HEURISTIC ACCOUNT FRAUD DETECTION ENGINE
20230099100 · 2023-03-30
Inventors
- Elizabeth A. Flowers (Bloomington, IL, US)
- Puneit Dua (Bloomington, IL, US)
- Eric Balota (Bloomington, IL, US)
- Shanna L. Phillips (Bloomington, IL, US)
Cpc classification
G06Q20/042
PHYSICS
G06N3/006
PHYSICS
G06N5/01
PHYSICS
G06Q20/4016
PHYSICS
International classification
Abstract
A heuristic engine includes capabilities to collect an unstructured data set and detect instances of transaction fraud in a financial account. By providing a heuristic algorithm with unstructured transaction sets and indications of particular instances of transactions that correlate with past fraudulent activity allows prevention of future occurrences of fraud. Such heuristic algorithms may learn from past indications of fraudulent activity and improve accuracy of detection of future fraud detections.
Claims
1. A computer-implemented method, comprising: retrieving a transaction set comprising transaction data associated with a plurality of users, and an indication of fraudulent activity; receiving, from a user device, context data associated with a transaction by a user of the plurality of users; executing a heuristic algorithm to generate an account indication using the transaction set, the indication of fraudulent activity, and the context data; providing, based at least in part on the account indication, a request for additional context data associated with the transaction; receiving the additional context data from the user device and based on the request; and training the heuristic algorithm using the account indication and the additional context data.
2. The computer-implemented method of claim 1, wherein the fraudulent activity comprises an unauthorized withdrawal.
3. The computer-implemented method of claim 1, wherein the account indication corresponds to an unauthorized credit transaction.
4. The computer-implemented method of claim 1, wherein the transaction set further comprises one or more past transactions related to at least one account.
5. The computer-implemented method of claim 1, wherein the transaction set is stored in a memory, the memory comprising an external transaction server.
6. The computer-implemented method of claim 1, wherein the heuristic algorithm is stored in a memory, the memory comprising an external heuristic server.
7. The computer-implemented method of claim 1, further comprising updating the heuristic algorithm using the account indication
8. A computer system, the comprising at least one of one or more processors or one or more transceivers configured to: retrieve a transaction set comprising transaction data associated with a plurality of users and an indication of fraudulent activity; receive, from a user device, context data associated with a transaction by a user of the plurality of users; execute a heuristic algorithm to generate an account indication using the transaction set, the indication of fraudulent activity, and the context data; provide, based at least in part on the account indication, a request for additional context data associated with the transaction; receive the additional context data from the user device and based on the request; and train the heuristic algorithm using the account indication and the additional context data.
9. The computer system of claim 8, wherein the fraudulent activity comprises an unauthorized withdrawal.
10. The computer system of claim 8, wherein the fraudulent activity comprises an unauthorized credit transaction.
11. The computer system of claim 8, wherein the transaction set further comprises one or more past transactions related to at least one account.
12. The computer system of claim 8, wherein the transaction set is stored in a memory, the memory comprising an external transaction server.
13. The computer system of claim 8, wherein the heuristic algorithm is stored in memory, the memory comprising an external heuristic server.
14. A non-transitory computer readable medium, comprising computer readable instructions that, when executed, cause one or more processors to: retrieve, transaction data for a plurality of users and an indication of fraudulent activity; receive, from a user of the plurality of users via a human machine interface, context data associated with a transaction; execute a heuristic algorithm to generate an account indication of fraudulent activity using the transaction data and the context data; provide, based at least in part on the account indication, a request for the user to provide additional context data.
15. The non-transitory computer readable medium of claim 14, wherein the computer readable instructions, when executed, further cause the one or more processors to: receive the additional context data via the human machine interface; and train, the heuristic algorithm using the account indication and the additional context data.
16. The non-transitory computer readable medium of claim 15, wherein training the heuristic algorithm further comprises using the context data.
17. The non-transitory computer readable medium of claim 15, wherein the computer readable instructions, when executed, further cause the one or more processors to: update the heuristic algorithm using the account indication.
18. The non-transitory computer readable medium of claim 14, wherein the fraudulent activity comprises an unauthorized credit transaction.
