User interface for fraud alert management

Abstract

A user interface for a fraud detection application includes a visual display; a plurality of panes displayed on the visual display, each pane including an identifier corresponding to a communication received; a graphical representation of a threat risk associated with the identifier; a numeric score associated with the threat risk, wherein the numeric score is a weighted score based on a plurality of predetermined factors updated substantially continuously. The graphical representation may include a status bar indicative of a threat risk associated with the identifier, the threat risk provided by the fraud detection algorithm and based on a weighted score. Each pane may include additional information about the identifier, such as a number of accounts accessed or attempted to be accessed associated with the identifier; a number of days the identifier has been active; a type of channel associated with the identifier; and a number of communications initiated by the identifier over a predetermined period of time. A user may access further information by activating a portion of the visual display to access additional information related to the threat risk. The communication may be a phone call, a chat, a web interaction or the like.

Description

BACKGROUND OF THE INVENTION

Field of the Invention

Embodiments of the present invention relate to a graphical user interface, specifically a graphical user interface and information provided thereby for use in fraud alert management.

Background

According to the Identity Theft Resource Center, there were 781 tracked data breaches in 2015 where consumer data was stolen. There are many more breaches that go undetected or unreported. 338 of these breaches resulted in over 164 million social security numbers being stolen. Social security numbers are much more valuable to a fraudster than a credit card number. Credit card accounts can be closed, but social security numbers provide an ongoing opportunity for fraudulent activity. In 2016 the number of breaches increased to 1,091 and there have already been over 1,000 in 2017 including the Equifax breach where 143M social security numbers were compromised. According to Javelin, losses attributable to identity theft topped $16B.

Fraudsters take the stolen data and systematically attack the consumer, enterprises and government entities through the contact center and particularly the associated interactive voice response (IVR) system, the self-service channel. The IVR provides the means for a fraudster to access account information in anonymity without facing any interrogation by an agent.

In a 2016 Aite Group study, 78% of financial services executives indicated that fraud in the contact center is on the increase. 17% of financial services executives indicated that they did not know, likely because they do not have the processes in place to identify the fraud in the call center, let alone prevent it. Account Takeover (ATO) fraud accounts for 28% of all identity theft fraud in financial services and has a 10% compound annual growth rate (CAGR). Fraudulent activity is so prevalent in the contact center and IVR that Aite says, “Account Takeover is so commonly enabled in the contact center that it should be renamed the cross-channel fraud enablement channel.”

Accordingly, there is a need for systems to help detect and prevent fraud, particularly fraud via IVR systems.

BRIEF SUMMARY OF THE INVENTION

Accordingly, the present invention is directed to a user interface for fraud alert management that obviates one or more of the problems due to limitations and disadvantages of the related art.

In accordance with the purpose(s) of this invention, as embodied and broadly described herein, this invention, in one aspect, relates to a user interface for a fraud detection application, the user interface comprising: a visual display; a plurality of panes displayed on the visual display, each pane including: an identifier corresponding to a communication received; a graphical representation of a threat risk associated with the identifier; a numeric score associated with the threat risk, wherein the numeric score is a weighted score based on a plurality of predetermined factors updated substantially continuously.

Additional advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. The advantages of the invention will be realized and attained by means of the elements and combinations particularly pointed out in the appended claims. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention, as claimed.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention as claimed.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying figures, which are incorporated herein and form part of the specification, illustrate examples of user interface for fraud alert management. Together with the description, the figures further serve to explain the principles of a user interface for fraud alert management described herein and thereby enable a person skilled in the pertinent art to make and use the user interface for fraud alert management.

FIG. 1 is an exemplary initial view of a user interface for list management.

FIG. 2 is an exemplary initial view of a user interface according to principles described herein illustrating exemplary alerts.

FIG. 3 is an exemplary initial view of a user interface for sorting according to status of an alert.

FIG. 4 is an exemplary individual pane associated with a single caller or phone number.

FIG. 5 is an exemplary view of additional information available associated with a caller or phone number.

FIG. 6 further illustrates event details that may be available to an analyst.

DETAILED DESCRIPTION

Reference will now be made in detail to embodiments of the user interface for fraud alert management with reference to the accompanying figures, in which like reference numerals indicate like elements.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention. Thus, it is intended that the present invention cover the modifications and variations of this invention provided they come within the scope of the appended claims and their equivalents.

According to principles described herein, a user interface for fraud alert management provides a visual representation and integrated functionality to a user. Typically, the user would be a fraud analyst. Often, such analysts are tasked with evaluating the risk level of a caller or phone number.

