Method and system for identifying potential fraud activity in a tax return preparation system, at least partially based on data entry characteristics of tax return content

Patent metadata

Field	Value
Publication number	US-11087334-B1
Application number	US-201715478511-A
Country	US
Kind code	B1
Filing date	Apr 4, 2017
Priority date	Apr 4, 2017
Publication date	Aug 10, 2021
Grant date	Aug 10, 2021

Abstract

Stolen identity refund fraud is one of a number of types of Internet-centric crime (i.e., cybercrime) that includes the unauthorized use of a person's or business' identity information to file a tax return in order to illegally obtain a tax refund from, for example, a state or federal revenue service. Because fraudsters use legitimate identity information to create user accounts in tax return preparation systems, it can be difficult to detect stolen identity refund fraud activity. Methods and systems of the present disclosure identify and address potential fraud activity. The methods and systems analyze data entry characteristics of tax return content that is provided to a tax return preparation system to identify potential fraud activity and perform one or more risk reduction actions in response to identifying the potential fraud activity.

First claim

What is claimed is:

1. A system for using machine-learning to identify and delay or prevent submission of fraudulent content, the system configured to perform operations comprising:
generating training set data indicating characteristics of fraudulent content previously submitted to the system using stolen identity information;
using a machine-learning technique to train an analytics model to identify, based on the training set data, correlations between the characteristics of fraudulent content previously submitted to the system and characteristics of new content received by the system;
receiving new content from a system user, wherein the new content includes a set of data entry characteristics indicating ones of a plurality of user experience pages accessed by the system user;
using the analytics model trained by the machine-learning technique to:
detect one or more indications that the new content is being submitted using stolen identity information based on the set of data entry characteristics indicating that the system user visited the ones of the plurality of user experience pages in a specific order;
generate a risk score that quantifies a likelihood that the new content is being submitted using stolen identity information based on the detected indications; and
determine that the new content is fraudulent based on the risk score exceeding a risk score threshold; and

initiating at least one action to delay or prevent a submission of the new content.

2. The system of claim 1 , wherein the operations further include:
determining whether the new content is entered manually or by using a script.

3. The system of claim 1 , wherein the operations further include:
determining a number of risk categories related to the one or more indications.

4. The system of claim 1 , wherein training the analytics model is based on an artificial neural network.

5. A method for using machine-learning to identify and delay or prevent submission of fraudulent content, the method performed by a system and comprising:
generating training set data indicating characteristics of fraudulent content previously submitted to the system using stolen identity information;
using a machine-learning technique to train an analytics model to identify, based on the training set data, correlations between the characteristics of fraudulent content previously submitted to the system and characteristics of new content received by the system;
receiving new content from a system user, wherein the new content includes a set of data entry characteristics indicating ones of a plurality of user experience pages accessed by the system user;
using the analytics model trained by the machine-learning technique to:
detect one or more indications that the new content is being submitted using stolen identity information based on the set of data entry characteristics indicating that the system user visited the ones of the plurality of user experience pages in a specific order;
generate a risk score that quantifies a likelihood that the new content is being submitted using stolen identity information based on the detected indications; and
determine that the new content is fraudulent based on the risk score exceeding a risk score threshold; and

initiating at least one action to delay or prevent a submission of the new content.

6. The method of claim 5 , further comprising:
determining whether the new content is entered manually or by using a script.

7. A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a system for using machine-learning to identify and delay or prevent submission of fraudulent content causes the system to perform operations comprising:
generating training set data indicating characteristics of fraudulent content previously submitted to the system using stolen identity information;
using a machine-learning technique to train an analytics model to identify, based on the training set data, correlations between the characteristics of fraudulent content previously submitted to the system and characteristics of new content received by the system;
receiving new content from a system user, wherein the new content includes a set of data entry characteristics indicating ones of a plurality of user experience pages accessed by the system user;
using the analytics model trained by the machine-learning technique to:
detect one or more indications that the new content is being submitted using stolen identity information based on the set of data entry characteristics indicating that the system user visited the ones of the plurality of user experience pages in a specific order;
generate a risk score that quantifies a likelihood that the new content is being submitted using stolen identity information based on the detected indications; and
determine that the new content is fraudulent based on the risk score exceeding a risk score threshold; and

initiating at least one action to delay or prevent a submission of the new content.

8. The computer-readable medium of claim 7 , wherein execution of the instructions causes the system to perform operations further including:
determining whether the new content is entered manually or by using a script.

Assignees

• Intuit Inc

Inventors

• Mceachern Kyle
• Rambo Brent

Classifications

• H04L51/212

  using filtering or selective blocking · CPC title

• G06N20/00

  Machine learning · CPC title

• H04L63/1483

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title