Method and system for detecting fraud

• US 7,610,216 B1
• Filed: 07/13/2000
• Issued: 10/27/2009
• Est. Priority Date: 07/13/2000
• Status: Expired due to Fees

• Current Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Original Assignee: eBay Inc.
• Inventors: Flint, Ian, May, Jason W.
• Primary Examiner(s): Zeender; F. Ryan
• Assistant Examiner(s): ALMATRAHI, FARIS S
• Application Number:
  US09/615,638
• Time in Patent Office: 3,393 Days
• Field of Search: 705/1, 705/41, 705/44, 705/26, 705/27, 705/34, 705/38, 705/39, 705/40, 705/42, 705/75
• US Class Current: 705/18
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 20/403 Solvency checks
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: G06Q 30/0619 Neutral agent
• CPC Class Codes: G06Q 40/12 Accounting
• CPC Class Codes: G07G 3/003 Anti-theft control theft alarms G08B13/00

Abstract

A system and method for detecting fraud when facilitating a payment transaction over a global wide area network. The method comprises receiving a sale information, receiving a payment information from a buyer, and analyzing a transaction information for fraud. If the analyzing indicates fraud, an enhanced transaction information is communicated to a human for fraud analysis. In one embodiment, the method comprises performing rule-based analyses to determine whether the transaction appears to be fraudulent. Rule-based analyses may include suspect data rules and velocity rules. Velocity rules generally determine whether there has been excessive activity that may lead to a conclusion that the transaction may be fraudulent. Suspect data rules are used to determine whether the billing, shipping, selling addresses, telephone numbers, and account numbers, and other data are in a syntactically correct format and whether they exist. In one embodiment, the method further comprises performing simple screening of the transaction information. In one embodiment, the method further comprises seeking approval from a third party such as a financial institution based on the payment information. The method may be implemented as part of a system that includes personal computers, server computers, and other personal computing devices, some of which may communicate over the Internet, and others which may communicate via dedicated communication lines.

Claims

1. A method for detecting fraud by a payment facilitator when facilitating a payment transaction over a global wide area network, the method implemented in a computer-readable storage medium and executed by a server, the method comprising:

receiving, by the payment facilitator via a web site interface associated with the payment facilitator, sale information pertaining to a purchase of a product from a seller, wherein the sale information includes an email address for the seller;

receiving, by the payment facilitator via the web site interface, payment information from a buyer, where the payment information includes an email address for the buyer, and wherein the payment information is received from the buyer in response to an email generated invoice sent to the email address of the buyer or sent in response to an email generated notification of a location that the buyer can acquire the email generated invoice where the location is sent to the email address of the buyer;

performing, by the payment facilitator, automated analysis of transaction information including the sale information and the payment information to detect whether the transaction information indicates fraud, and wherein the payment facilitator executes a software program to process at least some information associated with historical information, in order to determine whether fraud is present;

if the automated analysis does not detect fraud, the payment facilitator sends information via email to the email address of the seller instructing the seller to send the product to the buyer, credits an account of the seller for the purchase in response to an indication that the buyer received the product, and the payment facilitator directly contacts a financial institution associated with the buyer, via a dedicated line, and debits another account associated with the buyer at that financial institution;

when the financial institution requests additional information from the payment facilitator before determining whether fraud exists, the payment facilitator automatically issues email messages to the buyer or the seller requesting information to clarify requests of the financial institution and again attempts to obtain approval from the financial institution with the clarifying information; and

if the automated analysis detects fraud, the payment facilitator causes an enhanced transaction information to be communicated to a human for manual fraud analysis.

2. The method of claim 1 wherein the sale information is received from a seller, and the method further comprises:

communicating an invoice to a buyer.

3. The method of claim 1 further comprising:

performing simple screening of the transaction information.

4. The method of claim 3 wherein performing simple screening comprises:

determining whether a financial account specified as part of the payment information is on a list of known fraudulent financial account numbers;

determining whether the name of the buyer or the name of the seller is on a list of known fraudulent users;

determining whether a shipping address specified as part of the payment information is on a list of known fraudulent addresses;

determining whether a billing address specified as part of the payment information is on a list of known fraudulent addresses;

determining whether an email address of the buyer or the seller is on a list of known fraudulent email addresses; and

determining whether an Internet protocol (IP) address of the buyer or the seller is on a list of known fraudulent IP addresses.

5. The method of claim 1 further comprising:

seeking approval from the financial institution based on the payment information.