In the process of identifying of whether a particular caller or phone number (ANI) 18 represents a risk requiring further investigation, information about a call would be received from the IVR. The present system uses rules based and a learning system (artificial intelligence) to process and continually update information presented in a usable fashion to the analyst via the user interface.

As illustrated in FIG. 1, an initial view of the user interface shows information important to the analyst for determining whether the caller or phone number represents a threat. Each “pane” 10 in the window 14 corresponds to a caller or phone numbers 18 associated with recent calls to the IVR.

FIG. 2 is an exemplary initial view of a user interface according to principles described herein illustrating exemplary alerts. As illustrated, information most import to a fraud analyst may be presented “by default” (e.g., new Fraud Alerts). As shown, the side bar 22 on the left provides quick navigation to remaining options (e.g, menu buttons 26 reveal/hide the side bar 22 and further sorting or functionality). E.g., selecting the arrows expands or hides sub-menus 30.

As shown in FIGS. 2 and 3, a menu of available screens, which may represent filters or sorting of the information, may be provided. In the example of FIG. 3, “Alerts” and “List Management” are provided as upper level screens, but the upper level screen access may be provided in another form that would be useful depending on the work flow of the analyst and the fraud review team. As further illustrated in this example, “alerts” may be further broken down into new, under review, and reviewed. In this example, “new” refers to potential fraud that has been recently detected (or evaluated based on the caller or phone number), “under review” refers to alerts that have been seen by an analyst and are in the process of determining whether fraudulent activity has occurred; and “reviewed” indicates that the analysis has been completed. A reviewed ANI can be placed on a blacklist if it is confirmed to be fraudulent, on a whitelist if the number is associated as a test number or an enterprise number, and kept in a monitoring state if there was no fraudulent activity detected. The screens/sort may further indicate disposition or referral of the incident, caller or phone number 18 to other fraud related activities or downstream analysts or functions, such as customer alerts, or closing of the incident. The screen may indicate age of the call, analyst assigned, risk level, under review, reviewed, closed, disposition, etc. A single analyst may see only his or her own assigned incidents or may be authorized or able to see system-wide calls. In the example of FIG. 2, the side bar menu 22 may include a category “Monitoring”, which indicates an analyst has completed review and is monitoring for additional activity.

As shown in FIG. 4, each caller or phone number (ANI) 18 is provided in a single “pane” 10 as an alert summary in the user interface along with a plurality associated information. As illustrated in FIG. 4, the pane 10 may include channel information 34 such as whether access to the IVR is made by phone or other means (e.g., chat, web, email, etc.) For the purposes of the illustration in FIG. 4, the description refers to phone calls. The alert summary may include a score 38 and threat level. For example, a numerical score 38 may be provided where the score is associated with the caller or phone number 18. As illustrated in FIG. 3 in particular, the exemplary score 38 is 65 on a scale of 1-100. The score 38 may take into account a variety of information, including, but not limited to behavior data (e.g., what a caller does in a call; behavior patterns), telecommunications data (e.g. the carrier, whether the phone number is a working number, landline versus cellular, fixed or non-fixed VOIP, etc.) and reputation/history data (e.g., reputation/history indicates how long has this number been active and how does their current behavior compare to past behavior. A Blacklist would indicate that the number had previously been used in fraud). Spoof risk 42 is a separate score visible in the UI as the last icon on each high level tile.

Each of these information sources may be taken into account individually or in combination to provide a total weighted aggregate score 38. Thresholds may be set to indicate whether the numerical score is indicative of the caller or phone number 18 being a high fraud risk, an elevated fraud risk, a low level threat or not considered a threat.

Further, a graphical bar 46 may be provided to illustrate at a glance the level of risk associated with the caller or phone number 18. As illustrated in FIG. 4, an exemplary status bar 46 is broken into three sections, which may be selectively illuminated based on the level of risk as indicated by the associated score thresholds. For example, as illustrated in the first pane 10 of FIG. 1, the exemplary caller has a risk score of 96, which is considered “high risk”, so that all three portions of the status bar 46 are illuminated. Referring again to FIGS. 1 and 2, a score of 65 or 43 is considered elevated risk, such that only two portions of the status bar are illuminated; a score of 28 is considered a low-level threat, such that only one portion of the status bar is illuminated. Although not shown, a numeric score of less than, e.g., 20, would be indicative of no threat, and thus no portions of the status bar would be illuminated. That is, in this exemplary embodiment, the visual representation of the threat risk presented to the analyst is broken down as follows: High Threat: 3 bars; Elevated Threat: 2 bars; Low Threat: 1 bar; No Threat: 0 bars (if used).

