Method and system for preventing illicit use of a telephony platform

• US 8,737,962 B2
• Filed: 07/24/2013
• Issued: 05/27/2014
• Est. Priority Date: 07/24/2012
• Status: Active Grant

• Current Assignee: Twilio, Inc.
• Original Assignee: Twilio, Inc.
• Inventors: Ballai, Adam, Hagemann, Robert C. III, Zarick, Daniel
• Primary Examiner(s): CAI, WAYNE HUU
• Application Number:
  US13/949,984
• Publication Number:
  US 20140045456A1
• Time in Patent Office: 307 Days
• Field of Search: 455/405, 455/406, 455/410, 455/411, 705/14.26, 705/14.47, 705/26.35, 379/189, 379/127.02
• US Class Current: 455/410
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A system and method for preventing illicit use of a telephony platform that includes enrolling a plurality of accounts on a telecommunications platform, wherein an account includes account configuration; at a fraud detection system of the telecommunications platform, receiving account usage data, wherein the usage data includes at least communication configuration data and billing configuration data of account configuration and further includes communication history of the plurality of accounts; calculating fraud scores of a set of fraud rules from the usage data, wherein at least a sub-set of the fraud rules include conditions of usage data patterns between at least two accounts; detecting when the fraud scores of an account satisfy a fraud threshold; and initiating an action response when a fraud score satisfies the fraud threshold.

Claims

1. A method comprising:

enrolling a plurality of accounts on a telecommunications platform, wherein an account includes account configuration;

at a fraud detection system of the telecommunications platform, receiving account usage data, wherein the account usage data includes at least communication configuration data and billing configuration data of account configuration and further includes communication history of the plurality of accounts;

calculating fraud scores of a set of fraud rules from the usage data, wherein at least a sub-set of the fraud rules include conditions of usage data patterns between at least two accounts;

detecting when the fraud scores of an account satisfy a fraud threshold;

initiating an action response when a fraud score satisfies the fraud threshold.

2. The method of claim 1, wherein communication configuration includes communication-application configuration;

wherein at least one fraud rule of the sub-set of fraud rules comprises identifying communication-application configuration shared between at least two accounts.

3. The method of claim 2, wherein the communication-application configuration is an application URI string.

4. The method of claim 1, wherein the communication history includes media resource usage;

and wherein at least one fraud rule of the sub-set of fraud rules comprises identifying shared patterns of media resource usage in two accounts.

5. The method of claim 1, wherein at least one fraud rule of the sub-set of fraud rules comprises detecting shared billing information across three or more accounts.

6. The method of claim 5, wherein the shared billing information can include a shared credit card or shared billing address.

7. The method of claim 1, wherein a fraud rule includes at least one usage pattern condition;

and where calculating a fraud rule comprises assigning a defined score if the conditions of the fraud rule are satisfied; and

wherein detecting when the fraud scores of an account satisfy a fraud threshold comprises adding fraud scores of the set of fraud rules.

8. The method of claim 7, wherein a fraud rule includes a usage data time window, and an account age condition.

9. The method of claim 1, further comprising automatically generating a fraud rule through usage data anomaly detection;

and adding the fraud score to the set of fraud scores.

10. The method of claim 1, wherein initiating an action response includes flagging the associated account;

and further comprising providing an analyst interface wherein an analyst can modify the set of fraud rules and modify flagged accounts.

11. The method of claim 1, further comprising a second sub-set of fraud rules that include conditions of usage data patterns within the account.

12. The method of claim 1, wherein the plurality of accounts include accounts and sub-accounts.