Patent Application
20140249934
The present disclosure generally relates to computer-implemented systems and methods for processing transactions across multiple users.
Transaction processing may result in many transactions against which data manipulations may be performed. An area of great concern to financial institutions and processors relates to fraudulent activity involving credit cards, financial accounts, debit cards, and the like. Cards and accounts that are discovered as having suffered fraudulent activity may be flagged or “black-listed” so that future transactions on such compromised accounts and cards may be prevented. Other areas of interest with respect to transaction processing relates to marketing actions based on information in the transactions.
As disclosed herein, transaction data is processed by receiving, at a computing device, a scoring request for a received transaction, and determining transactions in a database that are associated with a respective event that indicates a classification of interest and that share at least one common point of purchase (CPP) identifier across two or more of the determined transactions associated with the classification of interest. The computing device next determines a set of the transactions in the database, based on the CPP identifiers for transactions from a time period prior to a start tune of the associated respective event and accounts that are associated with the respective event; The system then determines times of occurrence for the transactions in the set, based on the CPP identifiers for transactions from the time period prior to the start time of the associated respective event and accounts that are associated with the respective event. Next, the system generates a score for the received transaction for any transactions in the database determined to be associated with at least one of the respective events and to share at least one common CPP, followed by generating information relating to the CPP identifiers for any transactions in the database determined to be associated with at least one of the respective events and to share at least one common CPP. Lastly, the processor provides the received transaction score, and the information relating to CPP identifiers.
In another aspect, transaction data is processed by identifying a common point of purchase (CPP) for multiple transactions in an offline, hatch process, and then identifying CPPs from historical transaction data, creating a list of the identified CPP entities, and creating a list of at-risk cards/accounts that have been at a CPP, but haven't yet had fraud, or purchased a given product, associated with the transaction. Processing transaction data further involves processing a received transaction, on a card/account in real time, such that as each transaction is received, it is determined if the card/account is in the created list of at-risk cards/accounts, and if it is, then information is generated on the received transaction relating to the CPP it was subject to in the created list of the identified CPP entities; and a list is created of at-risk cards/accounts that have been at a CPP, but haven't yet had fraud, or purchased a given product, associated with the transaction.
In another aspect, a computer-implemented method includes identifying a common point of purchase (CPP) for multiple transactions in an offline process, identifying CPPs from historical transaction data, and creating a list of the identified CPPs. The method involves creating a list of accounts that have been at a CPP, where the created list of accounts includes accounts that are not associated with an activity related to a purchase, and receiving transactions in real time, wherein the received transactions are associated with accounts. The method also includes determining, with a processor, whether an account associated with a received transaction is in the created list of accounts, and based upon determining that the account is in the created list of accounts, adding information for the received transaction relating to a CPP in the list of identified CPPs. The method includes creating a score related to the received transaction based upon the added information for the received transaction.
Other features may include one or more of the following features. The activity related to the purchase may include a fraudulent activity or activity associated with a purchase for a particular product. The score may relate to fraud or marketing. The score may be created in real time. The offline process may be a batch process. The list of accounts may include a list of at-risk cards or a list of at-risk accounts. The CPP may be associated with an entity, where the entity may be a merchant, a terminal, an acquirer, a payment processor, or refer to a geographic location or area.
Other features of the disclosed subject matter will be apparent from the following description of the embodiments, which illustrate, by way of example, the principles of the disclosed subject matter.
Stored transactions are identified in a history database of transactions across multiple entities associated with the transactions, wherein the identified stored transactions are associated with at least one co-occurrence of an event that indicates as classification of interest and share at least one common point of purchase (CPP) identifier across all the identified stored transactions for the classification of interest. In response to a scoring request for a received transaction, a transaction score is generated in response to the request. For those transactions that have not been associated with the classification of interest, but are associated with a card or account having a CPP identifier, the transaction score request response will also include information about the CPP identifier. The event may include, for example, a fraudulent transaction, and the classification of interest may include a fraudulent card or account. It should be noted that the occurrence of the event from which the classification arises may only be apparent in hindsight in some situations. For example, a purchase transaction may occur and not until weeks or even months later will it be understood that the transaction was a fraudulent transaction. The associated card or account that was involved in the fraudulent transaction will then be classified as a fraudulent card or account. In the marketing context, for example, the event may comprise a product purchase, and the classification may comprise a receptive card or account. An entity may comprise, for example, a merchant, a terminal, acquirer, payment processor, or geographic location or area, or the like.
