US20230394500A1 - Identifying fraudulent online applications - Google Patents
Identifying fraudulent online applications Download PDFInfo
- Publication number
- US20230394500A1 US20230394500A1 US18/222,199 US202318222199A US2023394500A1 US 20230394500 A1 US20230394500 A1 US 20230394500A1 US 202318222199 A US202318222199 A US 202318222199A US 2023394500 A1 US2023394500 A1 US 2023394500A1
- Authority
- US
- United States
- Prior art keywords
- data
- online
- fraud
- transaction
- user device
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 claims abstract description 389
- 230000000694 effects Effects 0.000 claims abstract description 109
- 230000004044 response Effects 0.000 claims abstract description 19
- 230000009471 action Effects 0.000 claims description 13
- 230000000116 mitigating effect Effects 0.000 claims 8
- 230000008569 process Effects 0.000 description 273
- 238000001514 detection method Methods 0.000 description 79
- 238000010801 machine learning Methods 0.000 description 51
- 238000004458 analytical method Methods 0.000 description 43
- 238000004891 communication Methods 0.000 description 37
- 230000015654 memory Effects 0.000 description 30
- 238000012552 review Methods 0.000 description 27
- 238000013480 data collection Methods 0.000 description 26
- 230000000875 corresponding effect Effects 0.000 description 24
- 230000001010 compromised effect Effects 0.000 description 22
- 230000006399 behavior Effects 0.000 description 20
- 238000012545 processing Methods 0.000 description 15
- 238000010191 image analysis Methods 0.000 description 13
- 238000011835 investigation Methods 0.000 description 12
- 230000005540 biological transmission Effects 0.000 description 11
- 238000012795 verification Methods 0.000 description 7
- 230000008901 benefit Effects 0.000 description 6
- 230000003287 optical effect Effects 0.000 description 6
- 238000012549 training Methods 0.000 description 6
- 238000010586 diagram Methods 0.000 description 4
- 238000005516 engineering process Methods 0.000 description 4
- 230000002093 peripheral effect Effects 0.000 description 4
- 230000006855 networking Effects 0.000 description 3
- 238000012706 support-vector machine Methods 0.000 description 3
- 235000011449 Rosa Nutrition 0.000 description 2
- 238000013528 artificial neural network Methods 0.000 description 2
- 239000003086 colorant Substances 0.000 description 2
- 238000007726 management method Methods 0.000 description 2
- 230000005055 memory storage Effects 0.000 description 2
- 230000002085 persistent effect Effects 0.000 description 2
- 239000007787 solid Substances 0.000 description 2
- 241000237858 Gastropoda Species 0.000 description 1
- 238000007792 addition Methods 0.000 description 1
- 230000002547 anomalous effect Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000012790 confirmation Methods 0.000 description 1
- 230000002596 correlated effect Effects 0.000 description 1
- 238000003066 decision tree Methods 0.000 description 1
- 238000013135 deep learning Methods 0.000 description 1
- 230000003116 impacting effect Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000010921 in-depth analysis Methods 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 230000002452 interceptive effect Effects 0.000 description 1
- 238000003064 k means clustering Methods 0.000 description 1
- 238000007477 logistic regression Methods 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 239000000203 mixture Substances 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000009428 plumbing Methods 0.000 description 1
- 230000002265 prevention Effects 0.000 description 1
- 238000011084 recovery Methods 0.000 description 1
- 230000008439 repair process Effects 0.000 description 1
- 238000001228 spectrum Methods 0.000 description 1
- 239000000126 substance Substances 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
- 230000007723 transport mechanism Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/018—Certifying business or products
- G06Q30/0185—Product, service or business identity fraud
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N20/00—Machine learning
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N5/00—Computing arrangements using knowledge-based models
- G06N5/04—Inference or reasoning models
- G06N5/046—Forward inferencing; Production systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/08—Payment architectures
- G06Q20/10—Payment architectures specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
- G06Q20/102—Bill distribution or payments
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/08—Payment architectures
- G06Q20/20—Point-of-sale [POS] network systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/22—Payment schemes or models
- G06Q20/24—Credit schemes, i.e. "pay after"
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
- G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
- G06Q20/322—Aspects of commerce using mobile devices [M-devices]
- G06Q20/3224—Transactions dependent on location of M-devices
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
- G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
- G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/407—Cancellation of a transaction
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/409—Device specific authentication in transaction processing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
- G06Q30/0207—Discounts or incentives, e.g. coupons or rebates
- G06Q30/0225—Avoiding frauds
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V30/00—Character recognition; Recognising digital ink; Document-oriented image-based pattern recognition
- G06V30/10—Character recognition
- G06V30/19—Recognition using electronic means
- G06V30/192—Recognition using electronic means using simultaneous comparisons or correlations of the image signals with a plurality of references
- G06V30/194—References adjustable by an adaptive method, e.g. learning
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V30/00—Character recognition; Recognising digital ink; Document-oriented image-based pattern recognition
- G06V30/40—Document-oriented image-based pattern recognition
- G06V30/41—Analysis of document content
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N5/00—Computing arrangements using knowledge-based models
- G06N5/01—Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N7/00—Computing arrangements based on specific mathematical models
- G06N7/01—Probabilistic graphical models, e.g. probabilistic networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
- G06Q30/0241—Advertisements
- G06Q30/0248—Avoiding fraud
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/56—Financial cryptography, e.g. electronic payment or e-cash
Definitions
- the present disclosure generally relates to financial fraud and, more specifically, to processing techniques that use machine learning to identify application-related to fraud (e.g., fraudulent online applications).
- Financial fraud in its many forms, is a problem of enormous magnitude and scope, causing billions of dollars in economic losses and impacting many millions of people.
- Types of financial fraud include use of a lost or stolen card, account takeover, skimming, chargeback (“friendly”) fraud, counterfeiting, forgeries and application (e.g., loan application) fraud, to name just a few.
- friendly chargeback
- counterfeiting forgeries
- application e.g., loan application
- application fraud e.g., obtaining a loan in the name of another person
- any losses might not be fully recoverable.
- the present embodiments may, inter alia, automatically detect application fraud.
- the detection may be based upon various types of information, and the rules used to detect such scenarios may be generated by a machine learning program.
- a computer-implemented method of using browsing activity to identify fraudulent online or virtual applications includes: (1) receiving, by one or more processors and via one or more transceivers, a virtual application over one or more radio frequency links; (2) determining, by the one or more processors, an applicant name on the virtual application; (3) determining, by the one or more processors, an IP address of a source computer from which the virtual application originated; (4) determining, by the one or more processors, an online browsing or search history associated with the IP address; (5) determining, by the one or more processors, whether the online browsing or search history indicates recent Internet searches for the applicant name; and/or (6) in response to determining that the online browsing or search history does indicate recent Internet searches for the applicant name, (i) flagging, by the one or more processors, the virtual application as fraudulent and (ii) generating an electronic alert indicating that the virtual application is fraudulent to facilitate identifying fraudulent virtual applications for goods or services.
- the method may include additional, less, or alternate actions, including those discussed elsewhere herein.
- a computer system is configured to use IP addresses and browsing activity to identify fraudulent virtual applications.
- the computer system includes one or more transceivers, and one or more processors configured to: (1) receive, via the one or more transceivers, a virtual application over one or more radio frequency links; (2) determine an applicant name on the virtual application; (3) determine an IP address of a source computer from which the virtual application originated; (4) determine an online browsing or search history associated with the IP address; (5) determine whether the online browsing or search history indicates recent Internet searches for the applicant name; and/or (6) in response to determining that the online browsing or search history does indicate recent Internet searches for the applicant name, (i) flag the virtual application as fraudulent and (ii) generate an electronic alert indicating that the virtual application is fraudulent to facilitate identifying fraudulent virtual applications for goods or services.
- the computer system may include additional, less, or alternate functionality, including that discussed elsewhere herein.
- a non-transitory, computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to: (1) receive, via one or more transceivers, a virtual application over one or more radio frequency links; (2) determine an applicant name on the virtual application; (3) determine an IP address of a source computer from which the virtual application originated; (4) determine an online browsing or search history associated with the IP address; (5) determine whether the online browsing or search history indicates recent Internet searches for the applicant name; and/or (6) in response to determining that the online browsing or search history does indicate recent Internet searches for the applicant name, (i) flag the virtual application as fraudulent and (ii) generate an electronic alert indicating that the virtual application is fraudulent to facilitate identifying fraudulent virtual applications for goods or services.
- FIG. 1 depicts an exemplary environment in which techniques for fraud detection, verification and/or classification may be implemented, according to one embodiment.
- FIG. 2 depicts an exemplary process flow for machine learning of fraud detection, verification and/or classification rules, according to one embodiment.
- FIGS. 3 A- 3 F depict exemplary process flows for machine learning of particular types of fraud detection, verification and/or classification rules, according to different embodiments.
- FIGS. 4 A- 4 F depict exemplary factors and algorithms that may be used in connection with various fraud detection, verification and/or classification rule sets, according to different embodiments.
- FIG. 5 depicts a flow diagram of an exemplary method for identifying a potential chargeback scenario, according to one embodiment.
- FIG. 6 illustrates an exemplary computer-implemented method of determining that a merchant computer terminal warrants a chargeback after a consumer dispute or fraudulent transaction occurs based upon dispute rules.
- FIG. 7 illustrates an exemplary computer-implemented method of detecting or identifying potentially compromised merchant computing systems based upon processor analysis of electronically-generated chargebacks or actual losses.
- FIG. 8 illustrates an exemplary computer-implemented method of detecting or determining potentially compromised merchant computing systems based upon processor analysis of electronically-generated fraud alerts.
- FIG. 9 depicts a flow diagram of an exemplary method for detecting potential application fraud, according to one embodiment.
- FIG. 10 illustrates an exemplary computer-implemented method of using IP address and/or browsing activity to identify fraudulent online or virtual applications, according to one embodiment.
- FIG. 11 illustrates an exemplary computer-implemented method of detecting or identifying potential mortgage fraud.
- FIG. 12 depicts an exemplary computer system in which the techniques described herein may be implemented, according to one embodiment.
- detecting” or “determining” fraud may be used herein to refer to initially flagging fraudulent (or potentially fraudulent) activity, to verifying/confirming that suspect/flagged activity was indeed fraudulent, or generally to both.
- the systems and techniques described herein may be used, for example, to identify, prevent and/or quantify/measure instances of lost or stolen card use, account takeover, counterfeiting, skimming, chargeback (“friendly”) fraud, collusive merchant fraud, application (e.g., loan application) fraud, mortgage fraud, and/or one or more other types of fraud relating to existing and/or potential financial transactions and/or accounts.
- application e.g., loan application
- a fraud detection and/or classification system may analyze data relating to a number of existing or potential financial accounts.
- the analysis/processing may be performed in batch processing operations, or substantially in real-time (e.g., as the data is generated and/or as financial transactions occur, etc.), and the data may be obtained from a variety of sources based upon the particular embodiment and/or scenario.
- data from financial account records may be analyzed, along with data indicating online activity of an account holder, location data (e.g., global positioning satellite (GPS) data from a smartphone or vehicle of the account holder) and/or other data, to determine whether a particular financial transaction was fraudulent or likely fraudulent.
- the analysis may be performed automatically after the transaction has been made, or may be performed in response to a person or algorithm flagging the transaction as a potentially fraudulent one, for example.
- GPS global positioning satellite
- the analysis may include determining whether the account holder has expressed interest in the object (e.g., product or service) of the transaction or the merchant, and/or determining whether the transaction is consistent with spending patterns associated with the account holder (e.g., spending patterns identified using the account holder's transaction records), for example.
- the account holder e.g. multiple credit or debit card holders
- accuracy may be improved by identifying spending patterns at the individual level rather than, or in addition to, at the aggregate account level.
- a maximum amount of money typically spent in a single transaction may be determined for each of two cardholders listed on a single account, and the maximum amount for the cardholder who purportedly made a particular purchase may be compared to the purchase amount to determine whether fraud is suspected.
- financial transaction data may be analyzed to determine whether a chargeback payment from the merchant or acquiring bank to a card issuer may be appropriate in connection with a particular fraudulent transaction.
- the card information entry mode e.g., collecting card information by inserting the card in a chip reader, swiping the card, manually entering the card information, etc.
- the transaction amount, the similarity to other transaction(s), and/or other information may be used to identify which fraudulent transactions are relatively strong chargeback candidates.
- the analysis may be performed in response to a cardholder reporting the transaction as fraudulent, or after a card issuer has confirmed that the transaction was fraudulent, for example.
- a full set of chargeback rules may be manually or automatically applied to determine whether a chargeback process should be initiated (or continued).
- application data (e.g., information entered in fields of an online application) may be analyzed in conjunction with search terms entered by a user at a computing device (e.g., the device from which the user submitted the application information) to determine whether the person proffering the application is not the person that he or she purports to be. For example, if the person submitting an application had previously used an Internet-based search engine to search for results associated with the purported applicant's name (e.g., by using the name as a search term, possibly in addition to other terms such as “address” and/or “employer,” etc.), the application may be flagged for suspected fraud, and subjected to additional steps of manual and/or automated review.
- a fraud dispute resolution process (e.g., after a customer has reported a fraudulent or unrecognized transaction associated with his or her account) may be facilitated using machine learning techniques.
- a machine learning program may be trained, using past dispute resolution interactions with customers and the associated outcomes (fraud determinations), to identify various types of information that, if elicited from customers, tend to be indicative of fraud or the absence thereof.
- one or more queries for the individual purportedly making the transaction may be automatically generated using the types of information identified by the machine learning program, as well as information about the suspect transaction and/or related transactions (e.g., dates, locations, amounts, etc.).
- responses to the queries may be collected and analyzed to automatically generate additional queries, with the end goal of discerning whether the transaction was authorized.
- queries may include asking whether a cardholder recalls particular other transactions that appear on the cardholder's account and were made around the same time as the suspect transaction (and/or from the same merchant), asking whether the cardholder recalls being in a particular location at a particular time (e.g., a location associated with another transaction appearing on the cardholder's account), whether the cardholder is aware of a particular billing alias used by a merchant, and so on.
- image data corresponding to a particular physical document may be analyzed, using rules generated by a machine learning program, to determine whether the document is, or may be, fraudulent (e.g., a counterfeit document, and/or a document that includes forged contents).
- a machine learning program may be trained using images of multiple other documents, and fraud determinations made in connection with those other documents.
- the machine learning program may learn which ranges and/or tolerances for dimensions, fonts, colors, patterns, etc., tend to be most indicative of counterfeiting, for example.
- a forgery may be detected based upon factors relating to the contents of various fields in a document, such as whether handwriting, a signature, and/or a date format (e.g., “Jan. 1, 2016,” “1/1/16,” etc.) matches that used for other personal checks from a particular account holder, for example.
- the fraud determination may be made substantially in real-time to provide a warning, if needed, to a merchant making a sale, for example, or may be used to flag a relatively small number of documents for physical review at a later time, etc.
- machine learning techniques may be used to analyze financial transactions for purposes of classifying potentially fraudulent behavior (e.g., “counterfeiting,” “skimming,” “lost or stolen card,” etc.).
- the machine learning program may be trained using fraud classifications made in connection with multiple other financial accounts.
- the machine learning program may learn which types of data tend to be indicative of different classifications (e.g., transaction amount, credit card information entry mode, particular types of online activity data, etc.), and/or which data values tend to be indicative of different classifications (e.g., transactions over $10,000, manual card number entry, etc.), for example.
- the classification may be used to facilitate or guide a further, more in-depth analysis or investigation.
- the classification may be used to calculate one or more metrics indicating the prevalence of that type of fraud.
- problems that have beset the field of fraud detection, classification and/or prevention in the past may be greatly mitigated or eliminated.
- information that has conventionally been overlooked or ignored may be used to more accurately detect, prevent and/or classify fraud, and/or to reduce false positive fraud alerts.
- a significant amount of time may be saved by removing the need for manual investigations, or by reducing the number of instances where manual investigations are required.
- FIG. 1 depicts an exemplary environment 10 in which techniques for fraud detection and/or classification may be implemented, according to one embodiment.
- the environment 10 may include an anti-fraud services system (AFSS) 12 , a financial account management system (FAMS) 14 , a card network computing system 16 , a number of cardholder computing devices 20 , a number of merchant computing systems 22 , a number of other sources 24 , and a network 26 .
- AFSS anti-fraud services system
- FAMS financial account management system
- the environment 10 may include one or more additional financial account management systems and/or card network computing systems, and/or one or more of the cardholder computing devices 20 may instead be a computing device of a holder of a non-card account (e.g., a checking, savings or loan account) or an applicant for a new account (e.g., a new loan account).
- the environment 10 may include a computing system of one or more acquiring/merchant banks, and some or all of the communications with merchant computing systems 22 described below may instead be with the acquiring bank(s).
- FAMS 14 may be associated with (e.g., owned and/or maintained by) a bank or other financial entity.
- FAMS 14 may be a bank that acts as a card issuer associated with a particular type of card network (e.g., VISA®, Mastercard®, etc.), and/or an entity that provides loans (e.g., mortgage, home equity, vehicle, etc.), saving/checking account services, and/or other financial services to customers.
- FAMS 14 may maintain an account records database 30 that stores various kinds of account information, including account holder information (e.g., names, addresses, etc.) and data indicative of financial transactions made in connection with each account (e.g., dates, amounts and merchants for credit or debit card transactions, dates and amounts for customer deposits and withdrawals, etc.).
- account records database 30 may store account information for some or all of the cardholders associated with cardholder computing devices 20 , for example. While shown in FIG. 1 as a single entity within FAMS 14 , it is understood that account records database 30 may, in some embodiments, be distributed across multiple databases and/or multiple physical/hardware memories, and/or may be wholly or partially external to (e.g., remote from) FAMS 14 .
- AFSS 12 may generally provide services that help to detect and/or classify fraudulent activity in connection with existing and/or potential (e.g., applied for) financial accounts, such as the accounts managed by FAMS 14 .
- AFSS 12 is included within FAMS 14 .
- AFSS 12 may include a network interface 32 , a memory 34 , and a fraud detection/classification unit 36 .
- Network interface 32 may include hardware, firmware and/or software configured to enable AFSS 12 to wirelessly exchange electronic data with one or more other components of environment 10 via network 26 .
- network interface 32 may include an Ethernet port, a modem, a router, and/or one or more other ports and/or transceivers for one or more other wired and/or wireless communication technologies.
- Memory 34 may be a computer-readable, non-transitory storage unit or device, or collection of units/devices, and may include persistent (e.g., hard disk) and/or non-persistent memory components. Memory 34 may store instructions that are executable on one or more processors of AFSS 12 (not shown in FIG. 1 ) to perform various operations, including the instructions of various software applications and data generated and/or used by such applications.
- Card network computing system 16 may be a computing system (e.g., one or more servers) of a credit and/or debit card network entity, such as VISA® or Mastercard®, for example. In some embodiments and/or scenarios where the card network entity also acts as the issuer (e.g., American Express® or Discover®), card network computing system 16 may include FAMS 14 . Card network computing system 16 may provide various services to FAMS 14 and/or AFSS 12 . For example, card network computing system 16 may provide electronic updates to chargeback rules, fraud scores for particular customers and/or transactions, and so on.
- Each of cardholder computing devices 20 may be a computing device of a respective holder of a credit or debit card account managed by FAMS 14 .
- one or more of cardholder computing devices 20 may be desktop computers, laptop computers, tablet computers, smartphones, smart watches, and so on.
- the cardholders e.g., credit or debit card account holders
- cardholder computing devices 20 may instead be computing devices of other types of customers or potential customers, such as holders of non-card-based accounts, or individuals who have submitted an online application for a loan, etc., as discussed further below.
- the environment 10 may omit card network computing system 16 .
- Each of merchant computing systems 22 may include one or more computing devices associated with a particular provider of products and/or services.
- some or all of merchant computing systems 22 may include servers associated with online retailers.
- some or all of merchant computing systems 22 may include point-of-sale terminal devices providing credit and/or debit card payment processing features for “card present” transactions.
- AFSS 12 detects and/or classifies activity not related to customer purchases (e.g., if AFSS 12 only detects loan application fraud, etc.)
- the environment 10 may omit merchant computing systems 22 .
- the other sources 24 may include computing devices and/or systems associated with sources of one or more other types of information.
- other sources 24 may include vehicle telematics systems (e.g., installed in vehicles of cardholders associated with cardholder computing devices 20 ), one or more Internet service providers (ISPs) (e.g., ISPs providing Internet access to some or all cardholders), “smart home” system devices (e.g., installed in homes of some or all cardholders), and/or other systems/devices.
- ISPs Internet service providers
- smart home system devices e.g., installed in homes of some or all cardholders
- the environment 10 does not include the other sources 24 .
- Network 26 may communicatively couple some or all of the components shown in FIG. 1 .
- FAMS 14 may use network 26 to communicate with AFSS 12 , card network computing system 16 , cardholder computing devices 20 and/or merchant computing systems 22 .
- AFSS 12 may use network 26 to communicate with FAMS 14 , card network computing system 16 , cardholder computing devices 20 , merchant computing systems 22 and/or one or more of the other sources 24 .
- network 26 may include multiple communication networks of one or more types (e.g., one or more wired and/or wireless local area networks (LANs), and/or one or more wired and/or wireless wide area networks (WANs) such as the Internet).
- LANs local area networks
- WANs wide area networks
- network 26 may use partially or entirely distinct network components to support communications between different endpoints or computing devices, such as wireless communication or data transmission over one or more radio frequency links and/or wireless communication channels.
- the portion(s) of network 26 used for communications between FAMS 14 and AFSS 12 may be the same as, or different than, the portion(s) of network 26 used for communications between FAMS 14 and one or more of cardholder computing devices 20 over one or more radio links or wireless communication channels, or between AFSS 12 and one or more of the other sources 24 , etc.
- Those skilled in the art will appreciate different types of networks that are appropriate for network 26 , depending upon, for example, how AFSS 12 , FAMS 14 and/or other components of environment 10 are localized or distributed across a relatively large geographic area.
- fraud detection/classification unit 36 of AFSS 12 may detect fraudulent activity, confirm whether suspected or reported fraudulent activity is truly fraudulent, and/or classify fraudulent or suspected fraudulent activity. For example, fraud detection/classification unit 36 may analyze each transaction stored in account records database 30 to determine whether that transaction is, or potentially is, fraudulent. Alternatively, fraud detection/classification unit 36 may analyze only those transactions that were flagged as possibly being fraudulent (e.g., by a cardholder calling in to report an unauthorized and/or unrecognized transaction, or by FAMS 14 or AFSS 12 generating a preliminary fraud alert after applying an initial set of rules to a transaction, etc.). Fraud detection/classification unit 36 may also, or instead, support additional functionality, such as that described below in connection with the various components of fraud detection/classification unit 36 shown in FIG. 1 .
- fraud detection/classification unit 36 may include a machine learning (ML) rule generator 40 , an external data collection unit 42 , a behavior analysis unit 44 , a dispute resolution unit 46 , a chargeback analysis unit 50 , an image analysis unit 52 , a classification unit 54 , and/or a notification unit 56 .
- fraud detection/classification unit 36 may include more, fewer and/or different components/units than those shown in FIG. 1 .
- each of ML rule generator 40 , external data collection unit 42 , behavior analysis unit 44 , dispute resolution unit 46 , chargeback analysis unit 50 , image analysis unit 52 , classification unit 54 , notification unit 56 , and/or other units or components of fraud detection/classification unit 36 may be a software component stored in memory 34 and implemented by one or more processors of one or more computing devices (e.g., servers) included in AFSS 12 .
- ML rule generator 40 may generally analyze various types of data to generate and/or update fraud detection and/or classification rules to be applied by fraud detection/classification unit 36 and stored in an ML rules database 58 . As discussed in further detail below, the rules may be used to detect and/or classify a single type or category of fraudulent activity, or may be used broadly in connection with multiple types or categories of fraudulent activity.
- ML rule generator 40 may implement any suitable type or types of machine learning. For example, ML rule generator 40 may implement supervised learning techniques, such as decision trees, regression-based models, support vector machines (SVMs) and/or neural networks, and/or unsupervised learning techniques such as Dirichlet process mixture models and/or k-means clustering.
- SVMs support vector machines
- ML rules database 58 may, in some embodiments, be distributed across multiple databases and/or multiple physical/hardware memories, and/or may be wholly or partially external to (e.g., remote from) AFSS 12 .
- External data collection unit 42 may generally collect, via network interface 32 and/or from sources internal to AFSS 12 , information from various sources (e.g., FAMS 14 , cardholder computing devices 20 , other sources 24 , etc.), and provide that data to other portions of AFSS 12 as needed (e.g., to ML rule generator 40 to generate and/or update rules, and/or to behavior analysis unit 44 , dispute resolution unit 46 , chargeback analysis unit 50 , image analysis unit 52 and/or classification unit 54 to detect and/or classify fraudulent activity). Some data may be collected indirectly. For example, FAMS 14 may collect transaction data from merchant computing systems 22 (and/or from acquiring banks associated with one or more of merchant computing systems 22 ), and external data collection unit 42 may then collect that data from the account records database 30 of FAMS 14 .
- sources e.g., FAMS 14 , cardholder computing devices 20 , other sources 24 , etc.
- Some data may be collected indirectly.
- FAMS 14 may collect transaction data from merchant computing systems 22 (and/or from
- ML rules database 58 Once an initial set of rules has been generated and stored in ML rules database 58 , those rules may dictate some or all of the types of data gathered by external data collection unit 42 . In some embodiments, however, external data collection unit 42 collects a broad set of data types that may or may not be relevant to fraud determination or classification, and ML rule generator 40 continually analyzes that data to determine which data types are most predictive of fraud and/or fraud type/class.
- Behavior analysis unit 44 may generally analyze cardholder-related (or other customer-related) information to identify patterns of behavior, which may then be used by fraud detection/classification unit 36 to detect and/or classify fraudulent activity. For example, behavior analysis unit 44 may analyze information obtained from account records database 30 to identify spending patterns associated with different cardholders. The operation of behavior analysis unit 44 , including the types of information analyzed and the ways in which that information is used to arrive at a result (e.g., a pattern of behavior), may be dictated by the rules stored in ML rules database 58 .
- Data indicative of the behavior patterns identified by behavior analysis unit 44 may be stored in an account holder behaviors database 60 , for example. While shown in FIG. 1 as a single entity within AFSS 12 , it is understood that account holder behaviors database 60 may, in some embodiments, be distributed across multiple databases and/or multiple physical/hardware memories, and/or may be wholly or partially external to (e.g., remote from) AFSS 12 . In one embodiment, for example, account holder behaviors database 60 may be included within account records database 30 .
- the environment 10 may not include account holder behaviors database 60 , and behavior patterns may be only identified by behavior analysis unit 44 “on the fly” as needed by fraud detection/classification unit 36 (e.g., when needed to analyze a transaction in view of past spending patterns of a particular cardholder, etc.).
- behavior analysis unit 44 may separately analyze the transactions associated with each account holder, even if more than one account holder exists for a particular account. For example, behavior analysis unit 44 may independently analyze the transactions of each cardholder for a credit or debit card account in which each spouse has been issued a credit or debit card in his or her name. Fraud detection/classification unit 36 may then utilize the individual spending patterns when detecting and/or classifying fraud. In one embodiment where fraud detection/classification unit 36 utilizes a dollar amount threshold to detect likely fraudulent transactions, for example, a first threshold may be used for transactions made by a first cardholder listed on an account, and a higher, second threshold may be used for transactions made by a second cardholder listed on the account. Further examples are provided below in connection with FIG.
- fraud detection and/or classification may be made more precise than would be the case if spending patterns were only identified at the aggregate level (e.g., using a single dollar amount threshold, regardless of which cardholder made a particular transaction).
- Dispute resolution unit 46 may generally analyze financial transaction data and/or other information to automatically generate queries for cardholders or other customers. For example, dispute resolution unit 46 may analyze information obtained from account records database 30 . The generated queries may be designed to help fraud detection/classification unit 36 determine whether a particular transaction was fraudulent, or estimate a probability that the transaction was fraudulent, etc. Dispute resolution unit 46 may also process responses from cardholders/customers, and automatically generate additional queries based upon those responses. Examples of the operation of dispute resolution unit 46 are provided below in connection with FIGS. 4 E and 9 , according to various embodiments.
- Chargeback analysis unit 50 may generally analyze financial transaction and/or other information to identify transactions that are good candidates for chargeback payments. For example, chargeback analysis unit 50 may analyze information obtained from account records database 30 to determine whether there is a relatively high probability that the merchant (or an acquiring bank) should be responsible for a chargeback payment to a card issuer associated with FRMS 14 . The operation of chargeback analysis unit 50 , including the types of information analyzed and the ways in which that information is used to arrive at a result (e.g., flagging a transaction as a chargeback candidate), may be dictated by the rules stored in ML rules database 58 .
- ML rule generator 40 may make use of chargeback rules obtained from a card network entity (e.g., from card network computing system 16 ), and stored in chargeback rules database 62 , to generate and/or update the rules applied by chargeback analysis unit 50 . Examples of the operation of chargeback analysis unit 50 are provided below in connection with FIGS. 4 B and 7 , according to various embodiments.
- transactions flagged by chargeback analysis unit 50 are subject to further, manual review using the chargeback rules stored in chargeback rules database 62 .
- chargeback analysis unit 50 (or another component of fraud detection/classification unit not shown in FIG. 1 ) automatically, with little or no manual input/assistance, applies the chargeback rules from chargeback rules database 62 for each flagged transaction. While shown in FIG. 1 as a single entity within AFSS 12 , it is understood that chargeback rules database 62 may, in some embodiments, be distributed across multiple databases and/or multiple physical/hardware memories, and/or may be wholly or partially external to (e.g., remote from) AFSS 12 .
- Image analysis unit 52 may generally analyze image data corresponding to physical documents to identify fraudulent (e.g., counterfeit and/or forged) documents, and/or to flag potentially fraudulent documents for further (e.g., manual) review. For example, image analysis unit 52 may analyze information obtained from merchant computing systems 22 to determine whether there is a relatively high probability that documents presented to the merchants (e.g., personal checks, identification cards, etc.) are fraudulent. Image analysis unit 52 may be configured to analyze only a single type of document, or multiple types of documents. The operation of image analysis unit 52 , including the image characteristics analyzed and the ways in which the characteristics may be used to arrive at a result (e.g., flagging a document as potentially fraudulent), may be dictated by the rules stored in ML rules database 58 . Examples of the operation of image analysis unit 52 are provided below in connection with FIGS. 4 F and 10 , according to various embodiments.
- Classification unit 54 may generally analyze broad categories of data from various sources (e.g., account records database 30 , cardholder computing devices 20 , merchant computing systems 22 , and/or other sources 24 ) to categorize/classify types of suspected fraudulent financial activity. Classification unit 54 may classify fraudulent activity only within a particular subset of fraudulent financial activity (e.g., classifying debit and/or credit card transactions as involving a potential case of counterfeiting, skimming, lost/stolen card use, chargeback fraud, etc.), or may classify fraudulent financial activity across a broader spectrum (e.g., including types of identity theft not necessarily tied to a single financial transaction, such as application fraud).
- sources e.g., account records database 30 , cardholder computing devices 20 , merchant computing systems 22 , and/or other sources 24 .
- Classification unit 54 may classify fraudulent activity only within a particular subset of fraudulent financial activity (e.g., classifying debit and/or credit card transactions as involving a potential case of counterfeiting, skimming,
- classification unit 54 classifies suspected fraudulent activity in connection with a particular account or transaction in response to being notified of suspect activity (e.g., notified by another component of fraud detection/classification unit 36 , or by a manual user input, etc.). In other embodiments, classification unit 54 itself (or another component of fraud detection/classification unit 36 ) identifies suspect activity before classification unit 54 classifies that activity. Examples of the operation of classification unit 54 are provided below in connection with FIGS. 4 C and 11 , according to various embodiments.
- Notification unit 56 may generally provide alerts, confirmations, and/or other notifications to various individuals (e.g., customers, bank employees associated with FAMS 14 , third party employees associated with AFSS 12 , etc.). For example, notification unit 56 may generate a notification message stating that a fraud alert associated with a particular transaction is a false positive, and cause network interface 32 to send the message to a computer terminal or to FAMS 14 for display to a system user. As another example, notification unit 56 may cause network interface 32 to send other flagged transactions and/or documents (e.g., chargeback candidates identified by chargeback analysis unit 50 , documents that image analysis unit 52 has identified as potentially fraudulent, etc.) to a computer terminal or FAMS 14 for display to a system user. As yet another example, notification unit 56 may cause network interface 32 to send queries generated by dispute resolution unit 46 to various ones of cardholder computing devices 20 for display to cardholders.
- individuals e.g., customers, bank employees associated with FAMS 14 , third party employees associated with AFSS 12 , etc.
- ML rule generator 40 may generate and/or update rules that are used for one or more of a variety of different purposes relating to fraud detection and/or classification.
- FIG. 2 depicts one generalized, example process flow 80 for machine learning that may be implemented by ML rule generator 40 , and possibly one or more other components of fraud detection/classification unit 36 .
- multi-account data 82 may represent data associated with multiple financial accounts, each with one or more account holders.
- the financial accounts may be existing or potential accounts, and the account holders may include holders of accounts and/or potential holders of potential accounts.
- the multi-account data 82 may include existing and/or applied-for credit card accounts, debit card accounts, savings accounts, checking accounts, investment accounts, loan accounts, etc.
- the multi-account data 82 may include one or more different types of information obtained (e.g., by external data collection unit 42 of FIG. 1 ) from one or more of FAMS 14 , cardholder computing devices 20 , merchant computing systems 22 , and/or other sources 24 .
- the multi-account data 82 may include transaction data (e.g., transaction dates, amounts, locations, etc.) from account records database 30 of FAMS 14 , data indicative of Internet Protocol (IP) addresses of cardholder computing devices 20 and/or devices in merchant computing systems 22 , Internet browsing and/or search history data from cardholder computing devices 20 (or from an ISP computer system included in other sources 24 , etc.), vehicle telematics data from telematics systems of cardholder vehicles, home occupancy and/or usage data (e.g., smart appliance data) from smart home systems of cardholders, autonomous or smart vehicle data, vehicle navigation system data, mobile device data, mobile device and/or vehicle GPS data, and/or one or more other types of data.
- transaction data e.g., transaction dates, amounts, locations, etc.
- IP Internet Protocol
- ISP computer system included in other sources 24 e.g., etc.
- vehicle telematics data from telematics systems of cardholder vehicles
- home occupancy and/or usage data e.g., smart appliance
- the multi-account data 82 only includes data that account holders or potential account holders have expressly consented to share with an entity associated with FAMS 14 and/or AFSS 12 (e.g., in exchange for fraud protection services). In certain other embodiments, however, express consent is only needed for certain types of information, such as browsing history information, vehicle telematics data, etc.
- the multi-account data 82 may be associated with multiple fraud determination labels.
- the labels may simply reflect whether or not fraud existed (e.g., “fraud” or “no fraud”), or may also indicate a type or class of fraud (e.g., “counterfeiting,” “lost or stolen card use,” etc.), for example.
- each of a number of data sets in the multi-account data 82 is associated with such a label, and includes data relating to a particular financial transaction, financial account, loan application, etc., for which the fraud determination was made (e.g., after a manual and/or automated fraud investigation).
- the labels may include final fraud determinations that were made via earlier iterations of the process flow 80 , and/or external to the process flow 80 .
- a first data set associated with a “card present” credit card transaction may include data describing that transaction (e.g., from account records database 30 ) and data indicative of the cardholder's online browsing activity (e.g., from one of cardholder computing devices 20 ) for the 15 days immediately preceding the transaction, and be labeled “confirmed fraud.”
- a second data set, associated with another “card present” transaction may include the same general types of data but be labeled “no fraud,” and so on.
- the same data may appear in, or be used by, two or more of the data sets. If the two “card present” transactions described above are both associated with the same account, for example, and if the second transaction occurred less than 15 days after the first transaction, some of the same online activity data may be shared by the first and second data sets.
- the multi-account data 82 may be analyzed to generate fraud detection and/or classification rules (e.g., to be stored in ML rules database 58 ). Any suitable type of supervised machine learning program/technique(s) may be used, such as SVMs, neural networks, logistic regression, etc.
- process stage 84 may serve to identify which type(s) of data is/are probative of whether fraud has occurred (and/or the type/category of fraud that may have occurred), and to determine the data values and/or combinations that are probative of whether fraud has occurred (and/or the type/category of fraud that may have occurred).
- process stage 84 may learn that certain spending patterns within a threshold time of a transaction tend to indicate that the cardholder made the transaction (e.g., thereby indicating that fraud has not occurred, or that a fraud report is itself fraudulent or mistaken, etc.), that certain types of online searches by a cardholder (e.g., including a descriptor of a product purchased in the transaction, or a name of the merchant, etc.) tend to indicate that the cardholder made the transaction, that the cardholder's distance from the site of a “card present” transaction (e.g., as determined from GPS information provided by the cardholder's smartphone, wearable electronics, or vehicle) relates to the probability of fraudulent activity according to a particular equation, and so on.
- Other specific examples of such rules, and how those rules may be generated, are discussed below in connection with FIGS. 3 A- 3 F and 4 A- 4 F , according to various
- the rules generated or updated at process stage 84 may be applied to first account data 90 associated with a particular account and customer(s) (e.g., a customer associated with a particular one of computing devices 20 ).
- the types of data included in first account data 90 may depend upon which types of data were determined, by process stage 84 , to be relevant to a fraud determination.
- the first account data 90 may include the amount and date of one or more transactions, as well as data indicative of visited web sites (e.g., Uniform Resource Locators (URLs) and/or content of visited websites, etc.).
- the first account data 90 may include information obtained (e.g., by external data collection unit 42 ) from one or more of FAMS 14 , one of cardholder computing devices 20 associated with the customer holding the first account, one or more of merchant computing systems 22 , and/or one or more of other sources 24 , for example.
- Process stage 86 may output various different types of information, depending upon the embodiment and/or scenario. For example, depending upon the content of first account data 90 and the rules generated or updated at process stage 84 , process stage 86 may generate data indicating that a particular financial transaction associated with first account data 90 is, or is not, fraudulent or potentially fraudulent. Alternatively, or additionally, process stage 86 may generate data indicating a particular classification for fraudulent or suspected fraudulent activity (e.g., a fraudulent transaction) associated with first account data 90 .
- a particular classification for fraudulent or suspected fraudulent activity e.g., a fraudulent transaction
- further analysis may be performed at an additional stage, shown in dashed lines in FIG. 2 as process stage 92 .
- the additional analysis may then be used to make a final fraud determination (e.g., a final decision on whether fraud occurred, and/or on the type of fraud that occurred) at process stage 94 .
- process stage 92 is omitted from process flow 80 , and process stage 94 merely represents the output of process stage 86 .
- the final determination made at process stage 94 along with the first account data 90 used to make that determination, may be fed back into process stage 84 to provide additional labeled data for purposes of updating the rules.
- the process flow 80 includes more, fewer and/or different stages, such as any of those discussed elsewhere herein (e.g., in connection with FIGS. 3 A- 3 F ).
- process stages 84 and 86 may be combined.
- the multi-account data 82 may be unlabeled rather than labeled (or the labels may be ignored), and the combined process stage 84 , 86 may use unsupervised learning techniques (e.g., clustering techniques) to classify anomalous/outlier financial transactions, accounts, applications, etc., as “suspect” and needing further analysis.
- unsupervised learning techniques e.g., clustering techniques
- FIGS. 3 A- 3 F generally correspond to embodiments in which supervised machine learning techniques are used, other embodiments may instead use unsupervised machine learning techniques, as noted above.
- fraud detection/classification unit 36 may be configured to implement only one of the process flows of FIGS. 3 A- 3 F , or may be configured to implement two or more (e.g., all) of the process flows shown in FIGS. 3 A- 3 F .
- an exemplary process flow 100 may generally be used to detect fraud using customer online activity data.
- multi-customer online activity data 102 may represent data associated with the online activities of a number (e.g., thousands) of customers (e.g., credit or debit cardholders, checking or saving account holders, etc.).
- the multi-customer online activity data 102 may include data indicating actions that the customers took, and/or web sites visited by the customers, while the customers were connected to the Internet via web browsers (e.g., executing on respective ones of cardholder computing devices 20 ).
- the multi-customer online activity data 102 may include URLs of, and/or content (e.g., text) within, web sites visited by customers, search terms entered by customers using search engine tools, search results presented to customers by search engine tools, indications of interactive controls (e.g., virtual buttons) selected by customers on various web pages, and so on.
- content e.g., text
- search engine tools e.g., search terms entered by customers using search engine tools
- search results presented to customers by search engine tools e.g., indications of interactive controls (e.g., virtual buttons) selected by customers on various web pages, and so on.
- the multi-customer online activity data 102 may include data obtained (e.g., by external data collection unit 42 of FIG. 1 ) from cardholder computing devices 20 , from one or more ISPs of other sources 24 , and/or from a third party aggregator of such information, for example.
- the multi-customer online activity data 102 may only include data that customers have expressly consented to share with an entity associated with FAMS 14 and/or AFSS 12 (e.g., in exchange for fraud protection services or other benefits, such as discounts).
- the multi-customer online account data 102 may be associated with multiple fraud determination labels.
- each label may be associated with a data set that includes not only the corresponding portion of multi-customer online activity data 102 , but also one or more other types of data, such as transaction data (e.g., transaction dates, amounts, locations, etc.) for each customer from account records database 30 of FAMS 14 , data indicative of IP addresses of cardholder computing devices 20 and/or devices in merchant computing systems 22 , Internet browsing and/or search history data from cardholder computing devices 20 (or from an ISP computer system included in other sources 24 , etc.), vehicle telematics data from telematics systems of other sources 24 , home occupancy and/or usage data (e.g., smart appliance data) from smart home systems of other sources 24 , and so on.
- transaction data e.g., transaction dates, amounts, locations, etc.
