Systems and methods of identity protection and management

Patent metadata

Field	Value
Publication number	US-9542553-B1
Application number	US-201514819824-A
Country	US
Kind code	B1
Filing date	Aug 6, 2015
Priority date	Sep 16, 2011
Publication date	Jan 10, 2017
Grant date	Jan 10, 2017

Abstract

In an embodiment, a computing system, such as a monitoring computer, receives a request from a user to monitor an account of the user with an online service provider. The request may include personal information and user preferences for one or more protective actions. The system periodically monitors external data sources for indications of changes to personal information associated with the account, and detects changes or attempted changes to personal information associated with the account. The system may determine risk levels associated with detected changes or attempted changes, and transmit a notification to the user via a communication channel selected based on the determined risk level and/or the user preferences. The system may also initiate protective actions, so that further unauthorized access to the account may be prevented.

First claim

What is claimed is:

1. A method of monitoring potential identity theft threats, the method being performed by a monitoring computer having one or more computer processors, the method comprising:
receiving a request, by the monitoring computer, from a user to monitor a third party account of the user with an online service provider, the request including personal information associated with the third party account;
periodically monitoring the third party account of the user for indications of changes or attempted changes to personal information associated with the third party account;
as part of the periodic monitoring,
detecting a change or attempted change to personal information associated with the third party account;
determining a risk level associated with the detected change or attempted change to personal information associated with the third party account; and
determining, based at least in part on the determined risk level, one or more protective actions; and

transmitting to a user computing device a notification of the detected change or attempted change, and a request to select one or more of the protective actions to be taken in response to the detected change or attempted change;
receiving from the user computing device an indication of selection of one or more of the protective actions by the user; and
initiating the one or more protective actions selected by the user.

2. The method of claim 1 , wherein periodically monitoring the third party account of the user for indications of changes to personal information comprises periodically connecting to the online service provider associated with the third party account, providing the online service provider with login credentials associated with the user, and determining whether the online service provider accepts the provided login credentials.

3. The method of claim 2 , wherein periodically monitoring the third party account of the user for indications of changes to personal information further comprises, after the online service provider accepts the provided login credentials:
retrieving personal information associated with the third party account from the online service provider;
comparing personal information retrieved from the online service provider with personal information provided in the user request; and
determining whether personal information retrieved from the online service provider matches personal information provided in the user request.

4. The method of claim 1 , wherein periodically monitoring the third party account of the user for indications of changes or attempted changes to personal information comprises periodically retrieving or receiving electronic messages associated with the user and analyzing content of the retrieved or received messages to determine whether any of the messages indicates a change or attempted change to personal information.

5. The method of claim 1 , wherein the risk level is determined at least in part based on whether a preauthorization for the detected change or attempted change to personal information was received.

6. The method of claim 1 , wherein the risk level is determined at least in part based on a determination of a likelihood that the detected change or attempted change is non-anomalous, known, and/or authorized by the user.

7. The method of claim 1 , wherein the user computing device to which the notification of the detected change or attempted change is transmitted is determined in part based on the determined risk level.

8. A method of monitoring potential identity theft threats, the method being performed by a monitoring computer having one or more computer processors, the method comprising:
receiving a request, by the monitoring computer, from a user to monitor an electronic communication account or device of the user;
periodically monitoring electronic communications in the electronic communication account or device of the user for changes, possible changes, or attempted changes to personal information associated with another account of the user;
as part of the periodic monitoring, detecting a change, a possible change, or an attempted change to personal information associated with said another account of the user;
determining a risk level associated with the detected change, possible change, or attempted change to personal information associated with said another account of the user; and
determining, based at least in part on the determined risk level, one or more protective actions; and
transmitting to a user computing device a notification of the detected change, possible change, or attempted change, and a request to select one or more of the protective actions to be taken in response to the detected change, possible change, or attempted change;
receiving from the user computing device an indication of selection of one or more of the protective actions by the user; and
initiating the one or more protective actions selected by the user.

9. The method of claim 8 , wherein periodically monitoring electronic communications in the electronic communication account or device of the user comprises periodically logging into the electronic communication account or device of the user, gathering messages from the electronic communication account or device, and determining whether the gathered messages indicate a change, possible change, or attempted change to personal information associated with another account of the user.

10. The method of claim 8 , wherein periodically monitoring electronic communications in the electronic communication account or device of the user comprises receiving messages sent from the electronic communication account or device to the monitoring computer and analyzing content of the received messages to determine whether any of the messages indicates a change, possible change, or attempted change to personal information associated with another account of the user.

11. The method of claim 8 , wherein the risk level is determined at least in part based on whether a preauthorization for the detected change, possible change, or attempted change to personal information was received.

12. The method of claim 8 , wherein the risk level is determined at least in part based on a determination of a likelihood that the detected change, possible change, or attempted change is non-anomalous, known, and/or authorized by the user.

13. The method of claim 8 , wherein the user computing device to which the notification of the detected change, possible change, or attempted change is transmitted is determined in part based on the determined risk level.

14. A computing system configured to monitor and handle potential identity theft threats, comprising:
a non-transitory computer-readable storage medium having stored thereon a plurality of executable software modules;
a network interface; and
one or more computer hardware processors configured to execute the plurality of executable software modules stored on the computer-readable storage medium, wherein the one or more processors execute:
a credentials monitoring module to
access a third party account of a user and determine whether a response from the third party account indicates a change or attempted change to personal information associated with the third party account of the user;
determine a risk level associated with the detected change or attempted change to personal information associated with the third party account of the user; and
determine, based at least in part on the determined risk level, one or more protective actions;

an event notification module to transmit, via the network interface, to a user computing device a notific

Assignees

• Consumerinfo Com Inc

Inventors

• Burger Michael
• Kapczynski Mark Joseph

Classifications

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L67/306

  User profiles · CPC title

• G06F21/6245 Primary

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title

• G06F2221/032

  Protect output to user by software means · CPC title