Systems and methods for classifying accounts based on shared attributes with known fraudulent accounts

Patent metadata

Field	Value
Publication number	US-12469035-B2
Application number	US-202117533054-A
Country	US
Kind code	B2
Filing date	Nov 22, 2021
Priority date	Aug 27, 2018
Publication date	Nov 11, 2025
Grant date	Nov 11, 2025

Abstract

Methods and systems are presented for classifying a particular user account as a fraudulent user account by analyzing links between the user account and two or more known fraudulent user accounts collectively. Attributes of the particular user account are compared against attributes of a plurality of known fraudulent accounts to determine that the particular user account has shared attributes with a first known fraudulent account and a second known fraudulent account. The shared attributes with the first known fraudulent account and the second known fraudulent account are analyzed collectively to determine a risk level for the particular user account. The risk level may indicate a likelihood that the particular user account corresponds to a fraudulent account.

First claim

What is claimed is:

1 . A system, comprising:
a processor; and a non-transitory computer-readable storage medium having stored thereon instructions that are executable to cause the system to perform operations comprising:
identifying, from a plurality of electronic accounts with an electronic transaction service provider, first and second electronic accounts classified as having a first specific account classification of a plurality of account classifications, wherein each of a plurality of computer devices, having a processor and a memory, is configured to perform electronic transactions through a corresponding electronic account from the plurality of electronic accounts with one or more other electronic accounts from the plurality of electronic accounts, and wherein performing an electronic transaction between two electronic accounts from the plurality of electronic accounts requires an authentication step for at least one of the two electronic accounts;
determining that a third electronic account with the electronic transaction service provider is linked to the first and second electronic accounts classified as having the first specific account classification, based on determining (i) that a first set of attributes corresponding to a first set of attribute types and associated with the third electronic account is shared with the first electronic account and (ii) that a second set of attributes corresponding to a second set of attribute types and associated with the third electronic account is shared with the second electronic account;
identifying one or more common attribute types that are included in both of the first set of attribute types and the second set of attribute types;
determining respective loss values corresponding to the one or more common attribute types; and
determining a risk level associated with the third electronic account using a machine learning model configured to output the risk level associated with the third electronic account using the respective loss values corresponding to the one or more common attribute types as input values, wherein the machine learning model is trained using historic data associated with the plurality of electronic accounts that were previously created and that have been classified as either the first specific account classification or a second specific account classification of the plurality of account classifications, and wherein the risk level indicates a likelihood that the third electronic account corresponds to the first specific account classification.

2 . The system of claim 1 , wherein the first set of attribute types comprises at least one of a user device identifier, a browser type, an Internet Protocol address, a physical address, a phone number, an e-mail address, or a sold item description.

3 . The system of claim 1 , wherein the respective loss values are determined based on a first loss amount associated with the first electronic account and a second loss amount associated with the second electronic account.

4 . The system of claim 1 , wherein the operations further comprise:
determining that the first electronic account and the second electronic account are linked based on a shared attribute between the first electronic account and the second electronic account.

5 . The system of claim 1 , wherein the determining the respective loss values comprises determining a first loss value corresponding to a first attribute type of the first set of attribute types.

6 . The system of claim 1 , wherein the operations further comprise:
based on the determined risk level associated with the third account, performing a remedial action against the third electronic account.

7 . The system of claim 6 , wherein the remedial action includes restricting access to one or more services provided via the electronic transaction service provider.

8 . A method, comprising:
accessing, by a computer system, account information for first and second electronic accounts of a plurality of electronic accounts with an electronic transaction service provider, wherein the first and second electronic accounts are classified as having a first specific account classification of a plurality of account classifications, wherein each of a plurality of computer devices, having a processor and a memory, is configured to perform electronic transactions through a corresponding electronic account from the plurality of electronic accounts with one or more other electronic accounts from the plurality of electronic accounts, and wherein performing an electronic transaction between two electronic accounts from the plurality of electronic accounts requires an authentication step for at least one of the two electronic accounts; determining, by the computer system and based on the account information, that a third electronic account with the electronic transaction service provider is linked to the first and second electronic accounts classified as having the first specific account classification, based on determining (i) that a first set of attributes corresponding to a first set of attribute types and associated with the third electronic account is shared with the first electronic account and (ii) that a second set of attributes corresponding to a second set of attribute types and associated with the third account is shared with the second electronic account; identifying, by the computer system, one or more common attribute types that are included in both of the first set of attribute types and the second set of attribute types; determining, by the computer system, respective loss values corresponding to the one or more common attribute types; and determining, by the computer system, a risk level associated with the third electronic account using a machine learning model configured to output the risk level associated with the third electronic account using the respective loss values corresponding to the one or more common attribute types as input values, wherein the machine learning model is trained using historic data associated with the plurality of electronic accounts that were previously created and that have been classified as either the first specific account classification or a second specific account classification of the plurality of account classifications, and wherein the risk level indicates a likelihood that the third electronic account corresponds to the first specific account classification.

9 . The method of claim 8 , wherein the determining that the third electronic account is linked to the first and second electronic accounts is further based on attribute threshold values, wherein the attribute threshold values are determined based on historical account data associated with (i) first electronic accounts classified as the first specific classification and (ii) second electronic accounts having a classification from the plurality of account classifications different than the first specific classification.

10 . The method of claim 8 , further comprising:
comparing a first attribute value associated with the third electronic account to first attribute values associated with the first and second electronic accounts; and comparing a second attribute value associated with the third electronic account to second attribute values associated with the first and second electronic accounts.

11 . The method of claim 8 , wherein the first set of attribute types comprises at least one of a user device identifier, a browser type, an Internet Protocol address, a physical address, a phone number, an e-mail address, or a sold item description.

12 . The method of claim 8 , wherein the respective loss values are determined based on a first

Assignees

• Paypal Inc

Inventors

• Fang Chuanyun
• Ran Chunmao
• Levi Itzik
• Fu Kun
• Cohen Adam
• Meron Avishay
• Hai-Reuven Doron
• Jislin Amnon

Classifications

• G06Q20/4014

  Identity check for transactions · CPC title

• H04L67/306

  User profiles · CPC title

• G06F18/24143

  Distances to neighbourhood prototypes, e.g. restricted Coulomb energy networks [RCEN] · CPC title

• G06Q20/4016 Primary

  involving fraud or risk level assessment in transaction processing · CPC title