- data indicative of IP addresses of cardholder computing devices 20 and/or devices in merchant computing systems 22 e.g., Internet browsing and/or search history data from
- the labels may include final fraud determinations that were made via earlier iterations of the process flow 100 , and/or external to the process flow 100 .
- Multi-customer online account data 102 may include many (e.g., thousands) of positively and negatively labeled data sets.
- the multi-customer online activity data 102 may be analyzed to generate fraud detection rules (e.g., to be stored in ML rules database 58 ).
- fraud detection rules e.g., to be stored in ML rules database 58 .
- any suitable type of supervised machine learning program/technique(s) may be used.
- process stage 104 may serve to identify which type(s) of online activity data is/are probative of whether fraud has occurred, and to determine the data values and/or combinations that are probative of whether fraud has occurred.
- the fraud detection rules may not only detect fraud, but also classify fraud (e.g., as described below in connection with FIG. 3 C ), in some embodiments.
- the rules generated or updated at process stage 104 may be applied to first customer online activity data 110 .
- the first customer online activity data 110 may be associated with a particular customer, such as a customer associated with a particular one of computing devices 20 , for example.
- the types of data included in first customer online activity data 110 may depend upon which types of online activity data were determined, by process stage 104 , to be relevant to a fraud determination.
- the first customer online activity data 110 may include information obtained (e.g., by external data collection unit 42 ) from one of cardholder computing devices 20 (i.e., the device associated with the first customer), and/or from an ISP of other sources 24 .
- Process stage 106 may output various different types of information, depending upon the embodiment and/or scenario. For example, depending upon the content of first customer online activity data 110 and the rules, process stage 106 may generate data indicating that a particular financial transaction associated with the first customer is, or is not, fraudulent or potentially fraudulent. Alternatively, or additionally, process stage 106 may generate data indicating a particular classification of fraudulent or potentially fraudulent activity associated with first customer online activity data 110 .
- further analysis e.g., a manual review, or further automated review using additional data sources, etc.
- the additional analysis may then be used to make a final fraud determination (e.g., a final decision on whether fraud occurred, and/or on the type of fraud that occurred) at process stage 114 .
- process stage 112 is omitted from process flow 100 , and process stage 114 merely represents the output of process stage 106 .
- the final determination made at process stage 114 may be fed back into process stage 104 to provide additional labeled data for purposes of updating the rules.
- a preliminary fraud determination made at process stage 106 is also fed back into process stage 104 , to allow the machine learning program to determine and improve upon past performance/accuracy.
- an exemplary process flow 120 may generally be used to identify the financial transactions for which chargebacks (e.g., post-transaction payments from merchants, or acquiring/merchant banks, back to the issuer to return proceeds from transactions) are appropriate.
- chargebacks e.g., post-transaction payments from merchants, or acquiring/merchant banks, back to the issuer to return proceeds from transactions
- multi-account transaction data 122 may represent data associated with the financial transactions involving the accounts of a number (e.g., thousands) of credit or debit cardholders.
- the multi-account transaction data 122 may include information such as transaction dates, transaction amounts, merchant names (and/or aliases) associated with the transaction, information relating to how the card information was collected by the merchant (e.g., by swiping, an EMV chip reader, manual entry of the card number, etc.), geographic locations of “card present” transactions, and so on.
- the multi-account transaction data 122 may include data obtained (e.g., by external data collection unit 42 of FIG. 1 ) from merchant computing systems 22 and/or from acquiring/merchant banks associated with those merchants, for example.
- the multi-account transaction data 122 may be associated with multiple chargeback outcome labels.
- each label may be associated with a data set that includes the corresponding portion of multi-account transaction data 122 .
- the outcome labels may include final chargeback determinations that were made (in connection with the transactions represented in multi-account transaction data 122 ) via earlier iterations of the process flow 120 , and/or external to the process flow 120 .
- Multi-account transaction data 122 may include many (e.g., thousands) of positively and negatively labeled data sets.
- the multi-account transaction data 122 may be analyzed to generate chargeback candidate detection rules (e.g., to be stored in ML rules database 58 ).
- chargeback candidate detection rules e.g., to be stored in ML rules database 58 .
- any suitable type of supervised machine learning program/technique(s) may be used.
- process stage 124 may serve to identify which type(s) of transaction data is/are probative of whether, under the full chargeback rules of the card network entity, a chargeback is appropriate for a given transaction.
- Process stage 124 may also determine the transaction data values and/or combinations that are probative of whether a chargeback is appropriate for the transaction.
- the rules generated or updated at process stage 124 may be applied to first account transaction data 130 to determine whether a transaction associated with the first account is a “good” chargeback candidate.
- process stage 126 may, instead of applying the full chargeback rules of the card network entity (which may be quite lengthy and complex) to the facts surrounding the transaction, use various factors and algorithms developed at process stage 124 to determine whether there exists a relatively high probability that a chargeback would be appropriate for the transaction if the full chargeback rules were applied.
- the process stage 126 may calculate a percentage probability that the transaction is one in which a chargeback is appropriate, for example.
- the first account transaction data 130 may be associated with the account of a particular cardholder or cardholders, such as a cardholder associated with a particular one of cardholder computing devices 20 , for example.
- the types of data included in first account transaction data 130 may depend upon which types of transaction-related data were determined, by process stage 124 , to be relevant to a chargeback candidate determination.
- the first account transaction data 130 may include information obtained (e.g., by external data collection unit 42 ) from one of merchant computing systems 22 (e.g., the computing system of the merchant involved in the transaction being analyzed) and/or from an acquiring/merchant bank associated with that merchant.
- the first account transaction data 130 may also include information about one or more other transactions associated with the first account (e.g., data pertaining to other transactions occurring shortly before and/or after the transaction at issue). Some specific examples of rules that may be generated by process stage 124 , and applied at process stage 126 , are described below in connection with FIG. 4 B .
- Process stage 126 may output information indicating whether the particular transaction represented by first account transaction data 130 is a “good” candidate for chargeback detection. For example, process stage 126 may output a percentage probability, calculated according to the rules generated or updated at process stage 124 , that the transaction is one in which a chargeback is appropriate. As another example, process stage 126 may output a binary indicator of whether the transaction is, or is not, a strong/likely chargeback candidate (e.g., by comparing the percentage probability to a threshold probability).
- the full chargeback rules of the card network entity may be applied at a process stage 132 .
- Process stage 132 may include manual application of the full chargeback rules, and/or automated application of the full chargeback rules, in various different embodiments.
- a final chargeback determination may be made at a process stage 134 .
- the final determination made at process stage 134 along with the first account transaction data 130 (and any other data) used to make that determination, may be fed back into process stage 124 to provide additional labeled data for purposes of updating the rules.
- the indication of whether the transaction is a good chargeback candidate generated at process stage 126 may also be fed back into process stage 124 , to allow the machine learning program to determine and improve upon past performance/accuracy.
- an exemplary process flow 140 may generally be used to classify instances of suspected or potential fraud.
- the process flow 140 may represent ongoing, real-time or batch processing of a large amount of data associated with a large number of potential and/or existing financial accounts (e.g., all accounts associated with a particular bank, or all accounts opting in to a fraud protection program, etc.).
- the process flow 140 may be used to initially flag situations for closer investigation, and provide one or more classifications of the type(s) of fraud potentially at issue in order to narrow or otherwise facilitate the investigation.
- the process flow 140 may be used to provide a narrower classification (e.g., “skimming”) when a broader class of fraud (e.g., credit card fraud) is already suspected.
- a narrower classification e.g., “skimming”
- multi-account data 142 may represent data associated with financial accounts of a number (e.g., thousands) of account holders.
- the financial accounts may be existing or potential accounts, and the account holders may include holders of accounts and/or potential holders of potential accounts.
- the multi-account data 142 may include existing and/or applied-for credit card accounts, debit card accounts, savings accounts, checking accounts, investment accounts, loan accounts, etc.
- the multi-account data 142 may include one or more different types of information obtained (e.g., by external data collection unit 42 of FIG. 1 ) from one or more of FAMS 14 , cardholder computing devices 20 , merchant computing systems 22 , and/or other sources 24 .
- the multi-account data 142 may include transaction data (e.g., transaction dates, amounts, locations, etc.) from account records database 30 of FAMS 14 , data indicative of IP addresses of cardholder computing devices 20 and/or devices in merchant computing systems 22 , Internet browsing and/or search history data from cardholder computing devices 20 (or from an ISP computer system included in other sources 24 , etc.), vehicle telematics data from telematics systems of cardholder vehicles, home occupancy and/or usage data (e.g., smart appliance data) from smart home systems of cardholders, and/or one or more other types of data.
- Some or all data within multi-account data 142 may be information that account holders or potential account holders have expressly consented to share with an entity associated with FAMS 14 and/or AFSS 12 (e.g., in exchange for fraud protection services).
- the multi-account data 142 may be associated with multiple fraud determination labels, each indicating a type or class of fraud (e.g., “counterfeiting,” “lost or stolen card use,” “skimming,” “chargeback fraud,” “application fraud,” etc.), or indicating a lack of fraud, for example.
- each of a number of data sets in the multi-account data 142 is associated with at least one such classification/label, and includes data relating to a particular financial transaction, financial account, loan application, etc., for which the fraud classification or classifications was/were made (e.g., after a previous iteration of process flow 140 , or after another manual and/or automated fraud investigation).
- Multi-account data 142 may include many (e.g., thousands) of data sets labeled with various known fraud classifications.
- the multi-account data 142 may be analyzed to generate fraud classification rules (e.g., to be stored in ML rules database 58 ).
- fraud classification rules e.g., to be stored in ML rules database 58 .
- any suitable type of supervised machine learning program/technique(s) may be used.
- process stage 144 may serve to identify which type(s) of transaction data is/are probative of the particular type of fraud (if any) that has occurred.
- Process stage 144 may also determine the data values and/or combinations that are probative of the particular type of fraud (if any) that has occurred.
- the rules generated or updated at process stage 144 may be applied to first account data 150 .
- the first account data 150 may be associated with a particular account and a particular customer (e.g., a cardholder associated with a particular one of computing devices 20 ).
- the types of data included in first account data 150 may depend upon which types of data were determined, by process stage 144 , to be relevant to fraud classification.
- the first account data 150 may include information obtained (e.g., by external data collection unit 42 ) from one or more of FAMS 14 , one of cardholder computing devices 20 (i.e., the device associated with the customer holding or applying for the first account), one or more of merchant computing systems 22 , and/or one or more of other sources 24 .
- Process stage 146 may output data (e.g., a message or code) that is used to classify suspected fraudulent activity (in connection with the account associated with first account data 150 ) at a process stage 152 .
- process stage 152 may assign a classification of “counterfeiting” if process stage 146 determined that the first account data 150 indicated a number of circumstances that, according to the rules generated at process stage 144 , are known to be correlated with counterfeiting activity (e.g., two “card present” transactions occurring in different states within the same one-hour time period, etc.).
- two or more classifications may concurrently be assigned to first account data 150 .
- process stage 146 may determine a set of probabilities for a set of two or more potential types of fraud, and process stage 152 may assign each classification, with each respective probability, to first account data 150 . Moreover, in some embodiments and scenarios, process stage 152 may assign a classification that corresponds to an absence of any suspected fraud (e.g., “no fraud”).
- process stage 152 may assign a classification that corresponds to an absence of any suspected fraud (e.g., “no fraud”).
- process stage 154 if process stage 152 assigned a classification other than one indicating the absence of suspected fraud, the first account data 150 , and/or other information associated with the account and the suspected class of fraud, may be analyzed in depth to make a final fraud determination at a process stage 156 .
- the fraud classification may be used to facilitate the analysis at process stage 154 , with process stage 154 including manual and/or automated fraud detection techniques. For example, personnel associated with AFSS 12 may use the fraud classification(s) to inform their strategy and/or focus with respect to conducting an in-depth fraud investigation.
- the additional analysis at process stage 154 may then result in a final fraud determination at process stage 156 .
- the final determination may indicate both whether fraud occurred and, if so, the class(es)/type(s) of fraud that occurred.
- the final determination made at process stage 156 and information used to make that determination (e.g., the first account data 150 and potentially other data), may be fed back into process stage 144 to provide additional labeled data for purposes of updating the rules.
- the (preliminary) fraud classification made at process stage 152 may also be fed back into process stage 144 to help the machine learning program identify instances in which the preliminary classifications at process stage 152 were incorrect. Process stage 144 may then update the fraud classification rules in ways that seek to prevent or reduce such instances in the future.
- an exemplary process flow 160 may generally be used to detect application fraud.
- “Application fraud” may generally refer to fraud in connection with the application for any type of financial account, loan and/or line of credit (e.g., mortgage loan, vehicle loan, small business loan, payday loan, home equity line of credit, credit card account, debit card account, checking account, savings account, investment account, etc.).
- the application may be for non-financial purposes, such as an application for membership in a particular group or institution, for example.
- multi-applicant search history data 162 may represent data associated with the Internet search history of a number (e.g., thousands) of applicants.
- the multi-applicant search history data 162 may include search terms entered by the applicants using online search engine tools, for example, and/or the results of such searches (e.g., URLs, titles and/or contents of search results), for example.
- the multi-applicant search history data 162 may include data obtained (e.g., by external data collection unit 42 of FIG. 1 ) from cardholder computing devices 20 , from one or more ISPs of other sources 24 , and/or from a third party aggregator of such information, for example.
- the multi-applicant search history data 162 only includes data that the applicants have expressly consented to share with an entity associated with FAMS 14 and/or AFSS 12 (e.g., in exchange for consideration of their applications).
- the multi-applicant search history data 162 may be associated with multiple fraud determination labels.
- each label may be associated with a data set that corresponds to an application submitted by a particular applicant, where the data set includes the corresponding portion of multi-applicant search history data 162 (e.g., the search terms and/or results associated with the particular application).
- the labels may include final fraud determinations that were made via earlier iterations of the process flow 160 , and/or external to the process flow 160 .
- Multi-applicant search history data 162 may include many (e.g., thousands) of positively and negatively labeled data sets.
- the multi-applicant search history data 162 may be analyzed to generate application fraud detection rules (e.g., to be stored in ML rules database 58 ).
- application fraud detection rules e.g., to be stored in ML rules database 58 .
- any suitable type of supervised machine learning program/technique(s) may be used.
- process stage 164 may serve to identify which type(s) of Internet search-related data is/are probative of whether application fraud has occurred, and to determine the data values and/or combinations that are probative of whether application fraud has occurred.
- first applicant search history data 170 may be associated with a particular application and a particular applicant (e.g., a person associated with a particular one of computing devices 20 ), for example.
- the types of data included in first applicant search history data 170 may depend upon which types of Internet search-related data were determined, by process stage 164 , to be relevant to a fraud determination.
- the first applicant search history data 170 may include information obtained (e.g., by external data collection unit 42 ) from one of computing devices 20 (i.e., the device associated with the first applicant), and/or from an ISP of other sources 24 , for example.
- Process stage 166 may output information indicating whether fraud is suspected in connection with the application corresponding to first applicant search history data 170 .
- process stage 166 may output a percentage probability, calculated according to the rules generated or updated at process stage 164 , that the application was fraudulently made (e.g., by someone other than the purported applicant or an authorized representative thereof).
- process stage 166 may output a binary indicator of whether the application likely was, or likely was not, fraudulently made (e.g., by comparing a percentage probability to a threshold probability).
- further analysis e.g., a manual review, or further automated review using additional data sources, etc.
- the additional analysis may then be used to make a final fraud determination (e.g., a final decision on whether application fraud occurred) at process stage 174 .
- process stage 172 is omitted from process flow 160 , and process stage 174 merely represents the output of process stage 166 .
- the final determination made at process stage 174 along with the first applicant search history data 170 (and any other data) used to make that determination, may be fed back into process stage 164 to provide additional labeled data for purposes of updating the rules.
- a preliminary fraud determination made at process stage 166 is also fed back into process stage 164 , to allow the machine learning program to determine and improve upon past performance/accuracy.
- an exemplary process flow 180 may generally be used to facilitate the resolution of fraud disputes (or potential disputes) with customers/account holders.
- the process flow 180 may be used to determine whether a reportedly unauthorized or fraudulent transaction (e.g., one that the account holder reported as such when looking at his or her account statement) was indeed unauthorized or fraudulent.
- the process flow 180 may also, or instead, be used to determine whether an “unrecognized” transaction (i.e., one that the account holder does not recall, but does not necessarily report as fraudulent) was unauthorized or fraudulent.
- multi-account data 182 may represent data associated with financial accounts of a number (e.g., thousands) of account holders.
- the multi-account data 182 may include data associated with financial transactions relating to credit card accounts, debit card accounts, savings accounts, checking accounts, etc.
- FIG. 3 E will be described with reference to an embodiment in which the accounts are credit card accounts.
- the multi-account data 182 may include transaction data (e.g., transaction dates, amounts, locations, etc.) obtained from FAMS 14 (e.g., by external data collection unit 42 of FIG. 1 ). In some embodiments, however, the multi-account data 182 also includes information obtained from cardholder computing devices 20 , merchant computing systems 22 , and/or other sources 24 .
- transaction data e.g., transaction dates, amounts, locations, etc.
- FAMS 14 e.g., by external data collection unit 42 of FIG. 1
- the multi-account data 182 also includes information obtained from cardholder computing devices 20 , merchant computing systems 22 , and/or other sources 24 .
- the multi-account data 182 may include, in addition to transaction data from account records database 30 of FAMS 14 , data indicative of IP addresses of cardholder computing devices 20 and/or devices in merchant computing systems 22 , Internet browsing and/or search history data from cardholder computing devices 20 (or from an ISP computer system included in other sources 24 , etc.), vehicle telematics data from telematics systems of cardholder vehicles, home occupancy and/or usage data (e.g., smart appliance data) from smart home systems of cardholders, autonomous vehicle data, smart vehicle data, mobile device data, vehicle or mobile device GPS data, and/or one or more other types of data.
- Some or all data within multi-account data 182 may be information that account holders or potential account holders have expressly consented to share with an entity associated with FAMS 14 and/or AFSS 12 (e.g., in exchange for fraud protection services).
- the multi-account data 182 may be associated with multiple fraud determination labels (e.g., “fraud” and “no fraud,” and/or more complex labels that indicate type/class, such as “lost/stolen card use,” etc.).
- each label may be associated with a data set that includes the corresponding portion of multi-account data 182 .
- the labels may include final fraud determinations that were made via earlier iterations of the process flow 180 , and/or external to the process flow 180 .
- Multi-account data 182 may include many (e.g., thousands) of positively and negatively labeled data sets.
- the multi-account data 182 may be analyzed to generate query generation rules (e.g., to be stored in ML rules database 58 ).
- query generation rules e.g., to be stored in ML rules database 58 .
- any suitable type of supervised machine learning program/technique(s) may be used.
- process stage 184 may serve to identify which types of information are probative of whether fraud has occurred, and to craft rules that formulate queries to ascertain such information based upon account data.
- process stage 184 may determine that, for a suspect “card present” transaction, a verified, non-fraudulent “card present” transaction within 10 miles and 3 hours of the suspect transaction is probative of whether the suspect transaction was fraudulent. Based upon this finding, process stage 184 may also generate a rule specifying that a cardholder should be queried as to whether he/she can confirm making each “card present” transaction within 10 miles and 3 hours of the suspect transaction.
- process stage 184 may determine that a merchant using a billing alias different from its legal and/or commonly-known name (e.g., by at least some threshold level of similarity, as measured by number of similar characters, order of characters, etc.) is probative of whether the cardholder authorized a transaction associated with that billing alias. Based upon this finding, process stage 184 may generate a rule specifying that a cardholder should be queried as to whether he/she is aware of a billing alias used for a suspect transaction if that billing alias is sufficiently different from the legal/common name of the merchant.
- the rules generated or updated at process stage 184 may be applied to first account data 190 .
- the first account data 190 may be associated with a particular cardholder, such as a cardholder associated with a particular one of cardholder computing devices 20 , for example.
- the types of data included in first account data 190 may depend upon which types of data were determined, by process stage 184 , to be relevant to developing dispute resolution queries.
- Process stage 186 may generate a set of one or more queries in accordance with the rules and the contents of first account data.
- the generated queries may be sent to the cardholder in one or more of various ways, such as sending the queries via SMS text message and/or email, and/or via a web browser or dedicated application executing on the one of cardholder computing devices 20 that is associated with the cardholder, for example.
- responses to the queries are received from the cardholder (e.g., via inputs made by the cardholder via the web browser or application, or a responsive SMS text message or email, etc.).
- the rules generated or updated at process stage 184 specify the manner in which follow-up queries should be generated based upon the responses received at process stage 194 , and process stages 192 and 194 may be repeated multiple times.
- process stage 196 further analysis (e.g., a manual review, or further automated review using additional data sources, etc.) that makes use of the received responses is performed at an additional stage, shown in dashed lines in FIG. 3 E as process stage 196 .
- the additional analysis may then be used to make a final fraud determination (e.g., a final decision on whether fraud occurred, and/or on the type of fraud that occurred) at process stage 198 .
- process stage 196 is omitted from process flow 180
- process stage 198 is based upon information from the cardholder. For example, the questions generated at process stage 192 may “jog” the cardholder's memory, and cause him or her to indicate that the transaction at issue was authorized.
- an exemplary process flow 200 may generally be used to detect fraud relating to documents, such as counterfeit and/or forged documents.
- the process flow 200 may be used in connection with various kinds of documents, such as checks (e.g., personal checks, cashier's checks, etc.), money orders, treasury bills, identification documents (e.g., social security cards, driver's licenses, passports, birth certificates, etc.), certification documents, and so on.
- checks e.g., personal checks, cashier's checks, etc.
- money orders e.g., money orders, treasury bills, identification documents (e.g., social security cards, driver's licenses, passports, birth certificates, etc.), certification documents, and so on.
- identification documents e.g., social security cards, driver's licenses, passports, birth certificates, etc.
- multi-document image data 202 may represent digital images of a number (e.g., thousands) of physical documents of one or more types.
- the multi-document image data 202 may include images in one or more formats, such as raster formats (e.g., JPEG, TIFF, GIF, BMP, PNG, etc.) and/or vector formats (e.g., CGM, SVG, etc.), for example.
- the multi-document image data 202 may include data obtained (e.g., by external data collection unit 42 of FIG. 1 ) from merchant computing systems 22 (e.g., point-of-sale devices with cameras for document identification) and/or from FAMS 14 (e.g., images of personal checks), for example.
- the multi-document image data 202 may only include data representing images that customers (or other individuals associated with the documents) have expressly consented to share (e.g., as a prerequisite to making a purchase, or in exchange for fraud protection services, etc.).
- the multi-document image data 202 may be associated with multiple fraud determination labels.
- each label may be associated with data representing a digital image of a particular document.
- the labels may include final fraud determinations (e.g., “fraud” or “no fraud,” or more complex labels such as “forgery,” “counterfeit,” “forgery—signature,” “counterfeit—angular line offset(s) outside tolerance,” etc.) that were made via earlier iterations of the process flow 200 , and/or external to the process flow 200 .
- Multi-document image data 202 may include many (e.g., thousands) of positively and negatively labeled data sets.
- the multi-document image data 202 may be analyzed to generate document fraud detection rules (e.g., to be stored in ML rules database 58 ).
- document fraud detection rules e.g., to be stored in ML rules database 58 .
- process stage 204 may serve to identify which characteristics of a document are probative of whether the document is counterfeit, and to determine the ranges, tolerances, etc., that are probative of whether the document is counterfeit.
- process stage 204 also, or instead, identifies which characteristics of information entered in document fields are probative of whether the document was forged (e.g., drafted or populated by someone other than the person purported to have drafted or populated the document).
- the rules generated or updated at process stage 204 may be applied to first document image data 210 .
- the first document image data 210 may be digital image data corresponding to a particular, physical document.
- the first document image data 210 may include information obtained (e.g., by external data collection unit 42 ) from one of merchant computing systems 22 (e.g., for real-time verification of an identification or other document presented during or prior to a sale), or from FAMS 14 (e.g., for real-time or batch-processing verification of a personal check prior to clearing the check), for example.
- Some specific examples of rules that may be generated by process stage 204 , and applied at process stage 206 are described below in connection with FIG. 4 F .
- Process stage 206 may output information indicating whether fraud is suspected in connection with the document corresponding to first document image data 210 .
- process stage 206 may output two percentage probabilities calculated according to the rules generated or updated at process stage 204 , with the first indicating the likelihood that the document is counterfeit and the second indicating the likelihood that the document includes forged content.
- process stage 206 may output binary indicators of whether the document likely is, or likely is not, counterfeit and/or includes forged content (e.g., by comparing percentage probabilities to threshold probabilities).
- further analysis may be performed at a process stage 212 .
- the additional analysis may then be used to make a final fraud determination (e.g., a final decision on whether the document is fraudulent) at process stage 214 .
- the process stage 206 may act as a filter, and flag only those documents having a relatively high probability of being fraudulent. In this manner, a considerably smaller amount of human and/or processing resources may be consumed at process stage 212 .
- the final determination made at process stage 214 may be fed back into process stage 204 to provide additional labeled data for purposes of updating the rules.
- a preliminary fraud determination made at process stage 206 may also be fed back into process stage 204 , to allow the machine learning program to determine and improve upon past performance/accuracy.
- FIGS. 4 A- 4 F depict exemplary factors and algorithms that may be used in connection with various fraud detection and/or classification rules, according to different embodiments. It is noted that the rule sets corresponding to FIGS. 4 A- 4 F are purely for purposes of illustration and are not limiting. Particularly in embodiments where machine learning is utilized, for example, the algorithms and/or factors may be far more complex, and/or less intuitive, than some or all of the examples shown in FIGS. 4 A- 4 F .
- an exemplary rule set 220 may use various factors relating to online activity of a cardholder to detect fraud in connection with a particular credit or debit card transaction.
- the rule set 220 may correspond to a particular embodiment and scenario in which the transaction at issue is a “card present” transaction, and in which the rule set 220 seeks to determine whether the cardholder made or otherwise authorized the transaction.
- the rule set 220 may be incorporated into a review process that is generally applied to all transactions, a review process applied only to those transactions that were flagged by a preliminary fraud alert, or a review process applied only after a cardholder reports the transaction as unauthorized, for example.
- the factors considered under the rule set 220 may include a number of interest-based factors 222 and a number of location-based factors 224 .
- the interest-based factors 222 may relate to the cardholder's interest (or non-interest) in a product or service purchased via the transaction, and/or the merchant providing the product or service, while the location-based factors 224 may relate to the cardholder's location or probable location.
- the interest-based factors 222 may include: (1) whether the cardholder searched online for the specific product or service purchased via the transaction at issue (e.g., by determining whether search terms entered by the cardholder included the name of the product or service involved in the transaction, or included a description of the product or service, etc.); (2) whether the cardholder visited a website associated with the merchant (e.g., by comparing URLs of websites visited by the cardholder to a known URL of the merchant's website, or by searching the contents of websites visited by the cardholder for the merchant's name, etc.); (3) whether the cardholder endorsed the merchant, or the product or service provided by the merchant, via a social media account of the cardholder (e.g., by determining whether the cardholder “liked” the merchant, product or service via his or her Facebook® account, etc.); (4) whether the cardholder visited a website associated with a competitor of the merchant (e.g., by comparing URLs of web sites visited by the cardholder to known URLs of known competitors
- the location-based factors 224 may include: (1) whether the cardholder “checked in” to a flight having a destination near the location where the transaction was initiated (e.g., by determining whether the cardholder checked in to a flight having a destination at the city in which the transaction occurred, or within a threshold number of miles of the city in which the transaction occurred, etc.); (2) whether the cardholder visited a website associated with a place near (or in) which the transaction was initiated (e.g., by comparing URLs of websites visited by the cardholder to URLs of websites known to be associated with particular areas, and/or by searching the contents of websites visited by the cardholder for location or area names, etc.); and/or (3) whether the cardholder endorsed a place near (or in) which the transaction was initiated via a social media account of the cardholder (e.g., by determining whether the cardholder “liked” the geographic area, attraction or other place via his or her Facebook® account, etc.).
- the location-based factors 224 may include: (1) whether the cardholder “
- the data indicative of whether the circumstance corresponding to each of interest-based factors 222 and/or location-based factors 224 is present/true for a particular cardholder may be included in the first customer online activity data 110 described above in connection with FIG. 3 A .
- external data collection unit 42 of FIG. 1 may obtain the search terms, URLs, user online selections, etc., needed to determine whether the various factors exist, from the cardholder's computing device (e.g., one of cardholder computing devices 20 ) and/or from an ISP of other sources 24 .
- each of the interest-based factors 222 and location-based factors 224 may be associated with a particular score or weighting value.
- a total score may be calculated based upon which factors are, or are not, present (e.g., add 94 points if it is determined that the cardholder searched for the particular lawnmower model that was purchased, add another 80 points if the transaction was a “card present” transaction in the Chicago suburb of Joliet and the cardholder checked in to a flight to Chicago just prior to the transaction, etc.).
- certain factors may instead be associated with negative scores (e.g., minus 80 if the cardholder checked in to a flight with a destination at least 200 miles from the site of the transaction and within one day of the transaction, etc.).
- certain factors may be associated with metrics or algorithms that determine how heavily those factors are weighed.
- search terms entered by the cardholder may be used to calculate a “need score” X (e.g., where X is based upon frequency of certain search terms being used, the amount of time spent clicking through search results, the magnitude and/or urgency of a problem indicated by the search terms, etc.), with X then being used to calculate a score equal to 0.2X.
- a threshold e.g., a threshold of +100
- a probability calculated based upon the total score e.g., a threshold of +100
- a probability calculated based upon the total score e.g., a threshold of +100
- FIG. 4 A it can be seen that larger scores generally correspond to a greater probability that the transaction was made or authorized by the cardholder. If the transaction is being automatically reviewed (e.g., to determine whether a fraud alert is appropriate, without any initial input from the cardholder), this may mean that a lower score corresponds to a higher probability of fraud. Conversely, if the cardholder had reported the transaction as being fraudulent, a higher score may correspond to
- the rule set 220 may also include one or more other types of factors not necessarily based upon online activities of the cardholder (e.g., whether GPS of the cardholder's smartphone or vehicle indicates that he or she was in that area shortly before or after the transaction, etc.), and/or may omit either interest-based factors 222 or location-based factors 224 .
- an exemplary rule set 230 may use various factors relating to a transaction between a cardholder and a merchant to determine whether the transaction should be flagged as a candidate for a chargeback (e.g., to determine whether the transaction should be reviewed under a full set of chargeback rules associated with the appropriate card network entity).
- the rule set 230 may correspond to a particular embodiment and scenario in which the transaction at issue is a “card present” transaction.
- the factors considered under the rule set 230 may include: (1) whether an EMV chip card was not inserted in a point-of-sale EMV chip reader device of the merchant; (2) whether a non-EMV card was not swiped in a point-of-sale device of the merchant; (3) whether the card is past its expiration date; (4) whether the transaction is for the same amount and/or date as another transaction involving the same card and merchant (e.g., by analyzing other transactions involving the same account and merchant within a particular time span); and/or (2) whether the transaction is for greater than a threshold amount.
- a threshold amount For example, one of merchant computing systems 22 of FIG.
- the factors considered under rule set 230 may include more, fewer and/or different factors than those shown in FIG. 4 B . It is noted that, in some embodiments, one or more factors may simply relate to the desirability (e.g., from a card issuer perspective) of further reviewing whether a chargeback is appropriate, without necessarily relating to the likelihood that a chargeback is appropriate.
- each of the factors may be associated with a particular score or weighting value.
- a total score may be calculated based upon which factors are, or are not, present (e.g., add 62 points if it is determined that the transaction has the same amount and date as another transaction occurring close in time and involving the same card and merchant).
- certain factors may instead be associated with negative scores, and/or certain factors may be associated with metrics or algorithms that determine how heavily those factors are weighed.
- the rule set 230 may then output the total score, a normalized total score, an indication of whether the total score exceeded a threshold, a probability calculated based upon the total score, and/or some other indicator or measure of the likelihood that a chargeback is appropriate for the transaction.
- a normalized total score an indication of whether the total score exceeded a threshold
- a probability calculated based upon the total score and/or some other indicator or measure of the likelihood that a chargeback is appropriate for the transaction.
- FIG. 4 B it can be seen that larger scores generally correspond to a greater probability that a chargeback is appropriate.
- an exemplary rule set 240 (e.g., generated at process stage 144 of FIG. 3 C ) may use a diverse array of factors to classify the type(s) of fraudulent activity, if any, that is/are suspected to be associated with an event or series of events.
- the rule set 240 may correspond to a particular embodiment and scenario in which the event at issue is a financial transaction involving a debit or credit card.
- the rule set 240 may classify fraudulent activity with respect to specific other types of events (e.g., loan applications), or may detect a variety of different event types (e.g., various types of financial transactions, loan or credit applications, etc.) and broadly classify fraudulent activity in connection with the detected event types (e.g., lost/stolen card use, application fraud, etc.).
- specific other types of events e.g., loan applications
- event types e.g., various types of financial transactions, loan or credit applications, etc.
- broadly classify fraudulent activity in connection with the detected event types e.g., lost/stolen card use, application fraud, etc.
- each potential classification may be associated with a number of factors probative of whether that type/class of fraud has occurred.
- the rule set 240 may include counterfeit factors 242 (e.g., factors indicating that a counterfeit card was used for the transaction), account takeover factors 244 (e.g., factors indicating that the transaction resulted from an unauthorized person gaining online access to the credit or debit card account itself, via phishing, malware or other means), chargeback fraud factors 246 (e.g., factors indicating that the cardholder made or otherwise authorized a purchase that the cardholder later contested) and skimming factors 248 (e.g., factors indicating that the card information used for the transaction was obtained via a skimming card reader device illegally installed in an ATM, gas station pump or other location).
- the rule set 240 may also, or instead, include factors corresponding to one or more other fraud classifications (e.g., forgery, lost/
- the counterfeit factors 242 may include: (1) whether the suspect transaction and another, contemporaneous transaction (e.g., occurring within one hour, etc.) in another state are both “card present” transactions; and/or (2) if the suspect transaction is a “card present” transaction, whether the card (if an EMV chip card) was not inserted in an EMV chip card reader.
- the counterfeit factors 242 may include more, fewer and/or different factors than those shown in FIG. 4 C .
- the account takeover factors 244 may include: (1) whether the debit or credit card account password was changed within the 10 days prior to the transaction; and/or (2) whether the transaction was originated from an IP address not associated with the cardholder.
- external data collection unit 42 may retrieve password change information from account records database 30 of FIG. 1 , which may log all password update activity, and/or may retrieve IP address information from one of merchant computing systems 22 (e.g., the computing system of the merchant involved in the transaction).
- the account takeover factors 244 may include more, fewer and/or different factors than those shown in FIG. 4 C .
- the chargeback fraud factors 246 may include: (1) whether the cardholder had searched online for the product or service purchased via the transaction; and/or (2) whether the cardholder had visited a website associated with the merchant involved in the transaction.
- external data collection unit 42 of FIG. 1 may retrieve online search information (e.g., search terms and/or results) and/or URLs from the one of cardholder computing devices 20 that is associated with the cardholder, and/or from an ISP (of other sources 24 ) used by the cardholder.
- the chargeback fraud factors 246 may include more, fewer and/or different factors than those shown in FIG. 4 C .
- the skimming factors 248 may include: (1) the number (X) of earlier transactions in which the card used for the transaction at issue was used at an ATM machine or a gas station pump within the 10 days prior to the transaction at issue; and/or (2) whether the transaction at issue originated from an IP address not associated with the cardholder.
- external data collection unit 42 of FIG. 1 may retrieve transaction data indicating that certain past purchases were made using gas station pump card readers, and/or indicating that the card was used for one or more ATM withdrawals, from account records database 30 , and/or may retrieve the originating IP address from the one of merchant computing systems 22 associated with the merchant involved in the transaction at issue.
- the skimming factors 248 may include more, fewer and/or different factors than those shown in FIG. 4 C .
- the data indicative of whether the circumstance corresponding to each of counterfeit factors 242 , account takeover factors 244 , chargeback fraud factors 246 and/or skimming factors 248 is present/true for a particular transaction may be included in the first account data 150 described above in connection with FIG. 3 C , for example.
- each of the counterfeit factors 242 , account takeover factors 244 , chargeback fraud factors 246 and skimming factors 248 may be associated with a particular score or weighting value.
- the factors for each classification may be used to calculate a total score specific to that classification.
- a counterfeit score may be calculated based upon which of factors 242 are, or are not, present
- an account takeover score may be calculated based upon which of factors 244 are, or are not, present, and so on.
- certain factors may instead be associated with negative scores, and/or certain factors (e.g., the first of skimming factors 248 shown in FIG. 4 C ) may be associated with metrics or algorithms that determine how heavily those factors are weighed.
- the rule set 240 may output the total score, a normalized total score, an indication of whether the total score exceeded a threshold, a probability calculated based upon the total score, and/or some other indicator or measure of the likelihood that fraud of that particular type/class occurred in connection with the transaction.
- the classification at process stage 152 may be the classification having the highest score and/or probability under rule set 240 , or may include the score and/or probability for each classification, the top three classifications, etc.
- an exemplary rule set 260 may use online search information (e.g., search terms, search results, clicked/selected search results, etc.) to detect whether an application was fraudulent (e.g., not populated and/or submitted by the purported applicant).
- the rule set 260 may have been generated at process stage 164 of FIG. 3 D , for example.
- the rule set 260 may be incorporated into a review process that is generally applied to all applications received by a particular entity or anti-fraud service, or a review process applied only to those applications that were flagged by a preliminary fraud alert, for example.
- the factors considered under the rule set 260 may generally be probative of whether the person that submitted the application (e.g., via a web browser, a dedicated application, as an email attachment, by snail mail, etc.) had performed one or more online searches indicating that he or she was trying to learn more about the purported applicant in order to populate particular fields of the application (e.g., a “home address” field, “employment history” fields, etc.).
- the “purported applicant” may be a person whose name appears in a name and/or signature field of the application, for example.
- the factors of exemplary rule set 260 may include: (1) whether the applicant used search terms that included the name of the purported applicant; (2) whether the search terms also included the words “address” or “residence” (and possibly other synonyms or near-synonyms); and/or (3) whether the search terms also included the words “employer,” “job” and/or “career” (and possibly other synonyms or near-synonyms).
- the rule set 260 may include more, fewer and/or different factors than those shown in FIG. 4 D .
- the rule set 260 may include one or more factors relating to which search results appeared and/or were selected (e.g., “clicked” on after appearing on a user interface) by the applicant.
- the data indicative of whether the circumstances corresponding to the factors of rule set 260 are present/true for a particular applicant may be included in the first applicant search history data 170 described above in connection with FIG. 3 D .
- external data collection unit 42 of FIG. 1 may obtain the search terms, search results, search result user selections, etc., needed to determine whether the various factors exist, from the applicant's computing device (e.g., similar to one of cardholder computing devices 20 ) and/or from an ISP of other sources 24 . Access to such information may be made a condition of having the application be considered, for example.
- each of the factors of rule set 260 may be associated with a particular score or weighting value. A total score may then be calculated based upon which factors are, or are not, present. In some embodiments, certain factors may instead be associated with negative scores, and/or certain factors may be associated with metrics or algorithms that determine how heavily those factors are weighed.
- the rule set 260 may then output the total score, a normalized total score, an indication of whether the total score exceeded a threshold, a probability calculated based upon the total score, and/or some other indicator or measure of the existence or likelihood of application fraud.
- a normalized total score an indication of whether the total score exceeded a threshold
- a probability calculated based upon the total score and/or some other indicator or measure of the existence or likelihood of application fraud.
- larger scores may generally correspond to a greater probability that the application was not populated and/or submitted by the purported applicant.
- FIG. 4 E a flow diagram illustrates at least a portion of a process flow 270 implementing an exemplary rule set for fraud dispute, or potential fraud dispute, resolution (e.g., a rule set generated at process stage 184 of FIG. 3 E ).
- the process flow 270 may be used to help resolve a dispute over a contested transaction, or to help a customer recall an unrecognized transaction, for example.
- FIG. 4 E illustrates a process flow, rather than just a set of factors, in order to better illustrate an example process for generating queries based upon the generated rules, according to one embodiment.
- the process flow 270 may correspond to a particular embodiment and scenario in which the transaction subject to dispute or potential dispute is a credit or debit card transaction.
- the rule set may specify that a process stage 272 determines whether the transaction was a “card present” transaction. If not, the rule set may specify that the flow proceed directly to a process stage 280 . If so, however, the rule set may specify that the flow instead proceeds to a process stage 274 .
- the rule set may also specify that process stage 274 determines whether at least one other transaction associated with the cardholder's account occurred within some threshold number of hours (X) of the transaction at issue. If not, the rule set may specify that the flow proceeds directly to process stage 280 . If so, however, the rule set may specify that the flow instead proceeds to a process stage 276 .
- Process stage 276 may generate one or more location-related queries using transaction data associated with the cardholder's account.
- the queries may ask, for example, whether the cardholder was in (or near) one or more particular geographic areas or locations at various times. If the transaction at issue occurred in San Francisco, for example, with a first other “card present” transaction occurring in Santa Rosa four hours earlier and a second other “card present” transaction occurring in San Jose two hours later, process stage 276 may generate one or more queries asking whether the cardholder made or authorized the earlier and/or later transactions, and/or whether the cardholder traveled on a route from Santa Rosa to San Jose that passed through San Francisco, etc.
- the location-related queries are generated based upon data associated with events or circumstances other than transactions. For example, if the transaction at issue occurred in Sarasota, Florida, and the data considered under the rule set indicates that the cardholder checked in to a flight to Tampa, process stage 276 may generate one or more queries asking whether the cardholder completed the flight, where the cardholder went after landing in Tampa, etc.
- the rule set may also specify that process stage 280 determines whether the transaction at issue is associated with a billing alias that is dissimilar to the name of the merchant involved in the transaction.
