Account theft risk identification

Patent metadata

Field	Value
Publication number	US-11233812-B2
Application number	US-201715816207-A
Country	US
Kind code	B2
Filing date	Nov 17, 2017
Priority date	May 29, 2015
Publication date	Jan 25, 2022
Grant date	Jan 25, 2022

Abstract

An operation request is received from a terminal device. An identification of the terminal device is determined. Based on the identification of the terminal device, historical operation requests initiated from the terminal device in a predetermined time period prior to the operation request are determined. A user identity location is determined for each historical operation request. A number of different user identity locations for the historical operation requests is determined. Based on the number of different user identity locations, an account theft risk value is determined.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving an operation request from a terminal device;
determining an identification of the terminal device;
based on the identification of the terminal device, determining historical operation requests associated with a plurality of respective user accounts belonging respectively to a plurality of different users who initiated the historical operation requests from the terminal device in a predetermined time period prior to the operation request;
determining a respective user identity location for each historical operation request initiated by the plurality of different users based on respective user registration information for each of the plurality of different users, wherein a granularity of the user identity location is a city or a county;
computing, from the user registration information for the plurality of different users, a number of different cities or counties among the user identity locations for the plurality of different users associated with the historical operation requests;
computing a risk level for the terminal device based on the number of different cities or counties computed from the user registration information for the plurality of different users indicating the user identity locations for the plurality of different users associated with the historical operation requests initiated from the terminal device;
computing an account theft risk level for a user of the operation request; and
computing an overall account theft risk level by combining the risk level for the terminal device and the account theft risk level for the user of the operation request.

2. The computer-implemented method of claim 1 , wherein the terminal device is a personal computer (PC), and the identification of the terminal device includes at least one of a Medium Access Control (MAC) address, an Internet Protocol (IP) address, or a Unique Material Identifier (UMID).

3. The computer-implemented method of claim 1 , wherein the terminal device is a mobile communication device, and the identification of the terminal device includes at least one of a Medium Access Control (MAC) address, an International Mobile Equipment Identity (IMEI), a Thread Identifier (TID), or a mobile phone number.

4. The computer-implemented method of claim 1 , wherein, determining the respective user identity location for each historical operation request initiated by the plurality of different users based on the respective user registration information for each of the plurality of different users comprises determining the respective user identity location based on a credential type and a credential number comprised in the respective user registration information.

5. The computer-implemented method of claim 4 , wherein the credential type is a resident identification (ID) card, and the credential number is a resident ID number.

6. The computer-implemented method of claim 5 , wherein the user identity location is determined by initial digits of the resident ID number.

7. The computer-implemented method of claim 1 , further comprising determining account theft if the overall account theft risk level exceeds a threshold.

8. A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:
receiving an operation request from a terminal device;
determining an identification of the terminal device;
based on the identification of the terminal device, determining historical operation requests associated with a plurality of respective user accounts belonging respectively to a plurality of different users who initiated the historical operation requests from the terminal device in a predetermined time period prior to the operation request;
determining a respective user identity location for each historical operation request initiated by the plurality of different users based on respective user registration information for each of the plurality of different users, wherein a granularity of the user identity location is a city or a county;
computing, from the user registration information for the plurality of different users, a number of different cities or counties among the user identity locations for the plurality of different users associated with the historical operation requests;
computing a risk level for the terminal device based on the number of different cities or counties computed from the user registration information for the plurality of different users indicating the user identity locations for the plurality of different users associated with the historical operation requests initiated from the terminal device;
computing an account theft risk level for a user of the operation request; and
computing an overall account theft risk level by combining the risk level for the terminal device and the account theft risk level for the user of the operation request.

9. The non-transitory, computer-readable medium of claim 8 , wherein the terminal device is a personal computer (PC), and the identification of the terminal device includes at least one of a Medium Access Control (MAC) address, an Internet Protocol (IP) address, or a Unique Material Identifier (UMID).

10. The non-transitory, computer-readable medium of claim 8 , wherein the terminal device is a mobile communication device, and the identification of the terminal device includes at least one of a Medium Access Control (MAC) address, an International Mobile Equipment Identity (IMEI), a Thread Identifier (TID), or a mobile phone number.

11. The non-transitory, computer-readable medium of claim 8 , wherein, determining the respective user identity location for each historical operation request initiated by the plurality of different users based on the respective user registration information for each of the plurality of different users comprises determining the respective user identity location based on a credential type and a credential number comprised in the respective user registration information.

12. The non-transitory, computer-readable medium of claim 11 , wherein the credential type is a resident identification (ID) card, and the credential number is a resident ID number.

13. The non-transitory, computer-readable medium of claim 12 , wherein the user identity location is determined by initial digits of the resident ID number.

14. The non-transitory, computer-readable medium of claim 8 , wherein the operations further comprise determining account theft if the overall account theft risk level exceeds a threshold.

15. A computer-implemented system, comprising:
one or more computers; and
one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising:
receiving an operation request from a terminal device;
determining an identification of the terminal device;
based on the identification of the terminal device, determining historical operation requests associated with a plurality of respective user accounts belonging respectively to a plurality of different users who initiated the historical operation requests from the terminal device in a predetermined time period prior to the operation request;
determining a respective user identity location for each historical operation request initiated by the plurality of different users based on respective user registration information for each of the plurality of different users, wherein a granularity of the

Assignees

• Advanced New Technologies Co Ltd

Inventors

• Tan Chunping

Classifications

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title

• H04W12/63

  Location-dependent; Proximity-dependent · CPC title

• H04W12/126

  Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning · CPC title

• G06F21/57 Primary

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title