Patent Application
20210233081
Embodiments discussed herein generally relate to fraudulent transactions and declined transaction data.
Credit cards have enabling users to make purchases without cash in a variety of settings. This convenience sometimes comes at a cost where criminals have found a way to obtain credit card numbers from the users. For example, criminals have copied credit cards and/or credit card numbers when they were handed to waiters/waitresses at dining establishments. These copied cards or numbers may make their way to black markets, and criminals may purchase goods and services with someone else's numbers. Other ways criminals have obtained someone else's credit cards are through hacking of merchants' computer systems to obtain the numbers.
Users used to spend time to carefully review credit card statements to identify these fraudulent charges and report them to the card issuers so that the charges may be investigated and/or reversed. Since the loss will be borne by the banks or issuers, these institutions have employed various approaches to proactively prevent fraudulent charges to begin in the first place.
However, fraudulent charges is a dynamic problem driven by intelligent agents or criminals who can quick adapt to static fraud models that these institutions employ. Moreover, much of the efforts (e.g., by identity theft prevention institutions) are done in identifying and tracking stolen card numbers in the dark web so as to proactively provide solutions to the users.
Therefore, embodiments attempt to create a technical solution to address the deficiencies of the challenges above by employing a machine learning (ML) or artificial intelligence (AI) system that may anticipate a fraudster's next moves.
Embodiments enable a system to initially provide an expected fraud risk data and update the data after a use real-time decline information is issued. In one embodiment, the decline information may further be provided along with weighted matrixes adjusted using the game theory. In one embodiment, the data may include an index table. Moreover, the system may predict next best solution matrix given historical data when faced with declines. Embodiments may further provide these next best solution to update dynamic risk index tables to be ingested by the real-time risk scoring model.
Persons of ordinary skill in the art may appreciate that elements in the figures are illustrated for simplicity and clarity so not all connections and options have been shown. For example, common but well-understood elements that are useful or necessary in a commercially feasible embodiment may often not be depicted in order to facilitate a less obstructed view of these various embodiments of the present disclosure. It may be further appreciated that certain actions and/or steps may be described or depicted in a particular order of occurrence while those skilled in the art may understand that such specificity with respect to sequence is not actually required. It may also be understood that the terms and expressions used herein may be defined with respect to their corresponding respective areas of inquiry and study except where specific meanings have otherwise been set forth herein.
Embodiments may now be described more fully with reference to the accompanying drawings, which form a part hereof, and which show, by way of illustration, specific exemplary embodiments which may be practiced. These illustrations and exemplary embodiments may be presented with the understanding that the present disclosure is an exemplification of the principles of one or more embodiments and may not be intended to limit any one of the embodiments illustrated. Embodiments may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure may be thorough and complete, and may fully convey the scope of embodiments to those skilled in the art. Among other things, the present invention may be embodied as methods, systems, computer readable media, apparatuses, or devices. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. The following detailed description may, therefore, not to be taken in a limiting sense.
Aspects of embodiments generate a dynamic solution to prevent fraudulent transactions. Based on historical data of transactions after the transactions have been denied, embodiments build an index table and assign weighted matrixes adjusted using the game theory to predict next best solution matrix as a function of the historical data when faced with declines.
Referring now to
However, referring now to
In another embodiment, an alert message 122 from either the payment processor 112 or the issuer 114 may be sent to the user 102 to alert the user 102 of the charge 124 and the decline 120. The user 102 may then confirm that the charge 124 was not authorized. In another embodiment, the alert 122 may be sent shortly after or simultaneously when the decline 120 was issued. In a further embodiment, the decline 120 may be sent after the user 102 reviews a statement of the payment device that includes the charge 124 and has determined that the charge 124 was not authorized.
However the decline 120 is issued, parties such as the payment processor 112 or the issuer 114 may now store such issuance as part of the historical record or historical data. However, it is assumed that the criminal 118 may move on to the next card or card number so a card-focused or number-focused approach would not yield much intelligence.
Aspects of embodiments build on a transaction risk model that reviews not only the account that has suffered a fraudulent charge but also reviews all aspects of the transaction, such as the merchant, time of day (“TOD”), amount of the transaction. In other words, aspects of embodiments attempt to build a model that may be account-neutral or account-agnostic.
Referring now to
It is to be understood that other granular division of the TOD may be used without departing from the spirit and scope of the embodiments.