- the computing system of the merchant e.g., one of merchant computing systems 22 of FIG. 1
- the determination at process stage 280 may use the billing alias to identify a legal and/or common name of the merchant (e.g., using a relational database stored in AFSS12 or FAMS 14 ), and determine that there is at least some threshold level of dissimilarity (e.g., based upon difference of characters, character ordering, etc.) between the billing alias and the merchant name.
- a threshold level of dissimilarity e.g., based upon difference of characters, character ordering, etc.
- Process stage 282 may generate a query relating to the billing alias that was presented to the cardholder. For example, the query may ask whether the cardholder is aware that the billing alias is used by that particular merchant. In some embodiments, process stage 282 may instead generate a message that simply informs the cardholder that the billing alias corresponds to the merchant, without posing a question.
- the rule set may specify that process stage 284 generates one or more default queries.
- one default query may ask whether the cardholder lent his or her card to a friend or family member around the time of the transaction.
- process stage 284 may be omitted from process flow 270 .
- the queries (and possibly non-query messages) generated in process flow 270 may serve to help the cardholder recall whether the transaction was made or authorized, and/or process flow 270 may prompt the cardholder for responses that are considered by others (e.g., personnel of an entity associated with FAMS 14 of FIG. 1 ) to determine whether the transaction was likely fraudulent.
- process flow 270 may include a number of iterative stages in which responses are received from the cardholder (e.g., from the respective one of cardholder computing devices 20 in FIG. 1 ) and used to generate additional, more detailed questions for the cardholder. For example, if a first query asks whether the cardholder recalls personally making another “card present” transaction that occurred at a nearby time and place, and the cardholder responds “no,” a new query may be generated asking whether the cardholder recalls personally making the next closest transaction (in terms of time and/or location).
- an exemplary rule set 290 may use various factors relating to an imaged (e.g., photographed or scanned) physical document to determine whether the document should be flagged as a candidate for a more in-depth (e.g., manual) analysis/review for fraud purposes.
- the rule set 290 may correspond to a particular embodiment and scenario in which the document is one that includes at least a signature field (e.g., a personal check, a driver's license, etc.).
- the factors considered under the rule set 290 may include a number of counterfeit factors 292 and a number of forgery factors 294 , each of which may be evaluated by image analysis unit 52 of FIG. 1 using one or more image processing techniques.
- the counterfeit factors 292 may relate to the look, presentation, format and/or structure of the document, while the forgery factors 294 may relate to the substance, style or format of information entered in one or more fields of the document.
- the counterfeit factors 292 may include: (1) whether one or more absolute or relative dimensions and/or angles of the document, or of lines, illustrations, patterns, etc. shown on the document (excluding user-entered contents in fields such as the signature line), are outside one or more predetermined tolerances; (2) whether one or more colors on the document are outside a predetermined tolerance (e.g., color/frequency range); (3) whether one or more line thicknesses of the document (excluding user-entered field contents) are outside one or more predetermined tolerances; and/or (4) whether one or more fonts on the document (excluding user-entered field contents) are outside one or more predetermined tolerances.
- predetermined tolerance e.g., color/frequency range
- image analysis unit 52 may determine whether the ratio of the document length to the document width is within 0.1% of an expected value. As another example, image analysis unit 52 may determine whether horizontal and vertical lines on the document are within 0.3 degrees of the horizontal and vertical edges of the document, respectively. As yet another example, image analysis unit 52 may determine whether a font used for a field descriptor or other text on the document matches an expected font (e.g., by meeting a similarity threshold measured in any suitable manner). In other embodiments, the counterfeit factors 292 may include more, fewer and/or different factors than those shown in FIG. 4 F .
- the forgery factors 294 may include: (1) whether a signature entered in a signature field of the document match is outside a predetermined tolerance (e.g., using any suitable signature recognition technique); (2) whether handwriting entered in one or more fields of the document is outside a predetermined tolerance (e.g., by applying a suitable handwriting recognition technique); and/or (3) whether the format of information entered by a user in one or more fields does not match an expected format (e.g., using “9.12.16” rather than the expected “9/12/2016,” as established based upon other documents known to have been populated and/or submitted by the purported applicant).
- the forgery factors 294 may include more, fewer and/or different factors than those shown in FIG. 4 F .
- the data indicative of whether the circumstances corresponding to counterfeit factors 292 and/or forgery factors 294 are present/true for a particular document may be included in the first document image data 210 described above in connection with FIG. 3 F .
- each of the counterfeit factors 292 and forgery factors 294 may be associated with a particular score or weighting value.
- a total score may be calculated based upon which factors are, or are not, present.
- certain factors may instead be associated with negative scores, and/or certain factors may be associated with metrics or algorithms that determine how heavily those factors are weighed.
- the rule set 290 may then output the total score, a normalized total score, an indication of whether the total score exceeded a threshold, a probability calculated based upon the total score, and/or some other indicator or measure of the likelihood that the document is fraudulent.
- the rule set 290 may output a separate total score, normalized score, probability, or other metric, for each of counterfeit factors 292 and forgery factors 294 , with the counterfeit metric indicating the likelihood that the document is a counterfeit and the forgery metric indicating the likelihood that the document was fraudulently populated by someone other than the purported person (e.g., by someone other than the person corresponding to the name, signature, address, etc. on the document).
- the counterfeit metric indicating the likelihood that the document is a counterfeit
- the forgery metric indicating the likelihood that the document was fraudulently populated by someone other than the purported person (e.g., by someone other than the person corresponding to the name, signature, address, etc. on the document).
- the rule set 290 also includes one or more other types of factors not shown in FIG. 4 F , and/or omits either counterfeit factors 292 or forgery factors 294 .
- FIGS. 5 - 11 depict flow diagrams of various exemplary computer-implemented methods that may be implemented by one or more components of AFSS 12 of FIG. 1 .
- AFSS 12 implements all of the methods corresponding to FIGS. 5 - 11 .
- AFSS 12 implements only a subset (e.g., one, two, etc.) of the methods corresponding to FIGS. 5 - 11 .
- Each of the methods described below may be implemented by fraud detection/classification unit 36 of FIG. 1 , for example.
- an exemplary computer-implemented method 300 may be used to identify a potential chargeback scenario, e.g., to narrow down the field of fraudulent transactions that should be further investigated for chargeback purposes.
- chargeback candidate detection rules may be generated or updated (block 301 ).
- the rules may be generated or updated using a machine learning program, such as any of the types of machine learning programs discussed above in connection with ML rule generator 40 of FIG. 1 or process stage 84 of FIG. 2 , for example.
- the machine learning program may be trained using transaction data associated with a plurality of financial transactions, and chargeback determinations each corresponding to a respective one of the plurality of financial transactions.
- the chargeback determinations (e.g., indications of whether a chargeback was or was not instituted for each transaction) may each be made in accordance with chargeback rules associated with (e.g., provided by) a card network entity.
- An indication that fraud has been confirmed for a first financial transaction, associated with a particular financial account and a particular merchant, may be received (block 302 ).
- an automated investigation e.g., using any suitable process, method or technique described herein
- a manual investigation may have been performed to determine that the first financial transaction was fraudulent in some way, and a user input or other data indicative of that outcome may be received at block 302 .
- First transaction data, associated with the first financial transaction, may be retrieved (block 303 ).
- a database containing account records e.g., account records database of FIG. 1
- the first financial transaction may be flagged as a relatively strong candidate with respect to the appropriateness of a chargeback payment from the merchant or acquiring bank to the card issuer. In other scenarios, not represented by FIG. 5 , it may instead be determined that a chargeback is not a good chargeback candidate.
- the determination at block 304 may be based upon different factors, in accordance with the specific scenario and/or embodiment. For example, the determination may be based at least upon a card associated with the financial account being expired when the first financial transaction occurred. As other examples, the determination may be based at least upon a dollar amount of the first financial transaction (e.g., the amount exceeding a threshold), and/or upon a second financial transaction under the same account duplicating one or more characteristics of the first financial transaction (e.g., the same amount, date, time, and/or other characteristics that may be indicative of an improper duplicate charge).
- a dollar amount of the first financial transaction e.g., the amount exceeding a threshold
- a second financial transaction under the same account duplicating one or more characteristics of the first financial transaction (e.g., the same amount, date, time, and/or other characteristics that may be indicative of an improper duplicate charge).
- An indication that the chargeback may be warranted may be caused to be displayed to one or more people via one or more respective computing device user interfaces (block 305 ).
- the indication may also specify the transaction at issue, the merchant, and possibly other information such as the transaction date, amount, etc.
- the indication may be sent to a computing device of a card issuer or other entity, for example, to prompt a full review of the first financial transaction under the chargeback rules of the card network entity.
- Block 305 may be implemented by notification unit 56 of FIG. 1 , for example.
- the method 300 may include one or more additional blocks not shown in FIG. 5 .
- the method 300 may include an additional block in which it is determined, by applying the chargeback rules of the card network entity to the first transaction data and additional data associated with that transaction (e.g., additional data received from the merchant and/or other sources), that a chargeback is indeed warranted for the transaction.
- the additional data may include data indicative of a card information entry mode used to conduct the first financial transaction (e.g., “card present,” swiped, inserted in an EMV chip card reader, etc.), for example.
- the chargeback rules may be applied manually.
- the method 300 may include an additional block in which first account data associated with the first financial account is retrieved (e.g., card expiration date, whether the card is an EMV card, etc., possibly obtained from the same account records database accessed at block 303 ).
- block 304 may further include applying the chargeback candidate detection rules to the first account data.
- FIG. 6 illustrates an exemplary computer-implemented method 310 of determining that a merchant computer terminal warrants a chargeback after a consumer dispute or fraudulent transaction based upon dispute rules (or chargeback rules).
- the method 310 may include, via one or more processors and/or transceivers, determining a merchant and/or a merchant computing terminal associated with a fraudulent financial transaction, such as by IP address (block 311 ).
- the method 310 may include, the one or more processors and/or transceivers, retrieving a configuration, or parameters or specifications of the merchant computing terminal from a memory unit, or receiving such information via wireless communication or data transmission over one or more radio links or wireless communication channel transmitted by the merchant computing terminal (block 312 ).
- the method 310 may include retrieving, via the one or more processors and/or transceivers, current or up-to-date dispute rules regarding computer specifications or requirements (block 313 ).
- the method 310 may include comparing, via the one or more processors, the current dispute rules regarding computer requirements with the merchant computer terminal specifications to determine whether or not the merchant computer terminal is compliant with current dispute rules (block 314 ).
- the one or more processors may analyze the dispute rules to identify requirements or required specifications of merchant computing terminals.
- the method 310 may include verifying other dispute rules are satisfied for a valid chargeback and/or whether the financial transaction is still within requisite time or allowable recovery period.
- the method 310 may include, if the merchant computer terminal is not compliant with the dispute rules or computer required specifications, generating an electronic chargeback notification and transmitting it to a merchant computing device (block 315 ) to facilitate merchant notification.
- the dispute rules may require merchant computing terminals to be equipped with “chip” readers, smart card readers, or the like.
- the method 310 may determine that the merchant computing terminal is only equipped with older or “swipe” technology, and if so, a card issuer may be entitled to a chargeback associated with a fraudulent transaction from the merchant.
- a computer-implemented method of identifying a merchant computer terminal warranting a chargeback may be provided.
- the method may include (1) identifying, via one or more processors and/or transceivers, a merchant computer terminal (and/or an IP address of the merchant computer terminal) associated with a fraudulent financial transaction; (2) retrieving or receiving, via the one or more processors and/or transceivers, an actual configuration, parameters, and/or specifications associated with the merchant computer terminal; (3) retrieving or receiving, via the one or more processors and/or transceivers, up-to-date dispute rules associated with chargebacks, the dispute rules including merchant computer terminal requirements; (4) analyzing, via the one or more processors, the dispute rules to determine merchant computer terminal requirements; (5) comparing, via the one or more processors and/or transceivers, the merchant computer terminal requirements from the current dispute rules with the actual configuration, parameters, and/or specifications associated with the merchant computer terminal to identify if the merchant computer terminal is non-complaint with the dispute rules; (6) if the merchant computer
- the method may include receiving, via the one or more processors and/or transceivers, dispute rules associated with a credit card issuer; and identifying, via the one or more processors, merchant computer terminal technical specifications that would warrant a chargeback and merchant computer terminal technical specifications that would not warrant a chargeback.
- the method may include receiving, via the one or more processors and/or transceivers, actual technical specifications of a merchant computer associated with the financial transaction; comparing, via the one or more processors, the actual technical specifications with the merchant computer terminal technical specifications that would warrant a chargeback to determine that a chargeback is warranted; and/or generating, via the one or more processors, an electronic notification indicating that the chargeback is warranted.
- the method may include receiving, via the one or more processors and/or transceivers, actual technical specifications of a merchant computer associated with the financial transaction; comparing, via the one or more processors, the actual technical specifications with the merchant computer terminal technical specifications that would not warrant a chargeback (or satisfy computer requirements of the dispute rules) to determine that a chargeback is not warranted; and/or generating, via the one or more processors, an electronic notification indicating that the chargeback is not warranted based upon computer specifications.
- a computer system configured to identify a merchant computer terminal warranting a chargeback.
- the computer system may include one or more processors and/or transceivers configured to: identify a merchant computer terminal (and/or an IP address of the merchant computer terminal) associated with a fraudulent financial transaction; retrieve from a local or remote memory unit, and/or receive via wireless communication or data transmission over one or more radio links or wireless communication channels, an actual configuration, parameters, and/or specifications associated with the merchant computer terminal; retrieve from a local or remote memory unit, and/or receive via wireless communication or data transmission over one or more radio links or wireless communication channels, up-to-date dispute rules associated with chargebacks, the dispute rules including merchant computer terminal requirements; determine merchant computer terminal requirements from processor analysis of the dispute rules; compare the merchant computer terminal requirements from the current dispute rules with the actual configuration, parameters, and/or specifications associated with the merchant computer terminal to identify if the merchant computer terminal is non-complaint with the dispute rules; if the merchant computer terminal is non-complaint, then generate an electronic notification that includes an
- FIG. 7 illustrates a computer-implemented method 320 of identifying compromised, or potentially compromised, merchants and/or reducing future chargebacks (or actual losses) or fraud.
- the method 320 may include, via one or more processors and/or transceivers (such as via wireless communication or data transmission over one or more radio frequency links and/or wireless communication channels), (1) generating a list of chargebacks for a given period of time (block 321 ); (2) inputting the list of chargebacks associated with the merchant (and/or associated facts related to the underlying financial transaction) into a machine learning program that is trained to identify a reason why each chargeback was generated (or actual loss was incurred), and/or a type or classification of each chargeback (block 322 ) (such stolen card, lost card, account take over, fraudulent application, compromised computing system, identity theft, counterfeit card, etc.); (3) analyzing the reason and/or the type or classification of each chargeback to identify those chargebacks associated with a potentially compromised merchant computer system (block 323 ) (such as by in
- FIG. 8 illustrates a computer-implemented method 330 of identifying compromised, or potentially compromised, merchants.
- the method 330 may include, via one or more processors and/or transceivers (such as via wireless communication or data transmission over one or more radio frequency links and/or wireless communication channels), (1) generating financial fraud electronic alerts using a rules-based model or engine (block 331 ); (2) inputting the financial fraud electronic alerts into a machine learning program trained to determine a reason why each fraud alert was generated (such stolen card, lost card, account take over, fraudulent application, compromised computing system, identity theft, counterfeit card, etc.), and/or a type or classification of each fraud alert (block 332 ); (3) analyzing the reason and/or the type or classification of each fraud alert to identify those fraud alerts associated with a potentially compromised merchant computer system (block 333 ) (such as by inputting the reason and/or the type or classification of each fraud alert into a second machine learning program trained to identify fraud alerts associated with potentially compromised merchant computer systems or determine unusual fraud alerts for individual merchants
- an exemplary computer-implemented method 340 may be used to detect potential application fraud, e.g., to detect instances where an applicant for a loan, credit, checking, savings, investment and/or other type of account, service or benefit is not the person that he or she purports to be.
- application data indicative of applicant entries in one or more fields of an application associated with a potential account, may be received (block 341 ).
- the application may be an application received from a source computing device via the Internet (e.g., via a web page, via a dedicated application, via email, etc.), for example.
- the source computing device via which the applicant submitted the application data, may be identified (block 342 ).
- the source computing device may be similar to one of computing devices 20 of FIG. 1 , for example.
- block 342 may include identifying an IP address of the source computing device.
- Search history data indicative of one or more search terms submitted to an Internet-based search engine (e.g., a Google® or Yahoo® search engine) via the source computing device, may be retrieved (block 343 ).
- the search history data may be retrieved from a database maintained by an ISP of the applicant, or a temporary database that is locally constructed based upon information received directly from the source computing device, for example.
- the search history data may include search terms that were submitted to the Internet-based search engine from the identified IP address.
- the applicant may not be the person whom the applicant purports to be (block 344 ), e.g., the person whose name and/or signature is included on the application, or is otherwise listed or indicated in connection with the application.
- the application may be flagged at block 344 for a further, more in-depth review.
- it may instead be determined that the applicant likely is the person whom he or she purports to be, such that it is not necessary to flag the application for further review.
- Block 344 may include various operations, depending upon the embodiment and/or scenario. For example, block 344 may include comparing information included in retrieved search term(s) (and/or included in search results) to information included in the applicant entries in the application fields. As other examples, block 344 may include comparing a name included in the search term(s) to a name included in the applicant entries, determining that the search term(s) is/are directed to discovering an address associated with the name (e.g., by including the terms “Jonathon Doe address” or “Jonathon Doe residence,” etc.), and/or determining that the search term(s) is/are directed to discovering an employment history associated with the name (e.g., by including the terms “Jonathon Doe employer” or “Jonathon Doe work history,” etc.).
- an address associated with the name e.g., by including the terms “Jonathon Doe address” or “Jonathon Doe residence,” etc.
- the search term(s) is/are directed to discovering an employment history associated with the
- An indication of potential application fraud may be caused to be displayed to one or more people via one or more respective computing device user interfaces (block 345 ).
- the indication may also specify the purported applicant, the actual applicant, and/or other relevant information.
- the indication may be sent to a computing device of a card issuer or other entity, for example, to prompt a full review of the application (e.g., a manual investigation).
- Block 345 may be implemented by notification unit 56 of FIG. 1 , for example.
- the method 340 may include one or more additional blocks not shown in FIG. 9 .
- block 344 includes applying application fraud detection rules to the application data and the search history data
- the method 340 may include an additional block in which the application fraud detection rules are generated or updated.
- the rules may be generated or updated by training a machine learning program, such as any of the types of machine learning programs discussed above in connection with ML rule generator 40 of FIG. 1 or process stage 84 of FIG. 2 .
- the machine learning program may be trained using historical application fraud determinations made in connection with a plurality of other applications, and additional search history data associated with additional source computing devices (e.g., the devices that submitted the data for those applications), for example.
- FIG. 10 illustrates an exemplary computer-implemented method 350 of using IP address and/or browsing activity to identify fraudulent online or virtual applications.
- the method 350 may include, via one or more processors and/or transceivers, receiving an online or virtual application via wireless communication or data transmission over one or more radio links or wireless communication channels (block 351 ), such as an application for financial services, such as vehicle, home, or personal loans, or credit cards.
- the virtual application may include an IP address identification and/or a recent browser activity history of the computer.
- the method 350 may include determining or retrieving a name of the applicant listed on the online application (block 352 ).
- the method 350 may include determining an IP address of the source computer that generated the online application (block 353 ).
- the method 350 may include retrieving or receiving recent online browsing activity of the source computer (such as by using the IP address and/or browsing activity received with the virtual application, or querying the source computer for such information) (block 354 ).
- the method 350 may include determining if the recent online activity of the source computer includes internet searches on the applicant's name and/or the applicant's social media presence or website (block 355 ) (indicating that the person submitting the application retrieved facts about the named applicant in an effort to perform fraudulent activity or impersonate the named applicant). If so, the method 350 may include flagging the virtual application as fraudulent, and/or in need of further manual or processor review (block 356 ).
- a computer-implemented method of using browsing activity to identify fraudulent online or virtual applications may be provided.
- the method may include (1) receiving, via one or more processors and/or transceivers, a virtual application over one or more radio frequency links or wireless communication channels; (2) determining, via the one or more processors, an applicant name on the virtual application; (3) determining, via the one or more processors, an IP address of a source computer from which the virtual application originated; (4) determining or receiving, via the one or more processors and/or transceivers, an online browsing or search history associated with the IP address and/or source computer; (5) determining, via the one or more processors, if the online browsing or search history indicates recent internet searches for or on the applicant name; and/or (6) if so, flagging, via the one or more processors, the virtual application as fraudulent and generating an electronic alert indicating that the virtual application is fraudulent to facilitating identifying fraudulent virtual or online applications for goods or services.
- the virtual application may include a field or routine that records and retrieves recent online browsing or searching activity of the source computer, and that information is transmitted from the source computer along with the virtual application when the virtual application is submitted.
- the virtual application may carry with it online browsing or search activity associated with the source computer when it is transmitted or submitted to a remote server, such as a financial services provider remote server.
- the virtual application may include a field or routine that records and retrieves recent social media searching activity of the source computer.
- the virtual application may include a field or routine that records and retrieves recent internet search engine searching activity of the source computer.
- the virtual application may include an IP address field of the source computer.
- the virtual application may include a current GPS location of the source computer.
- the method may further include determining, via the one or more processors, whether the named applicant is an existing customer; if so, receiving, via the one or more processors, customer data from one or more sources indicating a current customer location; determining, via the one or more processors, whether the current customer location corresponds to, or is within a predetermined distance of, a location of the source computer from which the virtual application originated; and/or if the current customer location does not correspond to the location of the source computer, then generating, via the one or more processors, an electronic alert indicating such.
- Determining an online browsing or search history associated with the IP address and/or source computer may include retrieving an online browsing or search history stored with or within the virtual application.
- Receiving an online browsing or search history associated with the IP address and/or source computer may include receiving, via the one or more processors and/or transceivers, an online browsing or search history over one or more radio links or wireless communication channels via wireless communication or data transmission.
- the virtual or online application may be an application for financial services or products, such vehicle, home, or personal loans; a credit card application; or an application for auto, homeowners, or life insurance.
- a computer system configured to use IP addresses and/or browsing activity to identify fraudulent online or virtual applications.
- the computer system may include one or more processors and/or transceiver configured to: receive a virtual application via wireless communication or data transmission over one or more radio frequency links or wireless communication channels; determine an applicant name on the virtual application (or retrieve the virtual applicant name saved within the virtual application); determine an IP address of a source computer from which the virtual application originated; determine or receive an online browsing or search history associated with the IP address and/or source computer; determine if the online browsing or search history indicates recent internet searches for, or on, the applicant name; and/or if so, flag the virtual application as fraudulent and generate an electronic alert indicating that the virtual application is fraudulent to facilitating identifying fraudulent virtual or online applications for goods or services.
- FIG. 11 illustrates a computer-implemented method 360 of identifying mortgage fraud.
- the method 360 may include, via one or more processors and/or transceivers (such as via wireless communication or data transmission over one or more radio frequency links or wireless communication channels), (1) receiving a virtual application for a home loan or line of credit for a property and an identity of a person or entity applying (block 361 ); (2) receiving home loan or line of credit information for the property from multiple sources or lenders, each of the multiple sources or lenders having provided a previous home loan or line of credit for the property (block 362 ), such as providing a previous home loan or line of credit for the property to the person or entity applying for another home loan or line of credit; (3) retrieving from a memory, or receiving an appraisal for the property, the appraisal including an estimated or actual value of the property (block 363 ), such as receiving a virtual appraisal from another lender; (4) determining that a total amount of the multiple home loans or lines of credit for the property exceed the estimated or actual value of the property, or a percentage thereof (block
- FIG. 12 depicts an exemplary computer system 500 in which the techniques described herein may be implemented, according to one embodiment.
- the computer system 500 of FIG. 12 may include a computing device in the form of a computer 510 .
- Components of the computer 510 may include, but are not limited to, a processing unit 520 , a system memory 530 , and a system bus 521 that couples various system components including the system memory 530 to the processing unit 520 .
- the system bus 521 may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, or a local bus, and may use any suitable bus architecture.
- such architectures include the Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus (also known as Mezzanine bus).
- ISA Industry Standard Architecture
- MCA Micro Channel Architecture
- EISA Enhanced ISA
- VESA Video Electronics Standards Association
- PCI Peripheral Component Interconnect
- Computer 510 may include a variety of computer-readable media.
- Computer-readable media may be any available media that can be accessed by computer 510 and may include both volatile and nonvolatile media, and both removable and non-removable media.
- Computer-readable media may comprise computer storage media and communication media.
- Computer storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules or other data.
- Computer storage media may include, but is not limited to, RAM, ROM, EEPROM, FLASH memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can accessed by computer 510 .
- Communication media typically embodies computer-readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.
- modulated data signal means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal.
- communication media may include wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, radio frequency (RF), infrared and other wireless media. Combinations of any of the above are also included within the scope of computer-readable media.
- the system memory 530 may include computer storage media in the form of volatile and/or nonvolatile memory such as read only memory (ROM) 531 and random access memory (RAM) 532 .
- ROM read only memory
- RAM random access memory
- BIOS basic input/output system
- RAM 532 typically contains data and/or program modules that are immediately accessible to, and/or presently being operated on, by processing unit 520 .
- FIG. 12 illustrates operating system 534 , application programs 535 , other program modules 536 , and program data 537 .
- the computer 510 may also include other removable/non-removable, volatile/nonvolatile computer storage media.
- FIG. 12 illustrates a hard disk drive 541 that reads from or writes to non-removable, nonvolatile magnetic media, a magnetic disk drive 551 that reads from or writes to a removable, nonvolatile magnetic disk 552 , and an optical disk drive 555 that reads from or writes to a removable, nonvolatile optical disk 556 such as a CD ROM or other optical media.
- removable/non-removable, volatile/nonvolatile computer storage media that can be used in the exemplary operating environment include, but are not limited to, magnetic tape cassettes, flash memory cards, digital versatile disks, digital video tape, solid state RAM, solid state ROM, and the like.
- the hard disk drive 541 may be connected to the system bus 521 through a non-removable memory interface such as interface 540
- magnetic disk drive 551 and optical disk drive 555 may be connected to the system bus 521 by a removable memory interface, such as interface 550 .
- the drives and their associated computer storage media discussed above and illustrated in FIG. 12 provide storage of computer-readable instructions, data structures, program modules and other data for the computer 510 .
- hard disk drive 541 is illustrated as storing operating system 544 , application programs 545 , other program modules 546 , and program data 547 .
- operating system 544 application programs 545 , other program modules 546 , and program data 547 are given different numbers here to illustrate that, at a minimum, they are different copies.
- a user may enter commands and information into the computer 510 through input devices such as cursor control device 561 (e.g., a mouse, trackball, touch pad, etc.) and keyboard 562 .
- cursor control device 561 e.g., a mouse, trackball, touch pad, etc.
- keyboard 562 e.g., a mouse, trackball, touch pad, etc.
- a monitor 591 or other type of display device is also connected to the system bus 521 via an interface, such as a video interface 590 .
- computers may also include other peripheral output devices such as printer 596 , which may be connected through an output peripheral interface 595 .
- the computer 510 may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer 580 .
- the remote computer 580 may be a personal computer, a server, a router, a network PC, a peer device or other common network node, and may include many or all of the elements described above relative to the computer 510 , although only a memory storage device 581 has been illustrated in FIG. 12 .
- the logical connections depicted in FIG. 12 include a local area network (LAN) 571 and a wide area network (WAN) 573 , but may also include other networks.
- LAN local area network
- WAN wide area network
- Such networking environments are commonplace in hospitals, offices, enterprise-wide computer networks, intranets and the Internet.
- the computer 510 When used in a LAN networking environment, the computer 510 is connected to the LAN 571 through a network interface or adapter 570 .
- the computer 510 may include a modem 572 or other means for establishing communications over the WAN 573 , such as the Internet.
- the modem 572 which may be internal or external, may be connected to the system bus 521 via the input interface 560 , or other appropriate mechanism.
- the communications connections 570 , 572 which allow the device to communicate with other devices, are an example of communication media, as discussed above.
- program modules depicted relative to the computer 510 may be stored in the remote memory storage device 581 .
- FIG. 12 illustrates remote application programs 585 as residing on memory device 581 .
- the techniques for detecting and/or classifying fraud described above may be implemented in part or in their entirety within a computer system such as the computer system 500 illustrated in FIG. 12 .
- the computer 510 may be included in AFSS 12 of FIG. 1 , for example, and/or the remote application programs 585 may include one or more applications of either FAMS 14 , one of cardholder computing device 20 , one of merchant computing systems 22 , or a computing device of other sources 24 .
- the functionality of fraud detection/classification unit 36 of FIG. 1 may be implemented by one or more of application programs 535 and/or other program modules 536 .
- hard disk drive 541 e.g., as program data 547
- magnetic disk 552 and/or optical disk drive 555 and/or the data retrieved by fraud detection/classification unit 36 of FIG. 1 may be stored in hard disk drive 541 (e.g., as program data 547 ) and/or RAM 532 (e.g., as program data 537 ).
- a computer-implemented method, implemented in one or more servers or other computing devices, of identifying a potential chargeback scenario may include (1) generating or updating, by one or more processors of the one or more servers, chargeback candidate detection rules, at least by training a machine learning program using at least (i) transaction data associated with a plurality of financial transactions, and (ii) chargeback determinations each made in accordance with chargeback rules associated with a card network entity, and each corresponding to a respective one of the plurality of financial transactions; (2) receiving, by the one or more processors, an indication that fraud has been confirmed for a first financial transaction associated with a merchant and a first financial account; (3) retrieving, by the one or more processors and from an account records database, first transaction data associated with the first financial transaction; (4) determining, by the one or more processors applying the chargeback candidate detection rules to the first transaction data, that a chargeback may be warranted for the first financial transaction; and/or (5) causing, by the one or more processors, an indication that the
- the method may further include determining, by the one or more processors applying the chargeback rules to (i) the first transaction data and (ii) additional data associated with the first financial transaction, that a chargeback is warranted for the first financial transaction.
- the method may further include, prior to determining that the chargeback is warranted, receiving at least a portion of the additional data from the merchant. Additionally or alternatively, the portion of the additional data received from the merchant may include data indicative of a card information entry mode used to conduct the first financial transaction.
- the method may further include retrieving, by the one or more processors and from the account records database, first account data associated with the first financial account, and determining that the chargeback may be warranted for the first financial transaction may further be performed by the one or more processors applying the chargeback candidate detection rules to the first account data.
- a computer-implemented method, implemented in one or more servers or other computing devices, of detecting potential application fraud may include (1) receiving, by one or more processors of the one or more servers, application data indicative of applicant entries in one or more fields of an application associated with a potential account; (2) identifying, by the one or more processors, a source computing device via which the applicant submitted the application data; (3) retrieving, by the one or more processors and from a database, search history data indicative of one or more search terms submitted to an Internet-based search engine via the source computing device; (4) determining, by the one or more processors analyzing the application data and the search history data, that the applicant may not be a person whom the applicant purports to be; and/or (5) causing, by the one or more processors, an indication of potential application fraud to be displayed to one or more people via one or more respective computing device user interfaces.
- the method may include additional, fewer or alternative actions, such as any of those discussed elsewhere herein.
- identifying the source computing device may include identifying an Internet Protocol (IP) address of the source computing device.
- retrieving search history data may include retrieving search history data indicative of search terms submitted to the Internet-based search engine from the identified IP address.
- IP Internet Protocol
- determining that the applicant may not be the person whom the applicant purports to be may include comparing information included in the one or more search terms to information included in the applicant entries in the one or more fields; comparing a name included in the one or more search terms to a name included in the applicant entries in the one or more fields; determining that the applicant may not be the person whom the applicant purports to be may further include determining that the one or more search terms are directed to discovering an address associated with the name; and/or determining that the one or more search terms are directed to discovering an employment history associated with the name.
- (1) determining that the applicant is not, or may not be, the person whom the applicant purports to be may include determining, by the one or more processors applying application fraud detection rules to the application data and the search history data, that the applicant may not be a person whom the applicant purports to be; and/or (2) the method may further include generating or updating, by the one or more processors, the application fraud detection rules, at least by training a machine learning program using at least (i) historical application fraud determinations made in connection with a plurality of applications, and (ii) additional search history data associated with a plurality of additional source computing devices.
- a computer system for identifying a potential chargeback scenario may include (1) an account records database configured to store data associated with a plurality of financial accounts; (2) a rules database configured to store chargeback candidate detection rules; (3) one or more processors; and/or (4) a non-transitory memory.
- the non-transitory memory stores instructions that, when executed by the one or more processors, may cause the one or more processors to (1) generate or update the chargeback candidate detection rules, at least by training a machine learning program using at least (i) transaction data associated with a plurality of financial transactions stored in the account records database, and (ii) chargeback determinations each made in accordance with chargeback rules associated with a card network entity, and each corresponding to a respective one of the plurality of financial transactions; (2) receive an indication that fraud has been confirmed for a first financial transaction associated with a merchant and a first financial account; (3) retrieve, from the account records database, first transaction data associated with the first financial transaction; (4) determine, by applying the chargeback candidate detection rules stored in the rules database to the first transaction data, that a chargeback may be warranted for the first financial transaction; and/or (5) cause an indication that the chargeback may be warranted to be displayed to one or more people via one or more respective computing device user interfaces, wherein the indication may further specify at least the first financial transaction and the merchant
- the instructions may further cause the one or more processors to determine, by applying the chargeback rules to (i) the first transaction data and (ii) additional data associated with the first financial transaction, that a chargeback is warranted for the first financial transaction. Additionally or alternatively, the instructions may further cause the one or more processors to, prior to determining that the chargeback is warranted, receive at least a portion of the additional data from the merchant.
- the portion of the additional data received from the merchant may include data indicative of a card information entry mode used to conduct the first financial transaction.
- the instructions may further cause the one or more processors to retrieve, from the account records database, first account data associated with the first financial account, and/or the instructions may cause the one or more processors to determine that the chargeback may be warranted for the first financial transaction further by applying the chargeback candidate detection rules to the first account data.
- the instructions may cause the one or more processors to determine that a chargeback may be warranted for the first financial transaction based at least upon a card associated with the first financial account being expired when the first financial transaction occurred. Additionally or alternatively, the instructions may cause the one or more processors to determine that a chargeback may be warranted for the first financial transaction based at least upon (i) a dollar amount of the first financial transaction, and/or (ii) a second financial transaction duplicating one or more characteristics of the first financial transaction.
- a computer system for detecting potential application fraud may include (1) a search history database configured to store data associated with a plurality of Internet searches; (2) one or more processors; and/or (3) a non-transitory memory.
- the non-transitory memory stores instructions that, when executed by the one or more processors, may cause the one or more processors to (1) receive application data indicative of applicant entries in one or more fields of an application associated with a potential account; (2) identify a source computing device via which the applicant submitted the application data; (3) retrieve, from the search history database, search history data indicative of one or more search terms submitted to an Internet-based search engine via the source computing device; (4) determine, by analyzing the application data and the search history data, that the applicant may not be a person whom the applicant purports to be; and/or (5) cause an indication of potential application fraud to be displayed to one or more people via one or more respective computing device user interfaces.
- the system may include additional, fewer or alternative components, features and/or functionality, such as any of those discussed elsewhere herein.
- the instructions may cause the one or more processors to identify the source computing device at least by identifying an Internet Protocol (IP) address of the source computing device.
- IP Internet Protocol
- the search history data may be indicative of search terms submitted to the Internet-based search engine from the identified IP address.
- the instructions may cause the one or more processors to determine that the applicant may not be the person whom the applicant purports to be (i) at least by comparing information included in the one or more search terms to information included in the applicant entries in the one or more fields; (ii) at least by comparing a name included in the one or more search terms to a name included in the applicant entries in the one or more fields; (iii) further by determining that the one or more search terms are directed to discovering an address associated with the name; and/or (iv) further by determining that the one or more search terms are directed to discovering an employment history associated with the name.
- the instructions may cause the one or more processors to determine that the applicant may not be the person whom the applicant purports to be at least by determining, by applying application fraud detection rules to the application data and the search history data, that the applicant may not be the person whom the applicant purports to be; and/or (2) the instructions may further cause the one or more processors to generate or update the application fraud detection rules, at least by training a machine learning program using at least (i) historical application fraud determinations made in connection with a plurality of applications, and (ii) additional search history data associated with a plurality of additional source computing devices.
- a non-transitory, computer-readable medium storing instructions that, when executed by one or more processors, may cause the one or more processors to (1) generate or update chargeback candidate detection rules, at least by training a machine learning program using at least (i) transaction data associated with a plurality of financial transactions, and (ii) chargeback determinations each made in accordance with chargeback rules associated with a card network entity, and each corresponding to a respective one of the plurality of financial transactions; (2) receive an indication that fraud has been confirmed for a first financial transaction associated with a merchant and a first financial account; (3) retrieve, from an account records database, first transaction data associated with the first financial transaction; (4) determine, by applying the chargeback candidate detection rules to the first transaction data, that a chargeback may be warranted for the first financial transaction; and/or (5) cause an indication that the chargeback may be warranted to be displayed to one or more people via one or more respective computing device user interfaces, wherein the indication may further specify at least the first financial transaction and the merchant.
- the system may
- the instructions may further cause the one or more processors to determine, by applying the chargeback rules to (i) the first transaction data and (ii) additional data associated with the first financial transaction, that a chargeback is warranted for the first financial transaction. Additionally or alternatively, the instructions may further cause the one or more processors to, prior to determining that the chargeback is warranted, receive at least a portion of the additional data from the merchant.
- the portion of the additional data received from the merchant may include data indicative of a card information entry mode used to conduct the first financial transaction.
- the instructions may further cause the one or more processors to retrieve, from the account records database, first account data associated with the first financial account, and/or the instructions may cause the one or more processors to determine that the chargeback may be warranted for the first financial transaction further by applying the chargeback candidate detection rules to the first account data.
- the instructions may cause the one or more processors to determine that a chargeback may be warranted for the first financial transaction based at least upon a card associated with the first financial account being expired when the first financial transaction occurred.
- a non-transitory, computer-readable medium stores instructions that, when executed by one or more processors, may cause the one or more processors to (1) receive application data indicative of applicant entries in one or more fields of an application associated with a potential account; (2) identify a source computing device via which the applicant submitted the application data; (3) retrieve, from a search history database, search history data indicative of one or more search terms submitted to an Internet-based search engine via the source computing device; (4) determine, by analyzing the application data and the search history data, that the applicant may not be a person whom the applicant purports to be; and/or (5) cause an indication of potential application fraud to be displayed to one or more people via one or more respective computing device user interfaces.
- the computer-readable medium may store instructions that include additional, fewer or alternative actions, such as any of those discussed elsewhere herein.
- the instructions may cause the one or more processors to identify the source computing device at least by identifying an Internet Protocol (IP) address of the source computing device.
- IP Internet Protocol
- the search history data may be indicative of search terms submitted to the Internet-based search engine from the identified IP address.
- the instructions may cause the one or more processors to determine that the applicant may not be the person whom the applicant purports to be at least by comparing information included in the one or more search terms to information included in the applicant entries in the one or more fields.
Landscapes
- Engineering & Computer Science (AREA)
- Business, Economics & Management (AREA)
- Accounting & Taxation (AREA)
- Theoretical Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Strategic Management (AREA)
- General Business, Economics & Management (AREA)
- Finance (AREA)
- Software Systems (AREA)
- Development Economics (AREA)
- Computer Security & Cryptography (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Artificial Intelligence (AREA)
- Economics (AREA)
- Mathematical Physics (AREA)
- Data Mining & Analysis (AREA)
- Evolutionary Computation (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Entrepreneurship & Innovation (AREA)
- Marketing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Medical Informatics (AREA)
- Multimedia (AREA)
- Computational Linguistics (AREA)
- Microelectronics & Electronic Packaging (AREA)
- Game Theory and Decision Science (AREA)
- Databases & Information Systems (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
Abstract
A method of using browsing activity to identify fraudulent online or virtual applications includes receiving a virtual application over one or more radio frequency links, determining an applicant name on the virtual application, determining an IP address of a source computer from which the virtual application originated, determining an online browsing or search history associated with the IP address, determining whether the online browsing or search history indicates recent Internet searches for the applicant name, and, in response to determining that the online browsing or search history does indicate recent Internet searches for the applicant name, flagging the virtual application as fraudulent and generating an electronic alert indicating that the virtual application is fraudulent to facilitate identifying fraudulent virtual applications for goods or services.
Description
- This application is a continuation of, and claims the benefit of U.S. Pat. No. 17,827,015, filed on May 27, 2022, and entitled “Identifying Fraudulent Online Applications,” which claims the benefit of U.S. Pat. No. 16,913,814, filed on Jun. 26, 2020, and entitled “Identifying Fraudulent Online Applications,” which claims the benefit of U.S. patent application Ser. No. 15/465,874, filed on Mar. 22, 2017, now U.S. Pat. No. 10,825,028, issued on Nov. 3, 2020 and entitled “Identifying Fraudulent Online Applications,” which claims the benefit of U.S. Patent Application No. 62/313,196, filed on Mar. 25, 2016 and entitled “Reducing Financial Fraud Using Machine Learning and Other Techniques,” U.S. Patent Application No. 62/318,423, filed on Apr. 5, 2016 and entitled “Reducing Financial Fraud Using Machine Learning and Other Techniques,” U.S. Patent Application No. 62/331,530, filed on May 4, 2016 and entitled “Reducing Financial Fraud Using Machine Learning and Other Techniques,” and U.S. Patent Application No. 62/365,699, filed on Jul. 22, 2016 and entitled “Detecting and/or Preventing Financial Fraud Using Geolocation Data,” the disclosures of which are hereby incorporated herein by reference in their entireties.
- The present disclosure generally relates to financial fraud and, more specifically, to processing techniques that use machine learning to identify application-related to fraud (e.g., fraudulent online applications).
