Synthetic online entity detection

Patent metadata

Field	Value
Publication number	US-11625730-B2
Application number	US-201816199349-A
Country	US
Kind code	B2
Filing date	Nov 26, 2018
Priority date	Nov 28, 2017
Publication date	Apr 11, 2023
Grant date	Apr 11, 2023

Abstract

In some aspects, a computing system can detect synthetic identities based on attributes associated with online entities. The computing system can generate entity links between primary entity objects and a secondary entity object. The secondary entity object identifies a target consumer as a secondary entity for accounts identified by the primary entity objects. Attributes of the secondary entity object and attributes of the primary entity objects can be calculated and compared to determine an inconsistency between a combination of a name attribute value and an address attribute value of the secondary entity object as compared to the primary entity objects. A fraud warning indicating that the target consumer is likely to be a synthetic identity can be generated based on the inconsistency and other attributes of the target consumer, such as an inquiries attribute, a terminations attribute, a duration attribute, and so on.

First claim

The invention claimed is:

1. A fraud detection computing system comprising:
a contributor external-facing device configured for:
communicating with a fraud detection server system through a security portal and for obtaining, via communications with contributor computing systems over a public data network, transaction data and account data for online entities;

a client external-facing device configured for:
receiving, from a client computing system and during a target transaction between the client computing system and a consumer computing system, a query regarding a presence of a fraud warning for a target consumer associated with the consumer computing system; and
transmitting, prior to completion of the target transaction, the fraud warning to the client computing system;

an identity repository to securely store the account data and the transaction data obtained from the contributor computing systems; and
the fraud detection server system configured for:
identifying, based, at least in part, upon the account data and the transaction data, a plurality of primary entities that are verified authentic entities;
identifying, based, at least in part, upon the account data and the transaction data, a plurality of secondary entities that are added to a plurality of accounts of the plurality of primary entities;
generating, in a data structure, entity links between primary entity objects identifying the plurality of primary entities that are verified authentic entities and secondary entity objects identifying respective secondary entities in the plurality of secondary entities that are added to the plurality of accounts of the plurality of primary entities; the entity links including persistent associations in the data structure representing a relationship of the secondary entity objects being secondary to the respective primary entity objects such that the relationship is represented in response to at least one of the primary entity objects and the associated secondary entity objects being accessed;
accessing attributes of a secondary entity object identifying the target consumer as a secondary entity in the plurality of secondary entities that is on an account of the plurality of accounts;
accessing attributes of a primary entity object that has an entity link with the secondary entity object, the primary entity object identifying a primary entity of the account from the plurality of primary entities;
comparing a first combination of a name attribute value and an address attribute value of the secondary entity object and a second combination of a name attribute value and an address attribute value of the primary entity object, a name attribute identifying a family name for an entity and an address attribute identifying a physical address for the entity;
generating, responsive to the query, the fraud warning based, at least in part, upon the first combination being different from the second combination according to the comparison;
computing synthetic identity detection attributes and labels for a group of consumers based on the account data and the transaction data; and
generating a plurality of decision rules for identifying synthetic identities by training a machine learning model based on the synthetic identity detection attributes and the labels for the group of consumers; wherein training the machine learning model generates a plurality of logic rules and wherein the plurality of decision rules are generated by further filtering the plurality of logic rules based, at least in part, upon a precision threshold and a recall threshold.

2. The fraud detection computing system of claim 1 , wherein the fraud detection server system is further configured for:
computing an inquiries attribute for the target consumer, where the inquiries attribute identifies a number of categories of online services having inquires for the target consumer over an evaluation period;
determining that the number of categories in the inquiries attribute is greater than a threshold number of categories; and
generating the fraud warning based on the inquiries attribute in addition to the first combination being different from the second combination.

3. The fraud detection computing system of claim 2 , wherein the fraud detection server system is further configured for:
computing a terminations attribute for the target consumer, where the terminations attribute identifies a number of accounts of the plurality of accounts in which a secondary entity status of the target consumer has been terminated;
determining that the number of the accounts in the terminations attribute is greater than a threshold number of terminations; and
generating the fraud warning based on the terminations attribute in addition to the inquiries attribute and the first combination being different from the second combination.

4. The fraud detection computing system of claim 2 , wherein the fraud detection server system is further configured for generating the fraud warning based on one or more of:
a duration attribute for the target consumer indicating that a duration since an electronic history for the target consumer was created is less than a threshold duration; and
an attribute for the target consumer indicating that a number of physical addresses in the electronic history for the target consumer is less than a threshold number of physical addresses.

5. The fraud detection computing system of claim 1 , wherein the fraud detection server system is further configured for:
computing the synthetic identity detection attributes for the target consumer; and
generating the fraud warning further based on the synthetic identity detection attributes for the target consumer satisfying a plurality of detection rules.

6. A method that includes one or more processing devices performing operations comprising:
obtaining, by a contributor external-facing device of a fraud detection computing system via communications with contributor computing systems over a public data network, transaction data and account data for online entities;
identifying, based, at least in part, upon the transaction data and the account data for online entities, a plurality of primary entities that are verified authentic entities;
identifying, based, at least in part, upon the transaction data and the account data, a plurality of secondary entities that are added to a plurality of accounts of the plurality of primary entities;
generating, in a data structure and by a fraud detection server system, entity links between primary entity objects identifying the plurality of primary entities and secondary entity objects identifying the respective secondary entities in the plurality of secondary entities that are added to the plurality of accounts of the plurality of primary entities;
receiving, by a client external-facing device of the fraud detection computing system from a client computing system and during a target transaction between the client computing system and a consumer computing system, a query regarding a presence of a fraud warning for a target consumer associated with the consumer computing system;
accessing, by the fraud detection server system, attributes of a secondary entity object identifying the target consumer as a secondary entity from the plurality of secondary entities that is on an account of the plurality of accounts;
accessing attributes of a primary entity object that has an entity link with the secondary entity object, the primary entity object identifying a primary entity of the account from the plurality of primary entities;
comparing a first combination of a name attribute value and an address attribute value of the secondary entity object for the target consumer and a second combination of a name attribute value and an address attrib

Assignees

• Equifax Inc

Inventors

• Liu Rong
• Yan Nian
• Ray Jr John D
• Tirunellayi Sriram

Classifications

• G06N5/046

  Forward inferencing; Production systems · CPC title

• G06N20/00

  Machine learning · CPC title

• G06Q30/0185 Primary

  Product, service or business identity fraud · CPC title

• H04W12/122

  Counter-measures against attacks; Protection against rogue devices · CPC title

• H04L63/168

  above the transport layer · CPC title