Method, device, and system of detecting mule accounts and accounts used for money laundering

Patent metadata

Field	Value
Publication number	US-11210674-B2
Application number	US-202016872381-A
Country	US
Kind code	B2
Filing date	May 12, 2020
Priority date	Nov 29, 2010
Publication date	Dec 28, 2021
Grant date	Dec 28, 2021

Abstract

Method, device, and system of detecting a mule bank account, or a bank account used for terror funding or money laundering. A method includes: monitoring interactions of a user with a computing device during online access with a banking account; and based on the monitoring, determining that the online banking account is utilized as a mule bank account to illegally receive and transfer money. The method takes into account one or more indicators, such as, utilization of a remote access channel, utilization of a virtual machine or a proxy server, unique behavior across multiple different account, temporal correlation among operations, detection of a set of operations that follow a pre-defined mule account playbook, detection of multiple incoming fund transfers from multiple countries that are followed by a single outgoing fund transfer to a different country, and other suitable indicators.

First claim

What is claimed is:

1. A method comprising:
(a) monitoring interactions of a user of a computing device during online access to a banking account, and analyzing user interactions that were performed during multiple usage sessions in which said online banking account was accessed;
(b) detecting that the user interactions in said multiple usage sessions, comprise: (I) multiple incoming funds transfers that are incoming from a plurality of different countries, and (II) multiple outgoing funds transfers that are outgoing to a single country that is different from said plurality of different countries; and
further detecting that each incoming funds transfer is followed, within N hours, by an outgoing funds transfer of at least K percent of the incoming funds;
wherein N is a pre-defined positive value;
wherein K is a pre-defined positive value;
(c) based on step (b), generating a notification alert that said online banking account is utilized for money laundering or terror funding.

2. The method of claim 1 , further comprising:
analyzing user interactions with multiple bank accounts that are known to be money laundering bank accounts; and extracting a common playbook of interactions that characterizes a utilization of a bank account as a money laundering bank account;
wherein the generating of step (c) is further based on detection of a match between (I) user interactions monitored in said online banking account, and (II) said common playbook of interactions that characterizes utilization of a bank account as a money laundering bank account.

3. The method of claim 1 , further comprising:
analyzing user interactions with multiple bank accounts that are known to be terror funding laundering bank accounts; and extracting a common playbook of interactions that characterizes a utilization of a bank account as a terror funding bank account;
wherein the generating of step (c) is further based on detection of a match between (I) user interactions monitored in said online banking account, and (II) said common playbook of interactions that characterizes utilization of a bank account as a terror funding bank account.

4. The method of claim 1 ,
wherein monitoring interactions of the user comprises both (I) monitoring user-gestures performed via input units of the computing device of the user, and also (II) monitoring banking transactions performed in said online bank account;
wherein the generating of step (c) is based cumulatively on (I) monitored user-gestures performed via input units of the computing device of the user, and also (II) monitored banking transactions performed in said online bank account.

5. The method of claim 1 ,
wherein monitoring interactions of the user comprises both (I) monitoring user-gestures performed via a touch-screen of the computing device of the user, and also (II) monitoring banking transactions performed in said online bank account;
wherein the generating of step (c) is based cumulatively on (I) monitored user-gestures performed via a touch-screen of the computing device of the user, and also (II) monitored banking transactions performed in said online bank account.

6. The method of claim 1 ,
wherein monitoring interactions of the user comprises: performing user-transparent continuous monitoring of user interactions and user gestures in a background of a usage session without the user being aware that his interactions and gestures are monitored.

7. A method comprising:
(A) monitoring multiple interactions of a particular user that utilizes a computing device to access a particular banking account;
(B) upon detecting that a frequency of said multiple interactions is below a pre-defined threshold, determining that said particular user is located remotely from said computing device and is controlling remotely said computing device via a remote access channel;
(C) based on detection of utilization of said remote access channel to remotely control said particular bank account, and based on analysis of transactions performed in said particular bank account, generating a notification alert that said online banking account is used as a mule bank account or as a money laundering bank account;
wherein the method determines utilization of said remote access channel to remotely control said particular bank account, by taking into account: a detected mismatch between (I) accelerometer data, gyroscope data, and device orientation data of said computing device, and (II) touch-based gestures of a touch-screen of said computing device.

8. The method of claim 7 ,
wherein the method determines utilization of said remote access channel to remotely control said particular bank account by taking into account also: a detection that said computing device is accessing said particular bank account via a proxy server.

9. The method of claim 7 ,
wherein the method determines utilization of said remote access channel to remotely control said particular bank account by taking into account also: detecting a detection that said computing device is accessing said particular bank account via a virtual machine.

10. A non-transitory storage medium having stored thereon instructions that, when executed by a hardware processor, cause the hardware processor to perform a method:
(a) monitoring interactions of a user of a computing device during online access to a banking account, and analyzing user interactions that were performed during multiple usage sessions in which said online banking account was accessed;
(b) detecting that the user interactions in said multiple usage sessions, comprise: (I) multiple incoming funds transfers that are incoming from a plurality of different countries, and (II) multiple outgoing funds transfers that are outgoing to a single country that is different from said plurality of different countries; and
further detecting that each incoming funds transfer is followed, within N hours, by an outgoing funds transfer of at least K percent of the incoming funds;
wherein N is a pre-defined positive value;
wherein K is a pre-defined positive value;
(c) based on step (b), generating a notification alert that said online banking account is utilized for money laundering or terror funding.

11. A non-transitory storage medium having stored thereon instructions that, when executed by a hardware processor, cause the hardware processor to perform a method:
(A) monitoring multiple interactions of a particular user that utilizes a computing device to access a particular banking account;
(B) upon detecting that a frequency of said multiple interactions is below a pre-defined threshold, determining that said particular user is located remotely from said computing device and is controlling remotely said computing device via a remote access channel;
(C) based on detection of utilization of said remote access channel to remotely control said particular bank account, and based on analysis of transactions performed in said particular bank account, generating a notification alert that said online banking account is used as a mule bank account or as a money laundering bank account;
wherein the method determines utilization of said remote access channel to remotely control said particular bank account, by taking into account: a detected mismatch between (I) accelerometer data, gyroscope data, and device orientation data of said computing device, and (II) touch-based gestures of a touch-screen of said computing device.

12. A system comprising:
one or more processors configured to execute code;
one or more memory units configured to store code;
wherein the one or more processors are configured to perform a process comprising:

(a) monitoring inte

Assignees

• Biocatch Ltd

Inventors

• Novick Itai
• Turgeman Avi

Classifications

• G06Q20/4016 Primary

  involving fraud or risk level assessment in transaction processing · CPC title

• G06Q20/10

  specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems · CPC title

• H04W12/122 Primary

  Counter-measures against attacks; Protection against rogue devices · CPC title