- Financial fraud, in its many forms, is a problem of enormous magnitude and scope, causing billions of dollars in economic losses and impacting many millions of people. Types of financial fraud include use of a lost or stolen card, account takeover, skimming, chargeback (“friendly”) fraud, counterfeiting, forgeries and application (e.g., loan application) fraud, to name just a few. The problem only continues to grow as various technological advances, intended to improve convenience and efficiency in the marketplace, provide new opportunities for bad actors. For example, an ever-increasing amount of fraud may be linked to online transactions made via the Internet.
- Various software applications have been developed to detect potentially fraudulent transactions. For example, dollar amounts and geographic locations have generally been used to flag particular credit or debit card transactions, with cardholders then being contacted by employees of the card issuer to determine whether the transactions were indeed fraudulent. To ensure that most instances of fraud are captured, however, such techniques generally have a low threshold for triggering a fraud alert. As a result, numerous fraud alerts are false positives. The prevalence of false positives leads to a large cost in terms of the drain on human resources (e.g., calling customers to discuss each suspect transaction, and/or other manual investigation techniques), and considerable distraction or annoyance for cardholders. To provide a solution to these shortcomings in the field of automated fraud detection, innovative processing techniques capable of reducing false positives are needed.
- Other conventional processes relating to financial fraud are likewise resource-intensive. For example, card issuers today perform manual reviews of fraudulent transactions to determine whether, under the lengthy and complex rules of a particular card network, chargebacks are appropriate (i.e., payments from the merchant or acquiring/merchant bank back to the card issuer). These manual reviews are another significant drain on human resources, and may be subject to human error. Moreover, failure to properly identify chargeback scenarios may cost the card issuer money.
- As another example, application fraud (e.g., obtaining a loan in the name of another person) may sometimes not be discovered until the loan has been made. By that point in time, any losses might not be fully recoverable.
- The present embodiments may, inter alia, automatically detect application fraud. The detection may be based upon various types of information, and the rules used to detect such scenarios may be generated by a machine learning program.
- In one embodiment, a computer-implemented method of using browsing activity to identify fraudulent online or virtual applications includes: (1) receiving, by one or more processors and via one or more transceivers, a virtual application over one or more radio frequency links; (2) determining, by the one or more processors, an applicant name on the virtual application; (3) determining, by the one or more processors, an IP address of a source computer from which the virtual application originated; (4) determining, by the one or more processors, an online browsing or search history associated with the IP address; (5) determining, by the one or more processors, whether the online browsing or search history indicates recent Internet searches for the applicant name; and/or (6) in response to determining that the online browsing or search history does indicate recent Internet searches for the applicant name, (i) flagging, by the one or more processors, the virtual application as fraudulent and (ii) generating an electronic alert indicating that the virtual application is fraudulent to facilitate identifying fraudulent virtual applications for goods or services. The method may include additional, less, or alternate actions, including those discussed elsewhere herein.
- In another embodiment, a computer system is configured to use IP addresses and browsing activity to identify fraudulent virtual applications. The computer system includes one or more transceivers, and one or more processors configured to: (1) receive, via the one or more transceivers, a virtual application over one or more radio frequency links; (2) determine an applicant name on the virtual application; (3) determine an IP address of a source computer from which the virtual application originated; (4) determine an online browsing or search history associated with the IP address; (5) determine whether the online browsing or search history indicates recent Internet searches for the applicant name; and/or (6) in response to determining that the online browsing or search history does indicate recent Internet searches for the applicant name, (i) flag the virtual application as fraudulent and (ii) generate an electronic alert indicating that the virtual application is fraudulent to facilitate identifying fraudulent virtual applications for goods or services. The computer system may include additional, less, or alternate functionality, including that discussed elsewhere herein.
- In another embodiment, a non-transitory, computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to: (1) receive, via one or more transceivers, a virtual application over one or more radio frequency links; (2) determine an applicant name on the virtual application; (3) determine an IP address of a source computer from which the virtual application originated; (4) determine an online browsing or search history associated with the IP address; (5) determine whether the online browsing or search history indicates recent Internet searches for the applicant name; and/or (6) in response to determining that the online browsing or search history does indicate recent Internet searches for the applicant name, (i) flag the virtual application as fraudulent and (ii) generate an electronic alert indicating that the virtual application is fraudulent to facilitate identifying fraudulent virtual applications for goods or services.
- The Figures described below depict various aspects of the systems and methods disclosed herein. It should be understood that each Figure depicts an embodiment of a particular aspect of the disclosed systems and methods, and that each of the Figures is intended to accord with a possible embodiment thereof.
-
FIG. 1 depicts an exemplary environment in which techniques for fraud detection, verification and/or classification may be implemented, according to one embodiment. -
FIG. 2 depicts an exemplary process flow for machine learning of fraud detection, verification and/or classification rules, according to one embodiment. -
FIGS. 3A-3F depict exemplary process flows for machine learning of particular types of fraud detection, verification and/or classification rules, according to different embodiments. -
FIGS. 4A-4F depict exemplary factors and algorithms that may be used in connection with various fraud detection, verification and/or classification rule sets, according to different embodiments. -
FIG. 5 depicts a flow diagram of an exemplary method for identifying a potential chargeback scenario, according to one embodiment. -
FIG. 6 illustrates an exemplary computer-implemented method of determining that a merchant computer terminal warrants a chargeback after a consumer dispute or fraudulent transaction occurs based upon dispute rules. -
FIG. 7 illustrates an exemplary computer-implemented method of detecting or identifying potentially compromised merchant computing systems based upon processor analysis of electronically-generated chargebacks or actual losses. -
FIG. 8 illustrates an exemplary computer-implemented method of detecting or determining potentially compromised merchant computing systems based upon processor analysis of electronically-generated fraud alerts. -
FIG. 9 depicts a flow diagram of an exemplary method for detecting potential application fraud, according to one embodiment. -
FIG. 10 illustrates an exemplary computer-implemented method of using IP address and/or browsing activity to identify fraudulent online or virtual applications, according to one embodiment. -
FIG. 11 illustrates an exemplary computer-implemented method of detecting or identifying potential mortgage fraud. -
FIG. 12 depicts an exemplary computer system in which the techniques described herein may be implemented, according to one embodiment. - The embodiments described herein relate to, inter alia, wholly or partially automated detection, verification and/or classification of financial fraud. For ease of explanation, and unless otherwise clearly indicated by the context of usage, “detecting” or “determining” fraud may be used herein to refer to initially flagging fraudulent (or potentially fraudulent) activity, to verifying/confirming that suspect/flagged activity was indeed fraudulent, or generally to both. The systems and techniques described herein may be used, for example, to identify, prevent and/or quantify/measure instances of lost or stolen card use, account takeover, counterfeiting, skimming, chargeback (“friendly”) fraud, collusive merchant fraud, application (e.g., loan application) fraud, mortgage fraud, and/or one or more other types of fraud relating to existing and/or potential financial transactions and/or accounts. Moreover, those skilled in the art will appreciate that at least some of the technical advancements described below (and/or shown in the accompanying figures) are not necessarily restricted to the financial field.
- In some embodiments, a fraud detection and/or classification system may analyze data relating to a number of existing or potential financial accounts. The analysis/processing may be performed in batch processing operations, or substantially in real-time (e.g., as the data is generated and/or as financial transactions occur, etc.), and the data may be obtained from a variety of sources based upon the particular embodiment and/or scenario. In one embodiment, for example, data from financial account records may be analyzed, along with data indicating online activity of an account holder, location data (e.g., global positioning satellite (GPS) data from a smartphone or vehicle of the account holder) and/or other data, to determine whether a particular financial transaction was fraudulent or likely fraudulent. The analysis may be performed automatically after the transaction has been made, or may be performed in response to a person or algorithm flagging the transaction as a potentially fraudulent one, for example.
- The analysis may include determining whether the account holder has expressed interest in the object (e.g., product or service) of the transaction or the merchant, and/or determining whether the transaction is consistent with spending patterns associated with the account holder (e.g., spending patterns identified using the account holder's transaction records), for example. In the case of multiple account holders (e.g. multiple credit or debit card holders), accuracy may be improved by identifying spending patterns at the individual level rather than, or in addition to, at the aggregate account level. For example, a maximum amount of money typically spent in a single transaction (e.g., over the course of a one-month window, etc.) may be determined for each of two cardholders listed on a single account, and the maximum amount for the cardholder who purportedly made a particular purchase may be compared to the purchase amount to determine whether fraud is suspected.
- In another exemplary embodiment, financial transaction data may be analyzed to determine whether a chargeback payment from the merchant or acquiring bank to a card issuer may be appropriate in connection with a particular fraudulent transaction. For example, the card information entry mode (e.g., collecting card information by inserting the card in a chip reader, swiping the card, manually entering the card information, etc.), the transaction amount, the similarity to other transaction(s), and/or other information may be used to identify which fraudulent transactions are relatively strong chargeback candidates. The analysis may be performed in response to a cardholder reporting the transaction as fraudulent, or after a card issuer has confirmed that the transaction was fraudulent, for example. For the subset of instances where a fraudulent transaction has been identified as a chargeback candidate, a full set of chargeback rules (e.g., devised by a card network entity such as VISA®, Mastercard®, American Express®, Discover®, etc.) may be manually or automatically applied to determine whether a chargeback process should be initiated (or continued).
- In another exemplary embodiment, application data (e.g., information entered in fields of an online application) may be analyzed in conjunction with search terms entered by a user at a computing device (e.g., the device from which the user submitted the application information) to determine whether the person proffering the application is not the person that he or she purports to be. For example, if the person submitting an application had previously used an Internet-based search engine to search for results associated with the purported applicant's name (e.g., by using the name as a search term, possibly in addition to other terms such as “address” and/or “employer,” etc.), the application may be flagged for suspected fraud, and subjected to additional steps of manual and/or automated review.
- In another exemplary embodiment, a fraud dispute resolution process (e.g., after a customer has reported a fraudulent or unrecognized transaction associated with his or her account) may be facilitated using machine learning techniques. For example, a machine learning program may be trained, using past dispute resolution interactions with customers and the associated outcomes (fraud determinations), to identify various types of information that, if elicited from customers, tend to be indicative of fraud or the absence thereof. When fraud is suspected for a particular transaction, one or more queries for the individual purportedly making the transaction may be automatically generated using the types of information identified by the machine learning program, as well as information about the suspect transaction and/or related transactions (e.g., dates, locations, amounts, etc.). In some embodiments and/or scenarios, responses to the queries may be collected and analyzed to automatically generate additional queries, with the end goal of discerning whether the transaction was authorized. For example, queries may include asking whether a cardholder recalls particular other transactions that appear on the cardholder's account and were made around the same time as the suspect transaction (and/or from the same merchant), asking whether the cardholder recalls being in a particular location at a particular time (e.g., a location associated with another transaction appearing on the cardholder's account), whether the cardholder is aware of a particular billing alias used by a merchant, and so on.
- In another exemplary embodiment, image data corresponding to a particular physical document (e.g., a personal or cashier's check, a driver's license or other identification card, etc.) may be analyzed, using rules generated by a machine learning program, to determine whether the document is, or may be, fraudulent (e.g., a counterfeit document, and/or a document that includes forged contents). For example, the machine learning program may be trained using images of multiple other documents, and fraud determinations made in connection with those other documents. The machine learning program may learn which ranges and/or tolerances for dimensions, fonts, colors, patterns, etc., tend to be most indicative of counterfeiting, for example. A forgery may be detected based upon factors relating to the contents of various fields in a document, such as whether handwriting, a signature, and/or a date format (e.g., “Jan. 1, 2016,” “1/1/16,” etc.) matches that used for other personal checks from a particular account holder, for example. The fraud determination may be made substantially in real-time to provide a warning, if needed, to a merchant making a sale, for example, or may be used to flag a relatively small number of documents for physical review at a later time, etc.
- In another exemplary embodiment, machine learning techniques may be used to analyze financial transactions for purposes of classifying potentially fraudulent behavior (e.g., “counterfeiting,” “skimming,” “lost or stolen card,” etc.). For example, the machine learning program may be trained using fraud classifications made in connection with multiple other financial accounts. The machine learning program may learn which types of data tend to be indicative of different classifications (e.g., transaction amount, credit card information entry mode, particular types of online activity data, etc.), and/or which data values tend to be indicative of different classifications (e.g., transactions over $10,000, manual card number entry, etc.), for example. Once a class of potential fraud has been identified for a particular transaction, the classification may be used to facilitate or guide a further, more in-depth analysis or investigation. Alternatively, or in addition, the classification may be used to calculate one or more metrics indicating the prevalence of that type of fraud.
- By replacing conventional processing techniques with one or more of the processing techniques described herein, problems that have beset the field of fraud detection, classification and/or prevention in the past may be greatly mitigated or eliminated. For example, information that has conventionally been overlooked or ignored may be used to more accurately detect, prevent and/or classify fraud, and/or to reduce false positive fraud alerts. As another example, a significant amount of time may be saved by removing the need for manual investigations, or by reducing the number of instances where manual investigations are required.
-
FIG. 1 depicts anexemplary environment 10 in which techniques for fraud detection and/or classification may be implemented, according to one embodiment. Theenvironment 10 may include an anti-fraud services system (AFSS) 12, a financial account management system (FAMS) 14, a card network computing system 16, a number ofcardholder computing devices 20, a number ofmerchant computing systems 22, a number ofother sources 24, and anetwork 26. It is noted that, in other embodiments and/or scenarios, theenvironment 10 may include more, fewer and/or different components than those shown inFIG. 1 , such as any of those discussed elsewhere herein. For example, theenvironment 10 may include one or more additional financial account management systems and/or card network computing systems, and/or one or more of thecardholder computing devices 20 may instead be a computing device of a holder of a non-card account (e.g., a checking, savings or loan account) or an applicant for a new account (e.g., a new loan account). As another example, theenvironment 10 may include a computing system of one or more acquiring/merchant banks, and some or all of the communications withmerchant computing systems 22 described below may instead be with the acquiring bank(s). -
FAMS 14 may be associated with (e.g., owned and/or maintained by) a bank or other financial entity. For example,FAMS 14 may be a bank that acts as a card issuer associated with a particular type of card network (e.g., VISA®, Mastercard®, etc.), and/or an entity that provides loans (e.g., mortgage, home equity, vehicle, etc.), saving/checking account services, and/or other financial services to customers.FAMS 14 may maintain anaccount records database 30 that stores various kinds of account information, including account holder information (e.g., names, addresses, etc.) and data indicative of financial transactions made in connection with each account (e.g., dates, amounts and merchants for credit or debit card transactions, dates and amounts for customer deposits and withdrawals, etc.).Account records database 30 may store account information for some or all of the cardholders associated withcardholder computing devices 20, for example. While shown inFIG. 1 as a single entity withinFAMS 14, it is understood thataccount records database 30 may, in some embodiments, be distributed across multiple databases and/or multiple physical/hardware memories, and/or may be wholly or partially external to (e.g., remote from)FAMS 14. -
AFSS 12 may generally provide services that help to detect and/or classify fraudulent activity in connection with existing and/or potential (e.g., applied for) financial accounts, such as the accounts managed byFAMS 14. In some embodiments,AFSS 12 is included withinFAMS 14. As seen inFIG. 1 ,AFSS 12 may include anetwork interface 32, amemory 34, and a fraud detection/classification unit 36. -
Network interface 32 may include hardware, firmware and/or software configured to enableAFSS 12 to wirelessly exchange electronic data with one or more other components ofenvironment 10 vianetwork 26. For example,network interface 32 may include an Ethernet port, a modem, a router, and/or one or more other ports and/or transceivers for one or more other wired and/or wireless communication technologies. -
Memory 34 may be a computer-readable, non-transitory storage unit or device, or collection of units/devices, and may include persistent (e.g., hard disk) and/or non-persistent memory components.Memory 34 may store instructions that are executable on one or more processors of AFSS 12 (not shown inFIG. 1 ) to perform various operations, including the instructions of various software applications and data generated and/or used by such applications. - Card network computing system 16 may be a computing system (e.g., one or more servers) of a credit and/or debit card network entity, such as VISA® or Mastercard®, for example. In some embodiments and/or scenarios where the card network entity also acts as the issuer (e.g., American Express® or Discover®), card network computing system 16 may include
FAMS 14. Card network computing system 16 may provide various services toFAMS 14 and/orAFSS 12. For example, card network computing system 16 may provide electronic updates to chargeback rules, fraud scores for particular customers and/or transactions, and so on. - Each of
cardholder computing devices 20 may be a computing device of a respective holder of a credit or debit card account managed byFAMS 14. For example, one or more ofcardholder computing devices 20 may be desktop computers, laptop computers, tablet computers, smartphones, smart watches, and so on. The cardholders (e.g., credit or debit card account holders) may usecardholder computing devices 20 to access (e.g., view, modify, etc.) their account information stored inaccount records database 30 online vianetwork 26. In some embodiments whereAFSS 12 detects and/or classifies activity not related to credit or debit card fraud (e.g., a fraudulent application for a home equity loan, etc.),cardholder computing devices 20 may instead be computing devices of other types of customers or potential customers, such as holders of non-card-based accounts, or individuals who have submitted an online application for a loan, etc., as discussed further below. In some of these embodiments, theenvironment 10 may omit card network computing system 16. - Each of
merchant computing systems 22 may include one or more computing devices associated with a particular provider of products and/or services. For example, some or all ofmerchant computing systems 22 may include servers associated with online retailers. Alternatively, or additionally, some or all ofmerchant computing systems 22 may include point-of-sale terminal devices providing credit and/or debit card payment processing features for “card present” transactions. In some embodiments whereAFSS 12 detects and/or classifies activity not related to customer purchases (e.g., ifAFSS 12 only detects loan application fraud, etc.), theenvironment 10 may omitmerchant computing systems 22. - The
other sources 24 may include computing devices and/or systems associated with sources of one or more other types of information. For example,other sources 24 may include vehicle telematics systems (e.g., installed in vehicles of cardholders associated with cardholder computing devices 20), one or more Internet service providers (ISPs) (e.g., ISPs providing Internet access to some or all cardholders), “smart home” system devices (e.g., installed in homes of some or all cardholders), and/or other systems/devices. In some embodiments, theenvironment 10 does not include theother sources 24. -
Network 26 may communicatively couple some or all of the components shown inFIG. 1 . For example,FAMS 14 may usenetwork 26 to communicate withAFSS 12, card network computing system 16,cardholder computing devices 20 and/ormerchant computing systems 22. As another example,AFSS 12 may usenetwork 26 to communicate withFAMS 14, card network computing system 16,cardholder computing devices 20,merchant computing systems 22 and/or one or more of theother sources 24. While shown as a single entity in FIG. 1,network 26 may include multiple communication networks of one or more types (e.g., one or more wired and/or wireless local area networks (LANs), and/or one or more wired and/or wireless wide area networks (WANs) such as the Internet). Moreover,network 26 may use partially or entirely distinct network components to support communications between different endpoints or computing devices, such as wireless communication or data transmission over one or more radio frequency links and/or wireless communication channels. For example, the portion(s) ofnetwork 26 used for communications betweenFAMS 14 andAFSS 12 may be the same as, or different than, the portion(s) ofnetwork 26 used for communications betweenFAMS 14 and one or more ofcardholder computing devices 20 over one or more radio links or wireless communication channels, or betweenAFSS 12 and one or more of theother sources 24, etc. Those skilled in the art will appreciate different types of networks that are appropriate fornetwork 26, depending upon, for example, howAFSS 12,FAMS 14 and/or other components ofenvironment 10 are localized or distributed across a relatively large geographic area. - Generally, fraud detection/
classification unit 36 ofAFSS 12 may detect fraudulent activity, confirm whether suspected or reported fraudulent activity is truly fraudulent, and/or classify fraudulent or suspected fraudulent activity. For example, fraud detection/classification unit 36 may analyze each transaction stored inaccount records database 30 to determine whether that transaction is, or potentially is, fraudulent. Alternatively, fraud detection/classification unit 36 may analyze only those transactions that were flagged as possibly being fraudulent (e.g., by a cardholder calling in to report an unauthorized and/or unrecognized transaction, or byFAMS 14 orAFSS 12 generating a preliminary fraud alert after applying an initial set of rules to a transaction, etc.). Fraud detection/classification unit 36 may also, or instead, support additional functionality, such as that described below in connection with the various components of fraud detection/classification unit 36 shown inFIG. 1 . - As seen in
FIG. 1 , fraud detection/classification unit 36 may include a machine learning (ML)rule generator 40, an externaldata collection unit 42, abehavior analysis unit 44, adispute resolution unit 46, achargeback analysis unit 50, an image analysis unit 52, aclassification unit 54, and/or anotification unit 56. In other embodiments, fraud detection/classification unit 36 may include more, fewer and/or different components/units than those shown inFIG. 1 . In some embodiments, each ofML rule generator 40, externaldata collection unit 42,behavior analysis unit 44,dispute resolution unit 46,chargeback analysis unit 50, image analysis unit 52,classification unit 54,notification unit 56, and/or other units or components of fraud detection/classification unit 36 may be a software component stored inmemory 34 and implemented by one or more processors of one or more computing devices (e.g., servers) included inAFSS 12. -
ML rule generator 40 may generally analyze various types of data to generate and/or update fraud detection and/or classification rules to be applied by fraud detection/classification unit 36 and stored in an ML rulesdatabase 58. As discussed in further detail below, the rules may be used to detect and/or classify a single type or category of fraudulent activity, or may be used broadly in connection with multiple types or categories of fraudulent activity.ML rule generator 40 may implement any suitable type or types of machine learning. For example,ML rule generator 40 may implement supervised learning techniques, such as decision trees, regression-based models, support vector machines (SVMs) and/or neural networks, and/or unsupervised learning techniques such as Dirichlet process mixture models and/or k-means clustering. Other machine learning techniques are also possible, such as techniques utilizing Bayesian networks, “deep learning” techniques, and so on. While shown inFIG. 1 as a single entity withinAFSS 12, it is understood that ML rulesdatabase 58 may, in some embodiments, be distributed across multiple databases and/or multiple physical/hardware memories, and/or may be wholly or partially external to (e.g., remote from)AFSS 12. - External
data collection unit 42 may generally collect, vianetwork interface 32 and/or from sources internal toAFSS 12, information from various sources (e.g.,FAMS 14,cardholder computing devices 20,other sources 24, etc.), and provide that data to other portions ofAFSS 12 as needed (e.g., toML rule generator 40 to generate and/or update rules, and/or tobehavior analysis unit 44,dispute resolution unit 46,chargeback analysis unit 50, image analysis unit 52 and/orclassification unit 54 to detect and/or classify fraudulent activity). Some data may be collected indirectly. For example,FAMS 14 may collect transaction data from merchant computing systems 22 (and/or from acquiring banks associated with one or more of merchant computing systems 22), and externaldata collection unit 42 may then collect that data from theaccount records database 30 ofFAMS 14. - Once an initial set of rules has been generated and stored in
ML rules database 58, those rules may dictate some or all of the types of data gathered by externaldata collection unit 42. In some embodiments, however, externaldata collection unit 42 collects a broad set of data types that may or may not be relevant to fraud determination or classification, andML rule generator 40 continually analyzes that data to determine which data types are most predictive of fraud and/or fraud type/class. -
Behavior analysis unit 44 may generally analyze cardholder-related (or other customer-related) information to identify patterns of behavior, which may then be used by fraud detection/classification unit 36 to detect and/or classify fraudulent activity. For example,behavior analysis unit 44 may analyze information obtained fromaccount records database 30 to identify spending patterns associated with different cardholders. The operation ofbehavior analysis unit 44, including the types of information analyzed and the ways in which that information is used to arrive at a result (e.g., a pattern of behavior), may be dictated by the rules stored inML rules database 58. - Data indicative of the behavior patterns identified by
behavior analysis unit 44 may be stored in an accountholder behaviors database 60, for example. While shown inFIG. 1 as a single entity withinAFSS 12, it is understood that accountholder behaviors database 60 may, in some embodiments, be distributed across multiple databases and/or multiple physical/hardware memories, and/or may be wholly or partially external to (e.g., remote from)AFSS 12. In one embodiment, for example, accountholder behaviors database 60 may be included withinaccount records database 30. In still other embodiments, theenvironment 10 may not include accountholder behaviors database 60, and behavior patterns may be only identified bybehavior analysis unit 44 “on the fly” as needed by fraud detection/classification unit 36 (e.g., when needed to analyze a transaction in view of past spending patterns of a particular cardholder, etc.). - In some embodiments,
behavior analysis unit 44 may separately analyze the transactions associated with each account holder, even if more than one account holder exists for a particular account. For example,behavior analysis unit 44 may independently analyze the transactions of each cardholder for a credit or debit card account in which each spouse has been issued a credit or debit card in his or her name. Fraud detection/classification unit 36 may then utilize the individual spending patterns when detecting and/or classifying fraud. In one embodiment where fraud detection/classification unit 36 utilizes a dollar amount threshold to detect likely fraudulent transactions, for example, a first threshold may be used for transactions made by a first cardholder listed on an account, and a higher, second threshold may be used for transactions made by a second cardholder listed on the account. Further examples are provided below in connection withFIG. 6 , according to various embodiments. In this manner, fraud detection and/or classification may be made more precise than would be the case if spending patterns were only identified at the aggregate level (e.g., using a single dollar amount threshold, regardless of which cardholder made a particular transaction). -
Dispute resolution unit 46 may generally analyze financial transaction data and/or other information to automatically generate queries for cardholders or other customers. For example,dispute resolution unit 46 may analyze information obtained fromaccount records database 30. The generated queries may be designed to help fraud detection/classification unit 36 determine whether a particular transaction was fraudulent, or estimate a probability that the transaction was fraudulent, etc.Dispute resolution unit 46 may also process responses from cardholders/customers, and automatically generate additional queries based upon those responses. Examples of the operation ofdispute resolution unit 46 are provided below in connection withFIGS. 4E and 9 , according to various embodiments. -
Chargeback analysis unit 50 may generally analyze financial transaction and/or other information to identify transactions that are good candidates for chargeback payments. For example,chargeback analysis unit 50 may analyze information obtained fromaccount records database 30 to determine whether there is a relatively high probability that the merchant (or an acquiring bank) should be responsible for a chargeback payment to a card issuer associated withFRMS 14. The operation ofchargeback analysis unit 50, including the types of information analyzed and the ways in which that information is used to arrive at a result (e.g., flagging a transaction as a chargeback candidate), may be dictated by the rules stored inML rules database 58.ML rule generator 40 may make use of chargeback rules obtained from a card network entity (e.g., from card network computing system 16), and stored inchargeback rules database 62, to generate and/or update the rules applied bychargeback analysis unit 50. Examples of the operation ofchargeback analysis unit 50 are provided below in connection withFIGS. 4B and 7 , according to various embodiments. - In some embodiments, transactions flagged by
chargeback analysis unit 50 are subject to further, manual review using the chargeback rules stored inchargeback rules database 62. In other embodiments, chargeback analysis unit 50 (or another component of fraud detection/classification unit not shown inFIG. 1 ) automatically, with little or no manual input/assistance, applies the chargeback rules fromchargeback rules database 62 for each flagged transaction. While shown inFIG. 1 as a single entity withinAFSS 12, it is understood thatchargeback rules database 62 may, in some embodiments, be distributed across multiple databases and/or multiple physical/hardware memories, and/or may be wholly or partially external to (e.g., remote from)AFSS 12. - Image analysis unit 52 may generally analyze image data corresponding to physical documents to identify fraudulent (e.g., counterfeit and/or forged) documents, and/or to flag potentially fraudulent documents for further (e.g., manual) review. For example, image analysis unit 52 may analyze information obtained from
merchant computing systems 22 to determine whether there is a relatively high probability that documents presented to the merchants (e.g., personal checks, identification cards, etc.) are fraudulent. Image analysis unit 52 may be configured to analyze only a single type of document, or multiple types of documents. The operation of image analysis unit 52, including the image characteristics analyzed and the ways in which the characteristics may be used to arrive at a result (e.g., flagging a document as potentially fraudulent), may be dictated by the rules stored inML rules database 58. Examples of the operation of image analysis unit 52 are provided below in connection withFIGS. 4F and 10 , according to various embodiments. -
Classification unit 54 may generally analyze broad categories of data from various sources (e.g.,account records database 30,cardholder computing devices 20,merchant computing systems 22, and/or other sources 24) to categorize/classify types of suspected fraudulent financial activity.Classification unit 54 may classify fraudulent activity only within a particular subset of fraudulent financial activity (e.g., classifying debit and/or credit card transactions as involving a potential case of counterfeiting, skimming, lost/stolen card use, chargeback fraud, etc.), or may classify fraudulent financial activity across a broader spectrum (e.g., including types of identity theft not necessarily tied to a single financial transaction, such as application fraud). In some embodiments,classification unit 54 classifies suspected fraudulent activity in connection with a particular account or transaction in response to being notified of suspect activity (e.g., notified by another component of fraud detection/classification unit 36, or by a manual user input, etc.). In other embodiments,classification unit 54 itself (or another component of fraud detection/classification unit 36) identifies suspect activity beforeclassification unit 54 classifies that activity. Examples of the operation ofclassification unit 54 are provided below in connection withFIGS. 4C and 11 , according to various embodiments. -
Notification unit 56 may generally provide alerts, confirmations, and/or other notifications to various individuals (e.g., customers, bank employees associated withFAMS 14, third party employees associated withAFSS 12, etc.). For example,notification unit 56 may generate a notification message stating that a fraud alert associated with a particular transaction is a false positive, andcause network interface 32 to send the message to a computer terminal or toFAMS 14 for display to a system user. As another example,notification unit 56 may causenetwork interface 32 to send other flagged transactions and/or documents (e.g., chargeback candidates identified bychargeback analysis unit 50, documents that image analysis unit 52 has identified as potentially fraudulent, etc.) to a computer terminal orFAMS 14 for display to a system user. As yet another example,notification unit 56 may causenetwork interface 32 to send queries generated bydispute resolution unit 46 to various ones ofcardholder computing devices 20 for display to cardholders. - The operation of various components of the
environment 10 shown inFIG. 1 , according to different embodiments and/or scenarios, will be described further below in connection with the remaining figures. - As discussed above,
ML rule generator 40 may generate and/or update rules that are used for one or more of a variety of different purposes relating to fraud detection and/or classification.FIG. 2 depicts one generalized, example process flow 80 for machine learning that may be implemented byML rule generator 40, and possibly one or more other components of fraud detection/classification unit 36. - In the
process flow 80,multi-account data 82 may represent data associated with multiple financial accounts, each with one or more account holders. The financial accounts may be existing or potential accounts, and the account holders may include holders of accounts and/or potential holders of potential accounts. For example, themulti-account data 82 may include existing and/or applied-for credit card accounts, debit card accounts, savings accounts, checking accounts, investment accounts, loan accounts, etc. - Depending upon the embodiment, the
multi-account data 82 may include one or more different types of information obtained (e.g., by externaldata collection unit 42 ofFIG. 1 ) from one or more ofFAMS 14,cardholder computing devices 20,merchant computing systems 22, and/orother sources 24. For example, themulti-account data 82 may include transaction data (e.g., transaction dates, amounts, locations, etc.) fromaccount records database 30 ofFAMS 14, data indicative of Internet Protocol (IP) addresses ofcardholder computing devices 20 and/or devices inmerchant computing systems 22, Internet browsing and/or search history data from cardholder computing devices 20 (or from an ISP computer system included inother sources 24, etc.), vehicle telematics data from telematics systems of cardholder vehicles, home occupancy and/or usage data (e.g., smart appliance data) from smart home systems of cardholders, autonomous or smart vehicle data, vehicle navigation system data, mobile device data, mobile device and/or vehicle GPS data, and/or one or more other types of data. In some embodiments, themulti-account data 82 only includes data that account holders or potential account holders have expressly consented to share with an entity associated withFAMS 14 and/or AFSS 12 (e.g., in exchange for fraud protection services). In certain other embodiments, however, express consent is only needed for certain types of information, such as browsing history information, vehicle telematics data, etc. - The
multi-account data 82 may be associated with multiple fraud determination labels. The labels may simply reflect whether or not fraud existed (e.g., “fraud” or “no fraud”), or may also indicate a type or class of fraud (e.g., “counterfeiting,” “lost or stolen card use,” etc.), for example. In one embodiment, each of a number of data sets in themulti-account data 82 is associated with such a label, and includes data relating to a particular financial transaction, financial account, loan application, etc., for which the fraud determination was made (e.g., after a manual and/or automated fraud investigation). The labels may include final fraud determinations that were made via earlier iterations of theprocess flow 80, and/or external to theprocess flow 80. - To provide a more detailed example, a first data set associated with a “card present” credit card transaction may include data describing that transaction (e.g., from account records database 30) and data indicative of the cardholder's online browsing activity (e.g., from one of cardholder computing devices 20) for the 15 days immediately preceding the transaction, and be labeled “confirmed fraud.” A second data set, associated with another “card present” transaction (for the same account, or for a different account), may include the same general types of data but be labeled “no fraud,” and so on. In some embodiments and/or scenarios, the same data may appear in, or be used by, two or more of the data sets. If the two “card present” transactions described above are both associated with the same account, for example, and if the second transaction occurred less than 15 days after the first transaction, some of the same online activity data may be shared by the first and second data sets.
