EP1340178A4 - Method and apparatus for evaluating fraud risk in an electronic commerce transaction - Google Patents
Method and apparatus for evaluating fraud risk in an electronic commerce transactionInfo
- Publication number
- EP1340178A4 EP1340178A4 EP01989824A EP01989824A EP1340178A4 EP 1340178 A4 EP1340178 A4 EP 1340178A4 EP 01989824 A EP01989824 A EP 01989824A EP 01989824 A EP01989824 A EP 01989824A EP 1340178 A4 EP1340178 A4 EP 1340178A4
- Authority
- EP
- European Patent Office
- Prior art keywords
- value
- transaction
- transaction information
- fraud risk
- determining
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Ceased
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
- G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/403—Solvency checks
- G06Q20/4037—Remote solvency checks
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07F—COIN-FREED OR LIKE APPARATUS
- G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
- G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
Definitions
- the present invention generally relates to electronic commerce transaction processing.
- the invention relates more specifically to a method and apparatus for evaluating fraud risk in an electromc commerce transaction.
- Credit card transactions are being utilized in a variety of environments, h a typical environment a customer, purchaser or other user provides a merchant with a credit card, and the merchant through various means will verify whether that information is accurate.
- credit card authorization is used.
- credit card authorization involves contacting the issuer of the credit card or its agent, typically a bank or a national credit card association, and receiving information about whether or not funds are available for payment and whether or not the card number is valid. If the card has not been reported stolen and funds are available, the transaction is authorized.
- a typical credit card verification system 10 is shown.
- a merchant 12 receives a credit card from the customer 14.
- the merchant then verifies the credit card information through an automated address verification system ("AVS") 16.
- AVS automated address verification system
- These systems work well in a credit card transaction in which either the customer has a face-to-face meeting with the merchant or the merchant is actually shipping a package or the like to the address of a customer.
- the verification procedure typically includes receiving at the AVS system address information and identity information.
- AVS is currently beneficial for supporting the screening of purchases made by credit card customers of certain banks in the United States.
- the bank that issues a credit card from either of the two major brands (Visa or MasterCard) opts whether or not to support the AVS system.
- the AVS check designed to support mail order and telephone order businesses, is usually ran in conjunction with the bank card authorization, request.
- AVS performs an additional check, beyond verifying funds and credit card status, to ensure that elements of the address supplied by the purchaser match those on record with the issuing bank.
- the merchant can receive the following responses:
- AVS MATCH — The first four numeric digits of the street address, and the first five numeric digits of the ZIP code, and credit card number match those on record at the bank.
- AVS PARTIAL MATCH — There is a partial match (e.g., street matches but not ZIP code, or ZIP code matches but not street).
- AVS UNAVAILABLE — The system cannot provide a response. This result is returned if the system is down, or the bank card issuer does not support AVS, or the bank card issuer for the credit card used to purchase does not reside in the United States.
- AVS NON-MATCH — There is no match between either the address or ZIP data elements.
- merchants have augmented card authorization and AVS results with additional screening procedures and systems.
- One such additional procedure is to manually screen orders. While this approach is somewhat effective when order volume is low, the approach is inefficient and adds operating overhead that cannot scale with the business.
- Electronic commerce or online commerce is a rapidly expanding field of retail and business-to-business commerce.
- a buyer or purchaser normally acquires tangible goods or digital goods or services from a merchant or the merchant's agent, in exchange for value that is transferred from the purchaser to the merchant.
- Electronic commerce over a public network such as the Internet offers an equal or greater business opportunity than conventional, brick-and-rnortar business, but requires special precautions to ensure safe business operations.
- the technological foundation that makes e-shopping compelling — e.g., unconstrained store access, anonymity, shopping speed, and convenience — also provides new ways for thieves to commit credit card fraud.
- address and identity information are not enough to confidently verify that the customer who is purchasing the goods is actually the owner of the credit card.
- an individual may have both the name and the address of a particular credit card holder and that information in a normal transaction may be sufficient for authorization of such a transaction.
- an Internet transaction it is possible to obtain all the correct information related to the particular credit card holder through unscrupulous means, and therefore, carry out a fraudulent transaction.
- Electronic commerce fraud is believed to be based largely on identity theft rather than stolen cards.
- identity theft the legitimate cardholder does not detect or know that the identifying information or credit card account is being used illegally, until the cardholder reviews a monthly statement and finds fraudulent transactions.
- a stolen card case the cardholder has lost possession of the card itself and usually notifies credit card company officials or law enforcement immediately.
- the impact of fraud is different in the electromc commerce context; it affects a merchant's operating efficiency, and possibly the merchant's discount rate and ability to accept credit cards.
- a method and system for evaluating fraud risk in an electronic commerce transaction between consumer and a merchant over a network The merchant requests service from the system over the network using a secure, open messaging protocol.
- An e-commerce transaction or electronic purchase order is received from the merchant, the level of risk associated with each order is measured, and a risk score is returned to the merchant.
- data validation, highly predictive artificial intelligence pattern matching, network data aggregation and negative file checks are used to examine numerous factors to calculate fraud risk.
- the fraud screening system performs analysis that utilizes data elements submitted with the order, and includes data integrity checks and correlation analyses based on the characteristics of the transaction.
- Other analysis includes a comparative comparison of the current transaction against past known fraudulent transactions, and a search of a transaction history database to identify abnormal velocity patterns, name and address changes, and known defrauders.
- a risk score is generated and compared to the merchant's specified risk threshold. The result is returned to the merchant for order disposition.
- scoring algorithms are regularly refined through the use of a closed-loop risk modeling process that enables the service provided by the system to be fine-tuned to adapt to new or changing fraud patterns.
- the invention encompasses a computer apparatus, a computer readable medium, and a carrier wave configured to carry out the foregoing steps.
- FIG. 1 is a block diagram of a credit card verification system.
- FIG. 2 is a block diagram of a system that can use the verification procedure FIG. 3.
- FIG. 3 shows a simple block diagram for providing an integrated verification of a credit card transaction over the Internet.
- FIG. 4 is a flow chart of an embodiment of an Internet identification verification system.
- FIG. 5 A is a block diagram of a fraud screening system.
- FIG. 5B is a block diagram showing further detail of the fraud screening system of FIG. 5A.
- FIG. 6 is a flow diagram of a process of detecting gibberish text.
- FIG. 7A is a flow diagram of a process of applying a geo-location test based on area code.
- FIG. 7B is a flow diagram of a process of applying another geo-location test based on email address.
- FIG. 7C is a flow diagram of a process of applying another geo-location test based on bank identification number.
- FIG. 8 is a block diagram that illustrates a computer system upon which an embodiment may be implemented.
- FIG. 9 is a block diagram of a statistical modeling process.
- FIG. 10 is a diagram of a risk estimate blending process.
- FIG. 11 is a diagram of a limit surface logic process.
- the present invention relates to a fraud detection method, system and apparatus for use in credit card transaction over online services or the Internet.
- the following description is presented to enable one of ordinary skill in the art to make and use the invention and is provided in the context of a patent application and its requirements.
- Various modifications to the preferred embodiment will be readily apparent to those skilled in the art and the generic principles herein maybe applied to other embodiments.
- the present invention is not intended to be limited to the embodiment shown but is to be accorded the widest scope consistent with the principles and features described herein.
- FIG. 2 is a block diagram of a system 100 which would use the verification procedure in accordance with the present invention.
- System 100 includes, similar to FIG. 1, a customer 102 and a merchant 104.
- the customer 102 provides the merchant with a credit card, and the merchant then sends information from it to an integrated verification system ("TVS") 106, which includes a variety of parameters providing consistency, history and other information in an integrated fashion to determine whether the credit card information is valid.
- the TVS 106 is typically implemented in software for example in a hard disk, floppy disk or other computer- readable medium.
- the merchant when the customer 102 orders a particular piece of software to be downloaded from a merchant 104, the merchant will provide the credit card number, e-mail address and other pertinent information to the TVS 106.
- the integrated verification system 106 then weights the variety of parameters so as to provide a merchant with a quantifiable indication on whether the credit and transaction is fraudulent.
- FIG. 3 shows a simple block diagram for providing an integrated verification of a credit card transaction over the Internet.
- the IVS 106 includes a controller 212 that receives the credit information from the merchant and then sends that information on to a variety of parameters 202-208.
- the plurality of parameters operate on the information to provide an indication of whether the transaction is valid.
- the plurality of parameters comprises a history check 202, a consistency check 204, an automatic verification system 206 and an Internet identification verification system (“DNS”) 208.
- DNS Internet identification verification system
- the output or individual indications of validity of these parameters are provided to fraud detector 210.
- the fraud detector 210 combines these inputs to provide an integrated indication of whether the particular transaction is valid.
- Consistency check 204 allows IVS 106 to determine whether the credit information is consistent, i.e., does the credit information match the user and other information.
- ANS system 206 provides similar information as AVS 16 described in FIG. 1.
- a key feature of both the history database 222 and the Internet ID database 224 is that they can be accessed and the information there within can be supplemented by a variety of other merchants and, therefore, information from those merchants is obtainable thereby.
- History check 202 is provided which also accesses a history database 222 which may include card number and email information.