In another embodiment, the determination of which merchant or at what TOD the criminal 118 may wish to make a purchase may depend on various factors. To determine a similarity factor 216 for the merchants and a similarity factor 218 for TOD, a graph learner algorithm may be used. For example, a similarity score, point, or rating may represent how fraud action change after a current transaction is declined and based on past model performance. In another example, a Dijkstra's shortest path algorithm may be used and the following is an exemplary pseudo code for a modified Dijkstra's shortest path according to one embodiment:
In one embodiment, with the Dijkstra's shortest path, a strategy of the criminal 118's actions may be represented as a graph, such as the graphs in
In one example, the score may be generated using the distance between nodes calculated using a recursive depth first search. For example, adding to the above equation:
Referring now to
Based on these two proposals, aspects of embodiments may generate a possible decline rate for each proposal. In this example, the decline rate for the proposal 232 may be 0.5 or 50% while the decline rate for the proposal 242 may be 0.1 or 10%.
In one embodiment, the decline rate may be a weighted probability of decline of the given chain of actions. For example, given the account, the merchant (e.g., location and type), and the TOD, the system 100 may determine the rate of decline as shown in
In one aspect, amount of the proposals may be shown in column 234, but the different amounts may not have altered the decline rate because the different amounts, however small or large, are still fraudulent amounts.
Once determined, aspects of embodiments may construct or generate a “predicted post-decline strategy” in
For example, based on the prediction in
Referring now to
Once the risk score is calculated, the system 100 may at 306 update a similarity measure based on the transaction. For example, the similarity measure (e.g., as shown in
In one embodiment, the system 100 may select top queries, filtered by minimum distance threshold at 320 (e.g.,
In one embodiment, the database may store fraudulent transactional data using a generated ID (which would be the fraudsters “account” as indicated above) instead of the actual account number. For example, the ID may link various fraudulent transactions together but may not be associated with a person or account. This generated ID may be created by using an unsupervised graph learner that clusters fraudulent transactions together. The resulting community, based on the score, would be the community ID. New fraudulent transactions would get the ID from the closest fraudulent transaction based on the transaction profile using a graph based similarity measure like Dijkstra's algorithm.
Referring now
Referring now to
The system 100 may also determine a measure of success for the best fit of the transaction profiles of the past fraudster at 512. At 514, the system 100 may determine if the measure of success is over a threshold. At 516, in response to the measure of success being over a threshold, the system 100 may update profiles of past fraudsters based on the transaction to include the transaction that has been declined. The system 100 may further predict future fraudulent transactions of the best fit of the transaction profiles of the past fraudsters at 518. At 520, the system 100 may therefore attempt to stop future fraudulent transactions based on the predicted future fraudulent transactions.
In one embodiment, a portable computing device 801 may be a mobile device 108 that operates using a portable power source 855 such as a battery. The portable computing device 801 may also have a display 802 which may or may not be a touch sensitive display. More specifically, the display 802 may have a capacitance sensor, for example, that may be used to provide input data to the portable computing device 801. In other embodiments, an input pad 804 such as arrows, scroll wheels, keyboards, etc., may be used to provide inputs to the portable computing device 801. In addition, the portable computing device 801 may have a microphone 806 which may accept and store verbal data, a camera 808 to accept images and a speaker 810 to communicate sounds.
The portable computing device 801 may be able to communicate with a computing device 841 or a plurality of computing devices 841 that make up a cloud of computing devices 841. The portable computing device 801 may be able to communicate in a variety of ways. In some embodiments, the communication may be wired such as through an Ethernet cable, a USB cable or RJ6 cable. In other embodiments, the communication may be wireless such as through Wi-Fi® (802.11 standard), BLUETOOTH, cellular communication or near field communication devices. The communication may be direct to the computing device 841 or may be through a communication network 102 such as cellular service, through the Internet, through a private network, through BLUETOOTH, etc.,
The physical elements that make up the remote computing device 841 may be further illustrated in
The database 1025 may be stored in the memory 1010 or 1015 or may be separate. The database 1025 may also be part of a cloud of computing device 841 and may be stored in a distributed manner across a plurality of computing devices 841. There also may be an input/output bus 1020 that shuttles data to and from the various user input devices such as the microphone 806, the camera 808, the inputs such as the input pad 804, the display 802, and the speakers 810, etc. The input/output bus 1020 also may control of communicating with the networks, either through wireless or wired devices. In some embodiments, the application may be on the local computing device 801 and in other embodiments, the application may be remote 841. Of course, this is just one embodiment of the server 841 and the number and types of portable computing devices 841 is limited only by the imagination.