19. The non-transitory computer readable medium of claim 14, wherein the transaction data further comprises one or more past transactions related to at least one account.
20. The non-transitory computer readable medium of claim 14, wherein the fraudulent activity comprises an unauthorized withdrawal.
Description
BRIEF DESCRIPTION OF THE DRAWINGS
[0014] The Figures described below depict various aspects of the system and methods disclosed herein. It should be understood that each figure depicts an aspect of a particular aspect of the disclosed system and methods, and that each of the Figures is intended to accord with a possible aspect thereof. Further, wherever possible, the following description refers to the reference numerals included in the following Figures, in which features depicted in multiple Figures are designated with consistent reference numerals.
[0015] There are shown in the Figures arrangements which are presently discussed, it being understood, however, that the present embodiments are not limited to the precise arrangements and instrumentalities shown, wherein:
[0016]
[0017]
[0018]
[0019]
[0020]
[0021]
[0022]
[0023]
[0024]
[0025]
[0026] The Figures depict preferred embodiments for purposes of illustration only. Alternative embodiments of the systems and methods illustrated herein may be employed without departing from the principles of the invention described herein.
DETAILED DESCRIPTION
[0027] Various embodiments of the present disclosure include the collection of unstructured data sets together with a current context. Heuristic algorithms processing these unstructured data sets together the context may allow calculation of a future context, and the presentation of context relevant data that improves over time. By subsequently training the heuristic algorithm with the outcome of a current and future predicted context, and the relevance of presented data, the heuristic algorithm may improve its efficiency as the unstructured data set grows.
[0028] Although the following text sets forth a detailed description of numerous different embodiments, it should be understood that the legal scope of the description is defined by the words of the claims set forth at the end of this patent and equivalents. The detailed description is to be construed as exemplary only and does not describe every possible embodiment since describing every possible embodiment would be impractical. Numerous alternative embodiments may be implemented, using either current technology or technology developed after the filing date of this patent, which would still fall within the scope of the claims.
Identity Authentication
[0029]
[0030] The human-machine interface 115 may encode the customer 105 and representative 130 interactions with the respective user terminals 110 and service terminal 135 to encode a context in an electronic format, such that a processor 125 reads the context. The processor 125 may in one embodiment include a single processor, or in another embodiment include a variety of interconnected processors that operate in concert to efficiently perform tasks in parallel. The processor 125 may, in one embodiment, interface to a heuristic server 140, and a transaction server 145, storing respectively, a heuristic algorithm and a set of transaction data. In other embodiments, the heuristic algorithm and/or transaction data may reside on the same server.
[0031] The computer processor 125 includes an interface to a network interface 117, that may in one embodiment include wired and wireless interfaces to allow communication over any variety of computer networks communicating over a variety of mediums. One such embodiment includes an interface to a network 150, for example a wide-area network such as the Internet, that interconnects any number of computing devices, for example a remote transaction and/or heuristic server 155, over wired or wireless networks, or over one or more radio frequency links or wireless or digital communication channels. In another embodiment, the network 150 may comprise a local-area network with access controls to a specific entity, such as a business.
[0032] In one embodiment, a heuristic engine 120, may comprise the human-machine interface 115, computer processor 125, and network interface 117. However, in other embodiments the heuristic engine 120 may include other digital and analog interface devices, memory devices, and supplemental processing devices for performing calculations and storing data.
[0033] In accordance with one aspect of the present disclosure, the system 100 may perform the method 200, as illustrated in
[0034] In one embodiment, a customer, for example the customer 105 of
[0035] At step 240, in one embodiment, the processor 125 may generate further questions and expected answers, for example using the heuristic algorithm, using the available data. A customer service representative, such as the representative 130 of
Money Laundering Detection
[0036]
[0037] The customer may in one embodiment communicate using the mobile device 310 through any of a variety of wireless communication protocols 315 using a wireless access point 320 that implements such protocols and translates communications into a computer readable format. The wireless access point 320 may connect to a network 325, for example the Internet or a corporate intranet, that likewise interfaces to a remote server 330 and a service terminal 335 accessible to a customer service representative 345, such as via wireless communication or data transmission over one or more radio frequency links, or wireless or digital communication channels.