- the history check 202 will also actively determine if the particular transaction matches previous database information within the history database 222. Therefore, the Internet ID verification system 208 and history check 202 increases in utility over time.
- the Internet ID verification system 208 provides for a system for verifying the validity of an Internet address, the details of which will be discussed hereinafter.
- the Internet identification verification system 208 similar to the history check 202 includes a database 224 which can be added to by other merchants.
- the Internet identification verification system 208 accesses and communicates with a database of Internet addresses. This system will be used to verify whether the Internet address is consistent with other Internet addresses being used in transactions utilizing this credit card.
- weighting blocks 214-220 are weighted via weighting blocks 214-220, respectively, dependent upon the particular credit card transaction. For example, if the amount of dollar transaction is critical, it maybe appropriate for the history check 202 and AVS system 206 and 206 to be weighted more critically than the other parameters. On the other hand, if a critical point is the consistency of the Internet address, then the consistency check 204 and the Internet identification system 208 may be more critical. Accordingly, each of the verification parameters 202-208 may be weighted in different amounts depending upon its importance in the verification process.
- a particularly important feature of the present invention is the Internet identification system 208 and its operation within the integrated verification system 106. Through this system 208, it is possible to quickly determine if an Internet identification address is being utilized fraudulently. To describe this feature in more detail, refer now to FIG. 4 and the accompanying discussion.
- FIG. 4 is a flow chart of the Internet identification verification system 208.
- the goal of Internet identification verification system 208 is to determine whether the physical address or the physical location of the address compares to a previous physical location that was used for that particular Internet address. Accordingly, in the flow chart of FIG. 4, first the number of transactions that had been processed using that particular Internet address is obtained from the database 224, via step 302. Thereafter, a map of those transactions is constructed based on those obtained transactions, via step 304. Finally, the constructed map is used to determine if the new credit card transaction is valid, via step 306. Accordingly, through a system and method in accordance with this system, an Internet identification verification system is provided which can quickly and easily determine whether a particular Internet address is related to a particular credit card transaction.
- An integrated verification system provides for weighting the variety of parameters so as to provide a merchant with a quantifiable indication on whether the credit and transaction is fraudulent.
- an Internet fraud screening system examines e-commerce transactions and measures the level of risk associated with each transaction, returning a related risk score back to the merchant in real time.
- the system uses data validation, highly predictive artificial intelligence pattern matching, network data aggregation and negative file checks to examine numerous factors to calculate fraud risk.
- the system uses scoring algorithms that are regularly refined through the use of a closed-loop risk modeling process that enables the service provided by the system to be fine-tuned to adapt to new or changing fraud patterns.
- merchants request fraud screening service from the system over the Internet using a secure, open messaging protocol.
- the fraud screening system performs four levels of analysis.
- the first two levels utilize the data elements submitted with the order and include data integrity checks and correlation analyses based on the characteristics of the transaction.
- the second two levels include a comparative analysis of the current transaction profile against profiles of known fraudulent transactions and a referenced search of the transaction history database to identify abnormal velocity patterns, name and address changes, and known defrauders.
- a risk score is generated and compared to the merchant's specified risk threshold. The result is returned to the merchant for order disposition.
- FIG. 5 A is a block diagram showing a fraud screening system including the context in which it may operate.
- a merchant 501 sends a request for service 503 through one or more networks 504 to a merchant service provider 502, and receives a response 505 that contains a risk score for a particular transaction.
- Merchant 501 in FIG. 5 A, may comprise one or more software elements that are associated with an online merchant, such as computer programs, Web application programs, CGI or Perl scripts, etc.
- Merchant service provider 502 is an entity that provides electronic commerce services to online merchants. Such services may include, for example, payment services, tax computation services, fulfillment management, distribution control, etc. Merchant service provider 502 provides such services by or through one or more software elements that communicate through network 504. For example, the Internet Commerce Suite of CyberSource Corporation may provide such services.
- the foregoing information about merchant service provider 502 is provided only to illustrate an example operational context of the invention and does not constitute a required element of the invention.
- Network 504 is one or more local area networks, wide area networks, internetworks, etc.
- network 504 represents the global, packet- switched collection of internetworks known as the Internet.
- FIG. 5 A Although one merchant 501 is shown in FIG. 5 A for purposes of illustrating an example, in a practical system, there may be any number of merchants.
- Request 503 and response 505 may be routed over secure channels between merchant 501 and merchant service provider 502. hi one particular embodiment, each request 503 and response 505 is a message that conforms to the Simple Commerce Message Protocol ("SCMP") of CyberSource Corporation (Mountain View, California).
- SCMP Simple Commerce Message Protocol
- one of the services provided by merchant service provider 502 is risk management services 506.
- merchant service provider offers a fraud screening and risk scoring system 507.
- the fraud screening and risk scoring system 507 interacts with a transaction history database 508 that contains records of a large plurality of past, completed electronic commerce transactions.
- fraud screening and risk scoring system 507 can receive the request for service 503, consult transaction history database 508, perform various fraud screening checks, and create and store a risk score for the transaction.
- the risk score for the transaction is returned to the merchant in response 505.
- Fraud screening and risk management system 507 communicates over secure paths 506A, 509C with a credit card data source 509 that has a data modeling and feedback mechanism 509A and a transaction result database 509B.
- Credit card data source 509 is any institution or system that maintains a database of information representing a large plurality of actual credit card transactions, including both successful, non-fraudulent transactions and transactions that result in charge-backs by an acquiring bank to a card- issuing bank, one embodiment, credit card data source 509 is associated with one of the major national credit card associations and therefore includes a large database of credit card transaction and charge-back data.
- fraud screening and risk scoring system 507 may use one or more computer-implemented tests and mathematical algorithms to evaluate fraud risk associated with a transaction.
- the performance of the screening and scoring system may be refined in terms of predictability and accuracy by carrying out data modeling and feedback based on risk score values generated by the system in comparison to information in transaction result database 509B.
- fraud screening and risk scoring system 507 receives transaction information and assigns a risk score value that indicates a relatively low risk associated with completing the transaction.
- the transaction is in fact fraudulent and results in a charge-back request from the cardholder's card-issuing bank to the merchant 501.
- the charge-back request is processed by the credit card data source and a record of it is made in transaction result database 509B.
- credit card data source 509 can improve the performance of fraud screening and risk scoring system 507 by periodically receiving transaction information and risk score values over path 506A, and reviewing matching information in transaction result database 509B.
- credit card data source 509 can carry out data modeling and feedback 509 A and provide revised weight values, discrete score values, or even new statistical algorithms over path 509C to fraud screening and risk scoring system 507.
- the fraud screening and risk scoring system 507 may then use the new information to carry out subsequent screening evaluations with improved accuracy.
- credit card data source 509 may be located at a different physical location and structured in a way that fraud screening and risk scoring system 507 cannot issue queries directly to or otherwise communicate with transaction result database 509B. i practice the database 509B is expected to be maintained with high security in order to preserve the confidentiality of credit card numbers and purchase information therein.
- FIG. 5B is a block diagram of a transaction verification system that may be used to implement fraud screening and risk scoring system 507.
- the system of FIG. 5B can evaluate information representing one or more transactions to result in creating and storing a score value that represents a risk to a merchant associated with processing the transaction.
- Transaction information 502 a list of good customers 504, and a list of bad customers 506 and other pertinent information are received from a merchant who wishes to screen transactions using the system.
- Transaction information 502 comprises specific information that describes a particular purchase transaction, such as customer name, shipping address, billing address, time, products ordered, price or amount of order, method of payment, card number and expiration date for credit card payments, etc.
- the transaction information 502 also may include Internet- specific information such as customer domain, email address, IP address, etc.
- Transaction history information 508 also is received from the merchant or maintained by the system. History information 508 comprises information about past transactions for the same merchant and customer that the system has processed. Specific values in history information 508 include the same values described above with respect to transaction information 502. Thus, history information 508 may comprise a database of records of past transactions. The liistory information 508 is maintained in a database at the service provider that is processing the transactions.
- the list of good customers 504 and list of bad customers 506 comprise one or more tables or lists of information identifying past customer of the merchant with which the merchant has successfully collected funds for a transaction ("good customers") or experienced non-payment from a disputed transaction, fraud, etc. ("bad customers").
- lists 504, 506 may comprise order information that is marked as good or bad by the merchant, and in practice, such lists are treated as good or bad markings of customers themselves or their Internet identities.
- the transaction information 502 is first subjected transaction present tests 510.
- the transaction present tests 510 comprise a plurality of computer-implemented filters, tests, computations and other operations that determine whether transaction information 502 genuinely represents a good transaction. For example, transaction present tests 510 determine whether transaction information 502 is expressed in proper form, etc., to arrive at a value representing the relative risk that the customer is attempting to pass a fraudulent order through the system. Further information about transaction present tests 510 is set forth herein.
- transaction information 502 passes transaction present tests 510, then in comparison operation 520, transaction information 502 is compared to history information 508 to result in creating and storing one or more discrete score values 530.
- Each of the discrete score values 530 represent a relative risk evaluation carried out individually by transaction present tests 510 and comparison operation 520. Further information about history testing is set forth herein.