The single pane 10 may also include other information relevant to the fraud assessment for an analyst, including but not limited to channel information 34 such as, for phone calls: Phone number, carrier, and line type, and for other channel types, an indication of the channel by which the IVR is accessed, such as chat, web, email, etc. The pane 10 may further include a line risk indicator 50 (carrier/line correlation with fraudulent activity); events 54 (number of times application has been accessed via specified channel identifier); accounts 58 (different Accounts accessed via specified channel identifier); user active duration 62 (days user has accessed the system via the indicated channel); spoof risk 42 (level of threat that channel identifier has been spoofed); and a button 66 for access to detailed information about the alert, as shown, for example in FIG. 5. FIG. 6 further illustrates event details such as score and threat level; channel information; score report (which may be the same data as shown on Summary card); state management; Select new status from menu, then Save button to update; Score History. The chart further illustrates a risk score for channel identifier over time; Events and additional details for each event where the channel identifier accessed the application. As shown n FIG. 6, the Alert Details may provide a hyperlink labeled Transfer Success. This hyperlink pulls up the voice recording of the agent/caller interaction enabling the fraud analyst to easily combine activity and scoring from the IVR with the agent interaction to have a holistic view of the interaction.

While the information is organized in a particular way in the embodiment of FIG. 4, the exact layout of the user interface is not so limited. The information provided to the analyst in the alert summary may include, but is not limited to, the number of accounts accessed or attempted to be accessed by the caller or phone number 18, active duration such as the number of days a user has accessed the system via the channel (e.g., phone number 18), a risk of whether the phone number is a spoofed number, the number of calls for the caller or phone number 18 in a defined time period. The time period may be a rolling time period or a specified fixed time period. The pane 10 may also include an alert, which may be an activatable virtual button to that leads to further information or background information relevant to the fraud risk evaluation, as illustrated in FIG. 5. Such further information may include historical data or scores over a predetermine period of time, etc.

The system may include the capability to set up user profiles to define the scope of accessibility that a user is allowed. Example user profiles may include “super user” who can access any area for any customer; “admin” who has access to set up other users within a customer domain; “manager/supervisor” who has access to customer specific data; and “analyst” who has access to limited areas within the customer domain.

A “management view” may also be provided, where the management view may access to KPIs (key performance indicators) related to the fraud detection, alerts, analyst performance and overall system functionality. The management view provides additional insight into the workflow aspect of a fraud event providing high level and detailed information into when an alert was initiated, current status of an alert, the final disposition of the alert including timelines and the analyst who worked the alert.

During an IVR call or communication, the associated caller or the phone number is scored on a scale of 1 to 99 and if the score exceeds a certain level defined by business rules it may trigger an alert and be referred to a fraud specialist to determine whether the caller presents a fraud risk, require additional stepped up authentication, trigger automated changes to the IVR callflow to change the access allowed to the caller or other dispositions based on business rules. Scores are determined by the analysis of behavioral data, telecom data and known history of a caller and account activity. Behavioral data may include: ANI velocity, account velocity, transfer velocity, call duration, goal attempt and completion, exit point, authentication methods and success/failure, application specific data (card REPIN, PIN probing, payments, bank transfers, access of closed or blocked cards, time of day. Telecom data may include: the line type (e.g., landline, cellular, fixed VOIP or non-fixed VOIP); whether there is a caller ID associated with the phone number or whether it is anonymous, is ANI actually in service, is the cell phone a prepaid cell phone, date number was last ported, spoof risk and geolocation. The history component looks at the account being accessed, previous access to this account, checks for ANI on blacklist and/or account on watchlist. This list is not exhaustive and may adapt over time.

The present disclosure provides a user interface for the fraud analyst to managed numerous alerts, e.g., by being able to take in a significant amount of information visually, organize that information, and obtain additional details as needed via the user interface.

When a call is received by the IVR, it is designated “new” and a pane 10 created on a fraud analyst's screen. The ANI (phone number) will only appear on the analyst screen if it is scored at a level to exceed a threshold to appear on the screen. The analyst may see many panes related to multiple callers/phone numbers at one time. The status bar offers a visual cue for the analyst to designate callers/phone numbers with low fraud risk as closed or otherwise change their status, while devoting attention to callers/phone numbers with a higher risk or moderate risk. The analyst may click on any of the links provided in a pane 10 associated with a particular caller/phone number and assess the underlying data available to determine disposition of the particular caller/phone number. Once the fraud analyst has determined disposition of the caller/phone number and the incident is may be passed to another analyst for more investigation or closed, such that the pane 10 can be removed from the view the analyst sees.