- At a process stage 84, the
multi-account data 82 may be analyzed to generate fraud detection and/or classification rules (e.g., to be stored in ML rules database 58). Any suitable type of supervised machine learning program/technique(s) may be used, such as SVMs, neural networks, logistic regression, etc. Generally, process stage 84 may serve to identify which type(s) of data is/are probative of whether fraud has occurred (and/or the type/category of fraud that may have occurred), and to determine the data values and/or combinations that are probative of whether fraud has occurred (and/or the type/category of fraud that may have occurred). By analyzing many (e.g., thousands) of positively and negatively labeled data sets in themulti-account data 82, for example, process stage 84 may learn that certain spending patterns within a threshold time of a transaction tend to indicate that the cardholder made the transaction (e.g., thereby indicating that fraud has not occurred, or that a fraud report is itself fraudulent or mistaken, etc.), that certain types of online searches by a cardholder (e.g., including a descriptor of a product purchased in the transaction, or a name of the merchant, etc.) tend to indicate that the cardholder made the transaction, that the cardholder's distance from the site of a “card present” transaction (e.g., as determined from GPS information provided by the cardholder's smartphone, wearable electronics, or vehicle) relates to the probability of fraudulent activity according to a particular equation, and so on. Other specific examples of such rules, and how those rules may be generated, are discussed below in connection withFIGS. 3A-3F and 4A-4F , according to various embodiments. - At process stage 86, the rules generated or updated at process stage 84 may be applied to
first account data 90 associated with a particular account and customer(s) (e.g., a customer associated with a particular one of computing devices 20). The types of data included infirst account data 90 may depend upon which types of data were determined, by process stage 84, to be relevant to a fraud determination. For example, if the rules give weight to the amount and date of a financial transaction when determining whether the transaction is fraudulent, and also give weight to whether the account holder visits a particular type of website, then thefirst account data 90 may include the amount and date of one or more transactions, as well as data indicative of visited web sites (e.g., Uniform Resource Locators (URLs) and/or content of visited websites, etc.). Thefirst account data 90 may include information obtained (e.g., by external data collection unit 42) from one or more ofFAMS 14, one ofcardholder computing devices 20 associated with the customer holding the first account, one or more ofmerchant computing systems 22, and/or one or more ofother sources 24, for example. - Process stage 86 may output various different types of information, depending upon the embodiment and/or scenario. For example, depending upon the content of
first account data 90 and the rules generated or updated at process stage 84, process stage 86 may generate data indicating that a particular financial transaction associated withfirst account data 90 is, or is not, fraudulent or potentially fraudulent. Alternatively, or additionally, process stage 86 may generate data indicating a particular classification for fraudulent or suspected fraudulent activity (e.g., a fraudulent transaction) associated withfirst account data 90. - In some embodiments, further analysis (e.g., a manual review, or further automated review using additional data sources, etc.) may be performed at an additional stage, shown in dashed lines in
FIG. 2 asprocess stage 92. The additional analysis may then be used to make a final fraud determination (e.g., a final decision on whether fraud occurred, and/or on the type of fraud that occurred) atprocess stage 94. In other embodiments,process stage 92 is omitted fromprocess flow 80, andprocess stage 94 merely represents the output of process stage 86. The final determination made atprocess stage 94, along with thefirst account data 90 used to make that determination, may be fed back into process stage 84 to provide additional labeled data for purposes of updating the rules. - In some embodiments, the
process flow 80 includes more, fewer and/or different stages, such as any of those discussed elsewhere herein (e.g., in connection withFIGS. 3A-3F ). In one alternative embodiment, process stages 84 and 86 may be combined. For example, themulti-account data 82 may be unlabeled rather than labeled (or the labels may be ignored), and the combined process stage 84, 86 may use unsupervised learning techniques (e.g., clustering techniques) to classify anomalous/outlier financial transactions, accounts, applications, etc., as “suspect” and needing further analysis. - More specific, machine learning-based process flows generally corresponding to process
flow 80 ofFIG. 2 will now be described with reference toFIGS. 3A-3F . It is noted, however, that other process flows are also within the scope of the invention described herein. Moreover, whileFIGS. 3A-3F generally correspond to embodiments in which supervised machine learning techniques are used, other embodiments may instead use unsupervised machine learning techniques, as noted above. In various different embodiments, fraud detection/classification unit 36 may be configured to implement only one of the process flows ofFIGS. 3A-3F , or may be configured to implement two or more (e.g., all) of the process flows shown inFIGS. 3A-3F . - A. Exemplary Process Flow for Machine Learning of Fraud Detection Rules Using Online Activity Data
- Referring first to
FIG. 3A , anexemplary process flow 100 may generally be used to detect fraud using customer online activity data. In theprocess flow 100, multi-customeronline activity data 102 may represent data associated with the online activities of a number (e.g., thousands) of customers (e.g., credit or debit cardholders, checking or saving account holders, etc.). The multi-customeronline activity data 102 may include data indicating actions that the customers took, and/or web sites visited by the customers, while the customers were connected to the Internet via web browsers (e.g., executing on respective ones of cardholder computing devices 20). For example, the multi-customeronline activity data 102 may include URLs of, and/or content (e.g., text) within, web sites visited by customers, search terms entered by customers using search engine tools, search results presented to customers by search engine tools, indications of interactive controls (e.g., virtual buttons) selected by customers on various web pages, and so on. - The multi-customer
online activity data 102 may include data obtained (e.g., by externaldata collection unit 42 ofFIG. 1 ) fromcardholder computing devices 20, from one or more ISPs ofother sources 24, and/or from a third party aggregator of such information, for example. In some embodiments, the multi-customeronline activity data 102 may only include data that customers have expressly consented to share with an entity associated withFAMS 14 and/or AFSS 12 (e.g., in exchange for fraud protection services or other benefits, such as discounts). - As described above in connection with
multi-account data 82 ofprocess flow 80, the multi-customeronline account data 102 may be associated with multiple fraud determination labels. In some embodiments, each label may be associated with a data set that includes not only the corresponding portion of multi-customeronline activity data 102, but also one or more other types of data, such as transaction data (e.g., transaction dates, amounts, locations, etc.) for each customer fromaccount records database 30 ofFAMS 14, data indicative of IP addresses ofcardholder computing devices 20 and/or devices inmerchant computing systems 22, Internet browsing and/or search history data from cardholder computing devices 20 (or from an ISP computer system included inother sources 24, etc.), vehicle telematics data from telematics systems ofother sources 24, home occupancy and/or usage data (e.g., smart appliance data) from smart home systems ofother sources 24, and so on. The labels may include final fraud determinations that were made via earlier iterations of theprocess flow 100, and/or external to theprocess flow 100. Multi-customeronline account data 102 may include many (e.g., thousands) of positively and negatively labeled data sets. - At a
process stage 104, the multi-customeronline activity data 102 may be analyzed to generate fraud detection rules (e.g., to be stored in ML rules database 58). As described above in connection with process stage 84 ofprocess flow 80, any suitable type of supervised machine learning program/technique(s) may be used. Generally,process stage 104 may serve to identify which type(s) of online activity data is/are probative of whether fraud has occurred, and to determine the data values and/or combinations that are probative of whether fraud has occurred. While not shown inFIG. 3A , the fraud detection rules may not only detect fraud, but also classify fraud (e.g., as described below in connection withFIG. 3C ), in some embodiments. - At
process stage 106, the rules generated or updated atprocess stage 104 may be applied to first customer online activity data 110. The first customer online activity data 110 may be associated with a particular customer, such as a customer associated with a particular one ofcomputing devices 20, for example. The types of data included in first customer online activity data 110 may depend upon which types of online activity data were determined, byprocess stage 104, to be relevant to a fraud determination. For example, the first customer online activity data 110 may include information obtained (e.g., by external data collection unit 42) from one of cardholder computing devices 20 (i.e., the device associated with the first customer), and/or from an ISP ofother sources 24. Some specific examples of rules that may be generated byprocess stage 104, and applied atprocess stage 106, are described below in connection withFIG. 4A . -
Process stage 106 may output various different types of information, depending upon the embodiment and/or scenario. For example, depending upon the content of first customer online activity data 110 and the rules,process stage 106 may generate data indicating that a particular financial transaction associated with the first customer is, or is not, fraudulent or potentially fraudulent. Alternatively, or additionally,process stage 106 may generate data indicating a particular classification of fraudulent or potentially fraudulent activity associated with first customer online activity data 110. - In some embodiments, further analysis (e.g., a manual review, or further automated review using additional data sources, etc.) is performed at an additional stage, shown in dashed lines in
FIG. 3A asprocess stage 112. The additional analysis may then be used to make a final fraud determination (e.g., a final decision on whether fraud occurred, and/or on the type of fraud that occurred) at process stage 114. In other embodiments,process stage 112 is omitted fromprocess flow 100, and process stage 114 merely represents the output ofprocess stage 106. - The final determination made at process stage 114, along with the first customer online activity data 110 (and any other data) used to make that determination, may be fed back into
process stage 104 to provide additional labeled data for purposes of updating the rules. In some embodiments, a preliminary fraud determination made atprocess stage 106 is also fed back intoprocess stage 104, to allow the machine learning program to determine and improve upon past performance/accuracy. - B. Exemplary Process Flow for Machine Learning of Chargeback Candidate Detection Rules
- Referring next to
FIG. 3B , anexemplary process flow 120 may generally be used to identify the financial transactions for which chargebacks (e.g., post-transaction payments from merchants, or acquiring/merchant banks, back to the issuer to return proceeds from transactions) are appropriate. In theprocess flow 120,multi-account transaction data 122 may represent data associated with the financial transactions involving the accounts of a number (e.g., thousands) of credit or debit cardholders. Themulti-account transaction data 122 may include information such as transaction dates, transaction amounts, merchant names (and/or aliases) associated with the transaction, information relating to how the card information was collected by the merchant (e.g., by swiping, an EMV chip reader, manual entry of the card number, etc.), geographic locations of “card present” transactions, and so on. Themulti-account transaction data 122 may include data obtained (e.g., by externaldata collection unit 42 ofFIG. 1 ) frommerchant computing systems 22 and/or from acquiring/merchant banks associated with those merchants, for example. - Similar to the labels described above in connection with
multi-account data 82 ofprocess flow 80, themulti-account transaction data 122 may be associated with multiple chargeback outcome labels. For example, each label may be associated with a data set that includes the corresponding portion ofmulti-account transaction data 122. The outcome labels may include final chargeback determinations that were made (in connection with the transactions represented in multi-account transaction data 122) via earlier iterations of theprocess flow 120, and/or external to theprocess flow 120.Multi-account transaction data 122 may include many (e.g., thousands) of positively and negatively labeled data sets. - At a
process stage 124, themulti-account transaction data 122 may be analyzed to generate chargeback candidate detection rules (e.g., to be stored in ML rules database 58). As described above in connection with process stage 84 ofprocess flow 80, any suitable type of supervised machine learning program/technique(s) may be used. Generally,process stage 124 may serve to identify which type(s) of transaction data is/are probative of whether, under the full chargeback rules of the card network entity, a chargeback is appropriate for a given transaction.Process stage 124 may also determine the transaction data values and/or combinations that are probative of whether a chargeback is appropriate for the transaction. - At a
process stage 126, the rules generated or updated atprocess stage 124 may be applied to firstaccount transaction data 130 to determine whether a transaction associated with the first account is a “good” chargeback candidate. Put differently,process stage 126 may, instead of applying the full chargeback rules of the card network entity (which may be quite lengthy and complex) to the facts surrounding the transaction, use various factors and algorithms developed atprocess stage 124 to determine whether there exists a relatively high probability that a chargeback would be appropriate for the transaction if the full chargeback rules were applied. Theprocess stage 126 may calculate a percentage probability that the transaction is one in which a chargeback is appropriate, for example. - The first
account transaction data 130 may be associated with the account of a particular cardholder or cardholders, such as a cardholder associated with a particular one ofcardholder computing devices 20, for example. The types of data included in firstaccount transaction data 130 may depend upon which types of transaction-related data were determined, byprocess stage 124, to be relevant to a chargeback candidate determination. For example, the firstaccount transaction data 130 may include information obtained (e.g., by external data collection unit 42) from one of merchant computing systems 22 (e.g., the computing system of the merchant involved in the transaction being analyzed) and/or from an acquiring/merchant bank associated with that merchant. The firstaccount transaction data 130 may also include information about one or more other transactions associated with the first account (e.g., data pertaining to other transactions occurring shortly before and/or after the transaction at issue). Some specific examples of rules that may be generated byprocess stage 124, and applied atprocess stage 126, are described below in connection withFIG. 4B . -
Process stage 126 may output information indicating whether the particular transaction represented by firstaccount transaction data 130 is a “good” candidate for chargeback detection. For example,process stage 126 may output a percentage probability, calculated according to the rules generated or updated atprocess stage 124, that the transaction is one in which a chargeback is appropriate. As another example,process stage 126 may output a binary indicator of whether the transaction is, or is not, a strong/likely chargeback candidate (e.g., by comparing the percentage probability to a threshold probability). - If the transaction is identified as a chargeback candidate at
process stage 126, the full chargeback rules of the card network entity may be applied at aprocess stage 132.Process stage 132 may include manual application of the full chargeback rules, and/or automated application of the full chargeback rules, in various different embodiments. Based upon the analysis atprocess stage 132, a final chargeback determination may be made at aprocess stage 134. The final determination made atprocess stage 134, along with the first account transaction data 130 (and any other data) used to make that determination, may be fed back intoprocess stage 124 to provide additional labeled data for purposes of updating the rules. In some embodiments, the indication of whether the transaction is a good chargeback candidate generated atprocess stage 126 may also be fed back intoprocess stage 124, to allow the machine learning program to determine and improve upon past performance/accuracy. - C. Exemplary Process Flow for Machine Learning of Fraud Classification Rules
- Referring now to
FIG. 3C , anexemplary process flow 140 may generally be used to classify instances of suspected or potential fraud. For example, theprocess flow 140 may represent ongoing, real-time or batch processing of a large amount of data associated with a large number of potential and/or existing financial accounts (e.g., all accounts associated with a particular bank, or all accounts opting in to a fraud protection program, etc.). In this manner, theprocess flow 140 may be used to initially flag situations for closer investigation, and provide one or more classifications of the type(s) of fraud potentially at issue in order to narrow or otherwise facilitate the investigation. In other embodiments, theprocess flow 140 may be used to provide a narrower classification (e.g., “skimming”) when a broader class of fraud (e.g., credit card fraud) is already suspected. - In the
process flow 140,multi-account data 142 may represent data associated with financial accounts of a number (e.g., thousands) of account holders. The financial accounts may be existing or potential accounts, and the account holders may include holders of accounts and/or potential holders of potential accounts. For example, themulti-account data 142 may include existing and/or applied-for credit card accounts, debit card accounts, savings accounts, checking accounts, investment accounts, loan accounts, etc. - Depending upon the embodiment, the
multi-account data 142 may include one or more different types of information obtained (e.g., by externaldata collection unit 42 of FIG. 1) from one or more ofFAMS 14,cardholder computing devices 20,merchant computing systems 22, and/orother sources 24. For example, themulti-account data 142 may include transaction data (e.g., transaction dates, amounts, locations, etc.) fromaccount records database 30 ofFAMS 14, data indicative of IP addresses ofcardholder computing devices 20 and/or devices inmerchant computing systems 22, Internet browsing and/or search history data from cardholder computing devices 20 (or from an ISP computer system included inother sources 24, etc.), vehicle telematics data from telematics systems of cardholder vehicles, home occupancy and/or usage data (e.g., smart appliance data) from smart home systems of cardholders, and/or one or more other types of data. Some or all data withinmulti-account data 142 may be information that account holders or potential account holders have expressly consented to share with an entity associated withFAMS 14 and/or AFSS 12 (e.g., in exchange for fraud protection services). - The
multi-account data 142 may be associated with multiple fraud determination labels, each indicating a type or class of fraud (e.g., “counterfeiting,” “lost or stolen card use,” “skimming,” “chargeback fraud,” “application fraud,” etc.), or indicating a lack of fraud, for example. In one embodiment, each of a number of data sets in themulti-account data 142 is associated with at least one such classification/label, and includes data relating to a particular financial transaction, financial account, loan application, etc., for which the fraud classification or classifications was/were made (e.g., after a previous iteration ofprocess flow 140, or after another manual and/or automated fraud investigation).Multi-account data 142 may include many (e.g., thousands) of data sets labeled with various known fraud classifications. - At a
process stage 144, themulti-account data 142 may be analyzed to generate fraud classification rules (e.g., to be stored in ML rules database 58). As described above in connection with process stage 84 ofprocess flow 80, any suitable type of supervised machine learning program/technique(s) may be used. Generally,process stage 144 may serve to identify which type(s) of transaction data is/are probative of the particular type of fraud (if any) that has occurred.Process stage 144 may also determine the data values and/or combinations that are probative of the particular type of fraud (if any) that has occurred. - At a
process stage 146, the rules generated or updated atprocess stage 144 may be applied tofirst account data 150. Thefirst account data 150 may be associated with a particular account and a particular customer (e.g., a cardholder associated with a particular one of computing devices 20). The types of data included infirst account data 150 may depend upon which types of data were determined, byprocess stage 144, to be relevant to fraud classification. For example, thefirst account data 150 may include information obtained (e.g., by external data collection unit 42) from one or more ofFAMS 14, one of cardholder computing devices 20 (i.e., the device associated with the customer holding or applying for the first account), one or more ofmerchant computing systems 22, and/or one or more ofother sources 24. Some specific examples of rules that may be generated byprocess stage 144, and applied atprocess stage 146, are described below in connection withFIG. 4C . -
Process stage 146 may output data (e.g., a message or code) that is used to classify suspected fraudulent activity (in connection with the account associated with first account data 150) at aprocess stage 152. For example,process stage 152 may assign a classification of “counterfeiting” ifprocess stage 146 determined that thefirst account data 150 indicated a number of circumstances that, according to the rules generated atprocess stage 144, are known to be correlated with counterfeiting activity (e.g., two “card present” transactions occurring in different states within the same one-hour time period, etc.). In some embodiments and/or scenarios, two or more classifications may concurrently be assigned tofirst account data 150. For example,process stage 146 may determine a set of probabilities for a set of two or more potential types of fraud, andprocess stage 152 may assign each classification, with each respective probability, tofirst account data 150. Moreover, in some embodiments and scenarios,process stage 152 may assign a classification that corresponds to an absence of any suspected fraud (e.g., “no fraud”). - At a
process stage 154, ifprocess stage 152 assigned a classification other than one indicating the absence of suspected fraud, thefirst account data 150, and/or other information associated with the account and the suspected class of fraud, may be analyzed in depth to make a final fraud determination at aprocess stage 156. Generally, the fraud classification may be used to facilitate the analysis atprocess stage 154, withprocess stage 154 including manual and/or automated fraud detection techniques. For example, personnel associated withAFSS 12 may use the fraud classification(s) to inform their strategy and/or focus with respect to conducting an in-depth fraud investigation. - The additional analysis at
process stage 154 may then result in a final fraud determination atprocess stage 156. The final determination may indicate both whether fraud occurred and, if so, the class(es)/type(s) of fraud that occurred. The final determination made atprocess stage 156, and information used to make that determination (e.g., thefirst account data 150 and potentially other data), may be fed back intoprocess stage 144 to provide additional labeled data for purposes of updating the rules. In some embodiments, the (preliminary) fraud classification made atprocess stage 152 may also be fed back intoprocess stage 144 to help the machine learning program identify instances in which the preliminary classifications atprocess stage 152 were incorrect.Process stage 144 may then update the fraud classification rules in ways that seek to prevent or reduce such instances in the future. - D. Exemplary Process Flow for Machine Learning of Application Fraud Detection Rules
- Referring now to
FIG. 3D , anexemplary process flow 160 may generally be used to detect application fraud. “Application fraud” may generally refer to fraud in connection with the application for any type of financial account, loan and/or line of credit (e.g., mortgage loan, vehicle loan, small business loan, payday loan, home equity line of credit, credit card account, debit card account, checking account, savings account, investment account, etc.). In some embodiments and/or scenarios, however, the application may be for non-financial purposes, such as an application for membership in a particular group or institution, for example. - In the
process flow 160, multi-applicantsearch history data 162 may represent data associated with the Internet search history of a number (e.g., thousands) of applicants. The multi-applicantsearch history data 162 may include search terms entered by the applicants using online search engine tools, for example, and/or the results of such searches (e.g., URLs, titles and/or contents of search results), for example. - The multi-applicant
search history data 162 may include data obtained (e.g., by externaldata collection unit 42 ofFIG. 1 ) fromcardholder computing devices 20, from one or more ISPs ofother sources 24, and/or from a third party aggregator of such information, for example. In some embodiments, the multi-applicantsearch history data 162 only includes data that the applicants have expressly consented to share with an entity associated withFAMS 14 and/or AFSS 12 (e.g., in exchange for consideration of their applications). - As described above in connection with
multi-account data 82 ofprocess flow 80, the multi-applicantsearch history data 162 may be associated with multiple fraud determination labels. In some embodiments, each label may be associated with a data set that corresponds to an application submitted by a particular applicant, where the data set includes the corresponding portion of multi-applicant search history data 162 (e.g., the search terms and/or results associated with the particular application). The labels may include final fraud determinations that were made via earlier iterations of theprocess flow 160, and/or external to theprocess flow 160. Multi-applicantsearch history data 162 may include many (e.g., thousands) of positively and negatively labeled data sets. - At a
process stage 164, the multi-applicantsearch history data 162 may be analyzed to generate application fraud detection rules (e.g., to be stored in ML rules database 58). As described above in connection with process stage 84 ofprocess flow 80, any suitable type of supervised machine learning program/technique(s) may be used. Generally,process stage 164 may serve to identify which type(s) of Internet search-related data is/are probative of whether application fraud has occurred, and to determine the data values and/or combinations that are probative of whether application fraud has occurred. - At
process stage 166, the rules generated or updated atprocess stage 164 may be applied to first applicantsearch history data 170. The first applicantsearch history data 170 may be associated with a particular application and a particular applicant (e.g., a person associated with a particular one of computing devices 20), for example. The types of data included in first applicantsearch history data 170 may depend upon which types of Internet search-related data were determined, byprocess stage 164, to be relevant to a fraud determination. The first applicantsearch history data 170 may include information obtained (e.g., by external data collection unit 42) from one of computing devices 20 (i.e., the device associated with the first applicant), and/or from an ISP ofother sources 24, for example. Some specific examples of rules that may be generated byprocess stage 164, and applied atprocess stage 166, are described below in connection withFIG. 4D . -
Process stage 166 may output information indicating whether fraud is suspected in connection with the application corresponding to first applicantsearch history data 170. For example,process stage 166 may output a percentage probability, calculated according to the rules generated or updated atprocess stage 164, that the application was fraudulently made (e.g., by someone other than the purported applicant or an authorized representative thereof). As another example,process stage 166 may output a binary indicator of whether the application likely was, or likely was not, fraudulently made (e.g., by comparing a percentage probability to a threshold probability). - In some embodiments, further analysis (e.g., a manual review, or further automated review using additional data sources, etc.) is performed at an additional stage, shown in dashed lines in
FIG. 3D asprocess stage 172. The additional analysis may then be used to make a final fraud determination (e.g., a final decision on whether application fraud occurred) atprocess stage 174. In other embodiments,process stage 172 is omitted fromprocess flow 160, andprocess stage 174 merely represents the output ofprocess stage 166. The final determination made atprocess stage 174, along with the first applicant search history data 170 (and any other data) used to make that determination, may be fed back intoprocess stage 164 to provide additional labeled data for purposes of updating the rules. In some embodiments, a preliminary fraud determination made atprocess stage 166 is also fed back intoprocess stage 164, to allow the machine learning program to determine and improve upon past performance/accuracy. - E. Exemplary Process Flow for Machine Learning of Fraud Dispute Resolution Rules
- Referring now to
FIG. 3E , anexemplary process flow 180 may generally be used to facilitate the resolution of fraud disputes (or potential disputes) with customers/account holders. For example, theprocess flow 180 may be used to determine whether a reportedly unauthorized or fraudulent transaction (e.g., one that the account holder reported as such when looking at his or her account statement) was indeed unauthorized or fraudulent. In some embodiments, theprocess flow 180 may also, or instead, be used to determine whether an “unrecognized” transaction (i.e., one that the account holder does not recall, but does not necessarily report as fraudulent) was unauthorized or fraudulent. - In the
process flow 180,multi-account data 182 may represent data associated with financial accounts of a number (e.g., thousands) of account holders. For example, themulti-account data 182 may include data associated with financial transactions relating to credit card accounts, debit card accounts, savings accounts, checking accounts, etc. For ease of explanation,FIG. 3E will be described with reference to an embodiment in which the accounts are credit card accounts. - In one embodiment, the
multi-account data 182 may include transaction data (e.g., transaction dates, amounts, locations, etc.) obtained from FAMS 14 (e.g., by externaldata collection unit 42 ofFIG. 1 ). In some embodiments, however, themulti-account data 182 also includes information obtained fromcardholder computing devices 20,merchant computing systems 22, and/orother sources 24. For example, themulti-account data 182 may include, in addition to transaction data fromaccount records database 30 ofFAMS 14, data indicative of IP addresses ofcardholder computing devices 20 and/or devices inmerchant computing systems 22, Internet browsing and/or search history data from cardholder computing devices 20 (or from an ISP computer system included inother sources 24, etc.), vehicle telematics data from telematics systems of cardholder vehicles, home occupancy and/or usage data (e.g., smart appliance data) from smart home systems of cardholders, autonomous vehicle data, smart vehicle data, mobile device data, vehicle or mobile device GPS data, and/or one or more other types of data. Some or all data withinmulti-account data 182 may be information that account holders or potential account holders have expressly consented to share with an entity associated withFAMS 14 and/or AFSS 12 (e.g., in exchange for fraud protection services). - As described above in connection with
multi-account data 82 ofprocess flow 80, themulti-account data 182 may be associated with multiple fraud determination labels (e.g., “fraud” and “no fraud,” and/or more complex labels that indicate type/class, such as “lost/stolen card use,” etc.). In some embodiments, each label may be associated with a data set that includes the corresponding portion ofmulti-account data 182. The labels may include final fraud determinations that were made via earlier iterations of theprocess flow 180, and/or external to theprocess flow 180.Multi-account data 182 may include many (e.g., thousands) of positively and negatively labeled data sets. - At a process stage 184, the
multi-account data 182 may be analyzed to generate query generation rules (e.g., to be stored in ML rules database 58). As described above in connection with process stage 84 ofprocess flow 80, any suitable type of supervised machine learning program/technique(s) may be used. Generally, process stage 184 may serve to identify which types of information are probative of whether fraud has occurred, and to craft rules that formulate queries to ascertain such information based upon account data. - For example, process stage 184 may determine that, for a suspect “card present” transaction, a verified, non-fraudulent “card present” transaction within 10 miles and 3 hours of the suspect transaction is probative of whether the suspect transaction was fraudulent. Based upon this finding, process stage 184 may also generate a rule specifying that a cardholder should be queried as to whether he/she can confirm making each “card present” transaction within 10 miles and 3 hours of the suspect transaction. As another example, process stage 184 may determine that a merchant using a billing alias different from its legal and/or commonly-known name (e.g., by at least some threshold level of similarity, as measured by number of similar characters, order of characters, etc.) is probative of whether the cardholder authorized a transaction associated with that billing alias. Based upon this finding, process stage 184 may generate a rule specifying that a cardholder should be queried as to whether he/she is aware of a billing alias used for a suspect transaction if that billing alias is sufficiently different from the legal/common name of the merchant.
- At
process stage 186, the rules generated or updated at process stage 184 may be applied tofirst account data 190. Thefirst account data 190 may be associated with a particular cardholder, such as a cardholder associated with a particular one ofcardholder computing devices 20, for example. The types of data included infirst account data 190 may depend upon which types of data were determined, by process stage 184, to be relevant to developing dispute resolution queries.Process stage 186 may generate a set of one or more queries in accordance with the rules and the contents of first account data. Some specific examples of rules that may be generated by process stage 184 and applied atprocess stage 186, and the queries that may be generated as a result, are described below in connection withFIG. 4E . - At a
process stage 192, the generated queries may be sent to the cardholder in one or more of various ways, such as sending the queries via SMS text message and/or email, and/or via a web browser or dedicated application executing on the one ofcardholder computing devices 20 that is associated with the cardholder, for example. At aprocess stage 194, responses to the queries are received from the cardholder (e.g., via inputs made by the cardholder via the web browser or application, or a responsive SMS text message or email, etc.). In some embodiments, the rules generated or updated at process stage 184 specify the manner in which follow-up queries should be generated based upon the responses received atprocess stage 194, and process stages 192 and 194 may be repeated multiple times. - In some embodiments, further analysis (e.g., a manual review, or further automated review using additional data sources, etc.) that makes use of the received responses is performed at an additional stage, shown in dashed lines in
FIG. 3E asprocess stage 196. The additional analysis may then be used to make a final fraud determination (e.g., a final decision on whether fraud occurred, and/or on the type of fraud that occurred) at process stage 198. In other embodiments,process stage 196 is omitted fromprocess flow 180, and process stage 198 is based upon information from the cardholder. For example, the questions generated atprocess stage 192 may “jog” the cardholder's memory, and cause him or her to indicate that the transaction at issue was authorized. The final determination made at process stage 198, along with the first account data 110 (and any other data used at process stage 196), the queries generated atprocess stage 186 and/or the responses received atprocess stage 194, may be fed back into process stage 184 to provide additional labeled data for purposes of updating the rules. - F. Exemplary Process Flow for Machine Learning of Document Fraud Detection Rules
- Referring now to
FIG. 3F , anexemplary process flow 200 may generally be used to detect fraud relating to documents, such as counterfeit and/or forged documents. Theprocess flow 200 may be used in connection with various kinds of documents, such as checks (e.g., personal checks, cashier's checks, etc.), money orders, treasury bills, identification documents (e.g., social security cards, driver's licenses, passports, birth certificates, etc.), certification documents, and so on. - In the
process flow 200, multi-document image data 202 may represent digital images of a number (e.g., thousands) of physical documents of one or more types. The multi-document image data 202 may include images in one or more formats, such as raster formats (e.g., JPEG, TIFF, GIF, BMP, PNG, etc.) and/or vector formats (e.g., CGM, SVG, etc.), for example. The multi-document image data 202 may include data obtained (e.g., by externaldata collection unit 42 ofFIG. 1 ) from merchant computing systems 22 (e.g., point-of-sale devices with cameras for document identification) and/or from FAMS 14 (e.g., images of personal checks), for example. In some embodiments, the multi-document image data 202 may only include data representing images that customers (or other individuals associated with the documents) have expressly consented to share (e.g., as a prerequisite to making a purchase, or in exchange for fraud protection services, etc.). - As described above in connection with
multi-account data 82 ofprocess flow 80, the multi-document image data 202 may be associated with multiple fraud determination labels. In some embodiments, each label may be associated with data representing a digital image of a particular document. The labels may include final fraud determinations (e.g., “fraud” or “no fraud,” or more complex labels such as “forgery,” “counterfeit,” “forgery—signature,” “counterfeit—angular line offset(s) outside tolerance,” etc.) that were made via earlier iterations of theprocess flow 200, and/or external to theprocess flow 200. Multi-document image data 202 may include many (e.g., thousands) of positively and negatively labeled data sets. - At a
process stage 204, the multi-document image data 202 may be analyzed to generate document fraud detection rules (e.g., to be stored in ML rules database 58). As described above in connection with process stage 84 ofprocess flow 80, any suitable type of supervised machine learning program/technique(s) may be used. Generally,process stage 204 may serve to identify which characteristics of a document are probative of whether the document is counterfeit, and to determine the ranges, tolerances, etc., that are probative of whether the document is counterfeit. In some embodiments,process stage 204 also, or instead, identifies which characteristics of information entered in document fields are probative of whether the document was forged (e.g., drafted or populated by someone other than the person purported to have drafted or populated the document). - At process stage 206, the rules generated or updated at
process stage 204 may be applied to first document image data 210. The first document image data 210 may be digital image data corresponding to a particular, physical document. The first document image data 210 may include information obtained (e.g., by external data collection unit 42) from one of merchant computing systems 22 (e.g., for real-time verification of an identification or other document presented during or prior to a sale), or from FAMS 14 (e.g., for real-time or batch-processing verification of a personal check prior to clearing the check), for example. Some specific examples of rules that may be generated byprocess stage 204, and applied at process stage 206, are described below in connection withFIG. 4F . - Process stage 206 may output information indicating whether fraud is suspected in connection with the document corresponding to first document image data 210. For example, process stage 206 may output two percentage probabilities calculated according to the rules generated or updated at
process stage 204, with the first indicating the likelihood that the document is counterfeit and the second indicating the likelihood that the document includes forged content. As another example, process stage 206 may output binary indicators of whether the document likely is, or likely is not, counterfeit and/or includes forged content (e.g., by comparing percentage probabilities to threshold probabilities). - In some embodiments, further analysis (e.g., a manual review, or further automated review using additional data sources, etc.) may be performed at a
process stage 212. The additional analysis may then be used to make a final fraud determination (e.g., a final decision on whether the document is fraudulent) atprocess stage 214. For example, the process stage 206 may act as a filter, and flag only those documents having a relatively high probability of being fraudulent. In this manner, a considerably smaller amount of human and/or processing resources may be consumed atprocess stage 212. - The final determination made at
process stage 214, along with the first document image data 210 used to make that determination, may be fed back intoprocess stage 204 to provide additional labeled data for purposes of updating the rules. In some embodiments, a preliminary fraud determination made at process stage 206 may also be fed back intoprocess stage 204, to allow the machine learning program to determine and improve upon past performance/accuracy. -
FIGS. 4A-4F depict exemplary factors and algorithms that may be used in connection with various fraud detection and/or classification rules, according to different embodiments. It is noted that the rule sets corresponding toFIGS. 4A-4F are purely for purposes of illustration and are not limiting. Particularly in embodiments where machine learning is utilized, for example, the algorithms and/or factors may be far more complex, and/or less intuitive, than some or all of the examples shown inFIGS. 4A-4F . - Referring first to
FIG. 4A , an exemplary rule set 220 (e.g., generated atprocess stage 104 ofFIG. 3A ) may use various factors relating to online activity of a cardholder to detect fraud in connection with a particular credit or debit card transaction. The rule set 220 may correspond to a particular embodiment and scenario in which the transaction at issue is a “card present” transaction, and in which the rule set 220 seeks to determine whether the cardholder made or otherwise authorized the transaction. The rule set 220 may be incorporated into a review process that is generally applied to all transactions, a review process applied only to those transactions that were flagged by a preliminary fraud alert, or a review process applied only after a cardholder reports the transaction as unauthorized, for example. - The factors considered under the rule set 220 may include a number of interest-based
factors 222 and a number of location-basedfactors 224. The interest-basedfactors 222 may relate to the cardholder's interest (or non-interest) in a product or service purchased via the transaction, and/or the merchant providing the product or service, while the location-basedfactors 224 may relate to the cardholder's location or probable location. - As seen in
FIG. 4A , the interest-based factors 222 may include: (1) whether the cardholder searched online for the specific product or service purchased via the transaction at issue (e.g., by determining whether search terms entered by the cardholder included the name of the product or service involved in the transaction, or included a description of the product or service, etc.); (2) whether the cardholder visited a website associated with the merchant (e.g., by comparing URLs of websites visited by the cardholder to a known URL of the merchant's website, or by searching the contents of websites visited by the cardholder for the merchant's name, etc.); (3) whether the cardholder endorsed the merchant, or the product or service provided by the merchant, via a social media account of the cardholder (e.g., by determining whether the cardholder “liked” the merchant, product or service via his or her Facebook® account, etc.); (4) whether the cardholder visited a website associated with a competitor of the merchant (e.g., by comparing URLs of web sites visited by the cardholder to known URLs of known competitors' websites, or by searching the contents of websites visited by the cardholder for the competitors' names, etc.); (5) whether the cardholder searched online for a different product or service in the same price range as the transaction amount (e.g., by analyzing search terms and/or results, and/or by analyzing URLs or contents of websites visited by the cardholder and comparing prices of products/services, etc.); and/or (6) whether the cardholder entered search terms indicative of the cardholder's need for the product or service (e.g., by determining that the cardholder entered search terms including “pipe leak” prior to the purchase of new plumbing hardware, or “computer repair” prior to the purchase of a new hard drive, etc.). In other embodiments, the interest-basedfactors 222 may include more, fewer and/or different factors than those shown inFIG. 4A . - As is also seen in
FIG. 4A , the location-basedfactors 224 may include: (1) whether the cardholder “checked in” to a flight having a destination near the location where the transaction was initiated (e.g., by determining whether the cardholder checked in to a flight having a destination at the city in which the transaction occurred, or within a threshold number of miles of the city in which the transaction occurred, etc.); (2) whether the cardholder visited a website associated with a place near (or in) which the transaction was initiated (e.g., by comparing URLs of websites visited by the cardholder to URLs of websites known to be associated with particular areas, and/or by searching the contents of websites visited by the cardholder for location or area names, etc.); and/or (3) whether the cardholder endorsed a place near (or in) which the transaction was initiated via a social media account of the cardholder (e.g., by determining whether the cardholder “liked” the geographic area, attraction or other place via his or her Facebook® account, etc.). In other embodiments, the location-basedfactors 224 may include more, fewer and/or different factors than those shown inFIG. 4A . - Generally, the data indicative of whether the circumstance corresponding to each of interest-based
factors 222 and/or location-basedfactors 224 is present/true for a particular cardholder may be included in the first customer online activity data 110 described above in connection withFIG. 3A . For example, externaldata collection unit 42 ofFIG. 1 may obtain the search terms, URLs, user online selections, etc., needed to determine whether the various factors exist, from the cardholder's computing device (e.g., one of cardholder computing devices 20) and/or from an ISP ofother sources 24. - As is also seen in
FIG. 4A , each of the interest-basedfactors 222 and location-basedfactors 224 may be associated with a particular score or weighting value. In the rule set 220 shown inFIG. 4A , a total score may be calculated based upon which factors are, or are not, present (e.g., add 94 points if it is determined that the cardholder searched for the particular lawnmower model that was purchased, add another 80 points if the transaction was a “card present” transaction in the Chicago suburb of Joliet and the cardholder checked in to a flight to Chicago just prior to the transaction, etc.). - In some embodiments, certain factors may instead be associated with negative scores (e.g., minus 80 if the cardholder checked in to a flight with a destination at least 200 miles from the site of the transaction and within one day of the transaction, etc.). Moreover, certain factors may be associated with metrics or algorithms that determine how heavily those factors are weighed. As indicated in
FIG. 4A , for example, search terms entered by the cardholder may be used to calculate a “need score” X (e.g., where X is based upon frequency of certain search terms being used, the amount of time spent clicking through search results, the magnitude and/or urgency of a problem indicated by the search terms, etc.), with X then being used to calculate a score equal to 0.2X. - The rule set 220 may then output the total score (e.g., 94+80=+174), a normalized total score, an indication of whether the total score exceeded a threshold (e.g., a threshold of +100), a probability calculated based upon the total score, and/or some other indicator or measure of the existence or likelihood of fraud. In the example shown in
FIG. 4A , it can be seen that larger scores generally correspond to a greater probability that the transaction was made or authorized by the cardholder. If the transaction is being automatically reviewed (e.g., to determine whether a fraud alert is appropriate, without any initial input from the cardholder), this may mean that a lower score corresponds to a higher probability of fraud. Conversely, if the cardholder had reported the transaction as being fraudulent, a higher score may correspond to a higher probability of fraud (i.e., fraud on the part of the cardholder). - In some embodiments, the rule set 220 may also include one or more other types of factors not necessarily based upon online activities of the cardholder (e.g., whether GPS of the cardholder's smartphone or vehicle indicates that he or she was in that area shortly before or after the transaction, etc.), and/or may omit either interest-based
factors 222 or location-basedfactors 224. - Referring next to
FIG. 4B , an exemplary rule set 230 (e.g., generated atprocess stage 124 ofFIG. 3B ) may use various factors relating to a transaction between a cardholder and a merchant to determine whether the transaction should be flagged as a candidate for a chargeback (e.g., to determine whether the transaction should be reviewed under a full set of chargeback rules associated with the appropriate card network entity). The rule set 230 may correspond to a particular embodiment and scenario in which the transaction at issue is a “card present” transaction. - As seen in
FIG. 4B , the factors considered under the rule set 230 may include: (1) whether an EMV chip card was not inserted in a point-of-sale EMV chip reader device of the merchant; (2) whether a non-EMV card was not swiped in a point-of-sale device of the merchant; (3) whether the card is past its expiration date; (4) whether the transaction is for the same amount and/or date as another transaction involving the same card and merchant (e.g., by analyzing other transactions involving the same account and merchant within a particular time span); and/or (2) whether the transaction is for greater than a threshold amount. For example, one ofmerchant computing systems 22 ofFIG. 1 (or an acquiring/merchant bank) may provide transaction details that include the amounts, dates, etc., toFAMS 14 for storage inaccount records database 30, and externaldata collection unit 42 may then retrieve that information fromaccount records database 30. Generally, the data indicative of whether the circumstance corresponding to each of the factors is present/true for a particular transaction may be included in the firstaccount transaction data 130 described above in connection withFIG. 3B . In other embodiments, the factors considered under rule set 230 may include more, fewer and/or different factors than those shown inFIG. 4B . It is noted that, in some embodiments, one or more factors may simply relate to the desirability (e.g., from a card issuer perspective) of further reviewing whether a chargeback is appropriate, without necessarily relating to the likelihood that a chargeback is appropriate. - As is also seen in
FIG. 4B , each of the factors may be associated with a particular score or weighting value. A total score may be calculated based upon which factors are, or are not, present (e.g., add 62 points if it is determined that the transaction has the same amount and date as another transaction occurring close in time and involving the same card and merchant). In some embodiments, certain factors may instead be associated with negative scores, and/or certain factors may be associated with metrics or algorithms that determine how heavily those factors are weighed. - The rule set 230 may then output the total score, a normalized total score, an indication of whether the total score exceeded a threshold, a probability calculated based upon the total score, and/or some other indicator or measure of the likelihood that a chargeback is appropriate for the transaction. In the example shown in
FIG. 4B , it can be seen that larger scores generally correspond to a greater probability that a chargeback is appropriate. - Referring now to
FIG. 4C , an exemplary rule set 240 (e.g., generated atprocess stage 144 ofFIG. 3C ) may use a diverse array of factors to classify the type(s) of fraudulent activity, if any, that is/are suspected to be associated with an event or series of events. The rule set 240 may correspond to a particular embodiment and scenario in which the event at issue is a financial transaction involving a debit or credit card. In other embodiments and/or scenarios, however, the rule set 240 may classify fraudulent activity with respect to specific other types of events (e.g., loan applications), or may detect a variety of different event types (e.g., various types of financial transactions, loan or credit applications, etc.) and broadly classify fraudulent activity in connection with the detected event types (e.g., lost/stolen card use, application fraud, etc.). - In one embodiment, each potential classification (with the possible exception of “no fraud”) may be associated with a number of factors probative of whether that type/class of fraud has occurred. As seen in
FIG. 4C , for example, the rule set 240 may include counterfeit factors 242 (e.g., factors indicating that a counterfeit card was used for the transaction), account takeover factors 244 (e.g., factors indicating that the transaction resulted from an unauthorized person gaining online access to the credit or debit card account itself, via phishing, malware or other means), chargeback fraud factors 246 (e.g., factors indicating that the cardholder made or otherwise authorized a purchase that the cardholder later contested) and skimming factors 248 (e.g., factors indicating that the card information used for the transaction was obtained via a skimming card reader device illegally installed in an ATM, gas station pump or other location). In other embodiments, the rule set 240 may also, or instead, include factors corresponding to one or more other fraud classifications (e.g., forgery, lost/stolen card use, etc.). - As seen in
FIG. 4C , the counterfeit factors 242 may include: (1) whether the suspect transaction and another, contemporaneous transaction (e.g., occurring within one hour, etc.) in another state are both “card present” transactions; and/or (2) if the suspect transaction is a “card present” transaction, whether the card (if an EMV chip card) was not inserted in an EMV chip card reader. For example, one or more ofmerchant computing systems 22 ofFIG. 1 (or one or more acquiring/merchant banks) may provide transaction details that include whether the transaction was “card present,” whether the card was inserted in an EMV chip card reader, etc., toFAMS 14 for storage inaccount records database 30, and externaldata collection unit 42 may then retrieve that information fromaccount records database 30. In other embodiments, the counterfeit factors 242 may include more, fewer and/or different factors than those shown inFIG. 4C . - The account takeover factors 244 may include: (1) whether the debit or credit card account password was changed within the 10 days prior to the transaction; and/or (2) whether the transaction was originated from an IP address not associated with the cardholder. For example, external
data collection unit 42 may retrieve password change information fromaccount records database 30 ofFIG. 1 , which may log all password update activity, and/or may retrieve IP address information from one of merchant computing systems 22 (e.g., the computing system of the merchant involved in the transaction). In other embodiments, the account takeover factors 244 may include more, fewer and/or different factors than those shown inFIG. 4C . - The
chargeback fraud factors 246 may include: (1) whether the cardholder had searched online for the product or service purchased via the transaction; and/or (2) whether the cardholder had visited a website associated with the merchant involved in the transaction. For example, externaldata collection unit 42 ofFIG. 1 may retrieve online search information (e.g., search terms and/or results) and/or URLs from the one ofcardholder computing devices 20 that is associated with the cardholder, and/or from an ISP (of other sources 24) used by the cardholder. In other embodiments, thechargeback fraud factors 246 may include more, fewer and/or different factors than those shown inFIG. 4C . - The skimming factors 248 may include: (1) the number (X) of earlier transactions in which the card used for the transaction at issue was used at an ATM machine or a gas station pump within the 10 days prior to the transaction at issue; and/or (2) whether the transaction at issue originated from an IP address not associated with the cardholder. For example, external
data collection unit 42 ofFIG. 1 may retrieve transaction data indicating that certain past purchases were made using gas station pump card readers, and/or indicating that the card was used for one or more ATM withdrawals, fromaccount records database 30, and/or may retrieve the originating IP address from the one ofmerchant computing systems 22 associated with the merchant involved in the transaction at issue. In other embodiments, the skimming factors 248 may include more, fewer and/or different factors than those shown inFIG. 4C . - Generally, the data indicative of whether the circumstance corresponding to each of
counterfeit factors 242, account takeover factors 244,chargeback fraud factors 246 and/or skimmingfactors 248 is present/true for a particular transaction may be included in thefirst account data 150 described above in connection withFIG. 3C , for example. - As is also seen in
FIG. 4C , each of the counterfeit factors 242, account takeover factors 244,chargeback fraud factors 246 and skimmingfactors 248 may be associated with a particular score or weighting value. The factors for each classification (counterfeit, account takeover, chargeback fraud, skimming) may be used to calculate a total score specific to that classification. In the rule set 240 shown inFIG. 4C , for example, a counterfeit score may be calculated based upon which offactors 242 are, or are not, present, an account takeover score may be calculated based upon which of factors 244 are, or are not, present, and so on. In some embodiments, certain factors may instead be associated with negative scores, and/or certain factors (e.g., the first of skimmingfactors 248 shown inFIG. 4C ) may be associated with metrics or algorithms that determine how heavily those factors are weighed. - For each classification/category, the rule set 240 may output the total score, a normalized total score, an indication of whether the total score exceeded a threshold, a probability calculated based upon the total score, and/or some other indicator or measure of the likelihood that fraud of that particular type/class occurred in connection with the transaction. In the example shown in
FIG. 4C , it can be seen that larger scores generally correspond to a greater probability that the respective classification is accurate. Referring back toFIG. 3C , the classification atprocess stage 152 may be the classification having the highest score and/or probability under rule set 240, or may include the score and/or probability for each classification, the top three classifications, etc. - Referring now to
FIG. 4D , an exemplary rule set 260 may use online search information (e.g., search terms, search results, clicked/selected search results, etc.) to detect whether an application was fraudulent (e.g., not populated and/or submitted by the purported applicant). The rule set 260 may have been generated atprocess stage 164 ofFIG. 3D , for example. The rule set 260 may be incorporated into a review process that is generally applied to all applications received by a particular entity or anti-fraud service, or a review process applied only to those applications that were flagged by a preliminary fraud alert, for example. - The factors considered under the rule set 260 may generally be probative of whether the person that submitted the application (e.g., via a web browser, a dedicated application, as an email attachment, by snail mail, etc.) had performed one or more online searches indicating that he or she was trying to learn more about the purported applicant in order to populate particular fields of the application (e.g., a “home address” field, “employment history” fields, etc.). The “purported applicant” may be a person whose name appears in a name and/or signature field of the application, for example.