[0038] In one exemplary embodiment, a heuristic engine 355 may include a network interface 350 that communicatively couples to the network 325, and a computer processor 360. In other embodiments, the heuristic engine 355 may include a variety of memory devices, interface devices, and processing devices, to execute required functions. The network interface 350 may include interfaces to a database server 365 and a service terminal 380 used by a customer service representative 385. The computer processor 360 may communicatively couple to a heuristic server 370 and transaction server 375.
[0039] In accordance with one aspect of the present disclosure, the system 300 may perform the method 400, as illustrated in
[0040] Method 400 may include a regulatory authority demanding an audit report related to money laundering activity on a particular account (block 405). In one embodiment, a user, such as the user 305 from
[0041] The processor 360 may execute the algorithm with the retrieved transaction set and the indication of money laundering activity (block 430). In one exemplary embodiment, the processor 360 may generate an audit report for a regulatory authority. The processor 360 may update the algorithm stored in the heuristic server 370 (block 440), for example using the indication and additional transactions identified as comprising money laundering activity.
Document Verification
[0042]
[0043] In accordance with one aspect of the present disclosure, the system 500 may perform the computer-implemented method 600, as illustrated in
[0044] Method 600 may include, in one embodiment, a customer such as the user 505 of
[0045] A service representative 555 may determine if fraud exists (block 635), and the processor may calculate a correlation between the probability of fraud and an actual fraud detection (block 640). The processor 530 may update the algorithm stored in the heuristic server 550 with the calculated correlation (block 645).
Fraud Detection
[0046]
[0047] In accordance with one aspect of the present disclosure, the system 700 may perform the computer-implemented method 800, as illustrated in
[0048] The method 800 includes a user, for example the user 705 of
[0049] In one embodiment, the processor 730 may execute the algorithm with the aggregated transactions and a current context. The processor 730 may generate a probability of fraudulent activity in a current context (block 830). In another embodiment, the service representative 750 may prompt the customer 705 for additional context, for example related to the transaction being processed. The processor 730 may update the heuristic algorithm stored in the heuristic server 750 with the probability (block 840), the current context, and any additional context available.
[0050]
[0051] Data bus 940 includes interfaces to a graphics interface 945 that may in some embodiments process and transmit graphical data for a user on a display or similar devices. Likewise, data bus 940 includes interfaces for a digital I/O interface that processes and transmits, for example, keyboard, pointing device, and other digital and analog signals produced and consumed by users or other machines. A network interface 955 processes and transmits encoded information over wired and wireless networks to connect the system 900 to other machines and users. Data bus 940 also includes at least one interface to a non-volatile memory interface, that may process and transmit data that resides on non-volatile memory devices.
[0052]
Machine Learning and Other Matters
[0053] In certain embodiments, the heuristic engine and algorithms discussed herein may include machine learning, cognitive learning, deep learning, combined learning, and/or pattern recognition techniques. For instance, a processor or a processing element may be trained using supervised or unsupervised machine learning, and the machine learning program may employ a neural network, which may be a convolutional neural network, a deep learning neural network, or a combined learning module or program that learns in two or more fields or areas of interest. Machine learning may involve identifying and recognizing patterns in existing data in order to facilitate making predictions for subsequent data. Models may be created based upon example inputs in order to make valid and reliable predictions for novel inputs.
[0054] Additionally or alternatively, the machine learning programs may be trained by inputting sample data sets or certain data into the programs, such as image, mobile device, insurer database, and/or third-party database data. The machine learning programs may utilize deep learning algorithms that may be primarily focused on pattern recognition, and may be trained after processing multiple examples. The machine learning programs may include Bayesian program learning (BPL), voice recognition and synthesis, image or object recognition, optical character recognition, and/or natural language processing—either individually or in combination. The machine learning programs may also include natural language processing, semantic analysis, automatic reasoning, and/or machine learning.
[0055] In supervised machine learning, a processing element may be provided with example inputs and their associated outputs, and may seek to discover a general rule that maps inputs to outputs, so that when subsequent novel inputs are provided the processing element may, based upon the discovered rule, accurately predict the correct output. In unsupervised machine learning, the processing element may be required to find its own structure in unlabeled example inputs. In one embodiment, machine learning techniques may be used to extract the relevant data for one or more tokenized icons from user device details, user request or login details, user device sensors, geolocation information, image data, the insurer database, a third-party database, and/or other data.