In addition to the features described above, the system may include authentication and authorization such that the system is secure and accessible only to registered users. The system can be configured so that each analyst only sees an application list specific to each analyst, e.g, only those incidents assigned to them or that they are allowed to work. A manager or administrator can modify these settings, e.g., granting or changing authorizations, assignments or access.

While various embodiments of the present invention have been described above, it should be understood that they have been presented by way of example only, and not limitation. It will be apparent to persons skilled in the relevant art that various changes in form and detail can be made therein without departing from the spirit and scope of the present invention. Thus, the breadth and scope of the present invention should not be limited by any of the above-described exemplary embodiments but should be defined only in accordance with the following claims and their equivalents.

Claims

1. A system for fraud detection for a call center system, the system comprising: a processor; anda visual display in communication with the processor, the processor causing the visual display to presenta plurality of panes displayed on the visual display, each pane including: an identifier corresponding to a communication received;a graphical representation of a threat risk associated with the identifier;a numeric score associated with the threat risk, wherein the numeric score is a weighted score based on a plurality of predetermined factors updated substantially continuously.

2. The system of claim 1, wherein the graphical representation includes: a status bar indicative of a threat risk associated with the identifier, the threat risk provided by the fraud detection algorithm and based on a weighted score.

3. The system of claim 2, wherein the communication is one of a phone call, a chat and a web interaction.

4. The system of claim 1, wherein each pane includes additional information about the identifier.

5. The system of claim 4, wherein the communication is one of a phone call, a chat and a web interaction.

6. The system of claim 1, wherein the additional information includes: a number of accounts accessed or attempted to be accessed associated with the identifier;a number of days the identifier has been active;a type of channel associated with the identifier; anda number of communications initiated by the identifier over a predetermined period of time;wherein a user may access further information by activating a portion of the visual display to access additional information related to the threat risk.

7. The system of claim 6, wherein the communication is one of a phone call, a chat and a web interaction.

8. The system of claim 1, wherein the communication is one of a phone call, a chat and a web interaction.

9. A non-transitory computer readable medium having stored thereon program instructions that, when executed by a processing system direct the processing system to: display a plurality of graphical panes on a visual display, a plurality of panes displayed on the visual display;cause each pane to display an identifier corresponding to a communication received, a graphical representation of a threat risk associated with the identifier; and a numeric score associated with the threat risk, wherein the numeric score is a weighted score based on a plurality of predetermined factors; andupdate the graphic representation of the threat risk and the numeric scores displayed substantially continuously.

10. The non-transitory computer readable medium of claim 9, wherein the program instructions, when executed by a processing system further direct the processing system to display a status bar indicative of a threat risk associated with the identifier, the threat risk provided by the fraud detection algorithm and based on a weighted score.

11. The non-transitory computer readable medium of claim 9, wherein the program instructions, when executed by the processing system, further direct the processing system to cause each pane to display additional information about the identifier.

12. The non-transitory computer readable medium of claim 11, wherein the additional information includes a number of accounts accessed or attempted to be accessed associated with the identifier;a number of days the identifier has been active;a type of channel associated with the identifier; anda number of communications initiated by the identifier over a predetermined period of time;wherein a user may access further information by activating a portion of the visual display to access additional information related to the threat risk.

13. The non-transitory computer readable medium of claim 9, wherein the communication is one of a phone call, a chat and a web interaction.

14. A method of presenting information to a user of a fraud detection application in a call center, the method comprising: displaying a plurality of graphical panes on a visual display, a plurality of panes displayed on the visual display;causing each pane to display an identifier corresponding to a communication received, a graphical representation of a threat risk associated with the identifier; and a numeric score associated with the threat risk, wherein the numeric score is a weighted score based on a plurality of predetermined factors; andupdating the graphic representation of the threat risk and the numeric scores displayed substantially continuously.

15. The method of claim 14, further comprising display in each pane on the visual display a status bar indicative of a threat risk associated with the identifier, the threat risk provided by the fraud detection algorithm and based on a weighted score.

16. The method of claim 14, further comprising causing each pane to display additional information about the identifier.

17. The method of claim 16, wherein the additional information includes: a number of accounts accessed or attempted to be accessed associated with the identifier;a number of days the identifier has been active;a type of channel associated with the identifier; anda number of communications initiated by the identifier over a predetermined period of time;wherein a user may access further information by activating a portion of the visual display to access additional information related to the threat risk.

18. The method of claim 14, wherein the communication is one of a phone call, a chat and a web interaction.