- As seen in
FIG. 4D , the factors of exemplary rule set 260 may include: (1) whether the applicant used search terms that included the name of the purported applicant; (2) whether the search terms also included the words “address” or “residence” (and possibly other synonyms or near-synonyms); and/or (3) whether the search terms also included the words “employer,” “job” and/or “career” (and possibly other synonyms or near-synonyms). In other embodiments, the rule set 260 may include more, fewer and/or different factors than those shown inFIG. 4D . For example, the rule set 260 may include one or more factors relating to which search results appeared and/or were selected (e.g., “clicked” on after appearing on a user interface) by the applicant. - Generally, the data indicative of whether the circumstances corresponding to the factors of rule set 260 are present/true for a particular applicant may be included in the first applicant
search history data 170 described above in connection withFIG. 3D . For example, externaldata collection unit 42 ofFIG. 1 may obtain the search terms, search results, search result user selections, etc., needed to determine whether the various factors exist, from the applicant's computing device (e.g., similar to one of cardholder computing devices 20) and/or from an ISP ofother sources 24. Access to such information may be made a condition of having the application be considered, for example. - As is also seen in
FIG. 4D , each of the factors of rule set 260 may be associated with a particular score or weighting value. A total score may then be calculated based upon which factors are, or are not, present. In some embodiments, certain factors may instead be associated with negative scores, and/or certain factors may be associated with metrics or algorithms that determine how heavily those factors are weighed. - The rule set 260 may then output the total score, a normalized total score, an indication of whether the total score exceeded a threshold, a probability calculated based upon the total score, and/or some other indicator or measure of the existence or likelihood of application fraud. In the example shown in
FIG. 4D , it can be seen that larger scores may generally correspond to a greater probability that the application was not populated and/or submitted by the purported applicant. - Referring now to
FIG. 4E , a flow diagram illustrates at least a portion of aprocess flow 270 implementing an exemplary rule set for fraud dispute, or potential fraud dispute, resolution (e.g., a rule set generated at process stage 184 ofFIG. 3E ). Theprocess flow 270 may be used to help resolve a dispute over a contested transaction, or to help a customer recall an unrecognized transaction, for example.FIG. 4E illustrates a process flow, rather than just a set of factors, in order to better illustrate an example process for generating queries based upon the generated rules, according to one embodiment. Theprocess flow 270 may correspond to a particular embodiment and scenario in which the transaction subject to dispute or potential dispute is a credit or debit card transaction. - In the
exemplary process flow 270, the rule set may specify that aprocess stage 272 determines whether the transaction was a “card present” transaction. If not, the rule set may specify that the flow proceed directly to aprocess stage 280. If so, however, the rule set may specify that the flow instead proceeds to aprocess stage 274. - The rule set may also specify that
process stage 274 determines whether at least one other transaction associated with the cardholder's account occurred within some threshold number of hours (X) of the transaction at issue. If not, the rule set may specify that the flow proceeds directly to processstage 280. If so, however, the rule set may specify that the flow instead proceeds to aprocess stage 276. -
Process stage 276 may generate one or more location-related queries using transaction data associated with the cardholder's account. The queries may ask, for example, whether the cardholder was in (or near) one or more particular geographic areas or locations at various times. If the transaction at issue occurred in San Francisco, for example, with a first other “card present” transaction occurring in Santa Rosa four hours earlier and a second other “card present” transaction occurring in San Jose two hours later,process stage 276 may generate one or more queries asking whether the cardholder made or authorized the earlier and/or later transactions, and/or whether the cardholder traveled on a route from Santa Rosa to San Jose that passed through San Francisco, etc. - In some embodiments, the location-related queries are generated based upon data associated with events or circumstances other than transactions. For example, if the transaction at issue occurred in Sarasota, Florida, and the data considered under the rule set indicates that the cardholder checked in to a flight to Tampa,
process stage 276 may generate one or more queries asking whether the cardholder completed the flight, where the cardholder went after landing in Tampa, etc. - The rule set may also specify that
process stage 280 determines whether the transaction at issue is associated with a billing alias that is dissimilar to the name of the merchant involved in the transaction. For example, the computing system of the merchant (e.g., one ofmerchant computing systems 22 ofFIG. 1 ) may have sent to FAMS 14 a transaction record that identified the merchant by the alias, and was presented to the cardholder as an online or paper account statement. The determination atprocess stage 280 may use the billing alias to identify a legal and/or common name of the merchant (e.g., using a relational database stored in AFSS12 or FAMS 14), and determine that there is at least some threshold level of dissimilarity (e.g., based upon difference of characters, character ordering, etc.) between the billing alias and the merchant name. - If the billing alias and merchant name are not sufficiently dissimilar, the rule set may specify that the flow proceeds directly to a process stage 284. If sufficiently dissimilar, however, the rule set may specify that the flow instead proceeds to a
process stage 282.Process stage 282 may generate a query relating to the billing alias that was presented to the cardholder. For example, the query may ask whether the cardholder is aware that the billing alias is used by that particular merchant. In some embodiments,process stage 282 may instead generate a message that simply informs the cardholder that the billing alias corresponds to the merchant, without posing a question. - The rule set may specify that process stage 284 generates one or more default queries. For example, one default query may ask whether the cardholder lent his or her card to a friend or family member around the time of the transaction. In some embodiments and/or scenarios, process stage 284 may be omitted from
process flow 270. Generally, the queries (and possibly non-query messages) generated inprocess flow 270 may serve to help the cardholder recall whether the transaction was made or authorized, and/orprocess flow 270 may prompt the cardholder for responses that are considered by others (e.g., personnel of an entity associated withFAMS 14 ofFIG. 1 ) to determine whether the transaction was likely fraudulent. - Although not shown in
FIG. 4E , in someembodiments process flow 270 may include a number of iterative stages in which responses are received from the cardholder (e.g., from the respective one ofcardholder computing devices 20 inFIG. 1 ) and used to generate additional, more detailed questions for the cardholder. For example, if a first query asks whether the cardholder recalls personally making another “card present” transaction that occurred at a nearby time and place, and the cardholder responds “no,” a new query may be generated asking whether the cardholder recalls personally making the next closest transaction (in terms of time and/or location). - Referring next to
FIG. 4F , an exemplary rule set 290 (e.g., generated atprocess stage 204 ofFIG. 3F ) may use various factors relating to an imaged (e.g., photographed or scanned) physical document to determine whether the document should be flagged as a candidate for a more in-depth (e.g., manual) analysis/review for fraud purposes. The rule set 290 may correspond to a particular embodiment and scenario in which the document is one that includes at least a signature field (e.g., a personal check, a driver's license, etc.). - The factors considered under the rule set 290 may include a number of
counterfeit factors 292 and a number offorgery factors 294, each of which may be evaluated by image analysis unit 52 ofFIG. 1 using one or more image processing techniques. The counterfeit factors 292 may relate to the look, presentation, format and/or structure of the document, while the forgery factors 294 may relate to the substance, style or format of information entered in one or more fields of the document. - As seen in
FIG. 4F , the counterfeit factors 292 may include: (1) whether one or more absolute or relative dimensions and/or angles of the document, or of lines, illustrations, patterns, etc. shown on the document (excluding user-entered contents in fields such as the signature line), are outside one or more predetermined tolerances; (2) whether one or more colors on the document are outside a predetermined tolerance (e.g., color/frequency range); (3) whether one or more line thicknesses of the document (excluding user-entered field contents) are outside one or more predetermined tolerances; and/or (4) whether one or more fonts on the document (excluding user-entered field contents) are outside one or more predetermined tolerances. For example, image analysis unit 52 may determine whether the ratio of the document length to the document width is within 0.1% of an expected value. As another example, image analysis unit 52 may determine whether horizontal and vertical lines on the document are within 0.3 degrees of the horizontal and vertical edges of the document, respectively. As yet another example, image analysis unit 52 may determine whether a font used for a field descriptor or other text on the document matches an expected font (e.g., by meeting a similarity threshold measured in any suitable manner). In other embodiments, the counterfeit factors 292 may include more, fewer and/or different factors than those shown inFIG. 4F . - The forgery factors 294 may include: (1) whether a signature entered in a signature field of the document match is outside a predetermined tolerance (e.g., using any suitable signature recognition technique); (2) whether handwriting entered in one or more fields of the document is outside a predetermined tolerance (e.g., by applying a suitable handwriting recognition technique); and/or (3) whether the format of information entered by a user in one or more fields does not match an expected format (e.g., using “9.12.16” rather than the expected “9/12/2016,” as established based upon other documents known to have been populated and/or submitted by the purported applicant). In other embodiments, the forgery factors 294 may include more, fewer and/or different factors than those shown in
FIG. 4F . - Generally, the data indicative of whether the circumstances corresponding to counterfeit
factors 292 and/orforgery factors 294 are present/true for a particular document may be included in the first document image data 210 described above in connection withFIG. 3F . - As is also seen in
FIG. 4F , each of the counterfeit factors 292 andforgery factors 294 may be associated with a particular score or weighting value. In the rule set 290 shown inFIG. 4F , a total score may be calculated based upon which factors are, or are not, present. In some embodiments, certain factors may instead be associated with negative scores, and/or certain factors may be associated with metrics or algorithms that determine how heavily those factors are weighed. - The rule set 290 may then output the total score, a normalized total score, an indication of whether the total score exceeded a threshold, a probability calculated based upon the total score, and/or some other indicator or measure of the likelihood that the document is fraudulent. Alternatively, the rule set 290 may output a separate total score, normalized score, probability, or other metric, for each of
counterfeit factors 292 andforgery factors 294, with the counterfeit metric indicating the likelihood that the document is a counterfeit and the forgery metric indicating the likelihood that the document was fraudulently populated by someone other than the purported person (e.g., by someone other than the person corresponding to the name, signature, address, etc. on the document). In the example shown inFIG. 4F , it can be seen that larger scores generally correspond to a greater probability that the document is fraudulent. In some embodiments, the rule set 290 also includes one or more other types of factors not shown inFIG. 4F , and/or omits eithercounterfeit factors 292 or forgery factors 294. -
FIGS. 5-11 depict flow diagrams of various exemplary computer-implemented methods that may be implemented by one or more components ofAFSS 12 ofFIG. 1 . In one embodiment,AFSS 12 implements all of the methods corresponding toFIGS. 5-11 . In other embodiments,AFSS 12 implements only a subset (e.g., one, two, etc.) of the methods corresponding toFIGS. 5-11 . Each of the methods described below may be implemented by fraud detection/classification unit 36 ofFIG. 1 , for example. - A. Exemplary Methods for Detecting Chargeback Candidates and/or Compromised Merchants
- Referring now to
FIG. 5 , an exemplary computer-implementedmethod 300 may be used to identify a potential chargeback scenario, e.g., to narrow down the field of fraudulent transactions that should be further investigated for chargeback purposes. In themethod 300, chargeback candidate detection rules may be generated or updated (block 301). The rules may be generated or updated using a machine learning program, such as any of the types of machine learning programs discussed above in connection withML rule generator 40 ofFIG. 1 or process stage 84 ofFIG. 2 , for example. The machine learning program may be trained using transaction data associated with a plurality of financial transactions, and chargeback determinations each corresponding to a respective one of the plurality of financial transactions. The chargeback determinations (e.g., indications of whether a chargeback was or was not instituted for each transaction) may each be made in accordance with chargeback rules associated with (e.g., provided by) a card network entity. - An indication that fraud has been confirmed for a first financial transaction, associated with a particular financial account and a particular merchant, may be received (block 302). For example, an automated investigation (e.g., using any suitable process, method or technique described herein), and/or a manual investigation, may have been performed to determine that the first financial transaction was fraudulent in some way, and a user input or other data indicative of that outcome may be received at
block 302. - First transaction data, associated with the first financial transaction, may be retrieved (block 303). For example, a database containing account records (e.g., account records database of
FIG. 1 ) may contain a record of transactions associated with each of multiple accounts, and the transaction of interest may be retrieved atblock 303 by accessing the information stored in the database. - It may be determined, by applying the chargeback candidate detection rules generated or updated at block 301 to the first transaction data retrieved at
block 303, that a chargeback may be warranted for the first financial transaction (block 304). For example, the first financial transaction may be flagged as a relatively strong candidate with respect to the appropriateness of a chargeback payment from the merchant or acquiring bank to the card issuer. In other scenarios, not represented byFIG. 5 , it may instead be determined that a chargeback is not a good chargeback candidate. - The determination at
block 304 may be based upon different factors, in accordance with the specific scenario and/or embodiment. For example, the determination may be based at least upon a card associated with the financial account being expired when the first financial transaction occurred. As other examples, the determination may be based at least upon a dollar amount of the first financial transaction (e.g., the amount exceeding a threshold), and/or upon a second financial transaction under the same account duplicating one or more characteristics of the first financial transaction (e.g., the same amount, date, time, and/or other characteristics that may be indicative of an improper duplicate charge). - An indication that the chargeback may be warranted may be caused to be displayed to one or more people via one or more respective computing device user interfaces (block 305). The indication may also specify the transaction at issue, the merchant, and possibly other information such as the transaction date, amount, etc. The indication may be sent to a computing device of a card issuer or other entity, for example, to prompt a full review of the first financial transaction under the chargeback rules of the card network entity.
Block 305 may be implemented bynotification unit 56 ofFIG. 1 , for example. - In some embodiments, the
method 300 may include one or more additional blocks not shown inFIG. 5 . For example, themethod 300 may include an additional block in which it is determined, by applying the chargeback rules of the card network entity to the first transaction data and additional data associated with that transaction (e.g., additional data received from the merchant and/or other sources), that a chargeback is indeed warranted for the transaction. The additional data may include data indicative of a card information entry mode used to conduct the first financial transaction (e.g., “card present,” swiped, inserted in an EMV chip card reader, etc.), for example. In other embodiments and/or scenarios, the chargeback rules may be applied manually. - As another example, the
method 300 may include an additional block in which first account data associated with the first financial account is retrieved (e.g., card expiration date, whether the card is an EMV card, etc., possibly obtained from the same account records database accessed at block 303). In such an embodiment, block 304 may further include applying the chargeback candidate detection rules to the first account data. -
FIG. 6 illustrates an exemplary computer-implementedmethod 310 of determining that a merchant computer terminal warrants a chargeback after a consumer dispute or fraudulent transaction based upon dispute rules (or chargeback rules). Themethod 310 may include, via one or more processors and/or transceivers, determining a merchant and/or a merchant computing terminal associated with a fraudulent financial transaction, such as by IP address (block 311). Themethod 310 may include, the one or more processors and/or transceivers, retrieving a configuration, or parameters or specifications of the merchant computing terminal from a memory unit, or receiving such information via wireless communication or data transmission over one or more radio links or wireless communication channel transmitted by the merchant computing terminal (block 312). Themethod 310 may include retrieving, via the one or more processors and/or transceivers, current or up-to-date dispute rules regarding computer specifications or requirements (block 313). Themethod 310 may include comparing, via the one or more processors, the current dispute rules regarding computer requirements with the merchant computer terminal specifications to determine whether or not the merchant computer terminal is compliant with current dispute rules (block 314). For instance, the one or more processors may analyze the dispute rules to identify requirements or required specifications of merchant computing terminals. Themethod 310 may include verifying other dispute rules are satisfied for a valid chargeback and/or whether the financial transaction is still within requisite time or allowable recovery period. Themethod 310 may include, if the merchant computer terminal is not compliant with the dispute rules or computer required specifications, generating an electronic chargeback notification and transmitting it to a merchant computing device (block 315) to facilitate merchant notification. - For instance, the dispute rules may require merchant computing terminals to be equipped with “chip” readers, smart card readers, or the like. The
method 310 may determine that the merchant computing terminal is only equipped with older or “swipe” technology, and if so, a card issuer may be entitled to a chargeback associated with a fraudulent transaction from the merchant. - In one aspect, a computer-implemented method of identifying a merchant computer terminal warranting a chargeback may be provided. The method may include (1) identifying, via one or more processors and/or transceivers, a merchant computer terminal (and/or an IP address of the merchant computer terminal) associated with a fraudulent financial transaction; (2) retrieving or receiving, via the one or more processors and/or transceivers, an actual configuration, parameters, and/or specifications associated with the merchant computer terminal; (3) retrieving or receiving, via the one or more processors and/or transceivers, up-to-date dispute rules associated with chargebacks, the dispute rules including merchant computer terminal requirements; (4) analyzing, via the one or more processors, the dispute rules to determine merchant computer terminal requirements; (5) comparing, via the one or more processors and/or transceivers, the merchant computer terminal requirements from the current dispute rules with the actual configuration, parameters, and/or specifications associated with the merchant computer terminal to identify if the merchant computer terminal is non-complaint with the dispute rules; (6) if the merchant computer terminal is non-complaint, then generating, via the one or more processors, an electronic notification that includes an identification of the financial transaction at issue, a transaction amount, and that a chargeback is warranted due to a merchant computing device being non-compliant with the dispute rules; and/or (7) transmitting, via the one or more processors and/or transceivers, the electronic notification to a merchant computing device via wireless communication over one or more radio frequency links to facilitating resolving financial transaction disputes.
- The method may include receiving, via the one or more processors and/or transceivers, dispute rules associated with a credit card issuer; and identifying, via the one or more processors, merchant computer terminal technical specifications that would warrant a chargeback and merchant computer terminal technical specifications that would not warrant a chargeback.
- The method may include receiving, via the one or more processors and/or transceivers, actual technical specifications of a merchant computer associated with the financial transaction; comparing, via the one or more processors, the actual technical specifications with the merchant computer terminal technical specifications that would warrant a chargeback to determine that a chargeback is warranted; and/or generating, via the one or more processors, an electronic notification indicating that the chargeback is warranted.
- The method may include receiving, via the one or more processors and/or transceivers, actual technical specifications of a merchant computer associated with the financial transaction; comparing, via the one or more processors, the actual technical specifications with the merchant computer terminal technical specifications that would not warrant a chargeback (or satisfy computer requirements of the dispute rules) to determine that a chargeback is not warranted; and/or generating, via the one or more processors, an electronic notification indicating that the chargeback is not warranted based upon computer specifications.
- In another aspect, a computer system configured to identify a merchant computer terminal warranting a chargeback may be provided. The computer system may include one or more processors and/or transceivers configured to: identify a merchant computer terminal (and/or an IP address of the merchant computer terminal) associated with a fraudulent financial transaction; retrieve from a local or remote memory unit, and/or receive via wireless communication or data transmission over one or more radio links or wireless communication channels, an actual configuration, parameters, and/or specifications associated with the merchant computer terminal; retrieve from a local or remote memory unit, and/or receive via wireless communication or data transmission over one or more radio links or wireless communication channels, up-to-date dispute rules associated with chargebacks, the dispute rules including merchant computer terminal requirements; determine merchant computer terminal requirements from processor analysis of the dispute rules; compare the merchant computer terminal requirements from the current dispute rules with the actual configuration, parameters, and/or specifications associated with the merchant computer terminal to identify if the merchant computer terminal is non-complaint with the dispute rules; if the merchant computer terminal is non-complaint, then generate an electronic notification that includes an identification of the financial transaction at issue, a transaction amount, and that a chargeback is warranted due to a merchant computing device being non-compliant with the dispute rules; and/or transmit the electronic notification to a merchant computing device via wireless communication or data transmission over one or more radio frequency links or wireless communication links to facilitating resolving financial transaction disputes.
-
FIG. 7 illustrates a computer-implementedmethod 320 of identifying compromised, or potentially compromised, merchants and/or reducing future chargebacks (or actual losses) or fraud. The method 320 may include, via one or more processors and/or transceivers (such as via wireless communication or data transmission over one or more radio frequency links and/or wireless communication channels), (1) generating a list of chargebacks for a given period of time (block 321); (2) inputting the list of chargebacks associated with the merchant (and/or associated facts related to the underlying financial transaction) into a machine learning program that is trained to identify a reason why each chargeback was generated (or actual loss was incurred), and/or a type or classification of each chargeback (block 322) (such stolen card, lost card, account take over, fraudulent application, compromised computing system, identity theft, counterfeit card, etc.); (3) analyzing the reason and/or the type or classification of each chargeback to identify those chargebacks associated with a potentially compromised merchant computer system (block 323) (such as by inputting the reason and/or the type or classification of each chargeback into a second machine learning program trained to identify chargebacks associated with potentially compromised merchant computer systems); (4) determining a merchant associated with a number of chargebacks within the given period of time (including those that are identified as being associated with potentially compromised merchant computer systems) that are over a predetermined threshold amount or an outlier amount indicative of suspicious activity (block 324), such as a spike in a specific type or classification of chargeback that is an individual merchant is experiencing; (5) generating an electronic notification notifying the potentially compromised merchant of a possibility of a data breach or other security concern (block 325); and/or (6) transmitting the electronic notification to a compromised merchant computing device (block 326) to alert the compromised merchant of the data breach or other security concern. -
FIG. 8 illustrates a computer-implementedmethod 330 of identifying compromised, or potentially compromised, merchants. The method 330 may include, via one or more processors and/or transceivers (such as via wireless communication or data transmission over one or more radio frequency links and/or wireless communication channels), (1) generating financial fraud electronic alerts using a rules-based model or engine (block 331); (2) inputting the financial fraud electronic alerts into a machine learning program trained to determine a reason why each fraud alert was generated (such stolen card, lost card, account take over, fraudulent application, compromised computing system, identity theft, counterfeit card, etc.), and/or a type or classification of each fraud alert (block 332); (3) analyzing the reason and/or the type or classification of each fraud alert to identify those fraud alerts associated with a potentially compromised merchant computer system (block 333) (such as by inputting the reason and/or the type or classification of each fraud alert into a second machine learning program trained to identify fraud alerts associated with potentially compromised merchant computer systems or determine unusual fraud alerts for individual merchants or types of merchants); (4) determining a merchant associated with a number of fraud alerts (such as those identified as being associated with potentially compromised merchant computer systems, or other types of alerts) that are over a predetermined threshold or an outlier amount indicative of suspicious activity (block 334); (5) generating an electronic notification notifying the compromised merchant of a possibility of a data breach or other security concern (block 335); and/or (6) transmitting the electronic notification to a compromised merchant computing device (block 336) to alert the compromised, or potentially compromised, merchant of the data breach or other security concern. - Referring now to
FIG. 9 , an exemplary computer-implementedmethod 340 may be used to detect potential application fraud, e.g., to detect instances where an applicant for a loan, credit, checking, savings, investment and/or other type of account, service or benefit is not the person that he or she purports to be. In themethod 340, application data, indicative of applicant entries in one or more fields of an application associated with a potential account, may be received (block 341). The application may be an application received from a source computing device via the Internet (e.g., via a web page, via a dedicated application, via email, etc.), for example. - The source computing device, via which the applicant submitted the application data, may be identified (block 342). The source computing device may be similar to one of
computing devices 20 ofFIG. 1 , for example. In one embodiment, block 342 may include identifying an IP address of the source computing device. - Search history data, indicative of one or more search terms submitted to an Internet-based search engine (e.g., a Google® or Yahoo® search engine) via the source computing device, may be retrieved (block 343). The search history data may be retrieved from a database maintained by an ISP of the applicant, or a temporary database that is locally constructed based upon information received directly from the source computing device, for example. In one embodiment where the IP address of the source computing device is identified at
block 342, the search history data may include search terms that were submitted to the Internet-based search engine from the identified IP address. - It may be determined, by analyzing the application data and the search history data, that the applicant may not be the person whom the applicant purports to be (block 344), e.g., the person whose name and/or signature is included on the application, or is otherwise listed or indicated in connection with the application. For example, the application may be flagged at
block 344 for a further, more in-depth review. In other scenarios, not represented byFIG. 9 , it may instead be determined that the applicant likely is the person whom he or she purports to be, such that it is not necessary to flag the application for further review. -
Block 344 may include various operations, depending upon the embodiment and/or scenario. For example, block 344 may include comparing information included in retrieved search term(s) (and/or included in search results) to information included in the applicant entries in the application fields. As other examples, block 344 may include comparing a name included in the search term(s) to a name included in the applicant entries, determining that the search term(s) is/are directed to discovering an address associated with the name (e.g., by including the terms “Jonathon Doe address” or “Jonathon Doe residence,” etc.), and/or determining that the search term(s) is/are directed to discovering an employment history associated with the name (e.g., by including the terms “Jonathon Doe employer” or “Jonathon Doe work history,” etc.). - An indication of potential application fraud may be caused to be displayed to one or more people via one or more respective computing device user interfaces (block 345). The indication may also specify the purported applicant, the actual applicant, and/or other relevant information. The indication may be sent to a computing device of a card issuer or other entity, for example, to prompt a full review of the application (e.g., a manual investigation).
Block 345 may be implemented bynotification unit 56 ofFIG. 1 , for example. - In some embodiments, the
method 340 may include one or more additional blocks not shown inFIG. 9 . For example, in an embodiment whereblock 344 includes applying application fraud detection rules to the application data and the search history data, themethod 340 may include an additional block in which the application fraud detection rules are generated or updated. For example, the rules may be generated or updated by training a machine learning program, such as any of the types of machine learning programs discussed above in connection withML rule generator 40 ofFIG. 1 or process stage 84 ofFIG. 2 . The machine learning program may be trained using historical application fraud determinations made in connection with a plurality of other applications, and additional search history data associated with additional source computing devices (e.g., the devices that submitted the data for those applications), for example. -
FIG. 10 illustrates an exemplary computer-implementedmethod 350 of using IP address and/or browsing activity to identify fraudulent online or virtual applications. Themethod 350 may include, via one or more processors and/or transceivers, receiving an online or virtual application via wireless communication or data transmission over one or more radio links or wireless communication channels (block 351), such as an application for financial services, such as vehicle, home, or personal loans, or credit cards. The virtual application may include an IP address identification and/or a recent browser activity history of the computer. Themethod 350 may include determining or retrieving a name of the applicant listed on the online application (block 352). Themethod 350 may include determining an IP address of the source computer that generated the online application (block 353). Themethod 350 may include retrieving or receiving recent online browsing activity of the source computer (such as by using the IP address and/or browsing activity received with the virtual application, or querying the source computer for such information) (block 354). Themethod 350 may include determining if the recent online activity of the source computer includes internet searches on the applicant's name and/or the applicant's social media presence or website (block 355) (indicating that the person submitting the application retrieved facts about the named applicant in an effort to perform fraudulent activity or impersonate the named applicant). If so, themethod 350 may include flagging the virtual application as fraudulent, and/or in need of further manual or processor review (block 356). - In one aspect, a computer-implemented method of using browsing activity to identify fraudulent online or virtual applications may be provided. The method may include (1) receiving, via one or more processors and/or transceivers, a virtual application over one or more radio frequency links or wireless communication channels; (2) determining, via the one or more processors, an applicant name on the virtual application; (3) determining, via the one or more processors, an IP address of a source computer from which the virtual application originated; (4) determining or receiving, via the one or more processors and/or transceivers, an online browsing or search history associated with the IP address and/or source computer; (5) determining, via the one or more processors, if the online browsing or search history indicates recent internet searches for or on the applicant name; and/or (6) if so, flagging, via the one or more processors, the virtual application as fraudulent and generating an electronic alert indicating that the virtual application is fraudulent to facilitating identifying fraudulent virtual or online applications for goods or services.
- The virtual application may include a field or routine that records and retrieves recent online browsing or searching activity of the source computer, and that information is transmitted from the source computer along with the virtual application when the virtual application is submitted. In other words the virtual application may carry with it online browsing or search activity associated with the source computer when it is transmitted or submitted to a remote server, such as a financial services provider remote server.
- The virtual application may include a field or routine that records and retrieves recent social media searching activity of the source computer. The virtual application may include a field or routine that records and retrieves recent internet search engine searching activity of the source computer. The virtual application may include an IP address field of the source computer. The virtual application may include a current GPS location of the source computer.
- The method may further include determining, via the one or more processors, whether the named applicant is an existing customer; if so, receiving, via the one or more processors, customer data from one or more sources indicating a current customer location; determining, via the one or more processors, whether the current customer location corresponds to, or is within a predetermined distance of, a location of the source computer from which the virtual application originated; and/or if the current customer location does not correspond to the location of the source computer, then generating, via the one or more processors, an electronic alert indicating such.
- Determining an online browsing or search history associated with the IP address and/or source computer may include retrieving an online browsing or search history stored with or within the virtual application. Receiving an online browsing or search history associated with the IP address and/or source computer may include receiving, via the one or more processors and/or transceivers, an online browsing or search history over one or more radio links or wireless communication channels via wireless communication or data transmission. The virtual or online application may be an application for financial services or products, such vehicle, home, or personal loans; a credit card application; or an application for auto, homeowners, or life insurance.
- In another aspect, a computer system configured to use IP addresses and/or browsing activity to identify fraudulent online or virtual applications may be provided. The computer system may include one or more processors and/or transceiver configured to: receive a virtual application via wireless communication or data transmission over one or more radio frequency links or wireless communication channels; determine an applicant name on the virtual application (or retrieve the virtual applicant name saved within the virtual application); determine an IP address of a source computer from which the virtual application originated; determine or receive an online browsing or search history associated with the IP address and/or source computer; determine if the online browsing or search history indicates recent internet searches for, or on, the applicant name; and/or if so, flag the virtual application as fraudulent and generate an electronic alert indicating that the virtual application is fraudulent to facilitating identifying fraudulent virtual or online applications for goods or services.
-
FIG. 11 illustrates a computer-implementedmethod 360 of identifying mortgage fraud. The method 360 may include, via one or more processors and/or transceivers (such as via wireless communication or data transmission over one or more radio frequency links or wireless communication channels), (1) receiving a virtual application for a home loan or line of credit for a property and an identity of a person or entity applying (block 361); (2) receiving home loan or line of credit information for the property from multiple sources or lenders, each of the multiple sources or lenders having provided a previous home loan or line of credit for the property (block 362), such as providing a previous home loan or line of credit for the property to the person or entity applying for another home loan or line of credit; (3) retrieving from a memory, or receiving an appraisal for the property, the appraisal including an estimated or actual value of the property (block 363), such as receiving a virtual appraisal from another lender; (4) determining that a total amount of the multiple home loans or lines of credit for the property exceed the estimated or actual value of the property, or a percentage thereof (block 364); (5) if so, generating an electronic notification indicating that mortgage fraud associated with the property may exist and/or denying the application (block 365); and/or (6) transmitting the electronic notification to the multiple sources or lenders to notify them of the potential mortgage fraud (block 366). -
FIG. 12 depicts an exemplary computer system 500 in which the techniques described herein may be implemented, according to one embodiment. The computer system 500 ofFIG. 12 may include a computing device in the form of a computer 510. Components of the computer 510 may include, but are not limited to, a processing unit 520, a system memory 530, and a system bus 521 that couples various system components including the system memory 530 to the processing unit 520. The system bus 521 may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, or a local bus, and may use any suitable bus architecture. By way of example, and not limitation, such architectures include the Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus (also known as Mezzanine bus). - Computer 510 may include a variety of computer-readable media. Computer-readable media may be any available media that can be accessed by computer 510 and may include both volatile and nonvolatile media, and both removable and non-removable media. By way of example, and not limitation, computer-readable media may comprise computer storage media and communication media. Computer storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules or other data. Computer storage media may include, but is not limited to, RAM, ROM, EEPROM, FLASH memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can accessed by computer 510.
- Communication media typically embodies computer-readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media may include wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, radio frequency (RF), infrared and other wireless media. Combinations of any of the above are also included within the scope of computer-readable media.
- The system memory 530 may include computer storage media in the form of volatile and/or nonvolatile memory such as read only memory (ROM) 531 and random access memory (RAM) 532. A basic input/output system 533 (BIOS), containing the basic routines that help to transfer information between elements within computer 510, such as during start-up, is typically stored in ROM 531.
RAM 532 typically contains data and/or program modules that are immediately accessible to, and/or presently being operated on, by processing unit 520. By way of example, and not limitation,FIG. 12 illustrates operating system 534, application programs 535, other program modules 536, and program data 537. - The computer 510 may also include other removable/non-removable, volatile/nonvolatile computer storage media. By way of example only,
FIG. 12 illustrates a hard disk drive 541 that reads from or writes to non-removable, nonvolatile magnetic media, a magnetic disk drive 551 that reads from or writes to a removable, nonvolatile magnetic disk 552, and an optical disk drive 555 that reads from or writes to a removable, nonvolatile optical disk 556 such as a CD ROM or other optical media. Other removable/non-removable, volatile/nonvolatile computer storage media that can be used in the exemplary operating environment include, but are not limited to, magnetic tape cassettes, flash memory cards, digital versatile disks, digital video tape, solid state RAM, solid state ROM, and the like. The hard disk drive 541 may be connected to the system bus 521 through a non-removable memory interface such as interface 540, and magnetic disk drive 551 and optical disk drive 555 may be connected to the system bus 521 by a removable memory interface, such as interface 550. - The drives and their associated computer storage media discussed above and illustrated in
FIG. 12 provide storage of computer-readable instructions, data structures, program modules and other data for the computer 510. InFIG. 12 , for example, hard disk drive 541 is illustrated as storing operating system 544, application programs 545, other program modules 546, and program data 547. Note that these components can either be the same as or different from operating system 534, application programs 535, other program modules 536, and program data 537. Operating system 544, application programs 545, other program modules 546, and program data 547 are given different numbers here to illustrate that, at a minimum, they are different copies. A user may enter commands and information into the computer 510 through input devices such as cursor control device 561 (e.g., a mouse, trackball, touch pad, etc.) and keyboard 562. A monitor 591 or other type of display device is also connected to the system bus 521 via an interface, such as a video interface 590. In addition to the monitor, computers may also include other peripheral output devices such as printer 596, which may be connected through an output peripheral interface 595. - The computer 510 may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer 580. The remote computer 580 may be a personal computer, a server, a router, a network PC, a peer device or other common network node, and may include many or all of the elements described above relative to the computer 510, although only a memory storage device 581 has been illustrated in
FIG. 12 . The logical connections depicted inFIG. 12 include a local area network (LAN) 571 and a wide area network (WAN) 573, but may also include other networks. Such networking environments are commonplace in hospitals, offices, enterprise-wide computer networks, intranets and the Internet. - When used in a LAN networking environment, the computer 510 is connected to the LAN 571 through a network interface or adapter 570. When used in a WAN networking environment, the computer 510 may include a
modem 572 or other means for establishing communications over the WAN 573, such as the Internet. Themodem 572, which may be internal or external, may be connected to the system bus 521 via the input interface 560, or other appropriate mechanism. Thecommunications connections 570, 572, which allow the device to communicate with other devices, are an example of communication media, as discussed above. In a networked environment, program modules depicted relative to the computer 510, or portions thereof, may be stored in the remote memory storage device 581. By way of example, and not limitation,FIG. 12 illustrates remote application programs 585 as residing on memory device 581. - The techniques for detecting and/or classifying fraud described above may be implemented in part or in their entirety within a computer system such as the computer system 500 illustrated in
FIG. 12 . The computer 510 may be included inAFSS 12 ofFIG. 1 , for example, and/or the remote application programs 585 may include one or more applications of eitherFAMS 14, one ofcardholder computing device 20, one ofmerchant computing systems 22, or a computing device ofother sources 24. Moreover, the functionality of fraud detection/classification unit 36 ofFIG. 1 may be implemented by one or more of application programs 535 and/or other program modules 536. As another example, ML rulesdatabase 58, accountholder behaviors database 60 and/orchargeback rules database 62 ofFIG. 1 may be stored in hard disk drive 541 (e.g., as program data 547), magnetic disk 552 and/or optical disk drive 555, and/or the data retrieved by fraud detection/classification unit 36 ofFIG. 1 may be stored in hard disk drive 541 (e.g., as program data 547) and/or RAM 532 (e.g., as program data 537). - In another aspect, a computer-implemented method, implemented in one or more servers or other computing devices, of identifying a potential chargeback scenario may include (1) generating or updating, by one or more processors of the one or more servers, chargeback candidate detection rules, at least by training a machine learning program using at least (i) transaction data associated with a plurality of financial transactions, and (ii) chargeback determinations each made in accordance with chargeback rules associated with a card network entity, and each corresponding to a respective one of the plurality of financial transactions; (2) receiving, by the one or more processors, an indication that fraud has been confirmed for a first financial transaction associated with a merchant and a first financial account; (3) retrieving, by the one or more processors and from an account records database, first transaction data associated with the first financial transaction; (4) determining, by the one or more processors applying the chargeback candidate detection rules to the first transaction data, that a chargeback may be warranted for the first financial transaction; and/or (5) causing, by the one or more processors, an indication that the chargeback may be warranted to be displayed to one or more people via one or more respective computing device user interfaces, wherein the indication may further specifying at least the first financial transaction and the merchant. The method may include additional, fewer or alternative actions, such as any of those discussed elsewhere herein.
- For instance, the method may further include determining, by the one or more processors applying the chargeback rules to (i) the first transaction data and (ii) additional data associated with the first financial transaction, that a chargeback is warranted for the first financial transaction.
- Additionally or alternatively, the method may further include, prior to determining that the chargeback is warranted, receiving at least a portion of the additional data from the merchant. Additionally or alternatively, the portion of the additional data received from the merchant may include data indicative of a card information entry mode used to conduct the first financial transaction.
- Additionally or alternatively, the method may further include retrieving, by the one or more processors and from the account records database, first account data associated with the first financial account, and determining that the chargeback may be warranted for the first financial transaction may further be performed by the one or more processors applying the chargeback candidate detection rules to the first account data.
- Additionally or alternatively, determining that a chargeback may be warranted for the first financial transaction may include determining that a chargeback may be warranted based at least upon a card associated with the first financial account being expired when the first financial transaction occurred. Additionally or alternatively, determining that a chargeback may be warranted for the first financial transaction may include determining that a chargeback may be warranted based at least upon (i) a dollar amount of the first financial transaction, and/or (ii) a second financial transaction duplicating one or more characteristics of the first financial transaction.
- In another aspect, a computer-implemented method, implemented in one or more servers or other computing devices, of detecting potential application fraud may include (1) receiving, by one or more processors of the one or more servers, application data indicative of applicant entries in one or more fields of an application associated with a potential account; (2) identifying, by the one or more processors, a source computing device via which the applicant submitted the application data; (3) retrieving, by the one or more processors and from a database, search history data indicative of one or more search terms submitted to an Internet-based search engine via the source computing device; (4) determining, by the one or more processors analyzing the application data and the search history data, that the applicant may not be a person whom the applicant purports to be; and/or (5) causing, by the one or more processors, an indication of potential application fraud to be displayed to one or more people via one or more respective computing device user interfaces. The method may include additional, fewer or alternative actions, such as any of those discussed elsewhere herein.
- For instance, identifying the source computing device may include identifying an Internet Protocol (IP) address of the source computing device. Additionally or alternatively, retrieving search history data may include retrieving search history data indicative of search terms submitted to the Internet-based search engine from the identified IP address.
- Additionally or alternatively, determining that the applicant may not be the person whom the applicant purports to be may include comparing information included in the one or more search terms to information included in the applicant entries in the one or more fields; comparing a name included in the one or more search terms to a name included in the applicant entries in the one or more fields; determining that the applicant may not be the person whom the applicant purports to be may further include determining that the one or more search terms are directed to discovering an address associated with the name; and/or determining that the one or more search terms are directed to discovering an employment history associated with the name.
- Additionally or alternatively, (1) determining that the applicant is not, or may not be, the person whom the applicant purports to be may include determining, by the one or more processors applying application fraud detection rules to the application data and the search history data, that the applicant may not be a person whom the applicant purports to be; and/or (2) the method may further include generating or updating, by the one or more processors, the application fraud detection rules, at least by training a machine learning program using at least (i) historical application fraud determinations made in connection with a plurality of applications, and (ii) additional search history data associated with a plurality of additional source computing devices.
- In another aspect, a computer system for identifying a potential chargeback scenario may include (1) an account records database configured to store data associated with a plurality of financial accounts; (2) a rules database configured to store chargeback candidate detection rules; (3) one or more processors; and/or (4) a non-transitory memory. The non-transitory memory stores instructions that, when executed by the one or more processors, may cause the one or more processors to (1) generate or update the chargeback candidate detection rules, at least by training a machine learning program using at least (i) transaction data associated with a plurality of financial transactions stored in the account records database, and (ii) chargeback determinations each made in accordance with chargeback rules associated with a card network entity, and each corresponding to a respective one of the plurality of financial transactions; (2) receive an indication that fraud has been confirmed for a first financial transaction associated with a merchant and a first financial account; (3) retrieve, from the account records database, first transaction data associated with the first financial transaction; (4) determine, by applying the chargeback candidate detection rules stored in the rules database to the first transaction data, that a chargeback may be warranted for the first financial transaction; and/or (5) cause an indication that the chargeback may be warranted to be displayed to one or more people via one or more respective computing device user interfaces, wherein the indication may further specify at least the first financial transaction and the merchant. The system may include additional, fewer or alternative components, features and/or functionality, such as any of those discussed elsewhere herein.
- For instance, the instructions may further cause the one or more processors to determine, by applying the chargeback rules to (i) the first transaction data and (ii) additional data associated with the first financial transaction, that a chargeback is warranted for the first financial transaction. Additionally or alternatively, the instructions may further cause the one or more processors to, prior to determining that the chargeback is warranted, receive at least a portion of the additional data from the merchant.
- Additionally or alternatively, the portion of the additional data received from the merchant may include data indicative of a card information entry mode used to conduct the first financial transaction. Additionally or alternatively, the instructions may further cause the one or more processors to retrieve, from the account records database, first account data associated with the first financial account, and/or the instructions may cause the one or more processors to determine that the chargeback may be warranted for the first financial transaction further by applying the chargeback candidate detection rules to the first account data.
- Additionally or alternatively, the instructions may cause the one or more processors to determine that a chargeback may be warranted for the first financial transaction based at least upon a card associated with the first financial account being expired when the first financial transaction occurred. Additionally or alternatively, the instructions may cause the one or more processors to determine that a chargeback may be warranted for the first financial transaction based at least upon (i) a dollar amount of the first financial transaction, and/or (ii) a second financial transaction duplicating one or more characteristics of the first financial transaction.
- In another aspect, a computer system for detecting potential application fraud may include (1) a search history database configured to store data associated with a plurality of Internet searches; (2) one or more processors; and/or (3) a non-transitory memory. The non-transitory memory stores instructions that, when executed by the one or more processors, may cause the one or more processors to (1) receive application data indicative of applicant entries in one or more fields of an application associated with a potential account; (2) identify a source computing device via which the applicant submitted the application data; (3) retrieve, from the search history database, search history data indicative of one or more search terms submitted to an Internet-based search engine via the source computing device; (4) determine, by analyzing the application data and the search history data, that the applicant may not be a person whom the applicant purports to be; and/or (5) cause an indication of potential application fraud to be displayed to one or more people via one or more respective computing device user interfaces. The system may include additional, fewer or alternative components, features and/or functionality, such as any of those discussed elsewhere herein.
- For instance, the instructions may cause the one or more processors to identify the source computing device at least by identifying an Internet Protocol (IP) address of the source computing device. Additionally or alternatively, the search history data may be indicative of search terms submitted to the Internet-based search engine from the identified IP address.
- The instructions may cause the one or more processors to determine that the applicant may not be the person whom the applicant purports to be (i) at least by comparing information included in the one or more search terms to information included in the applicant entries in the one or more fields; (ii) at least by comparing a name included in the one or more search terms to a name included in the applicant entries in the one or more fields; (iii) further by determining that the one or more search terms are directed to discovering an address associated with the name; and/or (iv) further by determining that the one or more search terms are directed to discovering an employment history associated with the name.
- Additionally or alternatively, (1) the instructions may cause the one or more processors to determine that the applicant may not be the person whom the applicant purports to be at least by determining, by applying application fraud detection rules to the application data and the search history data, that the applicant may not be the person whom the applicant purports to be; and/or (2) the instructions may further cause the one or more processors to generate or update the application fraud detection rules, at least by training a machine learning program using at least (i) historical application fraud determinations made in connection with a plurality of applications, and (ii) additional search history data associated with a plurality of additional source computing devices.