[0056] In one embodiment, a processing element (and/or heuristic engine or algorithm discussed herein) may be trained by providing it with a large sample of images and/or user data with known characteristics or features. Based upon these analyses, the processing element may learn how to identify characteristics and patterns that may then be applied to analyzing user device details, user request or login details, user device sensors, geolocation information, image data, the insurer database, a third-party database, and/or other data. For example, the processing element may learn, with the user's permission or affirmative consent, to identify the user and/or the asset that is to be the subject of a transaction, such as generating an insurance quote or claim, opening a financial account, handling a loan or credit application, processing a financial (such as a credit card) transaction or the like.
Additional Considerations
[0057] All of the foregoing computer systems may include additional, less, or alternate functionality, including that discussed herein. All of the computer-implemented methods may include additional, less, or alternate actions, including those discussed herein, and may be implemented via one or more local or remote processors and/or transceivers, and/or via computer-executable instructions stored on computer-readable media or medium.
[0058] The processors, transceivers, mobile devices, service terminals, servers, remote servers, database servers, heuristic servers, transaction servers, and/or other computing devices discussed herein may communicate with each via wireless communication networks or electronic communication networks. For instance, the communication between computing devices may be wireless communication or data transmission over one or more radio links, or wireless or digital communication channels.
[0059] Customers may opt into a program that allows them share mobile device and/or customer, with their permission or affirmative consent, with a service provider remote server. In return, the service provider remote server may provide the functionality discussed herein, including security, fraud, or other monitoring, and generate recommendations to the customer and/or generate alerts for the customers in response to abnormal activity being detected.
[0060] The following additional considerations apply to the foregoing discussion. Throughout this specification, plural instances may implement components, operations, or structures described as a single instance. Although individual operations of one or more methods are illustrated and described as separate operations, one or more of the individual operations may be performed concurrently, and nothing requires that the operations be performed in the order illustrated. Structures and functionality presented as separate components in example configurations may be implemented as a combined structure or component. Similarly, structures and functionality presented as a single component may be implemented as separate components. These and other variations, modifications, additions, and improvements fall within the scope of the subject matter herein.
[0061] Additionally, certain embodiments are described herein as including logic or a number of routines, subroutines, applications, or instructions. These may constitute either software (e.g., code embodied on a machine-readable medium or in a transmission signal) or hardware. In hardware, the routines, etc., are tangible units capable of performing certain operations and may be configured or arranged in a certain manner. In example embodiments, one or more computer systems (e.g., a standalone, client or server computer system) or one or more hardware modules of a computer system (e.g., a processor or a group of processors) may be configured by software (e.g., an application or application portion) as a hardware module that operates to perform certain operations as described herein.
[0062] In various embodiments, a hardware module may be implemented mechanically or electronically. For example, a hardware module may comprise dedicated circuitry or logic that is permanently configured (e.g., as a special-purpose processor, such as a field programmable gate array (FPGA) or an application-specific integrated circuit (ASIC)) to perform certain operations. A hardware module may also comprise programmable logic or circuitry (e.g., as encompassed within a general-purpose processor or other programmable processor) that is temporarily configured by software to perform certain operations. It will be appreciated that the decision to implement a hardware module mechanically, in dedicated and permanently configured circuitry, or in temporarily configured circuitry (e.g., configured by software) may be driven by cost and time considerations.
[0063] Accordingly, the term “hardware module” should be understood to encompass a tangible entity, be that an entity that is physically constructed, permanently configured (e.g., hardwired), or temporarily configured (e.g., programmed) to operate in a certain manner or to perform certain operations described herein. Considering embodiments in which hardware modules are temporarily configured (e.g., programmed), each of the hardware modules need not be configured or instantiated at any one instance in time. For example, where the hardware modules comprise a general-purpose processor configured using software, the general-purpose processor may be configured as respective different hardware modules at different times. Software may accordingly configure a processor, for example, to constitute a particular hardware module at one instance of time and to constitute a different hardware module at a different instance of time.