- the discrete score values 530 are then applied to a statistical model 540, resulting in creating and storing one or more weight values and model score values.
- Statistical model 540 comprises one or more weighted computations or other computer-implemented mathematical operations that apply statistical formulae and weight values to the discrete scores.
- the purpose of statistical model 540 is to apply statistical analysis, based on the history information 508 and other records of what transactions have been found in practice to be actually fraudulent, to the discrete score values 530.
- the discrete score values 530 are also applied, in parallel, to a Heuristic Model 550 to generate a Heuristic Model Risk Estimate.
- Score Blending Process 552 provides a way to combine the Heuristic Model score with the model score value created as output by statistical model 540.
- Heuristic Model 550 may also take into account one or more merchant-specific values 570.
- Merchant-specific values 570 may comprise, for example:
- Product category information such as a value that limits the maximum number of products in a particular category that a customer is permitted to purchase online in one transaction.
- Product categories may be specified by the transaction processing system, or specified by the merchant;
- Selling frequency information i.e., how often a customer is permitted to buy a particular product over a specified period of time, e.g., a subscription product that can be purchased only once a week;
- One or more time of day weight values that indicate how important the buyer's time of purchase is, or that indicate what range of time in a day represents a reasonable time at which a buyer is expected to buy a particular product
- a "risky host” weight value that reflects an amount of risk associated with a particular host from which a customer order originates, as indicated by the customer's originating IP address or customer's claimed e-mail domain;
- a gender bias value that indicates whether a specified product is strongly expected to be associated with a purchaser of a particular gender, so that risk increases if the system determines that the purchaser is probably of the other gender;
- a first "velocity" value indicating how often the buyer has made online purchases at all
- a second "velocity" value indicating how often the buyer has made online purchases of a specified product category from a specified merchant.
- a final score value and one or more return code values are created and stored, as indicated by block 560.
- the final score value is in the range of 0-100, where "0" represents a transaction that is extremely unlikely to involve fraud and "100" involves a transaction that is highly likely to represent fraud.
- the return code values signify special results or other functions.
- one of the return codes comprises one or more bytes of score flags that signal a recommendation to the merchant to reject the transaction regardless of any other criteria of the merchant.
- score flags may indicate that one of the merchant "velocity" criteria exists in the order, or that prior orders related to the individual who placed the current order are on a fraud list.
- a score flag may indicate that a customer placing the current order is found in list of bad customers 506. If prior orders of the customer are on the fraud list, then the current transaction is automatically added to the fraud list as well.
- the final score value and return code values are returned to the merchant in one or more messages, using an appropriate protocol.
- the system of FIG. 5B creates a message that conforms to SCMP, packages the final score value and return code values in the SCMP message, and sends the SCMP message over a secure channel to the merchant.
- transaction present tests 510 comprise a plurality of tests selected from among the following:
- a "Gibberish city” test detects whether the customer city name value has no vowels, is too short, or has three of the same letter in a row.
- a "Gibberish last name” test detects whether the customer last name value has no vowels, is too short, or has three of the same letter in a row.
- a "Gibberish first name” test detects whether the customer first name value received from the merchant has no vowels or has three of the same letter in a row.
- a "Bad word in email” test detects whether the email address value received from the merchant contains a suspicious string.
- a "Bad word in first name” test detects whether the first name value received from the merchant contains a string marked as high-risk.
- a "Bad word in last name” test detects whether the last name value received from the merchant contains a string marked as high-risk. 7.
- a "Bad word in city” test detects whether the city value received from the merchant contains a string marked as high-risk.
- a "State change(s) found” test detects whether historical orders related to the current request have different state values associated with them.
- a "High number of credit cards” test detects whether historical orders related to the current request have many different credit card numbers associated with them.
- a "Long term penalty” test detects whether the customer is attempting to make too many purchases of a product during the long-term hedge period specified by the merchant for the current order.
- a "Fraud list” test detects whether information identifying the customer is found in an external fraud list.
- a "Name Change(s) Found” test detects whether historical orders related to the current request have different customer last name values associated with them.
- An "Email/name match” test detects whether the first name value or last name value provided by the customer also appears in the email address value provided by the customer.
- a "Browser type penalty” test detects whether the customer is using a Web browser program that is marked as high-risk.
- a "Browser email/email mismatch" test detects whether the email address that is stored as a configuration variable by the customer's Web browser program does not match the email address that the customer provided in the order information.
- a "No electronic products”- test detects whether the order contains no electronic or digital products, as opposed to tangible products.
- a "Phone number bad length” test detects whether the telephone number value that the customer provided has the wrong number of digits.
- An "Invalid phone number” test detects whether the telephone number value provided by the customer is invalid. For example, in the United States telephone numbers having the prefix "555" or "111" are invalid.
- a "Suspicious area code” test detects whether the telephone number value provided by the customer includes a high-risk area code value.
- An “Area code/state mismatch” test detects whether the area code within the telephone number value is associated with a state other than the state value provided by the customer.
- An "Area code nonexistent" test detects whether the telephone area code value provided by the customer is not a valid area code or does not exist.
- a "Toll-free phone number" test detects whether the telephone number value provided by the customer is a toll-free telephone number.
- a "U.S. address with foreign domain” test detects whether the top-level domain portion of the email address value provided by the customer is associated with a foreign country but the shipping address or billing address value provided by the customer is a U.S. address.
- a "Bill/ship state mismatch” test detects whether the shipping state value provided for an order does not match the state value in the billing address of the credit card information provided with the order.
- a "Bill/ship country mismatch” test detects whether the shipping country value provided for an order does not match the country value in the billing address of the credit card information provided with the order.
- An "AVS” test determines whether a score value associated with the order should be adjusted based on the results of testing the order information using an address verification system.
- An example of an address verification system is described in co-pending application Ser. No. 09/444,530, filed November 22, 1999, "Method and Apparatus for Verifying Address.”
- a "BIN penalty” test determines whether a penalty value should apply because the Bank Identification Number (“BIN”) received from the customer, which forms the first four to six digits of a conventional credit card number, is marked as high-risk.
- a "Digits/all lower-case in name” test determines whether the customer name value is all in lower case, or contains numeric digit characters.
- a "Sequential digits in phone number" test determines whether the customer telephone number value contains multiple consecutive sequential digits.
- a "Goodguy” test determines whether matching customer information is found in list of good customers 104.
- An "Unable to verify address” determines whether the customer address is unverifiable; international and military addresses may cause such a result.
- a "City/state/zip mismatch" test determines whether the city, state, and ZIP code values provided by the customer are not associated with one another based on data available from the Postal Service.
- An "IP address/hostname mismatch" test determines whether the resolved D? address associated with the customer does not match the hostname portion of the email address provided by the customer.
- a "No hostname” test determines whether the customer IP address value received as part of the transaction information does not resolve, using the DNS system of the Internet, into a valid hostname value.
- An "Email in originating domain” test detects whether the email address value provided by the customer is in the same domain as the customer's resolved domain name.
- An "AOL user from non-AOL host” value detects whether the customer email address value purports that the customer is an America Online user, but the customer is communicating with the merchant from a host other than an AOL host.
- An "ISP state mismatch" test detects whether a state value that is provided by an Internet Service Provider as part of a resolved domain name does not match the state value provided by the customer.
- Microsoft Network provides customer state information as part of a resolved domain name, e.g., "chicago-il.us.msn.com,” that can be checked against the state value provided by the customer in the transaction information.
- a "Netcom oldstyle host” test detects whether the customer is using a shell account of the Internet service provider Netcom that can be used to hide the true identity of the customer.
- a "Bill country/email mismatch" test detects whether the country value provided by the customer in its billing address information does not match the country value of the customer's email address.
- a "Bill country/IP host mismatch" test detects whether the country value provided by the customer in its billing address information does not match the country in which the host indicated by the customer's D? address is located, based on resolution using the DNS system.
- a "Whereis check negative” test detects whether the country associated with the customer's IP address, according to the "whereis” database of Network Solutions, Inc., does not match the country value of the customer's address information.
- a "Time Risk” test determines the riskiness of the transaction time of day.
- a "Host Risk” test determines the riskiness of the Internet source location from which the transaction originates, based on either email address or Internet domain ip_address.
- a "Gender Mismatch Risk” test determines whether the customer gender violates normative expectations in relation to the specified product.
- a "Gift” test determines whether a mismatch between the billing and shipping addresses is risky or not.
- FIG. 7A is a flow diagram of a process of applying a geo-location test based on area code.
- the geo-location test of FIG. 7A uses information in two tables.
- a city direction table is created and stored.
- the city direction table has rows that correspond to city values in a customer shipping address. Columns of the table store the city name, a longitude value indicating the absolute longitude of the city, and a latitude value indicating the absolute latitude of the city, h block 704, an area code direction table is created and stored.
- the area code direction table has rows that correspond to all possible or known area code values. Columns of the table store one or more longitude values and latitude values that represent the bounds of the area contained within the area code.
- the area code direction table comprises area code values stored in association with,vectors that indicate the boundaries of the area code in terms of latitude and longitude.
