Method, device, and system of detecting mule accounts and accounts used for money laundering

Patent metadata

Field	Value
Publication number	US-12380455-B2
Application number	US-202318218026-A
Country	US
Kind code	B2
Filing date	Jul 4, 2023
Priority date	Nov 29, 2010
Publication date	Aug 5, 2025
Grant date	Aug 5, 2025

Abstract

Method, device, and system of detecting a mule bank account, or a bank account used for terror funding or money laundering. A method includes: monitoring interactions of a user with a computing device during online access with a bank account; and based on the monitoring, determining that the bank account is utilized as a mule bank account to illegally receive and transfer money, or is used for money laundering or terror funding. The method takes into account one or more indicators, such as, utilization of a remote access channel, utilization of a virtual machine or a proxy server, unique behavior across multiple different accounts, temporal correlation among operations, detection of a set of operations that follow a pre-defined mule account playbook, detection of multiple incoming fund transfers from multiple countries that are followed by a single outgoing fund transfer to a different country, and other indicators.

First claim

What is claimed is:

1. A method comprising:
(a) monitoring multiple interactions of a particular user that utilizes an electronic device to access a particular bank account;
(b) performing an analysis that is based on at least one of:
(b1) data of transactions submitted for execution in said particular bank account,
(b2) user-specific behavioral data indicating a behavioral manner in which said particular user utilizes said electronic device, extracted from monitored interactions and monitored gestures of said particular user,
(b3) data about one or more operational properties of said electronic device,
(b4) one or more signals captured from a communication channel between said electronic device and a server associated with said particular bank account;
(c) based on said analysis, generating a notification alert that said online bank account is used as a mule bank account or as a money laundering bank account or as a terror-funding bank account; and
wherein the analysis of step (b) comprises:
(A) detecting that a first amount of money was transferred from a first account to a second account;
(B) detecting that a second amount of money, which is at least 50 percent of the first amount of money, was transferred from the second account to a third account;
(C) detecting that the second account was accessed via a Remote Access channel;
(D) based cumulatively on the detecting of step (A) and the detecting of step (B) and the detecting of step (C), determining that said second account is used as a mule bank account or as a money laundering bank account or as a terror-funding bank account.

2. The method of claim 1 ,
wherein the analysis of step (b) comprises:
(A) detecting that a set of banking operations comprise: (i) a first funds transfer from a first bank account to a second bank account, followed by (ii) a second funds transfer from the second bank account to a third bank account;
(B) analyzing (I) a first set of user interactions that were performed in a first usage session in which funds were transferred out from the first bank account, and also (II) a second set of user interactions that were performed in a second usage session in which funds were transferred out from the second bank account to the third bank account; and detecting a set of user-specific features that appear in both the first set of user interactions and the second set of user interactions;
(C) based on the detecting of step (B), performing:
(C1) determining that said first bank account was a victim bank account, and
(C2) determining that said second bank account was used as a mule bank account, and
(C3) determining that said third bank account was used as a real destination bank account.

3. The method of claim 1 ,
wherein the analysis of step (b) comprises:
(A) monitoring and analyzing user interactions during multiple, different, usage sessions in which said online bank account was accessed;
(B) based on step (A), creating a plurality of user-specific profiles that correspond to a plurality of users that accessed said online bank account, and generating an estimated number of said plurality of users that accessed said online bank account;
(C) based on step (B), determining that said target bank account is used as a mule bank account to illegally receive and transfer money.

4. The method of claim 1 ,
wherein the analysis of step (b) comprises:
(A) monitoring and analyzing user interactions during multiple usage sessions in which said online bank account was accessed;
(B) detecting that the user interactions in said multiple usage session, comprise: (i) an incoming funds transfer, and (ii) a subsequent outgoing funds transfer, and (iii) lack of cash withdrawals, and (iv) lack of check withdrawals; (C) based on the detecting of said (B), determining that said online bank account was used as a mule bank account to illegally receive and transfer money.

5. The method of claim 1 ,
wherein the analysis of step (b) comprises:
(A) receiving a list of bank accounts that are known to be mule bank accounts; analyzing user interactions that were performed via input units of computing devices by users that accessed said mule bank accounts; and extracting a set of interaction features that characterize the user interactions across multiple mule bank accounts;
(B) subsequently, checking whether user interactions in a particular bank account, match said set of interaction features that were extracted in step (A); and if the checking result is positive, then determining that said particular bank account was used as a mule bank account to illegally receive and transfer money.

6. The method of claim 1 ,
wherein the analysis of step (b) comprises:
(A) based on analysis of communications latency in a communication channel between said computing device and a remote server, determining that said user is located remotely from said computing device and is controlling remotely said computing device via said remote access channel;
(B) based on detection of utilization of said remote access channel, determining that said online banking account is used as a mule bank account to illegally receive and transfer money.

7. The method of claim 1 ,
wherein the analysis of step (b) comprises:
(A) sampling touch-based gestures of a touch-screen of said computing device;
(B) sampling accelerometer, gyro and device orientation data of said computing device, during a time period which at least partially overlaps said sampling of touch-based gestures of the touch-screen of the computing device;
(C) based on a mismatch between (i) sampled touch-based gestures, and (ii) sampled accelerometer, gyro and device orientation data, determining that the computing device was controlled remotely via a remote access channel;
(D) based on detection of utilization of said remote access channel, determining that said online banking account is used as a mule bank account to illegally receive and transfer money.

8. The method of claim 1 ,
The method of The method of wherein the analysis of step (b) comprises:
(A) sampling interactions of said user with said computing device during multiple online accesses to said banking account, and creating a user-specific profile of the interaction of said user with an input unit of said computing device;
(B) matching said user-specific profile with interactions of said user with said banking account via an electronic device that is different from said computing device;
(C) based on said matching, determining that said online banking account is used as a mule bank account to illegally receive and transfer money.

9. The method of claim 1 ,
wherein the analysis of step (b) comprises:
(A) monitoring and analyzing interactions of a first user who transfers funds from said online banking account to a target banking account; and creating a first user-specific profile based on said interactions monitored and analyzed in step (A);
(B) monitoring and analyzing interactions of a second user who accesses said target bank account; and creating a second user-specific profile based on said interactions monitored and analyzed in step (B);
(C) determining a match between the first user-specific profile and the second user-specific profile;
(D) based on said match, determining that said target bank account is used as a mule bank account to illegally receive and transfer money.

10. The method of claim 1 ,
wherein the analysis of step (b) comprises:
(A) monitoring and analyzing user interactions during usage sessions in which said online bank account was accessed, and generating a primary user-specific interaction profile that characterizes the interactions of said user with said online bank account;
(B) monitoring and

Assignees

• Biocatch Ltd

Inventors

• Novick Itai
• Turgeman Avi

Classifications

• G06Q20/10

  specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems · CPC title

• G06Q20/4016 Primary

  involving fraud or risk level assessment in transaction processing · CPC title

• H04W12/122 Primary

  Counter-measures against attacks; Protection against rogue devices · CPC title