Method, device, and system of back-coloring, forward-coloring, and fraud detection

Patent metadata

Field	Value
Publication number	US-10897482-B2
Application number	US-201916510919-A
Country	US
Kind code	B2
Filing date	Jul 14, 2019
Priority date	Nov 29, 2010
Publication date	Jan 19, 2021
Grant date	Jan 19, 2021

Abstract

System, device, and method for behaviorally validated link analysis, session linking, transaction linking, transaction back-coloring, transaction forward-coloring, fraud detection, and fraud mitigation. A method includes: receiving an indicator of a seed transaction known to be fraudulent; selecting, from a database of transactions, multiple transactions that share at least one common property with the seed transaction; generating a list of candidate fraudulent transactions; filtering the candidate fraudulent transactions, by applying a transaction filtering rule that is based on one or more behavioral characteristics; and generating a filtered list of candidate fraudulent transactions.

First claim

What is claimed is:

1. A method comprising:
(a) receiving by a computerized device an indicator of a seed transaction known to be fraudulent;
(b) selecting, from a database of transactions, multiple transactions that share at least one common property with said seed transaction; and generating a list of candidate fraudulent transactions;
(c) filtering the candidate fraudulent transactions, by applying a transaction filtering rule that is based on one or more behavioral characteristics; and generating a filtered list of candidate fraudulent transactions;
wherein the method is implemented by at least a hardware processor;
wherein the filtering of claim (c) comprises:

(c1) determining that user-gestures in said seed transaction, exhibited a first behavioral characteristic and a second behavioral characteristic;
(c2) determining that the first behavioral characteristic that was exhibited in the seed transaction, is sufficiently scarce in the general population of users, based on a pre-defined threshold value of scarcity;
(c3) determining that the second behavioral characteristic that was exhibited in the seed transaction, is not sufficiently scarce in the general population of users, based on the pre-defined threshold value of scarcity;
(c4) performing filtering of candidate fraudulent transactions, based on said first behavioral characteristic which is sufficiently scarce, and not based on said second behavioral characteristic that is not sufficiently scarce.

2. The method of claim 1 , comprising:
based on a table of pre-defined fraud indicators, that characterize online behavior of users that perform fraudulent activity, filtering-out from said list of candidate fraudulent transactions, one or more candidate transactions that lack any pre-defined fraud indicator other than being related to said seed transaction.

3. The method of claim 1 , further comprising:
filtering-out, from said list of candidate fraudulent transactions, one or more candidate fraud transactions whose user-gestures exhibit a level of computer savviness that is smaller than a pre-defined threshold value.

4. The method of claim 1 , further comprising:
based on analysis of user-gestures and user interactions of said seed transaction, determining a level of computer savviness of a user that performed said seed transaction;
filtering-out, from said list of candidate fraudulent transactions, one or more candidate fraud transactions that exhibit a level of computer savviness that is smaller than said level of computer savviness that said user exhibited in said seed transaction.

5. The method of claim 1 , wherein the selecting of step (b) comprises:
iteratively expanding said list of candidate fraudulent transactions, by selecting from said database of transactions, an additional transaction that shares with said seed transaction at least one of:
same Internet Protocol (IP) address,
same device,
same MAC address,
same cookie,
same beneficiary,
same shipping address,
same billing address,
same first name and same family name,
same geo-location venue.

6. The method of claim 1 , wherein the selecting of step (b) comprises:
iteratively expanding said list of candidate fraudulent transactions, by selecting from said database of transactions, an additional transaction that shares with said seed transaction at least one of:
same Internet Protocol (IP) address,
same device,
same MAC address,
same cookie,
same beneficiary,
same shipping address,
same billing address,
same first name and same family name,
same geo-location venue;
wherein said additional transaction is added to said list of candidate fraudulent transactions only if a usage-session of said additional transaction comprises at least one behavioral characteristic that is pre-defined as being fraud- related.

7. The method of claim 1 , wherein the selecting of step (b) comprises:
iteratively expanding said list of candidate fraudulent transactions, by selecting from said database of transactions, an additional transaction that shares with said seed transaction at least one of:
same Internet Protocol (IP) address,
same device,
same MAC address,
same cookie,
same beneficiary,
same shipping address,
same billing address,
same first name and same family name,
same geo-location venue;
wherein said additional transaction is added to said list of candidate fraudulent transactions only if a usage-session of said additional transaction comprises at least one behavioral characteristic that was also extracted from the usage-session of the seed transaction.

8. The method of claim 1 , wherein the selecting of step (b) comprises:
iteratively expanding said list of candidate fraudulent transactions, by selecting from said database of transactions, an additional transaction that shares with said seed transaction at least one of:
same Internet Protocol (IP) address,
same device,
same MAC address,
same cookie,
same beneficiary,
same shipping address,
same billing address,
same first name and same family name,
same geo-location venue;
wherein said additional transaction is added to said list of candidate fraudulent transactions only if a usage-session of said additional transaction comprises at least one device-usage property that is pre-defined as being fraud-related.

9. The method of claim 1 , comprising:
iteratively expanding said list of candidate fraudulent transactions, by performing:
back-coloring of transactions, that occurred prior to said seed transactions, as behaviorally-validated prior fraudulent transactions; and
forward-coloring of transactions, that occurred subsequent to said seed transactions, as behaviorally-validated subsequent fraudulent transactions.

10. The method of claim 1 , comprising:
iteratively expanding said list of candidate-fraud transactions; and
iteratively filtering expanded lists of candidate-fraud transactions by applying behavioral validation rules.

11. A system comprising:
one or more hardware processors, operably associated with one or more memory units,
wherein the one or more hardware processors are configured to:
(a) receive an indicator of a seed transaction known to be fraudulent;
(b) select, from a database of transactions, multiple transactions that share at least one common property with said seed transaction; and generate a list of candidate fraudulent transactions;
(c) filter the candidate fraudulent transactions, by applying a transaction filtering rule that is based on one or more behavioral characteristics; and generate a filtered list of candidate fraudulent transactions; by said one or more processors being configured to:
(c1) determine that user-gestures in said seed transaction, exhibited a first behavioral characteristic and a second behavioral characteristic;
(c2) determine that the first behavioral characteristic that was exhibited in the seed transaction, is sufficiently scarce in the general population of users, based on a pre-defined threshold value of scarcity;
(c3) determine that the second behavioral characteristic that was exhibited in the seed transaction, is not sufficiently scarce in the general population of users, based on the pre-defined threshold value of scarcity;
(c4) perform filtering of candidate fraudulent transactions, based only on said first behavioral characteristic which is sufficiently scarce, and not based on said second behavioral characteristic that is not sufficiently scarce.

Assignees

• Biocatch Ltd

Inventors

• Rivner Uri
• Turgeman Avi

Classifications

• H04L67/535

  Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34) · CPC title

• G06F21/316

  by observing the pattern of computer usage, e.g. typical user behaviour · CPC title

• G06F3/041

  Digitisers, e.g. for touch screens or touch pads, characterised by the transducing means · CPC title

• G06Q30/0277

  Online advertisement · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title