- the city value received from the customer is tested to determine whether it is within the area code value provided by the customer. For example, the position of the center of the city indicated in the city value provided by the customer is determined and then correlated to the values in the area code direction table. Stated another way, the test determines whether the area code specified by the customer actually contains the city specified in the shipping address.
- a city value and an area code value are received from the shipping address information in the transaction information for an order or customer.
- the action in block 706 may occur at a separate time interval from the action of block 702 and block 704.
- the separate time interval may be any duration.
- block 702 and block 704 may be viewed as preparatory steps that may be carried out in an offline mode or at a separate time.
- latitude values and longitude values associated with the received city value and the received area code are determined, hi one embodiment, a first latitude value and a first longitude value are obtained by looking up the city value in the city direction table, and a second latitude value and a second longitude value are obtained by looking up the received area code value in the area code direction table. h block 710, based on the latitude and longitude values, the system tests whether the received city value is within the received area code value. If not, then a penalty value is applied to the transaction, as indicated by block 712. If the city is properly found within the limits of the specified area code, then no penalty is applied and control continues with other tests or order processing.
- FIG. 7B is a flow diagram of a ⁇ rocess of ar ⁇ >lvin ⁇ another geo-location test, based
- longitude value is created and stored for each shipping address of an order that is processed by a transaction processing system, in association with information identifying a specified email domain.
- transaction information is received that includes an email address of the customer in the form "[email protected],” and a shipping address for customer John Custname.
- the system computes or otherwise determines (e.g., by a lookup in the city direction table that is created as part of FIG. 7A) a latitude value and longitude value for the city value.
- a record containing the domain value "isp.com,” the latitude value, and the longitude value is created and stored in the database.
- the process of block 714 is carried out each time a transaction is processed in the system.
- block 716 an email address of a prospective customer, and a city value from the shipping address portion of transaction information, are received for a new order. Thus, block 716 can occur concurrently with block 714 or at some later time.
- block 718 a latitude value and a longitude value are determined for the received city value.
- the process tests whether the received city value is too far from the domain indicated in the received email address value. For example, the process can determine whether the latitude value and longitude value for the received city value, as computed in block 718, differ too much from a metric that represents corresponding values in the database, e.g., a standard deviation value for the latitude value and longitude value. Alternative mechanisms may be used for determining that the received city value is too far from the geographical area indicated by all other city values for other transactions that reference the same email domain.
- test of block 720 If the test of block 720 is true, then as indicated in block 722, a penalty is applied to the transaction. Otherwise, control continues with other tests or processing.
- This test is effective when a particular Internet Service Provider (ISP) serves a geographically focused customer base. In that case, if an order arrives that includes a shipping address that is far outside the ISP's traditional geographical service area, then the system may hypothesize that the customer is using stolen identity information or stolen credit card information. Such a test may be supplemented with human review of score values in order to ensure that the rate of false negative results (“insults”) is not too high.
- ISP Internet Service Provider
- FIG. 7C is a flow diagram of a geo-location test based upon bank identification number.
- the BIN value of the credit card number provided by a prospective customer is used in geographic consistency screening
- the country value of the shipping address in each order processed by the system is stored in association with the BIN value of the credit card number that is specified in the order.
- block 724 involves building a table that associates BIN numbers with the shipping address location of actual orders.
- BIN value geo-consistency screening a range of latitude and longitude values are stored in a database in association with a BIN value.
- a country value is received from the shipping address portion of transaction information for a new order.
- the relative proximity of the current shipping address country value is determined, relative to all other countries associated with the bank identification number that is specified in the order.
- Block 728 may involve, for example, looking up a distance value or weight value in a country distance table that correlates every country of the world with every other country in the world.
- the distance value or weight value may reflect geographical distance, political distance, cultural distance, etc. For example, a value that correlates the United States to Canada might be very high, whereas a value that correlates the United States to Cuba might be very low because even though the United States is geographically close to Cuba, politically it is distant.
- a comparison is made to determine whether the country represented by the country value of the current order is too far from the bank that is associated with the BIN value, as indicated by the country distance table. If so, as indicated in block 732, a penalty is applied.
- GIBBERISH TESTS GIBBERISH TESTS
- Transaction present tests 510 may include one or more tests to determine whether one or more values of transaction information 102 consist of unintelligible or meaningless text ("gibberish").
- FIG. 6 is a block diagram of an example embodiment of a gibberish test. hi block 602, a text value for gibberish testing is received. For example, gibberish testing may be applied to a customer first name value or a last name value received from a merchant for a particular customer.
- a table of bi-gram probability values is received, h one embodiment, the table of bi-gram probability values consists of rows representing letter pairs ("bi- grams") and columns representing the likelihood that a specified bi-gram will appear (a) as the first pair of letters in of a text string, (b) anywhere in the middle of the text string, or (c) as the last pair of letters in a text string, where one column of the table is associated with situation (a), (b), and (c).
- bi-gram An example of a bi-gram is "DA.”
- the table could have a value of "80" in the first column position, indicating that the letter pair "DA” is likely to appear in the first ordinal position of a true name, as in "DAVID” or "DANIEL.”
- the table could have a value of "20" in the second column position, indicating that a true name is unlikely to have the letter pair "DA" in the middle of the name.
- Other numeric values may be used, h one specific embodiment, the table of bi-gram probability values is created and stored manually or automatically based on name information received from a trusted source. For example, name information from U.S. census data may be used.
- a score value is determined based on the table of bi-gram probability values.
- block 606 involves scanning through each bi-gram in the received text value, and looking up each such bi-gram in the table. For each bi-gram, a score value is generated based on the corresponding probability value that is found in the table. If a bi-gram is not found in the table, a default value may be ascribed, typically representing a low probability.
- the score value determination in block 606 preferably ignores or screens out received text values that comprise acronyms.
- acronyms are recognized in that a first received text value (e.g., first name) consists of all capital letters and a second received text value (e.g., last name) is mixed case. If an acronym is detected, then the score value determined in block 606 may be modified or set to a default value.
- Special letter combinations may be considered, as indicated in block 609.
- the process of block 606 attempts to determine an ethnicity associated with the received text values, and if such a determination is made, the values obtained from the table may be adjusted. For example, in a large random sample of names, appearance of the bi-gram "SZ" in the first ordinal position of a last name value may be unlikely. However, that combination is common surnames of Eastern European origin. Accordingly, if the process can determine that a received first name value appears to be a Eastern European name, then certain other letter pairs are more likely to appear in the received text. For example, the letter pair "CZ" may be more likely. Therefore, in response, the probability value received from the table for such letter pairs may be adjusted.
- block 604, block 606, block 608, and block 609 may involve separate iterations for a first name value and last name value.
- block 606 may involve a screening process whereby a score value representing an error is generated only when a bi-gram in the received text value is not found anywhere in the probability table. This option may be used to reduce processing time or when only a rough check of a text value is needed.
- a warning value is generated when the received text value comprises a combination of bi-grams that are determined to be unlikely to be associated with a real first name or last name.
- a warning value is generated only when the received text value comprises a combination of highly unlikely bi-gram values.
- the warning value is selected to indicate that the received text value is suspicious, but not so unusual as to warrant rejection of a transaction by the merchant.
- the table of bi-gram probability values may be updated as additional information becomes available, e.g., at each census interval. Separate tables maybe prepared for name values of foreign origin, e.g., Japanese names in kana representation.
- comparison operation 520 involves comparing transaction information 502 to history information 508 to result in creating and storing one or more discrete score values 530.
- Such liistory testing generally involves verifying that the current transaction information 502 is consistent with all previous transactions associated with an individual.
- transactions are associated with an Internet identity.
- an "Internet identity” comprises a unique identifier of a purchaser or other individual who submits order transactions.
- An Internet identity may comprise an email address. Such an Internet identity value tends to facilitate better screening results in cases where an individual uses a plurality of different email addresses to place orders.
- FIG. 5C is a block diagram of alternative embodiments of an Internet identity value.
- a first embodiment of an Internet identity value 590A consists of the combination of a hash value based on an email address, as indicated by block 592, and a hash value based on a credit card BIN value, as indicated by block 594.
- Using a value that includes a credit card number as a base element tends to improve accuracy for individuals who use multiple credit cards for different users.
- each Internet identity value uniquely identifies a particular email address and card combination.
- the system may use a value that uniquely identifies a purchase method other than a credit card. For example, if a customer uses an electronic check or a stored value card to make a purchase, a check number or card identifier may be used to create the Internet identity value.
- a second embodiment of an Internet identity value 590B consists of the combination of a hash value based on an email address, as indicated by block 592, and a hash value based on a credit card BIN value, as indicated by block 594, and a hash value based on a shipping address, as indicated by block 596.
- This alternative improves accuracy where a plurality of orders use different email addresses and credit card numbers but are all shipped to the same address, especially in the case of residential deliveries.
- an Internet identity may comprise a first hash value of an prospective purchaser's host IP address, in combination with a second hash value of an email address of a prospective purchaser carried, in combination with a third hash value of a card bank identification number of the prospective purchaser and a fourth hash value based on a shipping address of the prospective purchaser.