In aspects of the disclosed subject matter, transaction data for transactions associated with purchase cards are received. In the context of fraud detection, after some period of time ranging from minutes to weeks or months, some of the transactions can be deemed to be fraudulent after conferring with the legitimate card or account holder. Based on these fraudulent transactions, a set of compromise points can be identified based on linking multiple cards or accounts to a common entity, terminal, acquirer, payment processor, or geographic area based on observing multiple fraudulent cards previously visiting the same entity. An entity may comprise, for example, a merchant, a terminal, acquirer, payment processor, or geographic location or area, or the like. These entities comprising merchants, terminals, acquirers, processors, or geographic areas may generally be referred to as common points of purchase (CPPs). A set of cards (and/or associated accounts) that visited any of the CPI's while they were vulnerable to being compromised, but that have not yet been associated with (victimized by) fraudulent activity, can be created as well. This set of cards and/or accounts that have not yet had fraud occur but were possibly compromised are referred to as cards at risk. As used herein, “account” may refer to either a card, an account, or both, unless specifically limited to one or the other.
It should be noted that more than one card may be associated with a single account, such as with corporate accounts having multiple issued cards. Transaction scoring can be performed such that a score for each received transaction can be generated using the common point of purchase (CPP) data and the cards at risk data. In this way, compromise events can be identified quickly and efficiently, thus helping to reduce financial losses from unauthorized account activity.
The identification of CPP data among fraudulent cases can aid in the identification of merchants, terminals, payment processors, geographic areas, and/or acquirers in situations where a data compromise event has taken place in the past or is currently taking place. Various embodiments of the techniques disclosed herein can use transaction data and fraud data to identify merchants, terminals, payment processors, geographic areas, and acquirers that might have possibly been compromised. This data is then used to identify cards that could have possibly been a part of a data compromise event, but have not yet suffered fraudulent activity. In a data processing system, data about suspect cards is then made available to a statistical model, for real-time scoring and for use in a rules engine, and to a case management system, for fraud alert creation and distribution.
Authorizations for credit card charges and the like are expected to be performed in real time, so a customer is not kept waiting, and therefore the identification of a compromised card and the resultant decision to decline approval for the transaction, occur in real time. The CPP-identifying process may be contained within a data processing system, such as the “SAS Enterprise Fraud Management” system from SAS Institute Inc., of Cary, N.C., which provides a system that can be updated multiple times during the day.
Processing for Detection of Common Points of Purchase (CPP) in a Transaction System
The system next receives a scoring request for a transaction and generates a score for the transaction, as represented by the box numbered 210. At the box numbered 212, the system determines if the received transaction is not associated with the classification of interest, but has at least one of the shared CPP identifiers in common with the stored transactions identified as having the classification of interest. If both conditions are true, an affirmative outcome at the decision box numbered 212, then CPP information is generated and appended to the scoring request response, as depicted by box 214. The system then sends the response to the scoring request, along with the appended CPP information, as represented by the box 216. System processing then continues at 218. If the conditions do not apply, meaning that the transaction was already associated with the classification of interest (such as fraud or a purchase of a target item) or has no shared CPP identifiers in common with cards or accounts associated with the classification of interest, a negative outcome at the box 212, then processing proceeds to box 216, which represents sending the response to the scoring request (i.e., the requested score for the transaction is sent in reply).
Authorization and Fraud Decision-Making Process
As noted above, the techniques disclosed herein can be used in fraud decision-making for transaction authorization and also in marketing decision-making.
The next operation 312 identifies cards at risk by finding cards that visited CPPs during their compromise timeframe, but which have not been determined to have experienced fraud. That is, for a set of cards already associated with fraud (i.e., identified as having suffered fraud), cards at risk are defined as those cards that are not currently associated with fraud, but which were used such that they have one or more CPP data in common with the set of cards already associated with fraud. At box 314, the information about such CPP data, comprising appended CPP data as described further below, is passed to a scoring engine, along with data relating to the cards at risk. The information passed along is used by the scoring engine at 316 to provide a score that reflects fraud risk, for example, indicating either a higher level of risk or a lower level of risk. A threshold of unacceptable fraud risk can be established, such that the system indicates unacceptable fraud risk for a score that exceeds the threshold value and otherwise does not.
The
Further with respect to fraud decision-making.
