Fraud detection based on efficient frequent-behavior sorted lists

Patent metadata

Field	Value
Publication number	US-9773227-B2
Application number	US-201113340469-A
Country	US
Kind code	B2
Filing date	Dec 29, 2011
Priority date	Mar 4, 2009
Publication date	Sep 26, 2017
Grant date	Sep 26, 2017

Abstract

A computerized method for detecting fraud includes obtaining frequency information on entities in transaction data for at least one individual account, converting frequency information to a frequency variable, and predicting whether an activity is fraudulent in response to the frequency variable. In some embodiments, the frequency variable is used with at least one other variable to predict fraudulent activity.

First claim

What is claimed:

1. A computerized method for detecting fraud, the computerized method being implemented by one or more data processors and comprising:
continuously tracking and obtaining, by the one or more data processors, data comprising frequency information of a plurality of activities of one or more entities, the frequency information of the plurality of activities obtained from transaction data for a plurality of electronic data transactions occurring on one or more of: a machine having an Internet Protocol address, an automated teller machine, and a point of sale system;
converting, by the one or more data processors, the frequency information of an activity of the plurality of activities to a frequency variable;
storing, by the one or more data processors, the frequency variable in a frequency table, the frequency table being a frequent-behavior sorted list sorting the plurality of activities according to a frequency of occurrence of the plurality of activities and including at least a portion of the transaction data, the frequent-behavior sorted list being decayed by a multiplicative factor over time;
compressing, by the one or more data processors, the frequency table by combining an activity identifier of the activity of the plurality of activities and the frequency variable for the activity into a single frequency unit;
deriving, by the one or more data processors, a velocity variable and an event variable, the velocity variable and the event variable providing an indication of an acceleration or deceleration of the frequency of occurrence of the plurality of activities;
removing, in response to the frequency variable being added to the frequency table, an entry in the frequency table associated with a lowest-frequency activity;
generating, by the one or more data processors, data comprising a signature of unique activity for an account using the frequency table;
generating, by the one or more data processors, a risk table, the risk table including information associated with a risk of an electronic data transaction being fraudulent;
predicting, in real-time and by the one or more data processors, whether the electronic data transaction, of the plurality of electronic data transactions and associated with the account having the generated signature, is fraudulent by comparing the generated signature associated with the account against one or more historical signatures for other accounts having known fraudulent activity and by comparing the electronic data transaction with the risk table, the other accounts being determined to have the known fraudulent activity in response to the other accounts having one or more activities in the frequency table being below a predefined threshold; and
preventing, by the one or more data processors, completion of the electronic data transaction in response to a prediction that the electronic data transaction associated with the electronic data transaction is fraudulent.

2. The computerized method of claim 1 , wherein the frequency variable is used with at least one other variable to predict fraudulent activity.

3. The computerized method of claim 1 , wherein the predicting of whether the electronic data transaction is fraudulent includes a model that utilizes the frequency variable.

4. The computerized method of claim 1 , wherein the plurality of electronic data transactions include telephone calls.

5. The computerized method of claim 1 , wherein the plurality of electronic data transactions include credit card or debit card purchases.

6. The computerized method of claim 1 , wherein the transactions data is includes transaction location, the transaction location being one or more of unique terminal ID, street address, and postal code of the automated teller machine or the point of sale system.

7. The computerized method of claim 1 , wherein the transaction data includes a transaction amount.

8. The computerized method of claim 1 , wherein the transaction data includes a transaction time.

9. The computerized method of claim 1 , wherein the transaction data includes a transaction category.

10. The computerized method of claim 1 , wherein the transaction data includes a destination phone numbers.

11. A system comprising:
at least one data processor; and
memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
continuously tracking and obtaining data comprising frequency information of a plurality of activities of one or more entities, the frequency information of the plurality of activities obtained from transaction data for a plurality of electronic data transactions occurring on one or more of: a machine having an Internet Protocol address, an automated teller machine, and a point of sale system;
converting the frequency information of an activity of the plurality of activities to a frequency variable;
storing the frequency variable in a frequency table, the frequency table being a frequent-behavior sorted list sorting the plurality of activities according to a frequency of occurrence of the plurality of activities and including at least a portion of the transaction data, the frequent-behavior sorted list being decayed by a multiplicative factor over time;
compressing the frequency table by combining an activity identifier of the activity of the plurality of activities and the frequency variable for the activity into a single frequency unit;
deriving a velocity variable and an event variable, the velocity variable and the event variable providing an indication of an acceleration or deceleration of the frequency of occurrence of the plurality of activities;
removing, in response to the frequency variable being added to the frequency table, an entry in the frequency table associated with a lowest-frequency activity;
generating data comprising a signature of unique activity for an account using the frequency table;
generating a risk table, the risk table including information associated with a risk of an electronic data transaction being fraudulent;
predicting, in real-time, whether the electronic data transaction, of the plurality of electronic data transactions and associated with the account having the generated signature, is fraudulent by comparing the generated signature associated with the account against one or more historical signatures for other accounts having known fraudulent activity and by comparing the electronic data transaction with the risk table, the other accounts being determined to have the known fraudulent activity in response to the other accounts having one or more activities in the frequency table being below a predefined threshold; and
preventing completion of the electronic data transaction in response to a prediction that the electronic data transaction associated with the electronic data transaction is fraudulent.

12. A non-transitory computer program product storing instructions which, when executed by at least one data processor forming part of at least one computing device, result in operations comprising:
continuously tracking and obtaining ,data comprising frequency information of a plurality of activities of one or more entities, the frequency information of the plurality of activities obtained from transaction data for a plurality of electronic data transactions occurring on one or more of: a machine having an Internet Protocol address, an automated teller machine, and a point of sale system;
converting the frequency information of an activity of the plurality of activities to a frequency variable;
storing the frequency variable in a frequency table, the frequency table being a frequent-behavior sorted list sorting the plur

Assignees

• Zoldi Scott M
• Li Hua
• Xue Xinwei
• Fair Isaac Corp

Inventors

• Zoldi Scott M
• Li Hua
• Xue Xinwei

Classifications

• G06Q10/10 Primary

  Office automation; Time management · CPC title

• G06Q40/12

  Accounting · CPC title

• G06Q40/03

  Credit; Loans; Processing thereof · CPC title

• G06Q40/025

  Physics · mapped topic