- an Internet identity may comprise a first hash value of a prospective purchaser's hardware device ID value, in combination with a second hash value of either the email address or user ID of the prospective purchaser, in combination with a third hash value of a card bank identification number of the prospective purchaser and with a fourth hash value based on a shipping address of the prospective purchaser. What is important is to use a value that accurately represents the repeating identity of a particular Internet user across multiple orders, regardless of the host or terminal that the Internet user uses to connect to the network.
- Historic transactions in history information 508 that are associated with the Internet identity of the current transaction may be obtained, for example, by issuing a database query to a database that contains the historical transaction information, and receiving a set of records in response as history information 508.
- comparison operation 520 looks for information that signals that the comparison operation should stop. In one embodiment, if any of the records that are returned from the database is for a prior order is on the fraud list, then the system skips comparison operation 520. This mechanism ensures that unnecessary processing is skipped for orders that are associated with past fraudulent orders, because if such orders are processed using comparison operation 520, they are certain to end in a negative result.
- history processing ceases if more than 500 history records are retrieved, and comparison operation 520 is carried out using only the 500 records that are retrieved. As a result, query time and overall transaction processing time is reduced.
- Internet identity values that are associated with test identities that are created by merchants to verify system operation are screened out.
- one of the return codes comprises one or more bytes of score flags that signal a recommendation to the merchant to reject the transaction regardless of any other criteria of the merchant.
- score flags may indicate that one of the merchant "velocity" criteria exists in the order, or that prior orders related to the Internet identity that placed the current order are on a fraud list.
- a score flag may indicate that a customer placmg the current order is found in list of bad customers 506. If prior orders of the customer are on the fraud list, then the current transaction is automatically added to the fraud list as well.
- History information 508 may be created and stored by a transaction processing system of the type shown in FIG. 5 as it processes transactions.
- the system creates and stores one or more score logs.
- Each record of a score log identifies a transaction and contains one or more penalty values that resulted from application of the transaction present tests 510 and other tests of the system to the transaction information 502.
- manual or automated review of the score logs may reveal how a particular transaction was processed in the system.
- the system includes a test scores table, and the system updates values in the test scores table as it processes transactions.
- the test scores table contains, for each order, a result value or penalty value for each test that is conducted for an order, hi a specific embodiment, the test scores table comprises columns for order number, email address, credit card number, and columns for each test that is carried out as part of transaction present tests 510.
- the test scores table may also include the model score value that is provided as output from statistical model 540, and the final score value and return codes that are provided at block 560 of FIG. 5.
- test scores table using data in the test scores table, statistical evaluations of the test results may be created. Further, database queries may be applied to the test scores table in order to retrieve orders that are related in some manner, hi the past approach, such processing required test parsing of the score logs, hi the present approach, such parsing is eliminated, and improved views of the actual significance of tests are provided. As a result, the insult rate of a particular test may be rapidly and regularly evaluated.
- the merchant's customer service center can issue a query for the return codes and rapidly determine the exact reason for the high fraud score.
- the ability to obtain the return codes in a rapid manner also provides the merchant with a weapon against "social engineering," a fraud technique in which a declined customer telephones the merchant and attempts fabricates one or more reasons why the order should be accepted, in an attempt to verbally circumvent the merchant's computer-based fraud screens by playing to the emotions of the merchant's customer service representative.
- the customer service representative can rapidly query the fraud screening system and receive a detailed description of why the order was refused. Such description may be generated based on one or more of the return code values.
- STATISTICAL MODELING Statistical model 540 comprises a plurality of computations that are based upon actual discrete scores that are weighted in non-linear combination, based on likelihood of indicating an actual fraudulent transaction, i one embodiment, such weighting involves identifying orders that are actually consummated and that result in actual charge-backs to the issuing bank associated with the credit card that is identified in the order. The methodology generally ignores orders that are rejected by the fraud screening system disclosed herein as part of the transaction present tests 510.
- FIG. 9 is a block diagram of a statistical modeling process.
- statistical modeling consists of a data selection and sampling phase 902, data normalization phase 904, data partitioning phase 906, model training phase 910, model verification phase 912, and model performance testing phase 918. Many of these phases can participate contribute feedback to earlier phases, as indicated by paths in FIG. 9.
- the phase 902 of statistical modeling process consists of data selection and sampling.
- data in this context, refers to truth-marked transaction data.
- Trust-marked means that the transaction records include a field indicating the final outcome of the transaction - whether the transaction ultimately resulted in an adverse outcome such as chargeback or suspicious credit back, or the transaction resulted in a good sale.
- the sources of truth-marked modeling data are selected. If the model is to provide custom protection to a single merchant, then data specific to that merchant would dominate but the modeling set might also contain representative data from similar merchants as well to broaden the modeling basis. If the model were to serve an entire industry sector then the data would be chosen broadly to represent the sector merchants. However broad the applicability of the model, the data selection is equally broad.
- this transaction data is not used for statistical modeling as-is; it is down- sampled.
- Down-sampling is a statistical process by which the modeler achieves an optimal balance between high-risk and low-risk transactions in the modeling set through biased random sampling.
- the modeler establishes the optimal mix proportions based on theoretical characteristics of the model that is to be built. For example, in many cases, high-risk transactions are rare in relation to low-risk. If the selected data is used for modeling as-is, the low-risk transactions could dominate and drown out the signal from the infrequent high-risk items. A balance is desirable.
- a ten-to-one ratio of low-risk to high-risk data items is obtained, by accepting all high-risk items in the selected data set and then randomly down-sampling the low-risk items, to achieve the desired ratio.
- phase 906 the selected and sampled data is broken down into three partitions or mutually exclusive data sets: the training set, the verification set, and the testing set. Although there is no required proportion for these data sets, proportions such as 50-50 and 60-40 are commonly used. For example, using the 60-40 proportion, 60 percent of the modeling data is randomly chosen for training and validation, and the remaining 40 percent is held aside or held back as testing data for the model testing phase. The 60 percent chosen for model building is further broken down according to another rule of thumb such as 65-35 into training data and validation data, both of which participate in a model building phase 908. All partitioning is done using pseudo-random number generation algorithms.
- model training phase 910 is carried out.
- the first step is to select or create an initial candidate model architecture.
- this involves configuring the input layer to conform to the dimensionality of the modeling data feature set, configuring the output layer to conform to the demands of the model domain, and to then select an initial number of "hidden units” or "basis function units". If the demands of the model domain are to simply make a simple numeric estimation of the transaction risk then a single unit output architecture is chosen. If the modeling domain demands that the transaction be categorized into multiple risk type estimates, then the output layer is made to conform to the dimensionality of the target category set.
- the model With each successive training cycle, the model is exposed to the training data one transaction at a time and allowed to self-adjust the model weights attempting to achieve a "best balance" in the face of the entire data set - a balance between correct risk estimation for the low-risk transactions and correct risk estimation for the high-risk transactions.
- the training cycle is terminated when the rate of successful weight adjustment, as measured by successive improvements in mean square error, begins to asymptote or flatten out. Training beyond that point may result in "over-fit" where the model becomes so specifically conditioned to the training data that later, in the performance testing phase, it will fail to generalize to previously unseen but similar patterns of data.
- modeler If the model fails to train to criteria, then the modeler returns to one of the previous steps and enters the modeling cycle again, adjusting to prevent the modeling failure on the next cycle.
- the most common step for modeling entry is to return to the beginning of the model training phase and make adjustments to the architecture although it is not uncommon to go back to the data selection and sampling phase if necessary.
- model verification phase 912 The model-in-training or the completely trained model both are subjected to verification in model verification phase 912.
- the behavior of the model is checked against common sense criteria by bringing some of the verification data to bear on the model. In a way this is an interim form of performance testing.
- the difference is that, once adjustments are made to the model, the verification data that was used to determine the nature of the required model change becomes part of the ongoing training set.
- the modeling process is re-entered at one of the earlier stages. This cycling between model training phase 910, model verification phase 912, model adjustment, and model re-training concludes the general model building phase 908.
- model building cycles have completed, the finished model is subjected to model performance testing in testing phase 918.
- the 40-50 percent of the original selected and sampled data that was held back for performance testing is now brought to bear.
- the model has never been exposed to this transaction data before.
- the model scores all of the remaining data, without allowing any modifications to be made to its weights or architecture. The results of scoring are analyzed. If the model has performed to criteria, modeling is completed and the statistical model is ready for deployment in the production fraud risk estimation system where it will be exposed to transactions as they are presented to the system in real time and produce a numeric risk estimate for each transaction. That numeric risk estimate can be interpreted as fraud likelihood, the likelihood that the transaction will turn out to be bad.
- the modeling process begins again from the beginning with a new data selection and sampling cycle, as shown in FIG. 9.
- Heuristic Model 550 is comprised one or more artificial intelligence computations that compute a weighted sum based on a linear combination of the discrete scores. The heuristic computations are performed on the results of the heuristic tests. This is a highly complex scoring process that occurs in stages and results in a single numeric estimation of risk. This risk estimate then serves as the basis for Score Blending Process 552, establishing the Risk Zones that stracture the blending process. This blending process will be discussed in detail in the appropriate section.
- a total raw score is computed as the weighted sum of the discrete test results.