[0064] Hardware modules may provide information to, and receive information from, other hardware modules. Accordingly, the described hardware modules may be regarded as being communicatively coupled. Where multiple of such hardware modules exist contemporaneously, communications may be achieved through signal transmission (e.g., over appropriate circuits and buses) that connect the hardware modules. In embodiments in which multiple hardware modules are configured or instantiated at different times, communications between such hardware modules may be achieved, for example, through the storage and retrieval of information in memory structures to which the multiple hardware modules have access. For example, one hardware module may perform an operation and store the output of that operation in a memory device to which it is communicatively coupled. A further hardware module may then, at a later time, access the memory device to retrieve and process the stored output. Hardware modules may also initiate communications with input or output devices, and may operate on a resource (e.g., a collection of information).
[0065] The various operations of example methods described herein may be performed, at least partially, by one or more processors that are temporarily configured (e.g., by software) or permanently configured to perform the relevant operations. Whether temporarily or permanently configured, such processors may constitute processor-implemented modules that operate to perform one or more operations or functions. The modules referred to herein may, in some example embodiments, comprise processor-implemented modules.
[0066] Similarly, the methods or routines described herein may be at least partially processor-implemented. For example, at least some of the operations of a method may be performed by one or more processors or processor-implemented hardware modules. The performance of certain of the operations may be distributed among the one or more processors, not only residing within a single machine, but deployed across a number of machines. In some example embodiments, the processor or processors may be located in a single location (e.g., within a home environment, an office environment or as a server farm), while in other embodiments the processors may be distributed across a number of locations.
[0067] The performance of certain of the operations may be distributed among the one or more processors, not only residing within a single machine, but deployed across a number of machines. In some example embodiments, the one or more processors or processor-implemented modules may be located in a single geographic location (e.g., within a home environment, an office environment, or a server farm). In other example embodiments, the one or more processors or processor-implemented modules may be distributed across a number of geographic locations.
[0068] Unless specifically stated otherwise, discussions herein using words such as “processing,” “computing,” “calculating,” “determining,” “presenting,” “displaying,” or the like may refer to actions or processes of a machine (e.g., a computer) that manipulates or transforms data represented as physical (e.g., electronic, magnetic, or optical) quantities within one or more memories (e.g., volatile memory, non-volatile memory, or a combination thereof), registers, or other machine components that receive, store, transmit, or display information.
[0069] As used herein any reference to “one embodiment” or “an embodiment” means that a particular element, feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. The appearances of the phrase “in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment.
[0070] Some embodiments may be described using the expression “coupled” and “connected” along with their derivatives. For example, some embodiments may be described using the term “coupled” to indicate that two or more elements are in direct physical or electrical contact. The term “coupled,” however, may also mean that two or more elements are not in direct contact with each other, but yet still co-operate or interact with each other. The embodiments are not limited in this context.
[0071] As used herein, the terms “comprises,” “comprising,” “includes,” “including,” “has,” “having” or any other variation thereof, are intended to cover a non-exclusive inclusion. For example, a process, method, article, or apparatus that comprises a list of elements is not necessarily limited to only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Further, unless expressly stated to the contrary, “or” refers to an inclusive or and not to an exclusive or. For example, a condition A or B is satisfied by any one of the following: A is true (or present) and B is false (or not present), A is false (or not present) and B is true (or present), and both A and B are true (or present).
[0072] In addition, use of the “a” or “an” are employed to describe elements and components of the embodiments herein. This is done merely for convenience and to give a general sense of the description. This description, and the claims that follow, should be read to include one or at least one and the singular also includes the plural unless it is obvious that it is meant otherwise.
[0073] The patent claims at the end of this patent application are not intended to be construed under 35 U.S.C. § 112(f) unless traditional means-plus-function language is expressly recited, such as “means for” or “step for” language being explicitly recited in the claim(s).
[0074] The systems and methods described herein are directed to improvements to computer functionality, and improve the functioning of conventional computers.
[0075] This detailed description is to be construed as exemplary only and does not describe every possible embodiment, as describing every possible embodiment would be impractical, if not impossible. One may be implement numerous alternate embodiments, using either current technology or technology developed after the filing date of this application.