignee: Vesta Corporation
• Original Assignee: Lightbridge Incorporated
• Inventors: Arena, Michael J., Antell, Richard H., Farrar, Michael B., Wilson, Theodore J., Mancini, Elizabeth, Uftring, Michael D., Samek, Scott J., Buchanan, Darin L., Butler, Timothy W., Wise, Karen G., Perfit, Michael Adam
• Primary Examiner(s): Le, Thanh Cong
• Assistant Examiner(s): Harry, Andrew T
• Application Number:
  US09/443,065
• Time in Patent Office: 1,216 Days
• Field of Search: 455/410, 455/411, 379/144.03, 379/145, 379/189
• US Class Current: 455/410
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: H04M 15/41 Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]
• CPC Class Codes: H04M 15/43 Billing software details
• CPC Class Codes: H04M 15/44 Augmented, consolidated or itemized billing statement or bill presentation
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

A fraud detection system receives data relating to telecommunications activity. Event generators generate events from the received data, with each event having a weight corresponding to an increased or decreased likelihood of fraud. The aggregated events for a subject (a subscriber or an account) determine a score for the subject, which is used to prioritize the subject in an investigation queue. Human analysts are assigned to open investigations on the investigation queue according to the priority of subjects. In this manner, investigation resources can be applied more effectively to high-risk subscribers and events.

Claims

1. A method for detecting fraud in a telecommunications system comprising:

receiving one or more events relating to a subscriber;

combining the one or more events to provide a score;

storing the subscriber and the score in an investigation queue if the score exceeds a predetermined threshold;

repeating the method for a plurality of subscribers;

storing a plurality of suspect subscribers in the investigation queue, each one of the plurality of suspect subscribers having a score that exceeds the predetermined threshold; and

updating the score of one of the plurality of suspect subscribers to provide an updated score, and removing the one of the plurality of suspect subscribers from the investigation queue if the updated score does not exceed the predetermined threshold.

2. The method of claim 1 further comprising assigning a human analyst to investigate one of the plurality of suspect subscribers.

3. The method of claim 1 further comprising:

determining a region for each one of the plurality of suspect subscribers; and

assigning a regional human analyst to investigate those ones of the plurality of suspect subscribers having a particular region.

4. The method of claim 2 wherein assigning a human analyst further comprises:

receiving a request to investigate from the human analyst;

assigning to the human analyst a one of the plurality of suspect subscribers having a highest priority; and

removing the one of the plurality of suspect subscribers from the investigation queue.

5. The method of claim 4 wherein combining the one or more events to provide a score further comprises:

weighting the one or more events according to one or more event weights, thereby providing one or more weighted events; and

summing the one or more weighted events to provide a score.

6. A method for detecting fraud in a telecommunications system comprising:

receiving one or more events relating to a subscriber;

combining the one or more events to provide a score;

weighting the one or more events according to one or more event weights, thereby providing one or more weighted events;

summing the one or more weighted events to provide a score;

storing the subscriber and the score in an investigation queue if the score exceeds a predetermined threshold; and

aging each of the one or more weighted events using a half-life.

7. A method for detecting fraud in a telecommunications system comprising:

receiving one or more events relating to a subscriber;

combining the one or more events to provide a score;

weighting the one or more events according to one or more event weights, thereby providing one or more weighted events;

summing the one or more weighted events to provide a score; and

storing the subscriber and the score in an investigation queue if the score exceeds a predetermined threshold;

wherein the one or more event weights are discounted according to a match quality.

8. A method for detecting fraud in a telecommunications system comprising:

receiving one or more events relating to a subscriber;

combining the one or more events to provide a score;

weighting the one or more events according to one or more event weights, thereby providing one or more weighted events;

summing the one or more weighted events to provide a score; and

storing the subscriber and the score in an investigation queue if the score exceeds a predetermined threshold;

wherein the one or more event weights are determined using logistic regression.

9. A method for detecting fraud in a telecommunications system comprising:

receiving one or more events relating to a subscriber;

combining the one or more events to provide a score;

feeding the one or more events to a neural network, the neural network being trained to generate a score indicative of possible fraud from the one or more events;

storing the subscriber and the score in an investigation queue if the score exceeds a predetermined threshold;

repeating the method for a plurality of subscribers;

storing a plurality of suspect subscribers in the investigation queue, each one of the plurality of suspect subscribers having a score that exceeds the predetermined threshold.

10. The method of claim 9 further comprising prioritizing the investigation queue according to the plurality of scores.

11. A system for detecting telecommunications fraud comprising:

means for receiving one or more events relating to a subscriber;

means for combining the one or more events to provide a score;

means for weighting the one or more events according to one or more event weights, thereby providing one or more weighted events;

means for summing the one or more weighted events to provide a score;

means for storing the subscriber and the score in an investigation queue if the score exceeds a predetermined threshold; and

means for aging each of the one or more weighted events using a half-life.

12. A system for detecting telecommunications fraud comprising:

means for receiving one or more events relating to a subscriber;

means for combining the one or more events to provide a score;

means for weighting the one or more events according to one or more event weights, thereby providing one or more weighted events;

means for summing the one or more weighted events to provide a score; and

means for storing the subscriber and the score in an investigation queue if the score exceeds a predetermined threshold;

wherein the one or more event weights are discounted according to a match quality.

13. A system for detecting telecommunications fraud comprising:

means for receiving one or more events relating to a subscriber;

means for combining the one or more events to provide a score;

means for weighting the one or more events according to one or more event weights, thereby providing one or more weighted events;

means for summing the one or more weighted events to provide a score; and

means for storing the subscriber and the score in an investigation queue if the score exceeds a predetermined threshold;

wherein the one or more event weights are determined using logistic regression.