Real-time processing is initiated in response to a received transaction and a request for scoring that transaction (indicated by the operation labeled as (7) in
After the scoring request for the received transaction 418 is performed, the transaction is sent to an Alert Generation server (AGS) 428, where case creation rules are initiated or launched that may inform the requesting party (e.g., a bank requesting the scoring) that transaction activity may be suspicious or risky, and should be confirmed. The transaction is provided to a Reporting History Database 402.
Periodically, data in the RH database 402 is consumed by the CPP Macro 404, wherein CPPs are identified and stored for future reference 406. The CPP identification process updates the CPP ID datastore 406 and creates a list of CPP affected (or at risk) cards 408. The list of CPP-affected cards 408 is then transferred 410 to the scoring engine OSE 414 to generate transaction scoring, for the next day's scoring. The transfer to the scoring engine is indicated in
The first operation in the fraud-detection process is identifying possible common points of purchase (CPP) on fraud-associated cards where there may have been a compromise event. To perform this operation, the system looks in the reporting history database 402 of transaction data for similar transactions at the same timeframe in a set time period and executes a process 404 to identify CPP data. The process is identified in
The first three listed transactions in
After the CPP Macro 404 process (
The system operations to identify CPP transactions in the data record to be placed in the CPP datastore 406 will result in, for example, identification of a possible compromise event at Merchant ABC in a time period between roughly the transaction at 21Jan2012:15:13:17 (earliest time) under Fraud Card N and 24Jan2012:12:11:17 (latest time) under Fraud Card N. The set of possible compromise events across the cards 502, 504, 506, 508 is determined from the data record in the database 406 because, out of all the transaction data, these determined events involve the same merchant on the same day at approximately the same time of day. These transactions on these cards comprise a set of possible (new) compromises.
The set of new compromises is combined with a set of previously suspected compromise transactions from the CPP ID datastore 406 (
After the determination of possible common points of compromise as described above, cards that have not been associated or tagged with a fraud event are extracted from the record history database 402 in an operation labeled (2) in
A list of possible compromise events is then produced and the list of possible compromises is updated in the compromise table comprising the CPP datastore 406, an operation identified in
Thus, the data regarding CPP-affected cards 408 is received, by the controller 412, and transactions 418 are also received into the controller, through an operation identified in
The transaction data and appended CPP information is sent to the AGS 428 in an operation identified as operation (11). In the AGS, cases and/or alert notifications are generated. The cases and notifications are generally handled by analysts or other financial institution personnel who contact card customers to verify proper activity, reissue new cards, and the like. After finishing in the AGS 428, the transaction data is inserted into the RU database 402 in an operation identified as operation (12), whereupon the inserted transaction data may be used in the next round of CPP detection,
Marketing Decision-Making Process
As noted above, the techniques disclosed herein can be used in fraud decision-making for transaction authorization and also in marketing decision-making.
The first operation in the marketing decision-making process of
Be set of card marketing targets is combined with a set of cards involved with marketing-targeted transactions from the Marketing ID datastore 506. For example, the Marketing ID datastore could house a list of marketing opportunities, such as coupons to be redeemed, price discounts, and other offers and promotions to encourage purchasing. As another example, if it was observed that many people Who recently bought tickets to a concert later went on to purchase dinner at a location near the concert event, then a marketing strategy could be created that produces special dining offers when concert tickets are purchased. Thus, each data record in the Marketing ID datastore 606 would comprise such an offer or some other marketing strategy. As with the fraud operation described in connection with
As described herein, the disclosed techniques can be used to take historical data from the reporting history database, extract information on product purchasing behavior, and push it back to corresponding marketing models so that the information can be used for generating marketing scores that are used for producing marketing offers. Customer preferences for products can drift over time, and hence the ability to extract the most recent purchase information from the extensive reporting history database and making, it available for scoring in a very timely manner can be useful. In some embodiments, another characteristic of the approach described in this disclosure is that the feedback may be implicit, in the sense that explicit feedback from customers about their purchase preferences may not be required, but implied preferences of customers can be derived from their most recent purchases.
Thus, the marketing decision-making process can review card authorizations (e.g., the recorded history) to determine co-occurrences of purchases of products. To do this, the process looks for purchases by the same card and/or account in a set time period. The list of co-occurring product purchases and accounts can be used to determine marketing targets and to transfer to the scoring engine for real-time use by the model and rules.
Some embodiments may involve the following operations.
