Systems and methods for fraud detection and prevention

Patent metadata

Field	Value
Publication number	US-12333548-B2
Application number	US-202418671158-A
Country	US
Kind code	B2
Filing date	May 22, 2024
Priority date	Jun 5, 2020
Publication date	Jun 17, 2025
Grant date	Jun 17, 2025

Abstract

Systems and methods for fraud detection and prevention is disclosed. The system may receive a transaction request for a first customer including a transaction location, transaction time stamp, and merchant type code. The system may determine whether the transaction location is expected for the first customer. When the transaction location is unexpected, the system may identify a last-known video detection having a last-known time stamp and last-known location. The system may determine a travel time estimate between the last-known location and the transaction location and determine a buffer based on the merchant type code. The system may compare the travel time estimate to an allotted time that includes a difference between the transaction time stamp and last-known time stamp less the buffer. When the travel time estimate exceeds the allotted time, the system may execute one or more fraud prevention steps.

First claim

What is claimed is:

1. A fraud detection and prevention system comprising:
one or more processors;
a memory in communication with the one or more processors and storing instructions that, when executed by the one or more processors, are configured to cause the system to:
receive a transaction request associated with a first customer, the transaction request comprising a transaction time stamp, a transaction location, and a merchant type code;
responsive to receiving the transaction request:
receive or retrieve image data captured by one or more image capture devices;
identify, using facial recognition processing techniques, the first customer from the image data at a last-known video detection of the first customer, the last-known video detection comprising a last-known time stamp and a last-known location;
determine a travel time estimate between the last-known location and the transaction location;
determine a buffer based at least in part on the merchant type code;
compare the travel time estimate to an allotted time comprising a difference between the transaction time stamp and the last-known time stamp less the buffer; and
responsive to the travel time estimate exceeding the allotted time:
when the travel time estimate exceeds the allotted time by at least a first threshold, execute a high threat response;
when the travel time estimate exceeds the allotted time by at least a second threshold, execute a medium threat response; and
when the travel time estimate exceeds the allotted time by less than the second threshold, execute a low threat response.

2. The system of claim 1 , wherein the high threat response comprises denying the transaction request and monitoring a first predetermined number of subsequent transaction requests for the first customer.

3. The system of claim 2 , wherein the medium threat response comprises requesting a secondary authentication from a user device associated with the first customer and monitoring a second predetermined number of subsequent transaction requests for the first customer, wherein the second predetermined number is less than the first predetermined number.

4. The system of claim 3 , wherein the low threat response comprises monitoring a third predetermined number of subsequent transaction requests for the first customer, wherein the third predetermined number is less than the second predetermined number.

5. The system of claim 4 , wherein determining each of the first and second predetermined numbers is based in part on determining by how much a respective first and second threshold has been exceeded by.

6. The system of claim 1 , wherein the last-known video detection is based on a live video feed and the live video feed is captured by one or more stationary cameras having a known location.

7. The system of claim 6 , wherein identifying the last-known video detection further comprises receiving the live video feed and identifying the first customer based on the live video feed.

8. A non-transitory computer readable medium storing program instructions that when executed by one or more processors cause the one or more processors to:
receive a transaction request associated with a first customer, the transaction request comprising a transaction time stamp, a transaction location, and a merchant type code;
responsive to receiving the transaction request:
receive or retrieve image data captured by one or more image capture devices;
identify, using facial recognition processing techniques, the first customer from the image data at a last-known video detection of the first customer, the last-known video detection comprising a last-known time stamp and a last-known location;
determine a travel time estimate between the last-known location and the transaction location;
determine a buffer based at least in part on the merchant type code;
compare the travel time estimate to an allotted time comprising a difference between the transaction time stamp and the last-known time stamp less the buffer; and
responsive to the travel time estimate exceeding the allotted time:
when the travel time estimate exceeds the allotted time by at least a first threshold, execute a high threat response;
when the travel time estimate exceeds the allotted time by at least a second threshold, execute a medium threat response; and
when the travel time estimate exceeds the allotted time by less than the second threshold, execute a low threat response.

9. The non-transitory computer readable medium of claim 8 , wherein the high threat response comprises denying the transaction request and monitoring a first predetermined number of subsequent transaction requests for the first customer.

10. The non-transitory computer readable medium of claim 9 , wherein the medium threat response comprises requesting a secondary authentication from a user device associated with the first customer and monitoring a second predetermined number of subsequent transaction requests for the first customer, wherein the second predetermined number is less than the first predetermined number.

11. The non-transitory computer readable medium of claim 10 , wherein the low threat response comprises monitoring a third predetermined number of subsequent transaction requests for the first customer, wherein the third predetermined number is less than the second predetermined number.

12. The non-transitory computer readable medium of claim 11 , wherein determining each of the first and second predetermined numbers is based in part on determining by how much a respective first and second threshold has been exceeded by.

13. The non-transitory computer readable medium of claim 8 , wherein the last-known video detection is based on a live video feed and the live video feed is captured by one or more stationary cameras having a known location.

14. The non-transitory computer readable medium of claim 13 , wherein identifying the last-known video detection further comprises receiving the live video feed and identifying the first customer based on the live video feed.

15. A method comprising:
receiving a transaction request associated with a first customer, the transaction request comprising a transaction time stamp, a transaction location, and a merchant type code;
responsive to receiving the transaction request:
receiving or retrieving image data captured by one or more image capture devices;
identifying, using facial recognition processing techniques, the first customer from the image data at a last-known video detection of the first customer, the last-known video detection comprising a last-known time stamp and a last-known location;
determining a travel time estimate between the last-known location and the transaction location;
determining a buffer based at least in part on the merchant type code;
comparing the travel time estimate to an allotted time comprising a difference between the transaction time stamp and the last-known time stamp less the buffer; and
responsive to the travel time estimate exceeding the allotted time,
executing a threat response, wherein: exceeding the travel time estimate by greater than a first threshold corresponds to executing a high threat response,
exceeding the travel time estimate by greater than a second threshold corresponds to executing a medium threat response, and
exceeding the travel time estimate by less than the second threshold corresponds to executing a low threat response.

16. The method of claim 15 , wherein:
the high threat response comprises denying the transaction request and monitoring a first predetermined number of subsequent tra

Assignees

• Capital One Services Llc

Inventors

• Edwards Joshua
• Benkreira Abdelkader
• Mossoba Michael

Classifications

• H04L2463/121

  Timestamp · CPC title

• H04L2463/102

  applying security measure for e-commerce · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title