14. A system for detecting telecommunications fraud comprising:

means for receiving one or more events relating to a subscriber;

means for combining the one or more events to provide a score;

means for feeding the one or more events to a neural network, the neural network being trained to generate a score indicative of possible fraud from the one or more events;

means for storing the subscriber and the score in an investigation queue if the score exceeds a predetermined threshold;

means for applying the receiving means, the combining means, and the storing means to a plurality of subscribers; and

means for storing a plurality of suspect subscribers in the investigation queue, each one of the plurality of suspect subscribers having a score that exceed the predetermined threshold.

15. The system of claim 14 further comprising means for prioritizing the investigation queue according to the plurality of scores.

16. A computer program for detecting telecommunications fraud embodied in machine executable code comprising:

machine executable code to receive one or more events relating to a subscriber;

machine executable code to combine the one or more events to provide a score;

machine executable code to weight the one or more events according to one or more event weights, thereby providing one or more weighted events;

machine executable code to sum the one or more weighted events to provide a score; and

machine executable code to store the subscriber and the score in an investigation queue if the score exceeds a predetermined threshold; and

machine executable code to age each of the one or more weighted events using a half-life.

17. A computer program for detecting telecommunications fraud embodied in machine executable code comprising:

machine executable code to receive one or more events relating to a subscriber;

machine executable code to combine the one or more events to provide a score;

machine executable code to weight the one or more events according to one or more event weights, thereby providing one or more weighted events;

machine executable code to sum the one or more weighted events to provide a score; and

machine executable code to store the subscriber and the score in an investigation queue if the score exceeds a predetermined threshold;

wherein the one or more event weights are discounted according to a match quality.

18. A computer program for detecting telecommunications fraud embodied in machine executable code comprising:

machine executable code to receive one or more events relating to a subscriber,

machine executable code to combine the one or more events to provide a score;

machine executable code to weight the one or more events according to one or more event weights, thereby providing one or more weighted events;

machine executable code to sum the one or more weighted events to provide a score; and

machine executable code to store the subscriber and the score in an investigation queue if the score exceeds a predetermined threshold;

wherein the one or more event weights are determined using logistic regression.

19. A computer program for detecting telecommunications fraud embodied in machine executable code comprising:

machine executable code to receive one or more events relating to a subscriber;

machine executable code to combine the one or more events to provide a score;

machine executable code to feed the one or more events to a neural network, the neural network being trained to generate a score indicative of possible fraud from the one or more events;

machine executable code to store the subscriber and the score in an investigation queue if the score exceeds a predetermined threshold;

machine executable code to repeat the machine executable code to receive, the machine executable code to combine, and the machine executable code to store for a plurality of subscribers; and

machine executable code to store a plurality of suspect subscribers in the investigation queue, each one of the plurality of suspect subscribers having a score that exceeds the predetermined threshold.

20. The computer program of claim 19 further comprising machine executable code to prioritize the investigation queue according to the plurality of scores.

21. A method for identifying possibly fraudulent activity in a telecommunications system comprising:

providing a fraud record, the fraud record including a first plurality of fields;

providing an account change record, the account change record including a second plurality of fields;

providing a search key, the search key indicating one or more search key fields corresponding to fields of the account change record and the fraud record;

applying the search key and a first set of rules to the account change record and the fraud record, thereby determining whether there is a possible match;

calculating a match quality for the one or more search key fields if there is a possible match;

calculating one or more field match terms for each field of the search key, weighting each field match term, and calculating a weighted sum of the field match terms; and

generating an event if there is a possible match, the event having a weight indicative of the quality of a match between the account change record and the fraud record.

22. A method for identifying possibly fraudulent activity in a telecommunications system comprising:

defining one or more events, each event corresponding to a category of account activity, assigning to each of the one or more events an event weight and an event half-life;

receiving a provisioning record, the provisioning record corresponding to an activity in an account;

determining which category of account activity corresponds to the provisioning record;

generating an event for the account activity, the event having the event weight and the event half-life of the category to which the account activity corresponds; and

providing a plurality of provisioning records, thereby generating a plurality of events;

wherein the plurality of provisioning records is a real-time payment information stream from a carrier.

23. A method for identifying possibly fraudulent activity in a telecommunications system comprising:

defining one or more events, each event corresponding to a category of account activity,

assigning to each of the one or more events an event weight and an event half-life;

receiving a provisioning record, the provisioning record corresponding to an activity in an account;

determining which category of account activity corresponds to the provisioning record;

generating an event for the account activity, the event having the event weight and the event half-life of the category to which the account activity corresponds; and

providing a plurality of provisioning records, thereby generating a plurality of events;

wherein the plurality of provisioning records is a real-time account change information stream from a carrier.

24. A method for identifying possibly fraudulent activity in a telecommunications system comprising:

defining one or more events, each event corresponding to a category of account activity,

assigning to each of the one or more events an event weight and an event half-life;

receiving a provisioning record, the provisioning record corresponding to an activity in an account;

determining which category of account activity corresponds to the provisioning record; and

generating an event for the account activity, the event having the event weight and the event half-life of the category to which the account activity corresponds;

wherein one of the account activity categories is a change in account information.

25. A method for identifying possibly fraudulent activity in a telecommunications system comprising:

defining one or more events, each event corresponding to a category of account activity,

assigning to each of the one or more events an event weight and an event half-life;

receiving a provisioning record, the provisioning record corresponding to an activity in an account;

determining which category of account activity corresponds to the provisioning record; and

generating an event for the account activity, the event having the event weight and the event half-life of the category to which the account activity corresponds;

wherein one of the account activity categories is a change in bill payment information.