The user devices, computers and servers described herein may be computers that may have, among other elements, a microprocessor (such as from the Intel® Corporation, AMD®, ARM®, Qualcomm®, or MediaTek®); volatile and non-volatile memory; one or more mass storage devices (e.g., a hard drive); various user input devices, such as a mouse, a keyboard, or a microphone; and a video display system. The user devices, computers and servers described herein may be running on any one of many operating systems including, but not limited to WINDOWS®, UNIX®, LINUX®, MAC® OS®, iOS®, or Android®. It is contemplated, however, that any suitable operating system may be used for the present invention. The servers may be a cluster of web servers, which may each be LINUX® based and supported by a load balancer that decides which of the cluster of web servers should process a request based upon the current request-load of the available server(s).
The user devices, computers and servers described herein may communicate via networks, including the Internet, wide area network (WAN), local area network (LAN), Wi-Fi®, other computer networks (now known or invented in the future), and/or any combination of the foregoing. It should be understood by those of ordinary skill in the art having the present specification, drawings, and claims before them that networks may connect the various components over any combination of wired and wireless conduits, including copper, fiber optic, microwaves, and other forms of radio frequency, electrical and/or optical communication techniques. It should also be understood that any network may be connected to any other network in a different manner. The interconnections between computers and servers in system are examples. Any device described herein may communicate with any other device via one or more networks.
The example embodiments may include additional devices and networks beyond those shown. Further, the functionality described as being performed by one device may be distributed and performed by two or more devices. Multiple devices may also be combined into a single device, which may perform the functionality of the combined devices.
The various participants and elements described herein may operate one or more computer apparatuses to facilitate the functions described herein. Any of the elements in the above-described Figures, including any servers, user devices, or databases, may use any suitable number of subsystems to facilitate the functions described herein.
Any of the software components or functions described in this application, may be implemented as software code or computer readable instructions that may be executed by at least one processor using any suitable computer language such as, for example, Java, C++, or Perl using, for example, conventional or object-oriented techniques.
The software code may be stored as a series of instructions or commands on a non-transitory computer readable medium, such as a random access memory (RAM), a read only memory (ROM), a magnetic medium such as a hard-drive or a floppy disk, or an optical medium such as a CD-ROM. Any such computer readable medium may reside on or within a single computational apparatus and may be present on or within different computational apparatuses within a system or network.
It may be understood that the present invention as described above may be implemented in the form of control logic using computer software in a modular or integrated manner. Based on the disclosure and teachings provided herein, a person of ordinary skill in the art may know and appreciate other ways and/or methods to implement the present invention using hardware, software, or a combination of hardware and software.
The above description is illustrative and is not restrictive. Many variations of embodiments may become apparent to those skilled in the art upon review of the disclosure. The scope embodiments should, therefore, be determined not with reference to the above description, but instead should be determined with reference to the pending claims along with their full scope or equivalents.
One or more features from any embodiment may be combined with one or more features of any other embodiment without departing from the scope embodiments. A recitation of “a”, “an” or “the” is intended to mean “one or more” unless specifically indicated to the contrary. Recitation of “and/or” is intended to represent the most inclusive sense of the term unless specifically indicated to the contrary.
One or more of the elements of the present system may be claimed as means for accomplishing a particular function. Where such means-plus-function elements are used to describe certain elements of a claimed system it may be understood by those of ordinary skill in the art having the present specification, figures and claims before them, that the corresponding structure includes a computer, processor, or microprocessor (as the case may be) programmed to perform the particularly recited function using functionality found in a computer after special programming and/or by implementing one or more algorithms to achieve the recited functionality as recited in the claims or steps described above. As would be understood by those of ordinary skill in the art that algorithm may be expressed within this disclosure as a mathematical formula, a flow chart, a narrative, and/or in any other manner that provides sufficient structure for those of ordinary skill in the art to implement the recited process and its equivalents.
While the present disclosure may be embodied in many different forms, the drawings and discussion are presented with the understanding that the present disclosure is an exemplification of the principles of one or more inventions and is not intended to limit any one embodiments to the embodiments illustrated.
The present disclosure provides a solution to the long-felt need described above. In particular, the systems and methods for handling large amount of input data files where the data structure or schema is not provided. Rather, only a metadata description file of the input files is provided. Embodiments may then apply the description file to dynamically generate, at run-time, necessary reader or writer engines to process the data within the input files. Hardcoded files/scripts may no longer be needed to be preloaded to the system before processing the input files.
Further advantages and modifications of the above described system and method may readily occur to those skilled in the art.
The disclosure, in its broader aspects, is therefore not limited to the specific details, representative system and methods, and illustrative examples shown and described above. Various modifications and variations may be made to the above specification without departing from the scope or spirit of the present disclosure, and it is intended that the present disclosure covers all such modifications and variations provided they come within the scope of the following claims and their equivalents.
