Card fraud detection utilizing real-time identification of merchant test sites

Patent metadata

Field	Value
Publication number	US-10102530-B2
Application number	US-201815950859-A
Country	US
Kind code	B2
Filing date	Apr 11, 2018
Priority date	Oct 30, 2012
Publication date	Oct 16, 2018
Grant date	Oct 16, 2018

Abstract

A system and method for detecting a test event involving a financial transaction device at a merchant having a merchant profile is disclosed. The method includes receiving data associated with a transaction involving a financial transaction device; calculating a score using at least the transaction data; comparing the score to a threshold value; and attaching a merchant probe flag to the merchant profile if the score exceeds the threshold value. The merchant probe flag indicates a likelihood that a test event has occurred at the merchant based on the score. If a test event has occurred, then financial transaction devices involved in the test event can have their profiles updated to reflect that they have been probed. If a financial transaction device that has been probed is used in a subsequent transaction, then a specialized fraud scoring model can be used to provide an improved fraud risk score.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving, from a first computing device controlling one or more financial services and over one or more financial channels, data associated with a transaction involving a financial transaction device, the transaction occurring at an Internet website of a merchant, the merchant having a merchant profile, the merchant profile associated with a set of variables;
retrieving, from a merchant profile store, the merchant profile for the merchant;
retrieving, from a card profile store, a financial transaction device profile for the financial transaction device;
determining whether the transaction is a test event by:
calculating a score using the received data and the set of variables; and
comparing the score to a threshold value;

attaching, in response to the determining, a merchant probe flag to the merchant profile, the merchant probe flag indicating a likelihood that the test event has occurred at the Internet website of the merchant;
attaching, to the financial transaction profile and in response to the merchant probe flag being attached to the merchant profile, a probe flag associated with the financial transaction device to indicate whether the financial transaction device is in a probed state;
receiving, from a second computing device controlling one or more financial services and over one or more financial channels, data associated with a second transaction involving the financial transaction device having the probe flag;
subjecting, in response to the financial transaction device having the probe flag, the second transaction and the financial transaction device to a specialized fraud scoring model, the specialized fraud scoring model separate from the fraud model applied to financial transactions associated with financial transaction devices that do not have the probe flag; and
blocking the second transaction from completing based on a fraud score using the specialized fraud scoring model satisfying a threshold value, and
wherein the receiving, the retrieving, the calculating, the determining, the attaching, the subjecting, and the blocking are performed by at least one processor.

2. The method of claim 1 , wherein the attaching of the probe flag associated with the financial transaction device occurs after the merchant probe flag is attached to the merchant profile.

3. The method of claim 1 , further comprising:
executing, by at least one processor, a first scoring methodology when the probe flag indicates that the financial transaction device is in the probed state and a second scoring methodology when the probe flag indicates that the financial transaction device is in the unprobed state.

4. The method of claim 1 , further comprising:
updating, by at least one processor, a probe risk associated with the financial transaction device, the probe risk specifying a period of time that the financial transaction device is considered at risk.

5. The method of claim 4 , wherein the updating involves decrementing the probe risk after a predefined period of time or after a predefined number of transactions involving the financial transaction device.

6. The method of claim 4 , wherein the financial transaction device is associated with an event key representing the test event, and wherein the updating involves increasing the probe risk when at least a second financial transaction device having the same event key has been used fraudulently or has been involved in a transaction associated with a fraud score exceeding a threshold value.

7. The method of claim 1 , wherein the calculating uses a recursive transaction function to characterize behavior indicative of the test event.

8. The method of claim 1 , wherein the test event is a pattern of successive low dollar purchases.

9. The method of claim 1 , wherein the financial transaction device is a credit card, a debit card, or a smart phone configured to execute a financial transaction application.

10. The method of claim 1 , wherein the specialized fraud model is a specialized high risk neural network model, the specialized high risk neural network model configured to detect fraudulent transactions with greater accuracy than a low risk neural network model.

11. A computer program product comprising:
a non-transitory storage medium readable by at least one processor and storing instructions for execution by the at least one processor, the instructions comprising:
receiving data associated with a transaction involving a financial transaction device, the transaction occurring at an Internet website of a merchant, the merchant having a merchant profile associated with a set of variables;
determining whether the transaction is a test event by:
calculating a score using the received data and the set of variables; and
comparing the score to a threshold value

the test event indicating a likely fraudulent use of the financial transaction device;
attaching, in response to the determining, a merchant probe flag to the merchant profile, the merchant probe flag indicating a likelihood that the test event has occurred at the Internet website of the merchant;
setting a probe flag associated with the financial transaction device to indicate that the financial transaction device is in a probed state;
receiving data associated with a second transaction involving the financial transaction device having the probe flag;
subjecting, in response to the financial transaction device having the probe flag, the second transaction and the financial transaction device to a specialized fraud scoring model, the specialized fraud scoring model separate from a fraud model applied to financial transactions associated with financial transaction devices that do not have the probe flag set; and
blocking the second transaction from completing based on a fraud score calculated using the specialized fraud scoring model satisfying a threshold value.

12. The computer program product of claim 11 , wherein the setting occurs after the merchant probe flag is attached to the merchant profile.

13. The computer program product of claim 11 , the instructions further comprising executing a first scoring methodology when the probe flag indicates that the financial transaction device is in the probed state and a second scoring methodology when the probe flag indicates that the financial transaction device is not in the probed state.

14. The computer program product of claim 11 , the instructions further comprising updating a probe risk associated with the financial transaction device, the probe risk specifying a period of time that the financial transaction device is considered at risk.

15. The computer program product of claim 14 , wherein the updating involves decrementing the probe risk after a predefined period of time or after a predefined number of transactions involving the financial transaction device.

16. The computer program product of claim 14 , wherein the financial transaction device is associated with an event key representing the test event, and wherein the updating involves increasing the probe risk when at least a second financial transaction device having the same event key has been used fraudulently or has been involved in a transaction associated with a fraud score exceeding a threshold value.

17. The computer program product of claim 11 , wherein the calculating uses a recursive transaction function to characterize behavior indicative of the test event.

18. The computer program product of claim 11 , wherein the test event is a pattern of successive low dol

Assignees

• Fair Isaac Corp

Inventors

• Zoldi Scott Michael
• Levner Ilya
• Derderian Maria

Classifications

• G06Q20/4016 Primary

  involving fraud or risk level assessment in transaction processing · CPC title