6. The method of claim 5 wherein seeking approval comprises:

sending a request for approval that comprises at least an account information extracted from the payment information and an amount information to a financial institution;

receiving from the financial institution a response to the request;

rejecting the payment transaction or continuing with the payment transaction responsive to the response.

7. The method of claim 1 wherein performing automated analysis comprises:

performing rule-based analyses.

8. The method of claim 7 wherein performing rule-based analyses comprises:

applying a plurality of rules to the transaction information such that a score for the payment transaction is incremented when one of the rules is violated.

9. The method of claim 8 wherein performing rule-based analyses further comprises:

creating the enhanced transaction information if the score exceeds a predefined threshold such that the enhanced transaction information comprises a tracking number, the score, and a violated rule information.

10. The method of claim 8 wherein applying comprises:

incrementing the score responsive to a numeric value assigned to the rule violated.

11. The method of claim 8 wherein the plurality of rules comprise a plurality of suspect data rules and a plurality of velocity rules.

12. The method of claim 11 wherein the plurality of suspect data rules comprise:

comparison of a shipping address with a directory of known real addresses;

comparison of a shipping address with a list of addresses implicated in prior possibly fraudulent transactions;

comparison of a billing address with a directory of known real addresses; and

comparison of a billing address with a list of addresses implicated in prior possibly fraudulent transactions.

13. The method of claim 11 wherein the plurality of velocity rules comprise:

determining whether a first number of transactions involving the seller exceeds a first predefined threshold for a first predefined time period;

determining whether a second number of transactions involving the buyer exceeds a second predefined threshold for a second predefined time period;

determining whether a first total dollar amount for a first plurality of transactions involving the buyer exceeds a third predefined threshold for a third predefined time period;

determining whether a second total dollar amount for a second plurality of transactions involving the seller exceeds a fourth predefined threshold for a fourth predefined time period;

determining whether a third total dollar amount for a specified financial account exceeds a fifth predefined threshold for a fifth predefined time period; and

determining whether a third number of transactions involving the specified financial account exceeds a sixth predefined threshold for a sixth predefined time period.

14. The method of claim 11 wherein the plurality of velocity rules comprise:

determining whether a financial account specified as part of the payment information has exceeded a predetermined acceptable number of times used over a predetermined period of time;

determining whether a financial account specified as part of the payment information has exceeded a predetermined acceptable number of times used over a predetermined number of transactions with the seller; and

determining whether a financial account specified as part of the payment information has exceeded a predetermined acceptable number of times used over a predetermined number of transactions with the payment facilitator.

15. The method of claim 1 wherein communicating an enhanced transaction information comprises sending an email message to at least one of a plurality of human fraud investigators.

16. The method of claim 1 further comprising:

if the analyzing indicates fraud, notifying the buyer and/or a seller that the payment transaction is on hold pending the outcome of a fraud investigation.

17. The method of claim 16 wherein notifying comprises:

sending an email message to the buyer and/or the seller.

18. A system comprising:

a first computer supporting communications over a wide area network by a buyer, wherein the communications over the wide area network occur via a web site interface for a payment facilitator;

a second computer supporting communications over the wide are network by a seller, wherein the communications over the wide area network occur via the web site interface for the payment facilitator;

the payment facilitator computer supporting communications over the wide are network and executing software that facilitates a payment transaction between the buyer and the seller, wherein the facilitator computer is to receive payment information from the buyer and to analyze the payment transaction for fraud by applying a plurality of rules and incrementing a score for the payment transaction for each of the plurality of rules that is violated,

if the score does not exceed a predefined threshold, instructs the seller via email to send a purchased product to the buyer, credits an account of the seller for the payment transaction in response to an email indication from the buyer that the buyer received the purchased product, and the payment facilitator directly contacts a financial institution associated with the buyer, via a dedicated line, and debits another account associated with the buyer at that financial institution and when the financial institution requests additional information from the payment facilitator before determining whether fraud exists the payment facilitator automatically issues email messages to the buyer or the seller requesting information to clarify requests of the financial institution and again attempts to obtain approval from the financial institution with the clarifying information before debiting the account of the buyer with the financial institution, and

if the score exceeds a predefined threshold, communicates an information about the payment transaction to a human fraud investigator, and wherein a number of the rules are applied in response to information related to historical information that compliments the rules.

19. The system of claim 18 further comprising:

a fourth computer capable of communications with the third computer and allowing the human fraud investigator to communicate with the third computer.