- Discrete test results are of four types: Boolean, quantitative, categorical, and probabilistic. Boolean true-false results are valued at zero or one. Quantitative results are valued as positive integers reflecting arithmetic counts of occurrence. Categorical results indicate levels of severity. And probabilistic results indicate levels of confidence.
- Each discrete test result is multiplied by its associated penalty and these products are summed together to produce the total raw score.
- the penalty associated with each test can be negative or positive. Negative penalties reduce the likelihood of risk and positive penalties increase the risk likelihood.
- the resulting total raw score indicates the face value and situational risk of the transaction.
- the heuristic model computes a raw score multiplier.
- the raw score multiplier is similar to a "gain control" device.
- the raw score is boosted upward based on a combination of certain test results and the merchant's declared policy toward those test results. If the merchant has indicated a special interest in a particular test, then the results of that test are magmfied to boost the score upward or downward - mostly upward.
- a score multiplier is computed and applied to the total raw score resulting in a "classic" score.
- the resulting classic score ranges in value from 0 to a very large number which can be greater than 100, 000 and in its upper ranges appears to be distributed exponentially.
- This Heuristic Model score ranges from 0 to 99 and is an estimate of risk likelihood. This heuristic estimate is later combined with the results of other models through a process of numeric fusion described in a later section of this document.
- the risk likelihood estimates deriving from Heuristics 550 and Statistical Models 540 are blended or fused to produce a final comprehensive estimate of the likelihood of risk associated with the transaction-merchant-card-fraudster combination. This is commonly called the Fraud Score, but here will be called the Risk Estimate.
- the blending takes place against the backdrop of the basic statistical dilemma faced by all discrete decision systems. This situation is illustrated in FIG. 10.
- FIG. 10 shows two frequency distributions: the score distribution of Good Transactions and that of Bad Transactions.
- Risk Zone 1 begins at the lowest risk likelihood (Risk Score 0) and extends to the point where the occurrence of fraud transactions becomes non-trivial. Risk Zone 1 contains low-scoring transactions that are highly unlikely to be fraudulent.
- Risk Zone 2 begins in the general non-fraud zone at the point where the occurrence of fraud transactions becomes non-trivial and extends to the point where the Good Transactions frequency surface and the Bad Transactions frequency surface intersect. That boundary is also defined as Error Minimization point (EM), the point that balances the risk of Type I and Type II Error and is often recommended as a default discrete decision threshold.
- EM Error Minimization point
- Risk Zone 2 contains mostly non- fraudulent transactions but also a mix of mid-low scoring fraudulent transactions.
- Type II Errors also known as Misses, Missed Detections, and Mistaken Sales
- Risk Zone 10 begins at the default Error Minimization point and extends to the point in the general fraud zone where the occurrence of non-fraudulent transactions becomes trivial.
- Risk Zone 3 contains mostly fraudulent transactions but also a mix of mid-high scoring non-fraudulent transactions.
- Risk Zone 4 begins at the point where the occurrence of mid-high scoring non-frauds becomes trivial and extends to the top of the scoring range. Risk Zone 4 contains high-scoring transactions that are extremely likely to be fraudulent.
- Type I Errors also known as False Alarms, False Positives, and Mistaken Non-Sales
- the score value (Risk Estimate) of Statistical Model 540 and the Heuristic Score Risk Estimate of Heuristic Model 550 are blended in Score Blending Process 552 as follows. For each of the four Risk Zones, a blending policy is established and enforced dictating the magnitude and the allowable direction of influence the models are permitted. The policies are a function of both 1) The nature of the risk estimation algorithms yielding the scores being blended, and 2) The nature of the Risk Zones themselves.
- the Heuristic Model is taken as the basic scoring authority for establishing the boundaries of all Risk Zones, hi this embodiment, the Statistical Model is intended primarily to protect non-fraudulent transactions from mistakenly receiving a high Risk Estimation (to prevention of False Alarms), and since most non-fraudulent transactions naturally fall in Risk Zones 1 and 2, the Statistical Model is given full responsibility for reducing Risk Estimations in Zone 1 and limited authority to reduce Risk Estimations in Zone 2. Further, in this example embodiment, since the Heuristic Model is intended primarily to optimize the detection of fraudulent transactions (and thus to avoid Misses); and since most fraudulent transactions naturally fall in Zones 3 and 4, that model is given full responsibility for producing Risk Estimates in Zone 4 and primary responsibility for producing Risk Estimates in Risk Zone 3. The Statistical Model is given limited authority to increase Risk Estimates in Zone 3.
- the Heuristic Model Risk Estimate falls in risk Zone 1
- the Statistical Model produces the final Risk Estimate.
- the Heuristic Model Risk Estimate falls in Risk Zone 4
- the Heuristic Model produces the final Risk Estimate.
- the Heuristic Model score falls in Zone 2 or Zone 3, a special Limit Surface Logic is applied to minimize either False Alarms or Misses, as the case may be.
- a Limit Surface (Type I Limit) is established below the Heuristic Score Surface to help minimize the likelihood of Type I Errors; and a Limit Surface (Type ⁇ Limit) is established above the Heuristic Score Surface to help minimize the likelihood of Type II Errors.
- the Heuristic Model Risk Estimate falls in Zone 2 and the Statistical Model Risk Estimate falls between the Type I Limit Surface and the Heuristic Model Surface, the Statistical Model Risk Estimate is allowed to reduce the final Risk Estimate for the apparently non-fraudulent transaction. Otherwise the Heuristic Model produces the final Risk Estimate.
- the Heuristic Model Score falls in Zone 3 and the Statistical Model Score falls between the Type U Limit Surface and the Heuristic Model Surface, the Statistical Model Score is allowed to increase the final Risk Estimate. Otherwise, the Heuristic Model produces the final Risk Estimate.
- the contribution of parallel models to the final Risk Estimate is determined during blending by considering the strengths and weaknesses of each to-be- blended model in light of the distribution characteristics of the various Risk Zones.
- FIG. 8 is a block diagram that illustrates a computer system 800 upon which an embodiment of the invention may be implemented.
- Computer system 800 includes a bus 802 or other communication mechanism for communicating information, and a processor 804 coupled with bus 802 for processing information.
- Computer system 800 also includes a main memory 806, such as a random access memory (“RAM”) or other dynamic storage device, coupled to bus 802 for storing information and instructions to be executed by processor 804.
- Main memory 806 also may be used for storing temporary variables or other intermediate information during execution of instractions to be executed by processor 804.
- Computer system 800 further includes a read only memory (“ROM”) 808 or other static storage device coupled to bus 802 for storing static information and instructions for processor 804.
- ROM read only memory
- a storage device 810 such as a magnetic disk or optical disk, is provided and coupled to bus 802 for storing information and instractions.
- Computer system 800 may be coupled via bus 802 to a display 812, such as a cathode ray tube ("CRT"), for displaying information to a computer user.
- a display 812 such as a cathode ray tube ("CRT")
- An input device 814 is coupled to bus 802 for communicating information and command selections to processor 804.
- cursor control 816 is Another type of user input device
- cursor control 816 such as a mouse, a trackball, or cursor direction keys for communicating direction information and command selections to processor 804 and for controlling cursor movement on display 812.
- This input device typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), that allows the device to specify positions in a plane.
- the invention is related to the use of computer system 800 for evaluating fraud risk of an electronic commerce transaction.
- evaluating fraud risk of an electronic commerce transaction is provided by computer system 800 in response to processor 804 executing one or more sequences of one or more instractions contained in main memory 806.
- Such instractions may be read into main memory 806 from another computer-readable medium, such as storage device 810.
- Execution of the sequences of instructions contained in main memory 806 causes processor 804 to perform the process steps described herein.
- hard- wired circuitry may be used in place of or in combination with software instractions to implement the invention.
- embodiments of the invention are not limited to any specific combination of hardware circuitry and software.
- Non- volatile media includes, for example, optical or magnetic disks, such as storage device 810.
- Volatile media includes dynamic memory, such as main memory 806.
- Transmission media includes coaxial cables, copper wire and fiber optics, including the wires that comprise bus 802. Transmission media can also take the form of acoustic or light waves, such as those generated during radio wave and infrared data communications.
- Computer-readable media include, for example, a floppy disk, a flexible disk, hard disk, magnetic tape, or any other magnetic medium, a CD-ROM, any other optical medium, punch cards, paper tape, any other physical medium with patterns of holes, a RAM, a PROM, and EPROM, a FLASH-EPROM, any other memory chip or cartridge, a carrier wave as described hereinafter, or any other medium from which a computer can read.
- the instractions may initially be carried on a magnetic disk of a remote computer.
- the remote computer can load the instractions into its dynamic memory and send the instractions over a telephone line using a modem.
- a modem local to computer system 800 can receive the data on the telephone line and use an infrared transmitter to convert the data to an infrared signal.
- An infrared detector can receive the data carried in the infrared signal and appropriate circuitry can place the data on bus 802.
- Bus 802 carries the data to main memory 806, from which processor 804 retrieves and executes the instructions.
- the instructions received by main memory 806 may optionally be stored on storage device 810 either before or after execution by processor 804.