- In one aspect, a non-transitory, computer-readable medium storing instructions that, when executed by one or more processors, may cause the one or more processors to (1) generate or update chargeback candidate detection rules, at least by training a machine learning program using at least (i) transaction data associated with a plurality of financial transactions, and (ii) chargeback determinations each made in accordance with chargeback rules associated with a card network entity, and each corresponding to a respective one of the plurality of financial transactions; (2) receive an indication that fraud has been confirmed for a first financial transaction associated with a merchant and a first financial account; (3) retrieve, from an account records database, first transaction data associated with the first financial transaction; (4) determine, by applying the chargeback candidate detection rules to the first transaction data, that a chargeback may be warranted for the first financial transaction; and/or (5) cause an indication that the chargeback may be warranted to be displayed to one or more people via one or more respective computing device user interfaces, wherein the indication may further specify at least the first financial transaction and the merchant. The system may include additional, fewer or alternative components, features and/or functionality, such as any of those discussed elsewhere herein.
- For instance, the instructions may further cause the one or more processors to determine, by applying the chargeback rules to (i) the first transaction data and (ii) additional data associated with the first financial transaction, that a chargeback is warranted for the first financial transaction. Additionally or alternatively, the instructions may further cause the one or more processors to, prior to determining that the chargeback is warranted, receive at least a portion of the additional data from the merchant.
- Additionally or alternatively, the portion of the additional data received from the merchant may include data indicative of a card information entry mode used to conduct the first financial transaction. Additionally or alternatively, the instructions may further cause the one or more processors to retrieve, from the account records database, first account data associated with the first financial account, and/or the instructions may cause the one or more processors to determine that the chargeback may be warranted for the first financial transaction further by applying the chargeback candidate detection rules to the first account data.
- Additionally or alternatively, the instructions may cause the one or more processors to determine that a chargeback may be warranted for the first financial transaction based at least upon a card associated with the first financial account being expired when the first financial transaction occurred.
- In another aspect, a non-transitory, computer-readable medium stores instructions that, when executed by one or more processors, may cause the one or more processors to (1) receive application data indicative of applicant entries in one or more fields of an application associated with a potential account; (2) identify a source computing device via which the applicant submitted the application data; (3) retrieve, from a search history database, search history data indicative of one or more search terms submitted to an Internet-based search engine via the source computing device; (4) determine, by analyzing the application data and the search history data, that the applicant may not be a person whom the applicant purports to be; and/or (5) cause an indication of potential application fraud to be displayed to one or more people via one or more respective computing device user interfaces. The computer-readable medium may store instructions that include additional, fewer or alternative actions, such as any of those discussed elsewhere herein.
- For instance, the instructions may cause the one or more processors to identify the source computing device at least by identifying an Internet Protocol (IP) address of the source computing device. Additionally or alternatively, the search history data may be indicative of search terms submitted to the Internet-based search engine from the identified IP address. Additionally or alternatively, the instructions may cause the one or more processors to determine that the applicant may not be the person whom the applicant purports to be at least by comparing information included in the one or more search terms to information included in the applicant entries in the one or more fields.
- The following additional considerations apply to the foregoing discussion. Throughout this specification, plural instances may implement operations or structures described as a single instance. Although individual operations of one or more methods are illustrated and described as separate operations, one or more of the individual operations may be performed concurrently, and nothing requires that the operations be performed in the order illustrated. These and other variations, modifications, additions, and improvements fall within the scope of the subject matter herein.
Claims (21)
1. (canceled)
2. A computer-implemented method of identifying fraudulent online applications, the method comprising:
providing, by a computer system, an online application to a user device, wherein the online application includes a routine configured to retrieve online searching activity associated with the user device;
receiving, by the computer system, a submission of the online application including applicant data;
receiving, by the computer system, the online searching activity associated with the user device;
determining, by the computer system, whether the online searching activity associated with the user device indicates a search for the applicant data; and
in response to determining that the online searching activity indicates a search for the applicant data, performing, by the computer system, a fraud mitigation action including at least one of:
flagging the submission of the online application as potentially fraudulent; or
generating an electronic alert indicating that the submission of the online application is potentially fraudulent.
3. The computer-implemented method of claim 2 , wherein the online searching activity is received as one or more data fields within the submission of the online application.
4. The computer-implemented method of claim 2 , wherein the online searching activity includes social media activity, and wherein the routine of the online application is configured to retrieve the social media activity associated with the user device.
5. The computer-implemented method of claim 2 , wherein the online searching activity includes an Internet search history, and wherein the routine of the online application is configured to retrieve the Internet search history from a search engine on the user device.
6. The computer-implemented method of claim 2 , wherein the submission of the online application includes a field indicating a GPS location of the user device, and wherein performing the fraud mitigation action is further based on the GPS location of the user device.
7. The computer-implemented method of claim 2 , wherein the submission of the online application includes an IP address of the user device, and wherein receiving the online searching activity comprises using the IP address to query the user device for the online searching activity.
8. The computer-implemented method of claim 2 , further comprising:
providing the online searching activity as input to a trained machine-learning program,
wherein performing the fraud mitigation action is based at least in part on an output of the trained machine-learning program.
9. The computer-implemented method of claim 2 , further comprising:
determining an existing user corresponding to the applicant data;
receiving, from a data source, a current user location of the existing user;
determining whether the current user location corresponds to a location of the user device; and
performing the fraud mitigation action, based at least in part on determining that the current user location does not correspond to the location of the user device.
10. The computer-implemented method of claim 2 , wherein determining the online searching activity includes receiving, via a transceiver of the computer system, the online searching activity over a radio link.
11. A system comprising:
at least one processor;
a non-transitory computer-readable media storing computer-executable instructions that, when executed, cause the at least one processor to perform operations comprising:
providing an online application to a user device, wherein the online application includes a routine configured to retrieve online searching activity associated with the user device;
receiving a submission of the online application including applicant data;
receiving the online searching activity associated with the user device;
determining whether the online searching activity associated with the user device indicates a search for the applicant data; and
in response to determining that the online searching activity indicates a search for the applicant data, performing a fraud mitigation action including at least one of:
flagging the submission of the online application as potentially fraudulent; or
generating an electronic alert indicating that the submission of the online application is potentially fraudulent.
12. The system of claim 11 , wherein the online searching activity is received as one or more data fields within the submission of the online application.
13. The system of claim 11 , wherein the online searching activity includes social media activity, and wherein the routine of the online application is configured to retrieve the social media activity associated with the user device.
14. The system of claim 11 , wherein the online searching activity includes an Internet search history, and wherein the routine of the online application is configured to retrieve the Internet search history from a search engine on the user device.
15. The system of claim 11 , wherein the submission of the online application includes a field indicating a GPS location of the user device, and wherein performing the fraud mitigation action is further based on the GPS location of the user device.
16. The system of claim 11 , wherein the submission of the online application includes an IP address of the user device, and wherein receiving the online searching activity comprises using the IP address to query the user device for the online searching activity.
17. The system of claim 11 , the operations further comprising:
providing the online searching activity as input to a trained machine-learning program,
wherein performing the fraud mitigation action is based at least in part on an output of the trained machine-learning program.
18. A non-transitory machine-readable storage medium storing instructions that, when executed, cause a processor to perform operations comprising:
providing an online application to a user device, wherein the online application includes a routine configured to retrieve online searching activity associated with the user device;
receiving a submission of the online application including applicant data;
receiving the online searching activity associated with the user device;
determining whether the online searching activity associated with the user device indicates a search for the applicant data; and
in response to determining that the online searching activity indicates a search for the applicant data, performing a fraud mitigation action including at least one of:
flagging the submission of the online application as potentially fraudulent; or
generating an electronic alert indicating that the submission of the online application is potentially fraudulent.
19. The non-transitory machine-readable storage medium of claim 18 , wherein the online searching activity is received as one or more data fields within the submission of the online application.
20. The non-transitory machine-readable storage medium of claim 18 , wherein the online searching activity includes social media activity, and wherein the routine of the online application is configured to retrieve the social media activity associated with the user device.
21. The non-transitory machine-readable storage medium of claim 18 , wherein the online searching activity includes an Internet search history, and wherein the routine of the online application is configured to retrieve the Internet search history from a search engine on the user device.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US18/222,199 US20230394500A1 (en) | 2016-03-25 | 2023-07-14 | Identifying fraudulent online applications |
Applications Claiming Priority (8)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US201662313196P | 2016-03-25 | 2016-03-25 | |
US201662318423P | 2016-04-05 | 2016-04-05 | |
US201662331530P | 2016-05-04 | 2016-05-04 | |
US201662365699P | 2016-07-22 | 2016-07-22 | |
US15/465,874 US10825028B1 (en) | 2016-03-25 | 2017-03-22 | Identifying fraudulent online applications |
US16/913,814 US11348122B1 (en) | 2016-03-25 | 2020-06-26 | Identifying fraudulent online applications |
US17/827,015 US11741480B2 (en) | 2016-03-25 | 2022-05-27 | Identifying fraudulent online applications |
US18/222,199 US20230394500A1 (en) | 2016-03-25 | 2023-07-14 | Identifying fraudulent online applications |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US17/827,015 Continuation US11741480B2 (en) | 2016-03-25 | 2022-05-27 | Identifying fraudulent online applications |
Publications (1)
Publication Number | Publication Date |
---|---|
US20230394500A1 true US20230394500A1 (en) | 2023-12-07 |
Family
ID=73019959
Family Applications (31)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/465,874 Active 2038-04-22 US10825028B1 (en) | 2016-03-25 | 2017-03-22 | Identifying fraudulent online applications |
US15/466,002 Abandoned US20210264429A1 (en) | 2016-03-25 | 2017-03-22 | Reducing false positive fraud alerts for card-present financial transactions |
US15/465,842 Active 2038-09-23 US11170375B1 (en) | 2016-03-25 | 2017-03-22 | Automated fraud classification using machine learning |
US15/466,014 Active US11334894B1 (en) | 2016-03-25 | 2017-03-22 | Identifying false positive geolocation-based fraud alerts |
US15/465,827 Active 2037-07-03 US10832248B1 (en) | 2016-03-25 | 2017-03-22 | Reducing false positives using customer data and machine learning |
US15/465,981 Abandoned US20220122071A1 (en) | 2016-03-25 | 2017-03-22 | Identifying fraudulent instruments and identification |
US15/465,977 Active 2037-10-21 US10949852B1 (en) | 2016-03-25 | 2017-03-22 | Document-based fraud detection |
US15/465,858 Active 2039-07-10 US11037159B1 (en) | 2016-03-25 | 2017-03-22 | Identifying chargeback scenarios based upon non-compliant merchant computer terminals |
US15/465,871 Abandoned US20210158355A1 (en) | 2016-03-25 | 2017-03-22 | Preempting or resolving fraud disputes relating to billing aliases |
US15/466,009 Abandoned US20210065186A1 (en) | 2016-03-25 | 2017-03-22 | Reducing false positive fraud alerts for online financial transactions |
US15/465,868 Abandoned US20210374764A1 (en) | 2016-03-25 | 2017-03-22 | Facilitating fraud dispute resolution using machine learning |
US15/465,832 Active 2037-06-12 US10872339B1 (en) | 2016-03-25 | 2017-03-22 | Reducing false positives using customer feedback and machine learning |
US15/465,856 Abandoned US20210374753A1 (en) | 2016-03-25 | 2017-03-22 | Identifying potential chargeback scenarios using machine learning |
US15/465,880 Abandoned US20210264458A1 (en) | 2016-03-25 | 2017-03-22 | Preempting or resolving fraud disputes relating to introductory offer expirations |
US16/540,505 Active US10949854B1 (en) | 2016-03-25 | 2019-08-14 | Reducing false positives using customer feedback and machine learning |
US15/931,560 Active US11004079B1 (en) | 2016-03-25 | 2020-05-13 | Identifying chargeback scenarios based upon non-compliant merchant computer terminals |
US16/899,486 Active US11049109B1 (en) | 2016-03-25 | 2020-06-11 | Reducing false positives using customer data and machine learning |
US16/913,814 Active US11348122B1 (en) | 2016-03-25 | 2020-06-26 | Identifying fraudulent online applications |
US17/078,744 Active US11687937B1 (en) | 2016-03-25 | 2020-10-23 | Reducing false positives using customer data and machine learning |
US17/080,476 Active US11687938B1 (en) | 2016-03-25 | 2020-10-26 | Reducing false positives using customer feedback and machine learning |
US17/134,901 Active US11699158B1 (en) | 2016-03-25 | 2020-12-28 | Reducing false positive fraud alerts for online financial transactions |
US17/166,854 Active 2037-07-02 US12026716B1 (en) | 2016-03-25 | 2021-02-03 | Document-based fraud detection |
US17/745,541 Active 2037-04-09 US11978064B2 (en) | 2016-03-25 | 2022-05-16 | Identifying false positive geolocation-based fraud alerts |
US17/827,015 Active US11741480B2 (en) | 2016-03-25 | 2022-05-27 | Identifying fraudulent online applications |
US17/993,758 Active US11989740B2 (en) | 2016-03-25 | 2022-11-23 | Reducing false positives using customer feedback and machine learning |
US18/207,069 Pending US20230316285A1 (en) | 2016-03-25 | 2023-06-07 | Reducing false positives using customer feedback and machine learning |
US18/207,081 Pending US20230316286A1 (en) | 2016-03-25 | 2023-06-07 | Reducing false positive fraud alerts for online financial transactions |
US18/222,199 Pending US20230394500A1 (en) | 2016-03-25 | 2023-07-14 | Identifying fraudulent online applications |
US18/624,826 Pending US20240249295A1 (en) | 2016-03-25 | 2024-04-02 | Identifying false positive geolocation-based fraud alerts |
US18/636,886 Pending US20240265405A1 (en) | 2016-03-25 | 2024-04-16 | Reducing false positives using customer feedback and machine learning |
US18/669,968 Pending US20240303664A1 (en) | 2016-03-25 | 2024-05-21 | Document-based fraud detection |
Family Applications Before (27)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/465,874 Active 2038-04-22 US10825028B1 (en) | 2016-03-25 | 2017-03-22 | Identifying fraudulent online applications |
US15/466,002 Abandoned US20210264429A1 (en) | 2016-03-25 | 2017-03-22 | Reducing false positive fraud alerts for card-present financial transactions |
US15/465,842 Active 2038-09-23 US11170375B1 (en) | 2016-03-25 | 2017-03-22 | Automated fraud classification using machine learning |
US15/466,014 Active US11334894B1 (en) | 2016-03-25 | 2017-03-22 | Identifying false positive geolocation-based fraud alerts |
US15/465,827 Active 2037-07-03 US10832248B1 (en) | 2016-03-25 | 2017-03-22 | Reducing false positives using customer data and machine learning |
US15/465,981 Abandoned US20220122071A1 (en) | 2016-03-25 | 2017-03-22 | Identifying fraudulent instruments and identification |
US15/465,977 Active 2037-10-21 US10949852B1 (en) | 2016-03-25 | 2017-03-22 | Document-based fraud detection |
US15/465,858 Active 2039-07-10 US11037159B1 (en) | 2016-03-25 | 2017-03-22 | Identifying chargeback scenarios based upon non-compliant merchant computer terminals |
US15/465,871 Abandoned US20210158355A1 (en) | 2016-03-25 | 2017-03-22 | Preempting or resolving fraud disputes relating to billing aliases |
US15/466,009 Abandoned US20210065186A1 (en) | 2016-03-25 | 2017-03-22 | Reducing false positive fraud alerts for online financial transactions |
US15/465,868 Abandoned US20210374764A1 (en) | 2016-03-25 | 2017-03-22 | Facilitating fraud dispute resolution using machine learning |
US15/465,832 Active 2037-06-12 US10872339B1 (en) | 2016-03-25 | 2017-03-22 | Reducing false positives using customer feedback and machine learning |
US15/465,856 Abandoned US20210374753A1 (en) | 2016-03-25 | 2017-03-22 | Identifying potential chargeback scenarios using machine learning |
US15/465,880 Abandoned US20210264458A1 (en) | 2016-03-25 | 2017-03-22 | Preempting or resolving fraud disputes relating to introductory offer expirations |
US16/540,505 Active US10949854B1 (en) | 2016-03-25 | 2019-08-14 | Reducing false positives using customer feedback and machine learning |
US15/931,560 Active US11004079B1 (en) | 2016-03-25 | 2020-05-13 | Identifying chargeback scenarios based upon non-compliant merchant computer terminals |
US16/899,486 Active US11049109B1 (en) | 2016-03-25 | 2020-06-11 | Reducing false positives using customer data and machine learning |
US16/913,814 Active US11348122B1 (en) | 2016-03-25 | 2020-06-26 | Identifying fraudulent online applications |
US17/078,744 Active US11687937B1 (en) | 2016-03-25 | 2020-10-23 | Reducing false positives using customer data and machine learning |
US17/080,476 Active US11687938B1 (en) | 2016-03-25 | 2020-10-26 | Reducing false positives using customer feedback and machine learning |
US17/134,901 Active US11699158B1 (en) | 2016-03-25 | 2020-12-28 | Reducing false positive fraud alerts for online financial transactions |
US17/166,854 Active 2037-07-02 US12026716B1 (en) | 2016-03-25 | 2021-02-03 | Document-based fraud detection |
US17/745,541 Active 2037-04-09 US11978064B2 (en) | 2016-03-25 | 2022-05-16 | Identifying false positive geolocation-based fraud alerts |
US17/827,015 Active US11741480B2 (en) | 2016-03-25 | 2022-05-27 | Identifying fraudulent online applications |
US17/993,758 Active US11989740B2 (en) | 2016-03-25 | 2022-11-23 | Reducing false positives using customer feedback and machine learning |
US18/207,069 Pending US20230316285A1 (en) | 2016-03-25 | 2023-06-07 | Reducing false positives using customer feedback and machine learning |
US18/207,081 Pending US20230316286A1 (en) | 2016-03-25 | 2023-06-07 | Reducing false positive fraud alerts for online financial transactions |
Family Applications After (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US18/624,826 Pending US20240249295A1 (en) | 2016-03-25 | 2024-04-02 | Identifying false positive geolocation-based fraud alerts |
US18/636,886 Pending US20240265405A1 (en) | 2016-03-25 | 2024-04-16 | Reducing false positives using customer feedback and machine learning |
US18/669,968 Pending US20240303664A1 (en) | 2016-03-25 | 2024-05-21 | Document-based fraud detection |
Country Status (1)
Country | Link |
---|---|
US (31) | US10825028B1 (en) |
Families Citing this family (99)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11429675B2 (en) * | 2018-06-20 | 2022-08-30 | Mongodb, Inc. | Systems and methods for managing transactional operation |
US10726377B2 (en) * | 2015-12-29 | 2020-07-28 | Workfusion, Inc. | Task similarity clusters for worker assessment |
US10825028B1 (en) | 2016-03-25 | 2020-11-03 | State Farm Mutual Automobile Insurance Company | Identifying fraudulent online applications |
US12073408B2 (en) | 2016-03-25 | 2024-08-27 | State Farm Mutual Automobile Insurance Company | Detecting unauthorized online applications using machine learning |
US11210670B2 (en) * | 2017-02-28 | 2021-12-28 | Early Warning Services, Llc | Authentication and security for mobile-device transactions |
WO2018187361A1 (en) * | 2017-04-03 | 2018-10-11 | DataVisor Inc. | Automated rule recommendation engine |
US11556936B1 (en) * | 2017-04-25 | 2023-01-17 | Wells Fargo Bank, N.A. | System and method for card control |
US11354749B2 (en) * | 2017-04-27 | 2022-06-07 | Sap Se | Computing device for machine learning based risk analysis |
US10699295B1 (en) * | 2017-05-05 | 2020-06-30 | Wells Fargo Bank, N.A. | Fraudulent content detector using augmented reality platforms |
US11657402B2 (en) * | 2017-05-16 | 2023-05-23 | Visa International Service Association | Dynamic claims submission system |
EP3639187A1 (en) * | 2017-06-13 | 2020-04-22 | Visa International Service Association | Method, system, and computer program product for controlling transaction velocity limits |
US11507953B1 (en) * | 2017-11-16 | 2022-11-22 | Worldpay, Llc | Systems and methods for optimizing transaction conversion rate using machine learning |
US11574204B2 (en) * | 2017-12-06 | 2023-02-07 | Accenture Global Solutions Limited | Integrity evaluation of unstructured processes using artificial intelligence (AI) techniques |
US11829866B1 (en) * | 2017-12-27 | 2023-11-28 | Intuit Inc. | System and method for hierarchical deep semi-supervised embeddings for dynamic targeted anomaly detection |
US11288672B2 (en) * | 2017-12-28 | 2022-03-29 | Paypal, Inc. | Machine learning engine for fraud detection following link selection |
US11457042B1 (en) * | 2018-02-27 | 2022-09-27 | Wells Fargo Bank, N.A. | Multi-tiered system for detecting and reducing unauthorized network access |
US10275613B1 (en) * | 2018-04-20 | 2019-04-30 | Capital One Services, Llc | Identity breach notification and remediation |
US11049112B2 (en) * | 2018-05-24 | 2021-06-29 | Paypal, Inc. | Systems and methods facilitating chargebacks in electronic transactions |
US11250345B1 (en) * | 2018-06-08 | 2022-02-15 | Intuit Inc. | Methods for identifying transactions with user location information |
WO2019245559A2 (en) * | 2018-06-21 | 2019-12-26 | Visa International Service Association | System and method for detecting and preventing "friendly fraud" |
FR3083356B1 (en) * | 2018-06-29 | 2020-09-11 | Ingenico Group | PROCESS FOR CARRYING OUT A TRANSACTION, TERMINAL, SERVER AND CORRESPONDING COMPUTER PROGRAM |
US11144990B1 (en) | 2018-06-29 | 2021-10-12 | Square, Inc. | Credit offers based on non-transactional data |
US11539716B2 (en) * | 2018-07-31 | 2022-12-27 | DataVisor, Inc. | Online user behavior analysis service backed by deep learning models trained on shared digital information |
WO2020105198A1 (en) * | 2018-11-21 | 2020-05-28 | 孝一 西郷 | Advertisement device |
US20200167772A1 (en) | 2018-11-24 | 2020-05-28 | Walmart Apollo, Llc | System and method for detecting signature forgeries |
US11157913B2 (en) * | 2018-12-28 | 2021-10-26 | Mastercard International Incorporated | Systems and methods for improved detection of network fraud events |
US11410047B2 (en) * | 2018-12-31 | 2022-08-09 | Paypal, Inc. | Transaction anomaly detection using artificial intelligence techniques |
US11605085B2 (en) * | 2019-01-24 | 2023-03-14 | Walmart Apollo, Llc | Methods and apparatus for fraud detection |
US11972429B2 (en) | 2019-01-24 | 2024-04-30 | Walmart Apollo, Llc | Methods and apparatus for fraud detection |
WO2020159917A1 (en) | 2019-01-28 | 2020-08-06 | Pindrop Security, Inc. | Unsupervised keyword spotting and word discovery for fraud analytics |
US12086874B2 (en) * | 2019-02-13 | 2024-09-10 | Yuh-Shen Song | Intelligent alert system |
US20200273039A1 (en) * | 2019-02-25 | 2020-08-27 | Jpmorgan Chase Bank, N.A. | Systems and methods for automated fraud-type identification and decisioning |
CA3132057A1 (en) | 2019-03-01 | 2020-09-10 | Mastercard Technologies Canada ULC | Multi-page online application origination (oao) service for fraud prevention systems |
WO2020186043A1 (en) * | 2019-03-14 | 2020-09-17 | IDEMIA National Security Solutions LLC | Systems and methods for detection of counterfeit documents |
US11283813B2 (en) * | 2019-04-02 | 2022-03-22 | Connectwise, Llc | Fraudulent host device connection detection |
US11164178B2 (en) * | 2019-04-04 | 2021-11-02 | Comenity Llc | Adding a credit account to a mobile wallet to make a transaction when the physical card associated with the credit account is unavailable |
US10963885B2 (en) * | 2019-04-04 | 2021-03-30 | Paypal, Inc. | Systems and methods for using machine learning to predict events associated with transactions |
US11803925B1 (en) * | 2019-04-16 | 2023-10-31 | Danielle Hutchinson | System and method for selecting a dispute resolution process |
US11741465B2 (en) * | 2019-05-02 | 2023-08-29 | Mastercard International Incorporated | Systems and methods for generating pre-chargeback dispute records |
US11966928B2 (en) * | 2019-05-08 | 2024-04-23 | International Business Machines Corporation | Intelligent learning and application of operational rules |
US10861593B1 (en) * | 2019-05-29 | 2020-12-08 | Capital One Service, LLC | Utilizing a machine learning model to identify unhealthy online user behavior and to cause healthy physical user behavior |
US11276124B2 (en) * | 2019-07-02 | 2022-03-15 | Sap Se | Machine learning-based techniques for detecting payroll fraud |
US12039615B2 (en) | 2019-07-03 | 2024-07-16 | Sap Se | Anomaly and fraud detection with fake event detection using machine learning |
US11308492B2 (en) | 2019-07-03 | 2022-04-19 | Sap Se | Anomaly and fraud detection with fake event detection using pixel intensity testing |
US11113689B2 (en) * | 2019-07-03 | 2021-09-07 | Sap Se | Transaction policy audit |
US10706423B1 (en) * | 2019-07-09 | 2020-07-07 | Capital One Services, Llc | Systems and methods for mitigating fraudulent transactions |
US11393023B1 (en) | 2019-07-19 | 2022-07-19 | Block, Inc. | Adaptive multi-stage user interface for credit offers |
US11288673B1 (en) * | 2019-07-29 | 2022-03-29 | Intuit Inc. | Online fraud detection using machine learning models |
US11468272B2 (en) * | 2019-08-15 | 2022-10-11 | Visa International Service Association | Method, system, and computer program product for detecting fraudulent interactions |
US11631082B2 (en) * | 2019-09-20 | 2023-04-18 | Walmart Apollo, Llc | Methods and apparatus for payment transfer fraud detection |
US11928683B2 (en) * | 2019-10-01 | 2024-03-12 | Mastercard Technologies Canada ULC | Feature encoding in online application origination (OAO) service for a fraud prevention system |
US11157914B2 (en) * | 2019-12-13 | 2021-10-26 | Visa International Service Association | Method, system, and computer program product for processing a potentially fraudulent transaction |
US11947643B2 (en) * | 2019-12-26 | 2024-04-02 | Rakuten Group, Inc. | Fraud detection system, fraud detection method, and program |
US12002087B1 (en) | 2020-01-30 | 2024-06-04 | Freedom Financial Network Llc | Network computing system to provide account management services for planning user actions |
US11853982B1 (en) | 2020-01-30 | 2023-12-26 | Freedom Financial Network, LLC | User dashboard for enabling user participation with account management services |
US11645543B2 (en) * | 2020-01-30 | 2023-05-09 | Visa International Service Association | System, method, and computer program product for implementing a generative adversarial network to determine activations |
US20210248512A1 (en) * | 2020-02-06 | 2021-08-12 | Signal Financial Technologies Llc | Intelligent machine learning recommendation platform |
US20210295379A1 (en) * | 2020-03-17 | 2021-09-23 | Com Olho It Private Limited | System and method for detecting fraudulent advertisement traffic |
US20210312451A1 (en) * | 2020-04-01 | 2021-10-07 | Mastercard International Incorporated | Systems and methods for modeling and classification of fraudulent transactions |
US11551228B2 (en) * | 2020-04-08 | 2023-01-10 | Capital One Services, Llc | Localized account freeze for fraudulent transactions |
US11687936B2 (en) * | 2020-04-27 | 2023-06-27 | SOURCE Ltd. | System and method for managing chargeback risk |
US11367008B2 (en) * | 2020-05-01 | 2022-06-21 | Cognitive Ops Inc. | Artificial intelligence techniques for improving efficiency |
US12014371B2 (en) * | 2020-06-05 | 2024-06-18 | Capital One Services, Llc | Systems and methods for fraud detection and prevention |
US11580561B1 (en) * | 2020-07-02 | 2023-02-14 | American Express Travel Related Services Company, Inc. | Detecting security breaches with watchdog transaction accounts |
US11895264B2 (en) * | 2020-07-02 | 2024-02-06 | Pindrop Security, Inc. | Fraud importance system |
US20220108330A1 (en) * | 2020-10-06 | 2022-04-07 | Rebecca Mendoza Saltiel | Interactive and iterative behavioral model, system, and method for detecting fraud, waste, abuse and anomaly |
US11455324B2 (en) * | 2020-10-23 | 2022-09-27 | Settle Smart Ltd. | Method for determining relevant search results |
US20220148001A1 (en) * | 2020-11-06 | 2022-05-12 | Capital One Services, Llc | Patching security vulnerabilities using machine learning |
US20220172142A1 (en) * | 2020-11-30 | 2022-06-02 | Sandra K. Johnson | System and methodology for dynamic accounts in dynamic lightweight personalized analytics |
US11836727B1 (en) | 2020-12-04 | 2023-12-05 | Wells Fargo Bank, N.A. | Location based transaction authentication |
US20220207352A1 (en) * | 2020-12-30 | 2022-06-30 | Capital One Services, Llc | Methods and systems for generating recommendations for counterfactual explanations of computer alerts that are automatically detected by a machine learning algorithm |
US20220207353A1 (en) * | 2020-12-30 | 2022-06-30 | Capital One Services, Llc | Methods and systems for generating recommendations for counterfactual explanations of computer alerts that are automatically detected by a machine learning algorithm |
US11887172B2 (en) | 2021-01-29 | 2024-01-30 | Walmart Apollo, Llc | Methods and apparatus for electronic detection of fraudulent transactions using machine learning processes |
US11991037B2 (en) * | 2021-02-08 | 2024-05-21 | Verizon Patent And Licensing Inc. | Systems and methods for reducing a quantity of false positives associated with rule-based alarms |
US20220253856A1 (en) * | 2021-02-11 | 2022-08-11 | The Toronto-Dominion Bank | System and method for machine learning based detection of fraud |
US20220292551A1 (en) * | 2021-03-15 | 2022-09-15 | Sandra K. Johnson | System and method for selecting donations in dynamic lightweight personalized analytics |
US11595446B2 (en) | 2021-04-19 | 2023-02-28 | Tekion Corp | Identifying suspicious entries in a document management system |
US20220358507A1 (en) * | 2021-05-08 | 2022-11-10 | Mastercard International Incorporated | Methods and systems for predicting chargeback behavioral data of account holders |
US20220366513A1 (en) * | 2021-05-14 | 2022-11-17 | Jpmorgan Chase Bank, N.A. | Method and apparatus for check fraud detection through check image analysis |
US20230032963A1 (en) * | 2021-07-26 | 2023-02-02 | Refine Intelligence Ltd. | Method and system for validating financial events and security events |
US12020250B2 (en) * | 2021-07-28 | 2024-06-25 | Capital One Services, Llc | Transaction based authentication with item-level data |
US11875335B2 (en) | 2021-08-10 | 2024-01-16 | Capital One Services, Llc | Determining merchant enforced transaction rules |
US11886417B2 (en) * | 2021-11-04 | 2024-01-30 | Capital One Services, Llc | Systems and methods for enhancing transaction data |
US11605126B1 (en) | 2021-11-29 | 2023-03-14 | Wells Fargo Bank, N.A. | Detecting fraud in credit applications |
US12020257B2 (en) * | 2021-12-08 | 2024-06-25 | Chime Financial, Inc. | Generating a fraud prediction utilizing a fraud-prediction machine-learning model |
US20230186308A1 (en) * | 2021-12-09 | 2023-06-15 | Chime Financial, Inc. | Utilizing a fraud prediction machine-learning model to intelligently generate fraud predictions for network transactions |
US20230196369A1 (en) * | 2021-12-20 | 2023-06-22 | International Business Machines Corporation | Identifying suspicious behavior based on patterns of digital identification documents |
WO2023121777A1 (en) * | 2021-12-23 | 2023-06-29 | Virtualitics, Inc. | Software engines configured for detection of high impact scenarios with machine learning-based simulation |
CN114331458A (en) * | 2021-12-31 | 2022-04-12 | 工银科技有限公司 | Suspicious transaction monitoring method and device |
US20230230088A1 (en) * | 2022-01-06 | 2023-07-20 | Socure, Inc. | Method and System of Predictive Document Verification and Machine Learning Therefor |
US20230222501A1 (en) * | 2022-01-10 | 2023-07-13 | International Business Machines Corporation | Authentication card degradation security |
WO2023168222A1 (en) * | 2022-03-03 | 2023-09-07 | Worldpay, Llc | Systems and methods for predictive analysis of electronic transaction representment data using machine learning |
US20230298028A1 (en) * | 2022-03-18 | 2023-09-21 | Fidelity Information Services, Llc | Analyzing a transaction in a payment processing system |
US20230306433A1 (en) * | 2022-03-24 | 2023-09-28 | Bank Of America Corporation | Cognitive Identification of Credit Reporting Disputes and Dispute Resolution Using Quantum Computing |
US20230325841A1 (en) * | 2022-04-07 | 2023-10-12 | Gen Digital Inc. | Systems and methods for detecting websites that perpetrate at least one of scams or frauds |
US20230334505A1 (en) * | 2022-04-19 | 2023-10-19 | Capital One Services, Llc | Processing of customer messages to avoid unneccessary fraud disputes |
US20230385844A1 (en) * | 2022-05-24 | 2023-11-30 | Chime Financial, Inc. | Granting provisional credit based on a likelihood of approval score generated from a dispute-evaluator machine-learning model |
US20240089293A1 (en) * | 2022-09-13 | 2024-03-14 | Google Llc | Automated Security Rule Updates Based On Alert Feedback |
US20240177512A1 (en) * | 2022-11-29 | 2024-05-30 | Stripe, Inc. | Systems and methods for identity document fraud detection |
Family Cites Families (311)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5774882A (en) | 1992-03-12 | 1998-06-30 | Keen; Regina D. | Credit approval system |
US5819226A (en) | 1992-09-08 | 1998-10-06 | Hnc Software Inc. | Fraud detection using predictive modeling |
US7251624B1 (en) | 1992-09-08 | 2007-07-31 | Fair Isaac Corporation | Score based decisioning |
US5444763A (en) | 1993-06-17 | 1995-08-22 | Research In Motion Limited | Translation and connection device for radio frequency point of sale transaction systems |
US5748780A (en) * | 1994-04-07 | 1998-05-05 | Stolfo; Salvatore J. | Method and apparatus for imaging, image processing and data compression |
US5467341A (en) | 1994-04-14 | 1995-11-14 | Toshiba America Information Systems, Inc. | Apparatus and method for alerting computer users in a wireless LAN of a service area transition |
US5708422A (en) | 1995-05-31 | 1998-01-13 | At&T | Transaction authorization and alert system |
US5825863A (en) | 1995-12-11 | 1998-10-20 | Walker Asset Management Limited Partnership | Prepaid limited usage calling card |
US8162125B1 (en) | 1996-05-29 | 2012-04-24 | Cummins-Allison Corp. | Apparatus and system for imaging currency bills and financial documents and method for using the same |
US6094643A (en) | 1996-06-14 | 2000-07-25 | Card Alert Services, Inc. | System for detecting counterfeit financial card fraud |
US6018723A (en) | 1997-05-27 | 2000-01-25 | Visa International Service Association | Method and apparatus for pattern generation |
US6119103A (en) | 1997-05-27 | 2000-09-12 | Visa International Service Association | Financial risk prediction systems and methods therefor |
US7403922B1 (en) | 1997-07-28 | 2008-07-22 | Cybersource Corporation | Method and apparatus for evaluating fraud risk in an electronic commerce transaction |
US6269169B1 (en) | 1998-07-17 | 2001-07-31 | Imaging Automation, Inc. | Secure document reader and method therefor |
US6170744B1 (en) | 1998-09-24 | 2001-01-09 | Payformance Corporation | Self-authenticating negotiable documents |
US6301579B1 (en) | 1998-10-20 | 2001-10-09 | Silicon Graphics, Inc. | Method, system, and computer program product for visualizing a data structure |
US7058597B1 (en) | 1998-12-04 | 2006-06-06 | Digital River, Inc. | Apparatus and method for adaptive fraud screening for electronic commerce transactions |
US6430539B1 (en) | 1999-05-06 | 2002-08-06 | Hnc Software | Predictive modeling of consumer financial behavior |
US6533168B1 (en) | 1999-05-27 | 2003-03-18 | Peter N. Ching | Method and apparatus for computer-readable purchase receipts using multi-dimensional bar codes |
US6437812B1 (en) | 1999-06-30 | 2002-08-20 | Cerebrus Solutions Limited | Graphical user interface and method for displaying hierarchically structured information |
US6215358B1 (en) | 1999-09-16 | 2001-04-10 | Samsung Electronics Co., Ltd. | Temperature compensated bias network for a power amplifier and method of operation |
US7428984B1 (en) | 1999-11-30 | 2008-09-30 | Diebold Self-Service Systems Division Of Diebold, Incorporated | Method and system of evaluating checks deposited into a cash dispensing automated banking machine |
US7735721B1 (en) | 1999-11-30 | 2010-06-15 | Diebold Self-Service Systems Division Of Diebold, Incorporated | Method of evaluating checks deposited into a cash dispensing automated banking machine |
US7377425B1 (en) | 1999-11-30 | 2008-05-27 | Diebold Self-Service Systems Division Of Diebold, Incorporated | Method and system of evaluating checks deposited into a cash dispensing automated banking machine |
US7494052B1 (en) | 1999-11-30 | 2009-02-24 | Diebold Self-Service Systems Division Of Diebold, Incorporated | Method of evaluating checks deposited into a cash dispensing automated banking machine |
US7263506B2 (en) | 2000-04-06 | 2007-08-28 | Fair Isaac Corporation | Identification and management of fraudulent credit/debit card purchases at merchant ecommerce sites |
GB0029229D0 (en) | 2000-11-30 | 2001-01-17 | Unisys Corp | Counter measures for irregularities in financial transactions |
US20020147694A1 (en) | 2001-01-31 | 2002-10-10 | Dempsey Derek M. | Retraining trainable data classifiers |
US6886008B2 (en) * | 2001-03-08 | 2005-04-26 | Technion Research & Development Foundation Ltd. | Machine learning by construction of a decision function |
US7089592B2 (en) | 2001-03-15 | 2006-08-08 | Brighterion, Inc. | Systems and methods for dynamic detection and prevention of electronic fraud |
US6666841B2 (en) | 2001-05-02 | 2003-12-23 | Glaukos Corporation | Bifurcatable trabecular shunt for glaucoma treatment |
US7676430B2 (en) | 2001-05-09 | 2010-03-09 | Lenovo (Singapore) Ptd. Ltd. | System and method for installing a remote credit card authorization on a system with a TCPA complaint chipset |
US7865427B2 (en) | 2001-05-30 | 2011-01-04 | Cybersource Corporation | Method and apparatus for evaluating fraud risk in an electronic commerce transaction |
US7707108B2 (en) | 2002-01-31 | 2010-04-27 | International Business Machines Corporation | Detection of unauthorized account transactions |
US20030182194A1 (en) | 2002-02-06 | 2003-09-25 | Mark Choey | Method and system of transaction card fraud mitigation utilizing location based services |
US20030172036A1 (en) | 2002-03-05 | 2003-09-11 | Idan Feigenbaum | Online financial transaction veracity assurance mechanism |