In an offline, batch process:
Then, in real time:
The next series of operations is performed in real time, so that each operation is performed on a received transaction data before the next operation is begun. In the first real-time operation, as each transaction arrives, the processor checks to see if the received card/account is in the list (B) above. If the received transaction is in (B), at box 708, the processor generates information on the transaction relating to the CPP in (A) to which it was subject. The next operation, at box 710, is to create as score for fraud, marketing, and the like, as desired, as disclosed herein, in addition to the data added to the transaction from the CPP process (if any was added).
Exemplary Hardware System
The systems and methods described above may be implemented in a number of ways. One such implementation includes computer devices having various electronic components. For example, components of the system in
The system 800 is shown comprising hardware elements that can be electrically coupled via a system bus 826 (or may otherwise be in communication, as appropriate). The hardware elements can include one or more central processor units (CPUs) 802, including without limitation one or more general-purpose processors and/or one or more special-purpose processors (such as communication processing chips, graphics acceleration chips, and/or the like); one or more input devices 804, that can include, without limitation, a mouse, a keyboard, and/or the like; and one or more output devices 806, which can include without limitation a display device, a printer, audio device, and/or the like.
The system 800 may further include (and/or be in communication with) one or more storage devices 808, which can comprise, without limitation, local and/or network accessible storage and/or can include, without limitation, a disk drive, a drive array, an optical storage device, solid-state storage device such as a random access memory (“RAM”), and/or a read-only memory (“ROM”), which can be programmable, flash-updateable, and/or the like. The system 800 might also include a communications subsystem 814, which can include without limitation a modem, a network card (wireless or wired), an infra-red communication device, a wireless communication device and/or chipset (such as a Bluetooth device, an 802.11 device, a WiFi device, a WiMax device, cellular communication facilities, etc.), and/or the like. The communications subsystem 814 may permit data to be exchanged with a network 815, and/or any other devices described herein. The network 815 may comprise a local area network (LAN) or a network such as the Internet, or a combination. In many embodiments, the computational system 800 will further include a working memory 818, which can include a RAM or ROM device, as described above.
The system 800 also may comprise software elements, shown as being currently located within the working memory 818, including an operating system 824 and/or other code, such as one or more application programs 822, which may comprise computer programs performing tasks and operations described above, and/or may be designed to implement methods in accordance with the disclosed subject matter and/or configure systems in accordance with the disclosed subject matter, as described herein. Merely by way of example, one or more procedures described with respect to the method(s) discussed above might be implemented as code and/or instructions executable by as computer (and/or a processor within a computer). In one embodiment, the data generating and presenting operations are implemented as application programs 822. In the description herein, references to “interface” and “processor” and “application” should be understood as referring to hardware, software, and combinations of the two, either as independent components (hardware, software, and/or both) for each interface, processor, or application, or as integrated components combined with one or more other components.
A set of these instructions and/or code may be stored on a computer readable storage medium 810b. In some embodiments, the computer readable storage medium 810b may comprise the storage device(s) 808 described above. In other embodiments, the computer readable storage medium 810b might be incorporated within the computer system 800. In still other embodiments, the computer readable storage medium 810b might be separate from the computer system (i.e. it may be a removable readable medium, such as a compact disc, etc.), and or might be provided in an installation package, such that the storage medium can be used to program a general purpose computer with the instructions/code stored thereon. These instructions might take the form of executable code, which is executable by the computational system 800 and/or might take the form of source and/or installable code, which, upon compilation and/or installation on the computational system 800 (e.g., using any of a variety of generally available compilers, installation programs, compression/decompression utilities, etc.), then takes the form of executable code. In these embodiments, the computer readable storage medium 810b may be read by a computer readable storage media reader 810a,
It will be apparent to those skilled in the art that substantial variations may be made in accordance with specific requirements. For example, customized hardware might also be used, and/or particular elements might be implemented in hardware, software (including portable software, such as applets, etc.), or both. Further, connection to other computing devices such as network input/output devices may be employed.
In one embodiment, local and remote computer systems (such as the computer data processing system 800) are utilized to perform methods of the disclosed subject matter. According to a set of embodiments, some or all of the procedures of such methods are performed by the system 800 in response to the processor 802 executing one or more sequences of one or more instructions (which might be incorporated into the operating system 824 and/or other code, such as an application program 822) contained in the working memory 818. Such instructions may be read into the working memory 818 from another machine-readable medium, such as one or more of the storage device(s) 808 (or 810). Merely by way of example, execution of the sequences of instructions contained in the working memory 818 might cause the processor(s) 802 to perform one or more procedures of the methods described herein.