- Computer system 800 also includes a communication interface 818 coupled to bus 802.
- Communication interface 818 provides a two-way data communication coupling to a network link 820 that is connected to a local network 822.
- communication interface 818 maybe an integrated services digital network ("ISDN") card or a modem to provide a data communication connection to a corresponding type of telephone line.
- ISDN integrated services digital network
- communication interface 818 may be a local area network (“LAN”) card to provide a data communication connection to a compatible LAN.
- LAN local area network
- Wireless links may also be implemented.
- communication interface 818 sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.
- Network link 820 typically provides data communication through one or more networks to other data devices.
- network link 820 may provide a connection through local network 822 to a host computer 824 or to data equipment operated by an Internet Service Provider ("ISP") 826.
- ISP 826 in turn provides data communication services through the worldwide packet data communication network now commonly referred to as the "Internet” 828.
- Internet 828 uses electrical, electromagnetic or optical signals that carry digital data streams.
- the signals through the various networks and the signals on network link 820 and tlirough communication interface 818, which carry the digital data to and from computer system 800, are exemplary forms of carrier waves transporting the information.
- Computer system 800 can send messages and receive data, including program code, through the network(s), network link 820 and communication interface 818.
- a server 830 might transmit a requested code for an application program through Internet 828, ISP 826, local network 822 and communication interface 818.
- one such downloaded application provides for analyzing a Layer 2 path in a switched network as described herein.
- the received code may be executed by processor 804 as it is received, and/or stored in storage device 810, or other non- volatile storage for later execution.
- computer system 800 may obtain application code in the form of a carrier wave.
- ALTERNATIVES AND VARIATIONS Accordingly, a computer-based processing method for evaluating fraud risk associated with an electronic commerce transaction has been described. In the embodiments disclosed herein, such a processing method provides for identifying transactions that are likely to be fraudulent, while limiting false positive results and limiting false negative results.
Landscapes
- Business, Economics & Management (AREA)
- Engineering & Computer Science (AREA)
- Accounting & Taxation (AREA)
- Strategic Management (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Finance (AREA)
- General Business, Economics & Management (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Development Economics (AREA)
- Entrepreneurship & Innovation (AREA)
- Game Theory and Decision Science (AREA)
- Economics (AREA)
- Marketing (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
Description
Claims
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US09/708,124 US7403922B1 (en) | 1997-07-28 | 2000-11-02 | Method and apparatus for evaluating fraud risk in an electronic commerce transaction |
US708124 | 2000-11-02 | ||
PCT/US2001/045372 WO2002037219A2 (en) | 2000-11-02 | 2001-10-31 | Method and apparatus for evaluating fraud risk in an electronic commerce transaction |
Publications (2)
Publication Number | Publication Date |
---|---|
EP1340178A2 EP1340178A2 (en) | 2003-09-03 |
EP1340178A4 true EP1340178A4 (en) | 2005-06-08 |
Family
ID=24844451
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP01989824A Ceased EP1340178A4 (en) | 2000-11-02 | 2001-10-31 | Method and apparatus for evaluating fraud risk in an electronic commerce transaction |
Country Status (5)
Country | Link |
---|---|
EP (1) | EP1340178A4 (en) |
JP (2) | JP2004524599A (en) |
AU (1) | AU2002228700A1 (en) |
CA (1) | CA2426168A1 (en) |
WO (1) | WO2002037219A2 (en) |
Families Citing this family (79)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7783536B2 (en) * | 2002-07-26 | 2010-08-24 | Oracle International Corporation | Apparatus and method configurable for local jurisdictions that facilitates determining taxes |
US20030187759A1 (en) * | 2002-03-27 | 2003-10-02 | First Data Corporation | Systems and methods for electronically monitoring fraudulent activity |
US7346551B2 (en) | 2002-12-23 | 2008-03-18 | Cybersource Corporation | Method and apparatus for custom strategy specification in a hosted electronic transaction service system |
US9412123B2 (en) | 2003-07-01 | 2016-08-09 | The 41St Parameter, Inc. | Keystroke analysis |
US10999298B2 (en) | 2004-03-02 | 2021-05-04 | The 41St Parameter, Inc. | Method and system for identifying users and detecting fraud by use of the internet |
US7497374B2 (en) * | 2004-09-17 | 2009-03-03 | Digital Envoy, Inc. | Fraud risk advisor |
US20060233332A1 (en) * | 2005-03-24 | 2006-10-19 | Toms Alvin D | Credit worthiness rating method |
GB2427043A (en) * | 2005-05-26 | 2006-12-13 | Moneyexpert Ltd | Online system offering aggregate product and services data with corresponding propensity analysis |
US11301585B2 (en) | 2005-12-16 | 2022-04-12 | The 41St Parameter, Inc. | Methods and apparatus for securely displaying digital images |
US8938671B2 (en) | 2005-12-16 | 2015-01-20 | The 41St Parameter, Inc. | Methods and apparatus for securely displaying digital images |
US10127554B2 (en) | 2006-02-15 | 2018-11-13 | Citibank, N.A. | Fraud early warning system and method |
US7587348B2 (en) * | 2006-03-24 | 2009-09-08 | Basepoint Analytics Llc | System and method of detecting mortgage related fraud |
US7966256B2 (en) | 2006-09-22 | 2011-06-21 | Corelogic Information Solutions, Inc. | Methods and systems of predicting mortgage payment risk |
US8151327B2 (en) | 2006-03-31 | 2012-04-03 | The 41St Parameter, Inc. | Systems and methods for detection of session tampering and fraud prevention |
JP4921875B2 (en) * | 2006-07-13 | 2012-04-25 | ヤフー株式会社 | Network transaction fraud detection method |
GB0615430D0 (en) * | 2006-08-03 | 2006-09-13 | Iti Scotland Ltd | Brand protection management system |
US20090006230A1 (en) * | 2007-06-27 | 2009-01-01 | Checkfree Corporation | Identity Risk Scoring |
US8666841B1 (en) | 2007-10-09 | 2014-03-04 | Convergys Information Management Group, Inc. | Fraud detection engine and method of using the same |
US9842204B2 (en) | 2008-04-01 | 2017-12-12 | Nudata Security Inc. | Systems and methods for assessing security risk |
EP2266252B1 (en) | 2008-04-01 | 2018-04-25 | Nudata Security Inc. | Systems and methods for implementing and tracking identification tests |
US20100106611A1 (en) * | 2008-10-24 | 2010-04-29 | Uc Group Ltd. | Financial transactions systems and methods |
US9112850B1 (en) | 2009-03-25 | 2015-08-18 | The 41St Parameter, Inc. | Systems and methods of sharing information through a tag-based consortium |
US8489499B2 (en) | 2010-01-13 | 2013-07-16 | Corelogic Solutions, Llc | System and method of detecting and assessing multiple types of risks related to mortgage lending |
US9652802B1 (en) | 2010-03-24 | 2017-05-16 | Consumerinfo.Com, Inc. | Indirect monitoring and reporting of a user's credit data |
US8612463B2 (en) * | 2010-06-03 | 2013-12-17 | Palo Alto Research Center Incorporated | Identifying activities using a hybrid user-activity model |
US9235728B2 (en) | 2011-02-18 | 2016-01-12 | Csidentity Corporation | System and methods for identifying compromised personally identifiable information on the internet |
US20120310829A1 (en) | 2011-06-03 | 2012-12-06 | Uc Group Limited | Systems and methods for applying a unique user identifier across multiple websites |
US11030562B1 (en) | 2011-10-31 | 2021-06-08 | Consumerinfo.Com, Inc. | Pre-data breach monitoring |
US10754913B2 (en) | 2011-11-15 | 2020-08-25 | Tapad, Inc. | System and method for analyzing user device information |
US9633201B1 (en) | 2012-03-01 | 2017-04-25 | The 41St Parameter, Inc. | Methods and systems for fraud containment |
US9521551B2 (en) | 2012-03-22 | 2016-12-13 | The 41St Parameter, Inc. | Methods and systems for persistent cross-application mobile device identification |
US10496977B2 (en) | 2012-07-16 | 2019-12-03 | Square, Inc. | Storing and forwarding payment transactions |
WO2014022813A1 (en) | 2012-08-02 | 2014-02-06 | The 41St Parameter, Inc. | Systems and methods for accessing records via derivative locators |
US10163158B2 (en) | 2012-08-27 | 2018-12-25 | Yuh-Shen Song | Transactional monitoring system |
WO2014078569A1 (en) | 2012-11-14 | 2014-05-22 | The 41St Parameter, Inc. | Systems and methods of global identification |
