Systems and methods employing graph-derived features for fraud detection

Patent metadata

Field	Value
Publication number	US-12022024-B2
Application number	US-202318301897-A
Country	US
Kind code	B2
Filing date	Apr 17, 2023
Priority date	Mar 17, 2020
Publication date	Jun 25, 2024
Grant date	Jun 25, 2024

Abstract

Embodiments described herein provide for performing a risk assessment using graph-derived features of a user interaction. A computer receives interaction information and infers information from the interaction based on information provided to the computer by a communication channel used in transmitting the interaction information. The computer may determine a claimed identity of the user associated with the user interaction. The computer may extract features from the inferred identity and claimed identity. The computer generates a graph representing the structural relationship between the communication channels and claimed identities associated with the inferred identity and claimed identity. The computer may extract additional features from the inferred identity and claimed identity using the graph. The computer may apply the features to a machine learning model to generate a risk score indicating the probability of a fraudulent interaction associated with the user interaction.

First claim

What is claimed is:

1. A computer-implemented method for assessing a risk of fraud, the method comprising:
receiving, by a computer from a call center, inbound call data for a call directed to the call center;
extracting, by the computer, a first set of features from the inbound call data;
obtaining, by the computer, an inferred identity (II) and identity claim (IC) for an inbound caller based upon the inbound call data;
extracting, by the computer, a second set of features from a graph structure derived from prior call data of one or more prior calls each having an II-IC pair corresponding to the II and the IC of the inbound caller;
generating, by the computer, a risk score for the inbound call by applying a machine-learning model on the first set of features and on the second set of features; and
transmitting, by the computer to the call center, a risk assessment output for the inbound call indicating the risk score.

2. The method according to claim 1 , wherein extracting the second set of features from the graph structure includes:
determining, by the computer, each II-IC pair purportedly associated with the inbound caller based upon the inferred identity, the identity claim, a set of prior inferred identities stored in one or more databases, and a set of prior identity claims stored in the one or more databases.

3. The method according to claim 2 , wherein the one or more databases includes at least one of: a third-party database of a telecommunications network system or a call center database of the call center.

4. The method according to claim 1 , wherein extracting the second set of features from the graph structure includes:
generating, by the computer, the graph structure representing each II-IC pair purportedly associated with the inbound caller based upon the II-IC pair determined in the prior call data.

5. The method according to claim 1 , further comprising applying, by the computer, a classification model on the risk score to determine a risk classification, wherein the computer transmits to the call center the risk assessment output having the risk score and the risk classification.

6. The method according to claim 1 , wherein obtaining the inferred identity includes determining, by the computer, the inferred identity based upon inferred identity information in the inbound call data.

7. The method according to claim 1 , wherein obtaining the inferred identity includes querying, by the computer, one or more databases for inferred identity information associated with the inbound call data.

8. The method according to claim 1 , wherein the inferred identity is at least one of:
an ANI in a phone channel,
a first Internet Protocol (IP) address associated with a transaction, or
a second IP address associated with voice samples for interactions between Internet of Things (IoT) devices and a provider server.

9. The method according to claim 1 , wherein obtaining the identity claim includes determining, by the computer, the identity claim based upon an indication received from the call center.

10. The method according to claim 1 , wherein obtaining the identity claim includes determining, by the computer, the identity claim based upon a caller assertion in the inbound call data based upon an indication received from the call center.

11. The method according to claim 1 , wherein the second set of features includes one or more features extracted directly from the graph structure.

12. The method according to claim 1 , wherein transmitting the risk assessment output to the call center includes generating, by the computer, a display for a graphical user interface of a call center agent device, the graphical user interface including the risk assessment output.

13. A computer-implemented method comprising:
obtaining, by a computer, an inferred identity (II) and identity claim OC) for an inbound caller based upon inbound call data;
identifying, by the computer, in a graph structure representing prior call data for a plurality of prior calls, the prior call data of a subset of one or more prior calls having at least one of the inferred identity or the identity claim of the inbound call data;
generating, by the computer, a sub-graph structure associated with the inbound call based upon a portion of the graph structure representing the prior call data of the subset of one or more prior calls;
extracting, by the computer, a first set of features from the inbound call data, and second set of features from the sub-graph structure; and
applying, by the computer, a machine learning model on the first set of features and the second set of features to generate a risk score for the inbound call.

14. The method according to claim 13 , wherein the graph structure represents one or more II-IC pairs purportedly associated with the inbound caller based upon the prior call data for the plurality of prior calls.

15. The method according to claim 13 , wherein the computer identifies the sub-graph structure embedded in the graph structure according to the inferred identity and the identity claim associated with the inbound call.

16. The method according to claim 13 , further comprising determining, by the computer, a fraud ratio based upon a number of fraud events associated with each identity claim of the graph relative to the number of fraud events associated with each identity claim of the sub-graph, wherein the computer determines the risk score based, at least in part, on the fraud ratio.

17. The method according to claim 13 , further comprising applying, by the computer, a classification model on the risk score to determine a risk classification.

18. The method according to claim 13 , further comprising transmitting, by the computer, a risk assessment output to a call center device, the risk assessment output indicating at least one of the risk score or a risk classification.

19. The method according to claim 13 , wherein the inferred identity is at least one of:
an ANI in a phone channel,
a first Internet Protocol (IP) address associated with a transaction, or
a second IP address associated with voice samples for interactions between Internet of Things (IoT) devices and a provider server.

20. The method according to claim 13 , wherein the second set of features includes features extracted directly from the sub-graph structure.

Assignees

• Pindrop Security Inc

Inventors

• Casal Ricardo
• Walker Theo
• PATIL Kailash
• Cornwell John

Classifications

• H04M3/51 Primary

  Centralised call answering arrangements requiring operator intervention {, e.g. call or contact centers for telemarketing} · CPC title

• H04M3/42042

  Notifying the called party of information on the calling party (details within substation equipment H04M1/57, signalling details H04Q3/72) · CPC title

• G06N3/08

  Learning methods · CPC title

• H04M2203/6027

  Fraud preventions · CPC title

• G06N20/20

  Ensemble learning · CPC title