The terms “machine readable medium” and “computer readable medium,” as used herein, refer to any medium that participates in providing data that causes a machine to operate in a specific fashion. In an embodiment implemented using the computer system 800, various machine-readable media might be involved in providing instructions code to processor(s) 802 for execution and/or might be used to store and/or carry such instructions/code (e.g., as transmissions). In many implementations, a computer readable medium is a physical and/or tangible storage medium. Such a medium may take many forms, including but not limited to, volatile and non-volatile media. Non-volatile computer-readable media includes, for example, optical or magnetic disks, such as the storage device(s) (808 or 810). Volatile computer-readable media includes, without limitation, dynamic memory, such as the working memory 818. In some implementation, data may be carried over transmission media. Transmission media includes coaxial cables, copper wire, and fiber optics, including the wires that comprise the bus 826, as well as the various components of the communication subsystem 814 (and/or the media by which the communications subsystem 814 provides communication with other devices). Hence, transmission media can also take the form of waves (including, without limitation, radio, acoustic, and/or light waves, such as those generated during radio-wave and infra-red data communications).
Common forms of physical and/or tangible computer readable media include, for example, a floppy disk, a flexible disk, hard disk, magnetic tape, or any other magnetic medium, a CD-ROM, any other optical medium, punchcards, papertape, any other physical medium with patterns of holes, a RAM, a PROM, an EPROM, a PLASH-EPROM, any other memory chip or cartridge, a carrier wave as described hereinafter, or any other medium from which a computer can read instructions and/or code.
Various forms of machine-readable media may be involved in carrying one or more sequences of one or more instructions to the processor(s) 802 for execution. Merely by way of example, the instructions may initially be carried on a magnetic disk and/or optical disc of a remote computer. A remote computer might load the instructions into its dynamic memory and send the instructions over a transmission medium to be received and/or executed by the computational system 800.
The communications subsystem 814 (and/or components thereof) generally will receive the transmission, and the bus 826 then might carry the transmissions (and/or the data, instructions, etc. carried by the transmissions) to the working memory 818, from which the processor(s) 802 retrieves and executes the instructions. The instructions received by the working memory 818 may optionally be stored on a storage device 808 either before or after execution by the processor(s) 802.
It will be appreciated that many processing capabilities in addition to those described are possible, without departing from the teachings according to the disclosed subject matter. Further, it should be noted that the methods, systems, and devices discussed above are intended merely to be examples. Various embodiments may omit, substitute, or add various procedures or components as appropriate. For example, it should be appreciated that, in alternative embodiments, the methods may be performed in an order different from that described, and that various steps may be added, omitted, or combined. Also, features described with respect to certain embodiments may be combined in various other embodiments. Different aspects and elements of the embodiments may be combined in a similar manner. Also, it should be emphasized that technology evolves and, thus, many of the elements are examples and should not be interpreted to limit the scope of the disclosed subject matter.
Specific details are given in the description to provide a thorough understanding of the embodiments. However, it will be understood by one of ordinary skill in the art that the embodiments may be practiced without these specific details.
Also, it is noted that the embodiments may be described as a process which is depicted as a flow diagram or block diagram. Although each may describe the operations as a sequential process, many of the operations can be performed in parallel or concurrently. In addition, the order of the operations may be rearranged. A process may have additional operations not included in the figures.
Other variations are within the spirit of the present disclosed subject matter. Thus, while the disclosed subject matter is susceptible to various modifications and alternative constructions, certain illustrated embodiments thereof are shown in the drawings and have been described above in detail. It should be understood, however, that there is no intention to limit the disclosed subject matter to the specific form or forms disclosed, but on the contrary, the intention is to cover all modifications, alternative constructions, and equivalents falling within the spirit and scope of the disclosed subject matter, as defined in the appended claims.
Many of the methods described herein can be performed in any suitable order unless otherwise indicated herein or otherwise clearly contradicted by context. The use of any and all examples, or exemplary language (e.g., “such as”) provided herein, is intended merely to better illuminate embodiments of the disclosed subject matter and does not pose a limitation on the scope of the disclosed subject matter unless otherwise claimed.
Thus, particular embodiments have been described. Other embodiments are within the scope of the following claims. For example, the actions recited in the claims can be performed in a different order and still achieve desirable results.