EP1345163B2 (en) | 2002-03-15 | 2010-12-29 | Computer Sciences Corporation | Methods for analysis of writing in documents |
US7356516B2 (en) | 2002-06-13 | 2008-04-08 | Visa U.S.A. Inc. | Method and system for facilitating electronic dispute resolution |
US6960990B2 (en) | 2002-10-31 | 2005-11-01 | General Motors Corporation | Telematics vehicle security system and method |
US7870078B2 (en) | 2002-11-01 | 2011-01-11 | Id Insight Incorporated | System, method and computer program product for assessing risk of identity theft |
US7143095B2 (en) | 2002-12-31 | 2006-11-28 | American Express Travel Related Services Company, Inc. | Method and system for implementing and managing an enterprise identity management for distributed security |
US7548886B2 (en) | 2003-06-12 | 2009-06-16 | International Business Machines Corporation | System and method for early detection and prevention of identity theft |
US20110225064A1 (en) | 2003-09-02 | 2011-09-15 | Augustine Fou | Methods and systems for using universally unique item identifiers |
US20050097046A1 (en) | 2003-10-30 | 2005-05-05 | Singfield Joy S. | Wireless electronic check deposit scanning and cashing machine with web-based online account cash management computer application system |
US20050097051A1 (en) | 2003-11-05 | 2005-05-05 | Madill Robert P.Jr. | Fraud potential indicator graphical interface |
US20050137982A1 (en) | 2003-12-23 | 2005-06-23 | Leslie Michelassi | Systems and methods for determining a reconcilement result |
US6948656B2 (en) | 2003-12-23 | 2005-09-27 | First Data Corporation | System with GPS to manage risk of financial transactions |
US7716135B2 (en) | 2004-01-29 | 2010-05-11 | International Business Machines Corporation | Incremental compliance environment, an enterprise-wide system for detecting fraud |
US7577938B2 (en) | 2004-02-20 | 2009-08-18 | Microsoft Corporation | Data association |
US7537153B2 (en) | 2004-05-03 | 2009-05-26 | De La Rue International, Limited | Method and computer program product for electronically managing payment media |
US8885894B2 (en) * | 2004-06-14 | 2014-11-11 | Michael John Rowen | Reduction of transaction fraud through the use of automatic centralized signature/sign verification combined with credit and fraud scoring during real-time payment card authorization processes |
WO2006023822A2 (en) | 2004-08-18 | 2006-03-02 | Kappa Image Llc | Validating negotiable documents using public document validation profiles |
US20060041464A1 (en) | 2004-08-19 | 2006-02-23 | Transunion Llc. | System and method for developing an analytic fraud model |
US8914309B2 (en) | 2004-08-20 | 2014-12-16 | Ebay Inc. | Method and system for tracking fraudulent activity |
US20060047725A1 (en) | 2004-08-26 | 2006-03-02 | Bramson Steven J | Opt-in directory of verified individual profiles |
US20060202012A1 (en) * | 2004-11-12 | 2006-09-14 | David Grano | Secure data processing system, such as a system for detecting fraud and expediting note processing |
US7480631B1 (en) | 2004-12-15 | 2009-01-20 | Jpmorgan Chase Bank, N.A. | System and method for detecting and processing fraud and credit abuse |
US20130104251A1 (en) | 2005-02-01 | 2013-04-25 | Newsilike Media Group, Inc. | Security systems and methods for use with structured and unstructured data |
JP4512512B2 (en) | 2005-03-29 | 2010-07-28 | 大王製紙株式会社 | Absorbent article and surface sheet thereof |
US8073691B2 (en) | 2005-04-21 | 2011-12-06 | Victrio, Inc. | Method and system for screening using voice data and metadata |
US8903859B2 (en) | 2005-04-21 | 2014-12-02 | Verint Americas Inc. | Systems, methods, and media for generating hierarchical fused risk scores |
EP1875653B1 (en) | 2005-04-29 | 2018-12-12 | Oracle International Corporation | System and method for fraud monitoring, detection, and tiered user authentication |
WO2006130874A2 (en) | 2005-06-02 | 2006-12-07 | Fair Isaac Corporation | Comprehensive identity protection system |
US7756783B2 (en) | 2005-09-02 | 2010-07-13 | Fair Isaac Corporation | Fraud clearinghouse |
US7668769B2 (en) | 2005-10-04 | 2010-02-23 | Basepoint Analytics, LLC | System and method of detecting fraud |
US7552865B2 (en) | 2005-10-20 | 2009-06-30 | Satyam Computer Services Ltd. | System and method for deep interaction modeling for fraud detection |
US8346638B2 (en) | 2005-10-26 | 2013-01-01 | Capital One Financial Corporation | Systems and methods for processing transaction data to perform a merchant chargeback |
US20070179840A1 (en) | 2005-11-10 | 2007-08-02 | American Express Marketing & Development Corp. | Joint redemption account |
US20070179849A1 (en) * | 2006-02-02 | 2007-08-02 | Microsoft Corporation | Ad publisher performance and mitigation of click fraud |
US20070187491A1 (en) | 2006-02-13 | 2007-08-16 | Godwin Bryan W | Processing Cashless Transactions of Remote Field Assets |
US7693767B2 (en) | 2006-03-23 | 2010-04-06 | Oracle International Corporation | Method for generating predictive models for a business problem via supervised learning |
US7788195B1 (en) | 2006-03-24 | 2010-08-31 | Sas Institute Inc. | Computer-implemented predictive model generation systems and methods |
US7912773B1 (en) | 2006-03-24 | 2011-03-22 | Sas Institute Inc. | Computer-implemented data storage systems and methods for use with predictive model systems |
US7818264B2 (en) | 2006-06-19 | 2010-10-19 | Visa U.S.A. Inc. | Track data encryption |
US8650080B2 (en) | 2006-04-10 | 2014-02-11 | International Business Machines Corporation | User-browser interaction-based fraud detection system |
WO2007120844A2 (en) | 2006-04-12 | 2007-10-25 | Chimento Marc A | System and method for screening for fraud in commercial transactions |
US20070275399A1 (en) | 2006-05-04 | 2007-11-29 | Lathrop Richard H | Methods for calculating codon pair-based translational kinetics values, and methods for generating polypeptide-encoding nucleotide sequences from such values |
US20070100773A1 (en) | 2006-08-11 | 2007-05-03 | Regions Asset Company | Transaction security system having user defined security parameters |
AU2007289166B2 (en) | 2006-08-29 | 2012-08-30 | Visa International Service Association | Method and system for processing internet purchase transactions |
US20080288299A1 (en) | 2006-10-31 | 2008-11-20 | Genmobi Technologies, Inc. | System and method for user identity validation for online transactions |
US8600789B1 (en) * | 2006-11-01 | 2013-12-03 | Bank Of America Corporation | System and method for processing offending items in a financial system |
US20080106726A1 (en) | 2006-11-02 | 2008-05-08 | Ellis Park | Currency detection & tracking system and method |
US20130197998A1 (en) | 2012-01-26 | 2013-08-01 | Finsphere Corporation | Authenticating entities engaging in automated or electronic transactions or activities |
US9922323B2 (en) | 2007-03-16 | 2018-03-20 | Visa International Service Association | System and method for automated analysis comparing a wireless device location with another geographic location |
US20090018940A1 (en) | 2007-03-30 | 2009-01-15 | Liang Wang | Enhanced Fraud Detection With Terminal Transaction-Sequence Processing |
US7962418B1 (en) | 2007-03-30 | 2011-06-14 | Amazon Technologies, Inc. | System and method of fulfilling a transaction |
US8078515B2 (en) | 2007-05-04 | 2011-12-13 | Michael Sasha John | Systems and methods for facilitating electronic transactions and deterring fraud |
US10769290B2 (en) | 2007-05-11 | 2020-09-08 | Fair Isaac Corporation | Systems and methods for fraud detection via interactive link analysis |
US20090018934A1 (en) | 2007-05-15 | 2009-01-15 | Chaorong Peng | System and Method for defense ID theft attack security service system in marketing environment |
US7575157B2 (en) | 2007-05-22 | 2009-08-18 | Bank Of America Corporation | Fraud protection |
US7739169B2 (en) | 2007-06-25 | 2010-06-15 | Visa U.S.A. Inc. | Restricting access to compromised account information |
US20090083080A1 (en) | 2007-09-24 | 2009-03-26 | Tim Brooks | Method, apparatus and program product for facilitating transfer of group meeting contracts |
WO2009048843A1 (en) | 2007-10-05 | 2009-04-16 | Basepoint Analytics Llc | Methods and systems of predicting mortgage payment risk |
US8666841B1 (en) | 2007-10-09 | 2014-03-04 | Convergys Information Management Group, Inc. | Fraud detection engine and method of using the same |
US20090099884A1 (en) | 2007-10-15 | 2009-04-16 | Mci Communications Services, Inc. | Method and system for detecting fraud based on financial records |
US8255318B2 (en) | 2007-10-18 | 2012-08-28 | First Data Corporation | Applicant authentication |
US9779403B2 (en) | 2007-12-07 | 2017-10-03 | Jpmorgan Chase Bank, N.A. | Mobile fraud prevention system and method |
US7992746B2 (en) | 2008-02-11 | 2011-08-09 | Carefusion 303, Inc. | Method and apparatus for removing, inserting and securing receptacles in a receptacle tray |
US7857212B1 (en) | 2008-02-14 | 2010-12-28 | Capital One Financial Corporation | Method and system for authorizing card account transactions by geographic region |
US20140200929A1 (en) | 2008-04-02 | 2014-07-17 | Yougetitback Limited | Systems and methods for dynamically assessing and mitigating risk of an insured entity |
US9985978B2 (en) | 2008-05-07 | 2018-05-29 | Lookingglass Cyber Solutions | Method and system for misuse detection |
US20140324677A1 (en) | 2008-05-19 | 2014-10-30 | Jpmorgan Chase Bank, N.A. | Method and system for detecting, monitoring and investigating first party fraud |
US8280833B2 (en) | 2008-06-12 | 2012-10-02 | Guardian Analytics, Inc. | Fraud detection and analysis |
US20160063501A1 (en) | 2008-06-18 | 2016-03-03 | Saraansh Software Solutions Pvt. Ltd. | System for detecting banking frauds by examples |
US8478692B2 (en) | 2008-06-26 | 2013-07-02 | Visa International Service Association | Systems and methods for geographic location notifications of payment transactions |
US8848924B2 (en) | 2008-06-27 | 2014-09-30 | University Of Washington | Privacy-preserving location tracking for devices |
US8229853B2 (en) | 2008-07-24 | 2012-07-24 | International Business Machines Corporation | Dynamic itinerary-driven profiling for preventing unauthorized card transactions |
JP5206197B2 (en) | 2008-07-28 | 2013-06-12 | 富士通株式会社 | Rule learning method, program and apparatus |
US20100106611A1 (en) | 2008-10-24 | 2010-04-29 | Uc Group Ltd. | Financial transactions systems and methods |
US20100114774A1 (en) | 2008-11-04 | 2010-05-06 | Moneygram International, Inc. | Chargeback decisioning system |
CA2742963A1 (en) | 2008-11-06 | 2010-05-14 | Visa International Service Association | Online challenge-response |
US8566235B2 (en) | 2008-12-23 | 2013-10-22 | Verifi, Inc. | System and method for providing dispute resolution for electronic payment transactions |
US8145561B1 (en) | 2009-01-05 | 2012-03-27 | Sprint Communications Company L.P. | Phone usage pattern as credit card fraud detection trigger |
US8140418B1 (en) | 2009-01-09 | 2012-03-20 | Apple Inc. | Cardholder-not-present authorization |
CA2752875A1 (en) | 2009-02-20 | 2010-08-26 | Moqom Limited | Merchant alert system and method for fraud prevention |
US8712912B2 (en) | 2009-04-28 | 2014-04-29 | Visa International Service Association | System and method for providing advice to consumer regarding a payment transaction |
US20100274691A1 (en) | 2009-04-28 | 2010-10-28 | Ayman Hammad | Multi alerts based system |
AU2010246085A1 (en) | 2009-05-04 | 2011-12-01 | Visa International Service Association | Determining targeted incentives based on consumer transaction history |
US20100293090A1 (en) | 2009-05-14 | 2010-11-18 | Domenikos Steven D | Systems, methods, and apparatus for determining fraud probability scores and identity health scores |
US8600873B2 (en) | 2009-05-28 | 2013-12-03 | Visa International Service Association | Managed real-time transaction fraud analysis and decisioning |
US8745698B1 (en) | 2009-06-09 | 2014-06-03 | Bank Of America Corporation | Dynamic authentication engine |
US10290053B2 (en) | 2009-06-12 | 2019-05-14 | Guardian Analytics, Inc. | Fraud detection and analysis |
US8955747B2 (en) | 2009-06-23 | 2015-02-17 | At&T Mobility Ii Llc | Devices, systems and methods for wireless point-of-sale |
US10242540B2 (en) | 2009-09-02 | 2019-03-26 | Fair Isaac Corporation | Visualization for payment card transaction fraud analysis |
US8620798B2 (en) | 2009-09-11 | 2013-12-31 | Visa International Service Association | System and method using predicted consumer behavior to reduce use of transaction risk analysis and transaction denials |
US8805737B1 (en) | 2009-11-02 | 2014-08-12 | Sas Institute Inc. | Computer-implemented multiple entity dynamic summarization systems and methods |
US10089683B2 (en) | 2010-02-08 | 2018-10-02 | Visa International Service Association | Fraud reduction system for transactions |
US20110238566A1 (en) | 2010-02-16 | 2011-09-29 | Digital Risk, Llc | System and methods for determining and reporting risk associated with financial instruments |
US8413234B1 (en) | 2010-02-17 | 2013-04-02 | Sprint Communications Company L.P. | Communications-service fraud detection using special social connection |
WO2011103432A2 (en) | 2010-02-19 | 2011-08-25 | Finshphere Corporation | System and method for financial transaction authentication using travel information |
US8712143B2 (en) * | 2010-02-26 | 2014-04-29 | Bank Of America Corporation | Processing financial documents |
US8626663B2 (en) * | 2010-03-23 | 2014-01-07 | Visa International Service Association | Merchant fraud risk score |
US8600875B2 (en) | 2010-04-12 | 2013-12-03 | Visa International Service Association | Authentication process using search technology |
US8543522B2 (en) | 2010-04-21 | 2013-09-24 | Retail Decisions, Inc. | Automatic rule discovery from large-scale datasets to detect payment card fraud using classifiers |
US20150173733A1 (en) | 2010-07-29 | 2015-06-25 | Greatbatch Ltd. | Retractor Tool For Minimally Invasive Hip Replacement Surgery |
CN102346894B (en) | 2010-08-03 | 2017-03-01 | 阿里巴巴集团控股有限公司 | The output intent of recommendation information, system and server |
US8528054B2 (en) | 2010-08-31 | 2013-09-03 | Yahoo! Inc. | Multi-step challenge-response test |
US9367843B2 (en) | 2010-10-14 | 2016-06-14 | Visa International Service Association | Transaction alerting in a multi-network environment |
US8306889B2 (en) | 2010-10-20 | 2012-11-06 | Fis Financial Compliance Solutions, Llc | System and method for presenting fraud detection information |
US20120109821A1 (en) | 2010-10-29 | 2012-05-03 | Jesse Barbour | System, method and computer program product for real-time online transaction risk and fraud analytics and management |
US9552470B2 (en) | 2010-11-29 | 2017-01-24 | Biocatch Ltd. | Method, device, and system of generating fraud-alerts for cyber-attacks |
US8773564B2 (en) | 2010-12-14 | 2014-07-08 | Truesense Imaging, Inc. | Image sensor with charge multiplication |
US20120158566A1 (en) | 2010-12-21 | 2012-06-21 | Corinne Fok | Transaction rate processing apparatuses, methods and systems |
US20120173570A1 (en) | 2011-01-05 | 2012-07-05 | Bank Of America Corporation | Systems and methods for managing fraud ring investigations |
US10373160B2 (en) | 2011-02-10 | 2019-08-06 | Paypal, Inc. | Fraud alerting using mobile phone location |
US8346217B2 (en) | 2011-02-21 | 2013-01-01 | Knowledge Solutions, LLC | Systems, methods and apparatus for controlling access to mobile devices |
US8401522B2 (en) | 2011-02-21 | 2013-03-19 | Carmela R. Crawford | Systems, methods and apparatus for authenticating access to enterprise resources |
US8458069B2 (en) | 2011-03-04 | 2013-06-04 | Brighterion, Inc. | Systems and methods for adaptive identification of sources of fraud |
US20150262195A1 (en) * | 2011-03-11 | 2015-09-17 | Bytemark, Inc. | Method and system for employing anti-ticket fraud system for mobile tickets |
AU2012202173B2 (en) | 2011-04-18 | 2013-09-05 | Castle Bookkeeping Wizard Pty Ltd | System and method for processing a transaction document including one or more financial transaction entries |
US20130013491A1 (en) | 2011-04-19 | 2013-01-10 | Early Warning Sevices, LLC | System and method for detecting and mitigating duplicate transaction fraud |
US20120278249A1 (en) | 2011-04-29 | 2012-11-01 | American Express Travel Related Services Company, Inc. | Generating an Identity Theft Score |
US20160232465A1 (en) | 2011-06-03 | 2016-08-11 | Kenneth Kurtz | Subscriber-based system for custom evaluations of business relationship risk |
US8620806B2 (en) | 2011-07-13 | 2013-12-31 | Mastercard International Incorporated | Merchant data cleansing in clearing record |
US20130024358A1 (en) | 2011-07-21 | 2013-01-24 | Bank Of America Corporation | Filtering transactions to prevent false positive fraud alerts |
US8606712B2 (en) * | 2011-07-21 | 2013-12-10 | Bank Of America Corporation | Multi-stage filtering for fraud detection with account event data filters |
US8447674B2 (en) | 2011-07-21 | 2013-05-21 | Bank Of America Corporation | Multi-stage filtering for fraud detection with customer history filters |
US20130046692A1 (en) | 2011-08-19 | 2013-02-21 | Bank Of America Corporation | Fraud protection with user location verification |
US8930295B2 (en) | 2011-09-12 | 2015-01-06 | Stanley Victor CAMPBELL | Systems and methods for monitoring and analyzing transactions |
US9916538B2 (en) | 2012-09-15 | 2018-03-13 | Z Advanced Computing, Inc. | Method and system for feature detection |
EP2575099A1 (en) | 2011-09-30 | 2013-04-03 | Tata Consultancy Services Limited | Electronic funds transfer |
US20140052621A1 (en) | 2011-10-03 | 2014-02-20 | Ap Technology, Llc | Merchant electronic check payments |
US8478688B1 (en) | 2011-12-19 | 2013-07-02 | Emc Corporation | Rapid transaction processing |
US20130218758A1 (en) | 2012-02-16 | 2013-08-22 | Andrew John Bruno Naumann zu Koenigsbrueck | Custom scorecard and hybrid fraud model |
GB2500212A (en) | 2012-03-13 | 2013-09-18 | Validsoft Uk Ltd | Method for location based authentication of transaction |
US9619852B2 (en) | 2012-04-17 | 2017-04-11 | Zighra Inc. | Context-dependent authentication system, method and device |
US9799020B2 (en) | 2012-04-27 | 2017-10-24 | Mastercard International Incorporated | Method for providing payment card security using registrationless telecom geolocation capture |
US9953326B2 (en) | 2012-05-02 | 2018-04-24 | Jpmorgan Chase Bank, N.A. | Alert optimization system and method |
US20130297501A1 (en) | 2012-05-04 | 2013-11-07 | Justin Monk | System and method for local data conversion |
US8484132B1 (en) | 2012-06-08 | 2013-07-09 | Lexisnexis Risk Solutions Fl Inc. | Systems and methods for segmented risk scoring of identity fraud |
US9691066B2 (en) | 2012-07-03 | 2017-06-27 | Verifone, Inc. | Location-based payment system and method |
US20140012701A1 (en) | 2012-07-05 | 2014-01-09 | Index Systems, Inc. | Electronic commerce network with mobile transactions |
US20140012738A1 (en) | 2012-07-09 | 2014-01-09 | Bennett Woo | Methods and systems for measuring accuracy in fraudulent transaction identification |
US20140058962A1 (en) | 2012-08-22 | 2014-02-27 | Municipality Real Time Payment Systems, Llc | Method and system for processing a transaction, effecting payment to a municipality and receiving a certificate of payment |
US10163158B2 (en) * | 2012-08-27 | 2018-12-25 | Yuh-Shen Song | Transactional monitoring system |
US9519903B2 (en) | 2012-08-29 | 2016-12-13 | 24/7 Customer, Inc. | Method and apparatus for proactive notifications based on the location of a user |
US20140067656A1 (en) | 2012-09-06 | 2014-03-06 | Shlomo COHEN GANOR | Method and system for fraud risk estimation based on social media information |
US9208676B2 (en) * | 2013-03-14 | 2015-12-08 | Google Inc. | Devices, methods, and associated information processing for security in a smart-sensored home |
US20140101050A1 (en) | 2012-10-04 | 2014-04-10 | Ethoca Technologies, Inc. | Do-not-recognize transaction handling |
US9940615B2 (en) | 2012-10-16 | 2018-04-10 | Fleetcor Technologies Operating Company, Llc | Automated pairing of payment products and mobile to mobile devices |
US20140114840A1 (en) * | 2012-10-19 | 2014-04-24 | Cellco Partnership D/B/A Verizon Wireless | Automated fraud detection |
US9953321B2 (en) | 2012-10-30 | 2018-04-24 | Fair Isaac Corporation | Card fraud detection utilizing real-time identification of merchant test sites |
US9836795B2 (en) | 2012-11-08 | 2017-12-05 | Hartford Fire Insurance Company | Computerized system and method for pre-filling of insurance data using third party sources |
WO2014088903A1 (en) | 2012-12-03 | 2014-06-12 | Thomson Licensing | Method and apparatus for nearly optimal private convolution |
US8623321B1 (en) | 2012-12-12 | 2014-01-07 | Uop Llc | UZM-44 aluminosilicate zeolite |
US10504163B2 (en) * | 2012-12-14 | 2019-12-10 | Mastercard International Incorporated | System for payment, data management, and interchanges for use with global shopping cart |
US9043887B2 (en) | 2012-12-31 | 2015-05-26 | Apple Inc. | Adaptive secondary authentication criteria based on account data |
US10262330B2 (en) | 2013-01-04 | 2019-04-16 | PlaceIQ, Inc. | Location-based analytic platform and methods |
US20140207637A1 (en) | 2013-01-23 | 2014-07-24 | Mastercard International Incorporated | System and Method for Using Credit/Debit Card Transaction Data to Determine Financial Health of a Merchant |
US20140207674A1 (en) | 2013-01-24 | 2014-07-24 | Mastercard International Incorporated | Automated teller machine transaction premium listing to prevent transaction blocking |
US20140244503A1 (en) | 2013-02-27 | 2014-08-28 | Mastercard International Incorporated | System and method for automatic thresholding for payment card spend control |
US20140250011A1 (en) | 2013-03-01 | 2014-09-04 | Lance Weber | Account type detection for fraud risk |
US9286618B2 (en) | 2013-03-08 | 2016-03-15 | Mastercard International Incorporated | Recognizing and combining redundant merchant designations in a transaction database |
US8983868B1 (en) | 2013-03-08 | 2015-03-17 | Google Inc. | Using location information in electronic commerce |
US20140279494A1 (en) | 2013-03-12 | 2014-09-18 | Mastercard International Incorporated | Method and system of detecting and using geofencing for fraud detection and modeling |
US20140279503A1 (en) | 2013-03-13 | 2014-09-18 | Bank Of America Corporation | Providing customer alerts based on geo-thresholds |
US9594907B2 (en) * | 2013-03-14 | 2017-03-14 | Sas Institute Inc. | Unauthorized activity detection and classification |
US9231979B2 (en) | 2013-03-14 | 2016-01-05 | Sas Institute Inc. | Rule optimization for classification and detection |
US9311685B2 (en) | 2013-03-14 | 2016-04-12 | Bank Of America Corporation | Geolocation check-in system |
US9230280B1 (en) * | 2013-03-15 | 2016-01-05 | Palantir Technologies Inc. | Clustering data based on indications of financial malfeasance |
US11232447B2 (en) | 2013-03-15 | 2022-01-25 | Allowify Llc | System and method for enhanced transaction authorization |
US20140279312A1 (en) | 2013-03-15 | 2014-09-18 | Capital One Financial Corporation | System and method for providing automated chargeback operations |
US9633322B1 (en) | 2013-03-15 | 2017-04-25 | Consumerinfo.Com, Inc. | Adjustment of knowledge-based authentication |
US20140310160A1 (en) | 2013-04-11 | 2014-10-16 | Pawan Kumar | Alert System with Multiple Transaction Indicators |
AU2014250767A1 (en) | 2013-04-12 | 2015-11-12 | Mastercard International Incorporated | Analytics rules engine for payment processing system |
US20140337217A1 (en) | 2013-05-09 | 2014-11-13 | Mastercard International Incorporated | Card present fraud prevention method using airline passenger detail |
US20140358592A1 (en) * | 2013-05-31 | 2014-12-04 | OneEvent Technologies, LLC | Sensors for usage-based property insurance |
US9438576B2 (en) | 2013-06-12 | 2016-09-06 | Luiz M Franca-Neto | Apparatus and method for validation and authorization of device and user by global positioning and non-prompted exchange of information |
US9811830B2 (en) | 2013-07-03 | 2017-11-07 | Google Inc. | Method, medium, and system for online fraud prevention based on user physical location data |
US11367073B2 (en) | 2013-07-03 | 2022-06-21 | Capital One Services, Llc | System and method for fraud control |
US20150032604A1 (en) | 2013-07-23 | 2015-01-29 | Mastercard International Incorporated | Merchant data cleansing in clearing record based on targeted merchants |
US20150032621A1 (en) | 2013-07-24 | 2015-01-29 | Mastercard International Incorporated | Method and system for proximity fraud control |
US20150039504A1 (en) | 2013-07-31 | 2015-02-05 | Cachet Financial Solutions Inc. | Check verification and remote deposit capture |
US20150046220A1 (en) | 2013-08-12 | 2015-02-12 | Mastercard International Incorporated | Predictive model of travel intentions using purchase transaction data method and apparatus |
EP3025299A4 (en) | 2013-08-16 | 2017-01-25 | Mdsave, Inc | Network-based marketplace service for facilitating purchases of bundled services and products |
US20150058119A1 (en) | 2013-08-22 | 2015-02-26 | SocialWire, Inc. | Automated Advertisement of Products on Online Sites |
CA2860179A1 (en) | 2013-08-26 | 2015-02-26 | Verafin, Inc. | Fraud detection systems and methods |
US20160071104A1 (en) | 2013-09-04 | 2016-03-10 | George Gregory Stamatis | Securebuy merchant information analytics decision engine |
US20150081349A1 (en) | 2013-09-13 | 2015-03-19 | Visa International Service Association | Systems and Methods to Provide Location Indication in Transaction Data |
US9607318B1 (en) | 2013-09-19 | 2017-03-28 | Intuit Inc. | Method and system for providing relevant sale event notifications using financial transaction data and location data |
US9483629B2 (en) | 2013-09-26 | 2016-11-01 | Dragnet Solutions, Inc. | Document authentication based on expected wear |
US20150106260A1 (en) | 2013-10-11 | 2015-04-16 | G2 Web Services | System and methods for global boarding of merchants |
US20150106265A1 (en) * | 2013-10-11 | 2015-04-16 | Telesign Corporation | System and methods for processing a communication number for fraud prevention |
US9727866B2 (en) | 2013-10-15 | 2017-08-08 | Intuit Inc. | Methods systems and computer program products for verifying consumer identity during transaction |
US9148869B2 (en) | 2013-10-15 | 2015-09-29 | The Toronto-Dominion Bank | Location-based account activity alerts |
US9934498B2 (en) | 2013-10-29 | 2018-04-03 | Elwha Llc | Facilitating guaranty provisioning for an exchange |
US20150120502A1 (en) | 2013-10-29 | 2015-04-30 | Elwha LLC, a limited liability corporation of the State of Delaware | Supporting guaranty provisioning via user attribute proffering |
US20150199738A1 (en) | 2014-01-14 | 2015-07-16 | Elwha Llc | Guaranty investigation |
US9818105B2 (en) | 2013-10-29 | 2017-11-14 | Elwha Llc | Guaranty provisioning via wireless service purveyance |
US10586234B2 (en) | 2013-11-13 | 2020-03-10 | Mastercard International Incorporated | System and method for detecting fraudulent network events |
US9936346B2 (en) | 2013-11-28 | 2018-04-03 | Microsoft Technology Licensing, Llc | Geofences from context and crowd-sourcing |
US9483765B2 (en) | 2013-12-09 | 2016-11-01 | Mastercard International Incorporated | Systems and methods for monitoring payment transactions for fraud using social media |
US20160203490A1 (en) | 2013-12-10 | 2016-07-14 | Sas Institute Inc. | Systems and Methods for Travel-Related Anomaly Detection |
US20150161611A1 (en) | 2013-12-10 | 2015-06-11 | Sas Institute Inc. | Systems and Methods for Self-Similarity Measure |
US10115107B2 (en) | 2013-12-23 | 2018-10-30 | International Business Machines Corporation | Payment card fraud protection |
US9330416B1 (en) | 2013-12-30 | 2016-05-03 | Emc Corporation | Visualization of fraud patterns |
AU2014373899A1 (en) | 2014-01-02 | 2016-07-14 | Visa International Service Association | Location obfuscation for authentication |
US20150193768A1 (en) | 2014-01-09 | 2015-07-09 | Capital One Financial Corporation | Method and system for providing alert messages related to suspicious transactions |
US9947055B1 (en) | 2014-01-29 | 2018-04-17 | Intuit Inc. | System and method for monitoring merchant transactions using aggregated financial data |
US20150227934A1 (en) | 2014-02-11 | 2015-08-13 | Mastercard International Incorporated | Method and system for determining and assessing geolocation proximity |
US20150039513A1 (en) | 2014-02-14 | 2015-02-05 | Brighterion, Inc. | User device profiling in transaction authentications |
US20150235221A1 (en) | 2014-02-19 | 2015-08-20 | Bank Of America Corporation | Proof-of-verification network for third party issuers |
US20150242856A1 (en) | 2014-02-21 | 2015-08-27 | International Business Machines Corporation | System and Method for Identifying Procurement Fraud/Risk |
US9786015B1 (en) | 2014-02-27 | 2017-10-10 | Intuit Inc. | System and method for fraud detection using aggregated financial data |
US10032168B2 (en) | 2014-03-07 | 2018-07-24 | Fmr Llc | Secure validation of financial transactions |
US20150262184A1 (en) | 2014-03-12 | 2015-09-17 | Microsoft Corporation | Two stage risk model building and evaluation |
US9589566B2 (en) | 2014-03-21 | 2017-03-07 | Wells Fargo Bank, N.A. | Fraud detection database |
US9552582B2 (en) | 2014-03-21 | 2017-01-24 | Ca, Inc. | Controlling ecommerce authentication with non-linear analytical models |
US9581342B2 (en) | 2014-03-28 | 2017-02-28 | Google Inc. | Mounting stand for multi-sensing environmental control device |
US10896421B2 (en) | 2014-04-02 | 2021-01-19 | Brighterion, Inc. | Smart retail analytics and commercial messaging |
US20180053114A1 (en) | 2014-10-23 | 2018-02-22 | Brighterion, Inc. | Artificial intelligence for context classifier |
US9569767B1 (en) | 2014-05-06 | 2017-02-14 | Square, Inc. | Fraud protection based on presence indication |
US20160283945A1 (en) | 2014-05-28 | 2016-09-29 | Emmanuel Gonzalez | User profile parameters for financial accounts |
US9210156B1 (en) | 2014-06-16 | 2015-12-08 | Lexisnexis Risk Solutions Inc. | Systems and methods for multi-stage identity authentication |
US9934517B2 (en) | 2014-06-17 | 2018-04-03 | American Express Travel Related Services Company, Inc. | Systems and methods for processing transactions |
US11410176B2 (en) | 2014-06-27 | 2022-08-09 | Tigergraph, Inc. | System and method for enhanced detection of fraudulent electronic transactions |
US10963810B2 (en) | 2014-06-30 | 2021-03-30 | Amazon Technologies, Inc. | Efficient duplicate detection for machine learning data sets |
US9509705B2 (en) | 2014-08-07 | 2016-11-29 | Wells Fargo Bank, N.A. | Automated secondary linking for fraud detection systems |
EP2988259A1 (en) | 2014-08-22 | 2016-02-24 | Accenture Global Services Limited | Intelligent receipt scanning and analysis |
JP6630347B2 (en) | 2014-09-03 | 2020-01-15 | ナントヘルス,インコーポレーテッド | Synthetic genomic variant-based secure transaction devices, systems, and methods |
US9418365B2 (en) | 2014-09-08 | 2016-08-16 | Mastercard International Incorporated | Systems and methods for using social network data to determine payment fraud |
US9280774B1 (en) | 2014-09-09 | 2016-03-08 | Bank Of America Corporation | System and method for investigating fraudulent activity |
US10657521B2 (en) | 2014-09-16 | 2020-05-19 | Mastercard International Incorporated | Systems and methods for determining fraudulent transactions using digital wallet data |
US9460071B2 (en) | 2014-09-17 | 2016-10-04 | Sas Institute Inc. | Rule development for natural language processing of text |
US10140615B2 (en) | 2014-09-22 | 2018-11-27 | Visa International Service Association | Secure mobile device credential provisioning using risk decision non-overrides |
US9298901B1 (en) | 2014-10-08 | 2016-03-29 | International Business Machines Corporation | Credential validation using multiple computing devices |
US10572877B2 (en) | 2014-10-14 | 2020-02-25 | Jpmorgan Chase Bank, N.A. | Identifying potentially risky transactions |
US20160071017A1 (en) | 2014-10-15 | 2016-03-10 | Brighterion, Inc. | Method of operating artificial intelligence machines to improve predictive model training and performance |
US20160086185A1 (en) * | 2014-10-15 | 2016-03-24 | Brighterion, Inc. | Method of alerting all financial channels about risk in real-time |
US20160063502A1 (en) | 2014-10-15 | 2016-03-03 | Brighterion, Inc. | Method for improving operating profits with better automated decision making with artificial intelligence |
US20160125721A1 (en) * | 2014-10-29 | 2016-05-05 | Verizon Patent And Licensing Inc. | Alerting users when a user device is dropped |
US10304042B2 (en) | 2014-11-06 | 2019-05-28 | Early Warning Services, Llc | Location-based authentication of transactions conducted using mobile devices |
US10037532B2 (en) | 2014-11-13 | 2018-07-31 | Mastercard International Incorporated | Systems and methods for detecting transaction card fraud based on geographic patterns of purchases |
CN106687864B (en) | 2014-11-26 | 2020-07-03 | 日立化成株式会社 | Photosensitive resin composition, photosensitive element, cured product, semiconductor device, method for forming resist pattern, and method for producing circuit substrate |
US10049364B2 (en) | 2014-12-04 | 2018-08-14 | Cubic Corporation | Credit and debit fraud card usage monitoring for transit |
US9412108B2 (en) | 2014-12-11 | 2016-08-09 | Mastercard International Incorporated | Systems and methods for fraud detection by transaction ticket size pattern |
US9858575B2 (en) | 2014-12-16 | 2018-01-02 | At&T Mobility Ii Llc | Fraud detection via mobile device location tracking |
US11093845B2 (en) | 2015-05-22 | 2021-08-17 | Fair Isaac Corporation | Tree pathway analysis for signature inference |
IN2015CH00232A (en) | 2015-01-15 | 2015-09-18 | Wipro Ltd | |
US9472098B2 (en) * | 2015-01-15 | 2016-10-18 | International Business Machines Corporation | Vehicle-based abnormal travel event detecting and reporting |
US20160217509A1 (en) * | 2015-01-23 | 2016-07-28 | York Eggleston, IV | Apparatus and method for management of electronic receipts and evaluation of the fair market value of goods based on free-form descriptions of goods and shoppers buying habits |
US9552578B2 (en) | 2015-02-25 | 2017-01-24 | Mastercard International Incorporated | Method and system for authentication of payment card transactions |
US20150213276A1 (en) | 2015-02-28 | 2015-07-30 | Brighterion, Inc. | Addrressable smart agent data structures |
SG10201502201UA (en) | 2015-03-20 | 2016-10-28 | Mastercard Asia Pacific Pte Ltd | Method and system for identifying linked cards from authorization records |
US20160292666A1 (en) | 2015-03-31 | 2016-10-06 | Mastercard International Incorporated | Method and system for determining and assessing geolocation proximity |
US20160300214A1 (en) | 2015-04-08 | 2016-10-13 | Elizabeth Chaffin | Methods and systems for automated matter resolution |
US9721253B2 (en) | 2015-05-06 | 2017-08-01 | Forter Ltd. | Gating decision system and methods for determining whether to allow material implications to result from online activities |
US20170011382A1 (en) | 2015-07-10 | 2017-01-12 | Fair Isaac Corporation | Mobile attribute time-series profiling analytics |
US9392008B1 (en) | 2015-07-23 | 2016-07-12 | Palantir Technologies Inc. | Systems and methods for identifying information related to payment card breaches |
US10043071B1 (en) | 2015-07-30 | 2018-08-07 | Morphotrust Usa, Llc | Automated document classification |
US9485265B1 (en) | 2015-08-28 | 2016-11-01 | Palantir Technologies Inc. | Malicious activity detection system capable of efficiently processing data accessed from databases and generating alerts for display in interactive user interfaces |
US11004071B2 (en) | 2015-09-09 | 2021-05-11 | Pay with Privacy, Inc. | Systems and methods for automatically securing and validating multi-server electronic communications over a plurality of networks |
EP3561707A1 (en) | 2015-10-14 | 2019-10-30 | Pindrop Security, Inc. | Call detail record analysis to identify fraudulent activity and fraud detection in interactive voice response systems |
US10373140B1 (en) | 2015-10-26 | 2019-08-06 | Intuit Inc. | Method and system for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling |
US10504122B2 (en) | 2015-12-17 | 2019-12-10 | Mastercard International Incorporated | Systems and methods for predicting chargebacks |
US10325436B2 (en) | 2015-12-31 | 2019-06-18 | Hand Held Products, Inc. | Devices, systems, and methods for optical validation |
US10419401B2 (en) | 2016-01-08 | 2019-09-17 | Capital One Services, Llc | Methods and systems for securing data in the public cloud |
US20170221062A1 (en) | 2016-01-28 | 2017-08-03 | Verifi, Inc. | Order insights system and method |
US20170243220A1 (en) | 2016-01-29 | 2017-08-24 | Mastercard International Incorporated | Systems and methods for blocking ineligible fraud-related chargebacks |
EP3203436B1 (en) | 2016-02-04 | 2022-05-18 | Amadeus S.A.S. | Monitoring user authenticity in distributed system |
US10475034B2 (en) | 2016-02-12 | 2019-11-12 | Square, Inc. | Physical and logical detections for fraud and tampering |
US20170270526A1 (en) | 2016-03-15 | 2017-09-21 | Hrb Innovations, Inc. | Machine learning for fraud detection |
US10825028B1 (en) | 2016-03-25 | 2020-11-03 | State Farm Mutual Automobile Insurance Company | Identifying fraudulent online applications |
US11037158B2 (en) | 2016-03-29 | 2021-06-15 | Microsoft Technology Licensing, Llc | Bulk dispute challenge system |
US10891628B1 (en) | 2016-05-05 | 2021-01-12 | State Farm Mutual Automobile Insurance Company | Using cognitive computing to improve relationship pricing |
US10846308B2 (en) | 2016-07-27 | 2020-11-24 | Anomalee Inc. | Prioritized detection and classification of clusters of anomalous samples on high-dimensional continuous and mixed discrete/continuous feature spaces |
US20180060839A1 (en) | 2016-08-25 | 2018-03-01 | Mastercard International Incorporated | Systems and methods for predicting chargeback stages |
US10896422B2 (en) | 2016-12-01 | 2021-01-19 | Mastercard International Incorporated | Systems and methods for detecting collusion between merchants and cardholders |
US11238528B2 (en) | 2016-12-22 | 2022-02-01 | American Express Travel Related Services Company, Inc. | Systems and methods for custom ranking objectives for machine learning models applicable to fraud and credit risk assessments |
US10452908B1 (en) * | 2016-12-23 | 2019-10-22 | Wells Fargo Bank, N.A. | Document fraud detection |
US10586152B2 (en) | 2017-02-16 | 2020-03-10 | Honeywell International Inc. | Determining image forensics using gradient statistics at edges |
-
2017
- 2017-03-22 US US15/465,874 patent/US10825028B1/en active Active
- 2017-03-22 US US15/466,002 patent/US20210264429A1/en not_active Abandoned
- 2017-03-22 US US15/465,842 patent/US11170375B1/en active Active
- 2017-03-22 US US15/466,014 patent/US11334894B1/en active Active
- 2017-03-22 US US15/465,827 patent/US10832248B1/en active Active
- 2017-03-22 US US15/465,981 patent/US20220122071A1/en not_active Abandoned
- 2017-03-22 US US15/465,977 patent/US10949852B1/en active Active
- 2017-03-22 US US15/465,858 patent/US11037159B1/en active Active
- 2017-03-22 US US15/465,871 patent/US20210158355A1/en not_active Abandoned
- 2017-03-22 US US15/466,009 patent/US20210065186A1/en not_active Abandoned
- 2017-03-22 US US15/465,868 patent/US20210374764A1/en not_active Abandoned
- 2017-03-22 US US15/465,832 patent/US10872339B1/en active Active
- 2017-03-22 US US15/465,856 patent/US20210374753A1/en not_active Abandoned
- 2017-03-22 US US15/465,880 patent/US20210264458A1/en not_active Abandoned
-
2019
- 2019-08-14 US US16/540,505 patent/US10949854B1/en active Active
-
2020
- 2020-05-13 US US15/931,560 patent/US11004079B1/en active Active
- 2020-06-11 US US16/899,486 patent/US11049109B1/en active Active
- 2020-06-26 US US16/913,814 patent/US11348122B1/en active Active
- 2020-10-23 US US17/078,744 patent/US11687937B1/en active Active
- 2020-10-26 US US17/080,476 patent/US11687938B1/en active Active
- 2020-12-28 US US17/134,901 patent/US11699158B1/en active Active
-
2021
- 2021-02-03 US US17/166,854 patent/US12026716B1/en active Active
-
2022
- 2022-05-16 US US17/745,541 patent/US11978064B2/en active Active
- 2022-05-27 US US17/827,015 patent/US11741480B2/en active Active
- 2022-11-23 US US17/993,758 patent/US11989740B2/en active Active
-
2023
- 2023-06-07 US US18/207,069 patent/US20230316285A1/en active Pending
- 2023-06-07 US US18/207,081 patent/US20230316286A1/en active Pending
- 2023-07-14 US US18/222,199 patent/US20230394500A1/en active Pending
-
2024
- 2024-04-02 US US18/624,826 patent/US20240249295A1/en active Pending
- 2024-04-16 US US18/636,886 patent/US20240265405A1/en active Pending
- 2024-05-21 US US18/669,968 patent/US20240303664A1/en active Pending
Also Published As
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US11741480B2 (en) | Identifying fraudulent online applications | |
US8732084B2 (en) | Identification and risk evaluation | |
US10304056B1 (en) | Enhanced merchant identification using transaction data | |
US11037160B1 (en) | Systems and methods for preemptive fraud alerts | |
US20160292666A1 (en) | Method and system for determining and assessing geolocation proximity | |
CN111461859A (en) | Loan pairing system and method | |
US20160239847A1 (en) | Systems and Methods for Processing Support Messages Relating to Features of Payment Networks | |
WO2023091467A2 (en) | Web presence based legitimacy analysis | |
US12073408B2 (en) | Detecting unauthorized online applications using machine learning | |
US12125039B2 (en) | Reducing false positives using customer data and machine learning | |
US20240273536A1 (en) | Systems and methods for advanced user authentication in accessing a computer network | |
Makatjane et al. | Detecting Bank Financial Fraud in South Africa Using a Logistic Model Tree | |
Vering | Scaling credit decisions in FinTech |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STPP | Information on status: patent application and granting procedure in general |
Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION |
|
AS | Assignment |
Owner name: STATE FARM MUTUAL AUTOMOBILE INSURANCE COMPANY, ILLINOIS Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:KRAMME, TIMOTHY;FLOWERS, ELIZABETH;BATRA, REENA;AND OTHERS;SIGNING DATES FROM 20170308 TO 20170320;REEL/FRAME:065037/0429 |