20. The system of claim 19 wherein the third computer is coupled to the fourth computer via a dedicated communications line.

21. The system of claim 19 wherein the third computer communicates with the fourth computer over the wide area network.

22. The system of claim 18 further comprising:

a fifth computer capable of communications with the third computer and responding on behalf of the financial institution to a request for authorization of the payment transaction initiated by the software executing on the third computer.

23. The system of claim 22 wherein the third computer is coupled to the fifth computer via a dedicated communications line.

24. The system of claim 22 wherein the third computer communicates with the fifth computer over the wide area network.

25. The system of claim 18 wherein the wide area network is the Internet.

26. A machine readable medium having stored thereon instructions which when executed by a processor cause the machine to perform a method for detecting fraud by a payment facilitator when facilitating a payment transaction over a global wide area network, the method comprising:

receiving, via a web site interface of the payment facilitator, sale information pertaining to a purchase of a product from a seller, and wherein the sale information includes an email address for the seller;

receiving, via the web site interface of the payment facilitator, payment information from a buyer, and wherein the payment information includes an email address for the buyer;

performing, by the payment facilitator, automated analysis of transaction information including the sale information and the payment information to detect whether the transaction information indicates fraud, and wherein the payment facilitator acquires at least some information related to historical information, in order to determine if fraud is present;

if the automated analysis does not detect fraud, the payment facilitator sends information via email instructing the seller to send the product to the buyer, credits an account of the seller for the purchase in response to an email indication that the buyer received the product, and the payment facilitator directly contacts a financial institution associated with the buyer, via a dedicated line, and debits another account associated with the buyer at that financial institution;

when the financial institution requests additional information from the payment facilitator before determining whether fraud exists the payment facilitator automatically issues email messages to the buyer or the seller requesting information to clarify requests of the financial institution and again attempts to obtain approval from the financial institution with the clarifying information;

and

if the automated analysis detects fraud, the payment facilitator causes an enhanced transaction information to be communicated to a human for manual fraud analysis.

27. The machine readable medium of claim 26 wherein the instructions cause the machine to perform operations further comprising:

performing simple screening of the transaction information.

28. The machine readable medium of claim 27 wherein performing simple screening comprises:

determining whether a financial account specified as part of the payment information is on a list of known fraudulent financial account numbers;

determining whether the name of the buyer or the name of the seller is on a list of known fraudulent users;

determining whether a shipping address specified as part of the payment information is on a list of known fraudulent addresses;

determining whether a billing address specified as part of the payment information is on a list of known fraudulent addresses;

determining whether an email address of the buyer or the seller is on a list of known fraudulent email addresses; and

determining whether an Internet protocol (IP) address of the buyer or the seller is on a list of known fraudulent IP addresses.

29. The machine readable medium of claim 26 wherein the instructions cause the machine to perform operations further comprising:

seeking approval from the financial institution based on the payment information.

30. The machine readable medium of claim 29 wherein seeking approval comprises:

sending a request for approval that comprises at least an account information extracted from the payment information and an amount information to a financial institution;

receiving from the financial institution a response to the request;

rejecting the payment transaction or continuing with the payment transaction responsive to the response.

31. The machine readable medium of claim 26 wherein performing automated analysis comprises:

performing rule-based analyses.

32. The machine readable medium of claim 31 wherein performing rule-based analyses comprises:

applying a plurality of rules to the transaction information such that a score for the payment transaction is incremented when one of the rules is violated.

33. The machine readable medium of claim 32 wherein performing rule-based analyses further comprises:

creating the enhanced transaction information if the score exceeds a predefined threshold such that the enhanced transaction information comprises a tracking number, the score, and a violated rule information.

34. The machine readable medium of claim 32 wherein applying comprises:

incrementing the score responsive to a numeric value assigned to the rule violated.

35. The machine readable medium of claim 32 wherein the plurality of rules comprise at least one of a plurality of suspect data rules and a plurality of velocity rules.

36. The machine readable medium of claim 26 wherein communicating an enhanced transaction information comprises sending an email message to at least one of a plurality of human fraud investigators.

37. The machine readable medium of claim 26 wherein the instructions cause the machine to perform operations further comprising:

if the analyzing indicates fraud, notifying the buyer and/or a seller that the payment transaction is on hold pending the outcome of a fraud investigation.

38. The machine readable medium of claim 37 wherein notifying comprises:

sending an email message to the buyer and/or the seller.