Systems and methods for classifying accounts based on shared attributes with known fraudulent accounts

Patent metadata

Field	Value
Publication number	US-2020065814-A1
Application number	US-201816114110-A
Country	US
Kind code	A1
Filing date	Aug 27, 2018
Priority date	Aug 27, 2018
Publication date	Feb 27, 2020
Grant date	—

Abstract

Methods and systems are presented for classifying a particular user account as a fraudulent user account by analyzing links between the user account and two or more known fraudulent user accounts collectively. Attributes of the particular user account are compared against attributes of a plurality of known fraudulent accounts to determine that the particular user account has shared attributes with a first known fraudulent account and a second known fraudulent account. The shared attributes with the first known fraudulent account and the second known fraudulent account are analyzed collectively to determine a risk level for the particular user account. The risk level may indicate a likelihood that the particular user account corresponds to a fraudulent account.

First claim

What is claimed is:

1 . A system, comprising:
a non-transitory memory; and one or more hardware processors coupled with the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:
identifying, from a plurality of accounts, a first known fraudulent account and a second known fraudulent account;
determining that a an account is linked to the first known fraudulent account based on determining that a first set of attributes corresponding to a first set of attribute types of the account is shared with the first known fraudulent account and linked to the second known fraudulent account based on determining that a second set of attributes corresponding to a second set of attribute types of the account is shared with the second known fraudulent account;
identifying one or more common attribute types that are included in both the first set of attribute types and the second set of attribute types;
determining respective loss values corresponding to each of the one or more common attribute types; and
determining a risk level associated with the account based on comparing the respective loss values against one or more loss value thresholds, the risk level indicating a likelihood that the account corresponds to a fraudulent account.

2 . The system of claim 1 , wherein the respective loss values are determined based on a first loss amount associated with the first known fraudulent account and a second loss amount associated with the second known fraudulent account.

3 . The system of claim 1 , wherein the first set of attribute types comprise at least one of a user device identifier, a browser type, an Internet Protocol address, a physical address, a phone number, an identifier of a bank associated with a funding account, a location of the bank, an e-mail address, or a sold item description.

4 . The system of claim 1 , wherein the operations further comprise:
determining the first known fraudulent account and the second known fraudulent account are linked based on a shared attribute between the first known fraudulent account and the second known fraudulent account; in response to determining that the first known fraudulent account and the second known fraudulent account are linked, selecting a first attribute type that was excluded from the first set of attribute types based on first attributes corresponding to the first attribute type and associated with the account and the first known fraudulent account failing a first similarity threshold; determining the first attributes exceed a second similarity threshold; and including the first attribute type in the first set of attribute types in response to determining that the first attributes exceed the second similarity threshold.

5 . The system of claim 4 , wherein the second similarity threshold is lower than the first similarity threshold.

6 . The system of claim 4 , wherein the first attribute type is selected in response to determining that the first attribute type is included in the second set of attribute types.

7 . The system of claim 6 , wherein determining the respective loss values comprises determining a first loss value corresponding to the first attribute type.

8 . The system of claim 7 , wherein the first known fraudulent account is associated with a first loss amount and the second known fraudulent account is associated with a second loss amount, and wherein determining the first loss value comprises:
reducing the first loss amount; and computing the first loss value based on the reduced first loss amount and the second loss amount.

9 . A method of classifying an account, comprising:
identifying, by one or more hardware processors from a plurality of accounts, a first known fraudulent account and a second known fraudulent account; determining, by the one or more hardware processors, that the account is linked to the first known fraudulent account based on determining that a first set of attributes corresponding to a first set of attribute types of the account is shared with the first known fraudulent account and linked to the second known fraudulent account based on determining that a second set of attributes corresponding to a second set of attribute types of the account is shared with the second known fraudulent account; identifying, by the one or more hardware processors, one or more common attribute types that are included in both the first set of attribute types and the second set of attribute types; determining, by the one or more hardware processors, respective loss values corresponding to each of the first and second set of attribute types comprising the one or more common attribute types; and determining, by the one or more hardware processors, a risk level associated with the account based on comparing the respective loss values against one or more loss value thresholds, the risk level indicating a likelihood that the account corresponds to a fraudulent account.

10 . The method of claim 9 , wherein determining that the account is linked to the first known fraudulent account comprises:
identifying a set of buyers who have purchased from both the account and the first known fraudulent account; and determining that the set of buyers comprises at least a threshold number of buyers.

11 . The method of claim 9 , wherein determining that the account is linked to the first known fraudulent account is based on a previous fund transfer between the account and the first known fraudulent account.

12 . The method of claim 9 , wherein the account has no history of transactions.

13 . The method of claim 9 , wherein a first respective loss value corresponding to a first attribute type included in the first set of attribute type is determined based on a first loss amount associated with the first known fraudulent account, and a second respective loss value corresponding to a second attribute type included in the second set of attribute type is determined based on a second loss amount associated with the second known fraudulent account.

14 . The method of claim 13 , wherein a third respective loss value corresponding to one of the one or more common attribute types is determined based on the first loss amount and the second loss amount.

15 . The method of claim 9 , further comprising:
determining the first known fraudulent account and the second known fraudulent account are linked based on a shared attribute between the first known fraudulent account and the second known fraudulent account; in response to determining that the first known fraudulent account and the second known fraudulent account are linked, selecting a first attribute type that was excluded from the first set of attribute types based on first attributes associated with the particular seller account and the first known fraudulent account failing a first similarity threshold; determining the first attributes exceed a second similarity threshold; and including the first attribute type in the first set of attribute types in response to determining that the first attributes exceed the second similarity threshold.

16 . The method of claim 15 , wherein the second similarity threshold is lower than the first similarity threshold.

17 . The method of claim 15 , further comprising updating a first loss value corresponding to the first attribute type in response to determining that the first attributes exceed the second similarity threshold.

18 . The method of claim 17 , wherein updating the first loss value compris

Assignees

• Paypal Inc

Inventors

• Fang Chuanyun
• Ran Chunmao
• Levi Itzik
• Fu Kun
• Cohen Adam
• Meron Avishay
• Hai-Reuven Doron
• Jislin Amnon

Classifications

• G06Q20/4016 Primary

  involving fraud or risk level assessment in transaction processing · CPC title

• G06Q20/4014

  Identity check for transactions · CPC title

• H04L67/306

  User profiles · CPC title

• G06K9/6276

  Physics · mapped topic

• G06F18/24143

  Distances to neighbourhood prototypes, e.g. restricted Coulomb energy networks [RCEN] · CPC title