US9911110B2 (en) | 2013-03-05 | 2018-03-06 | Square, Inc. | Predicting approval of transactions |
US8812387B1 (en) | 2013-03-14 | 2014-08-19 | Csidentity Corporation | System and method for identifying related credit inquiries |
US10902327B1 (en) | 2013-08-30 | 2021-01-26 | The 41St Parameter, Inc. | System and method for device identification and uniqueness |
WO2015071980A1 (en) * | 2013-11-13 | 2015-05-21 | 楽天株式会社 | Monitoring assistance device |
JP6199171B2 (en) * | 2013-12-05 | 2017-09-20 | テンソル・コンサルティング株式会社 | Information processing apparatus, method, and computer program |
WO2015088525A1 (en) * | 2013-12-12 | 2015-06-18 | Empire Technology Development, Llc | Randomization of processor subunit timing to enhance security |
JP6294193B2 (en) * | 2014-09-01 | 2018-03-14 | 日本電信電話株式会社 | Transaction management system and transaction management method |
CN105447755B (en) * | 2014-09-01 | 2021-12-17 | 创新先进技术有限公司 | Transaction control method and device |
US10091312B1 (en) | 2014-10-14 | 2018-10-02 | The 41St Parameter, Inc. | Data structures for intelligently resolving deterministic and probabilistic device identifiers to device profiles and/or groups |
US10339527B1 (en) | 2014-10-31 | 2019-07-02 | Experian Information Solutions, Inc. | System and architecture for electronic fraud detection |
CN104599002B (en) * | 2015-02-13 | 2020-10-13 | 北京嘀嘀无限科技发展有限公司 | Method and equipment for predicting order value |
US9881302B1 (en) | 2014-12-11 | 2018-01-30 | Square, Inc. | Intelligent payment capture in failed authorization requests |
CN106161372B (en) * | 2015-04-09 | 2019-05-31 | 阿里巴巴集团控股有限公司 | A kind of Risk Identification Method and device based on address matching |
US11423404B2 (en) | 2015-05-13 | 2022-08-23 | Mastercard International Incorporated | System and methods for enhanced approval of a payment transaction |
US11151468B1 (en) | 2015-07-02 | 2021-10-19 | Experian Information Solutions, Inc. | Behavior analysis using distributed representations of event data |
US10210520B2 (en) | 2015-07-10 | 2019-02-19 | Mastercard International Incorporated | Co-processing electronic signals for redundancy |
CN108780479B (en) | 2015-09-05 | 2022-02-11 | 万事达卡技术加拿大无限责任公司 | System and method for detecting and scoring anomalies |
JP6271085B2 (en) * | 2015-10-30 | 2018-01-31 | 株式会社モルフォ | Learning system, learning device, learning method, learning program, teacher data creation device, teacher data creation method, teacher data creation program, terminal device, and threshold change device |
KR101749494B1 (en) | 2016-01-08 | 2017-06-21 | 한국인터넷진흥원 | System for profiling malicious application/payment information and method thereof |
JP2017126246A (en) * | 2016-01-15 | 2017-07-20 | 有限会社アイティーキューブ | Shipment instruction program, shipment instruction device and shipment instruction system |
CN107230008B (en) * | 2016-03-25 | 2020-03-27 | 阿里巴巴集团控股有限公司 | Risk information output and risk information construction method and device |
JP2017200079A (en) * | 2016-04-28 | 2017-11-02 | 株式会社ジンテック | Computing for outputting distrust index of user by acquiring telephone number of user declared from portable terminal through internet |
US10366378B1 (en) | 2016-06-30 | 2019-07-30 | Square, Inc. | Processing transactions in offline mode |
US10127373B1 (en) | 2017-05-05 | 2018-11-13 | Mastercard Technologies Canada ULC | Systems and methods for distinguishing among human users and software robots |
US9990487B1 (en) | 2017-05-05 | 2018-06-05 | Mastercard Technologies Canada ULC | Systems and methods for distinguishing among human users and software robots |
US10007776B1 (en) | 2017-05-05 | 2018-06-26 | Mastercard Technologies Canada ULC | Systems and methods for distinguishing among human users and software robots |
KR101879416B1 (en) * | 2017-06-12 | 2018-07-18 | 고려대학교 산학협력단 | Apparatus and method for detecting abnormal financial transaction |
EP3416123A1 (en) * | 2017-06-16 | 2018-12-19 | KBC Groep NV | System for identification of fraudulent transactions |
US11494773B2 (en) | 2017-09-22 | 2022-11-08 | Jpmorgan Chase Bank, N.A. | System and method for integrating cyber fraud intelligence and payment risk decisions |
US10699028B1 (en) | 2017-09-28 | 2020-06-30 | Csidentity Corporation | Identity security architecture systems and methods |
US10896424B2 (en) * | 2017-10-26 | 2021-01-19 | Mastercard International Incorporated | Systems and methods for detecting out-of-pattern transactions |
US10896472B1 (en) | 2017-11-14 | 2021-01-19 | Csidentity Corporation | Security and identity verification system and architecture |
US20190197549A1 (en) * | 2017-12-21 | 2019-06-27 | Paypal, Inc. | Robust features generation architecture for fraud modeling |
GB201802315D0 (en) * | 2018-02-13 | 2018-03-28 | Ocado Innovation Ltd | Apparatus and method of fraud prevention |
JP6514383B1 (en) * | 2018-03-19 | 2019-05-15 | ヤフー株式会社 | Judgment apparatus, judgment method, and program |
JP7324226B2 (en) * | 2018-04-17 | 2023-08-09 | ビザ インターナショナル サービス アソシエーション | Systems and methods for processing card-not-present transactions |
CN109636572A (en) * | 2018-10-25 | 2019-04-16 | 深圳壹账通智能科技有限公司 | Risk checking method, device, equipment and the readable storage medium storing program for executing of bank card |
US10872341B1 (en) * | 2018-11-09 | 2020-12-22 | American Express Travel Related Services Company, Inc. | Secondary fraud detection during transaction verifications |
JP2020113178A (en) * | 2019-01-16 | 2020-07-27 | 株式会社メルカリ | Transaction monitoring server, transaction monitoring method, and program |
CN110322252B (en) * | 2019-05-30 | 2023-07-04 | 创新先进技术有限公司 | Risk subject identification method and device |
CN112235128B (en) * | 2020-09-23 | 2022-12-13 | 建信金融科技有限责任公司 | Transaction path analysis method, device, server and storage medium |
CN113222738A (en) * | 2021-05-25 | 2021-08-06 | 山东小葱数字科技有限公司 | Cash register card identification method and device, electronic equipment and computer readable storage medium |
US20220391910A1 (en) * | 2021-06-04 | 2022-12-08 | Handle Financial, Inc. | Action execution using decision engine scores with multiple merchants |
CN116862661B (en) * | 2023-07-20 | 2024-04-26 | 苏银凯基消费金融有限公司 | Digital credit approval and risk monitoring system based on consumption financial scene |
Family Cites Families (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5819226A (en) * | 1992-09-08 | 1998-10-06 | Hnc Software Inc. | Fraud detection using predictive modeling |
DE4323241A1 (en) * | 1993-07-12 | 1995-02-02 | Ibm | Method and computer system for finding incorrect character strings in a text |
US6094643A (en) * | 1996-06-14 | 2000-07-25 | Card Alert Services, Inc. | System for detecting counterfeit financial card fraud |
US6029154A (en) * | 1997-07-28 | 2000-02-22 | Internet Commerce Services Corporation | Method and system for detecting fraud in a credit card transaction over the internet |
JPH11259571A (en) * | 1998-03-13 | 1999-09-24 | Nippon Telegr & Teleph Corp <Ntt> | Electronic business transaction system unauthorized utilization detection method and device |
US6163604A (en) * | 1998-04-03 | 2000-12-19 | Lucent Technologies | Automated fraud management in transaction-based networks |
JPH11328318A (en) * | 1998-05-11 | 1999-11-30 | Sharp Corp | Probability table generating device, probability system language processor, recognizing device, and record medium |
WO2001063452A2 (en) * | 2000-02-23 | 2001-08-30 | Capital One Financial Corporation | Systems and methods for providing anonymous financial transactions |
-
2001
- 2001-10-31 JP JP2002539907A patent/JP2004524599A/en active Pending
- 2001-10-31 CA CA002426168A patent/CA2426168A1/en not_active Abandoned
- 2001-10-31 EP EP01989824A patent/EP1340178A4/en not_active Ceased
- 2001-10-31 WO PCT/US2001/045372 patent/WO2002037219A2/en active Application Filing
- 2001-10-31 AU AU2002228700A patent/AU2002228700A1/en not_active Abandoned
-
2008
- 2008-02-14 JP JP2008032718A patent/JP5265213B2/en not_active Expired - Lifetime
Non-Patent Citations (1)
Title |
---|
No Search * |
Also Published As
Publication number | Publication date |
---|---|
AU2002228700A1 (en) | 2002-05-15 |
WO2002037219A2 (en) | 2002-05-10 |
EP1340178A2 (en) | 2003-09-03 |
JP2004524599A (en) | 2004-08-12 |
WO2002037219A9 (en) | 2004-05-13 |
JP5265213B2 (en) | 2013-08-14 |
WO2002037219A3 (en) | 2003-02-13 |
JP2008165824A (en) | 2008-07-17 |
CA2426168A1 (en) | 2002-05-10 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7403922B1 (en) | Method and apparatus for evaluating fraud risk in an electronic commerce transaction | |
US7865427B2 (en) | Method and apparatus for evaluating fraud risk in an electronic commerce transaction | |
EP1340178A2 (en) | Method and apparatus for evaluating fraud risk in an electronic commerce transaction | |
US7096192B1 (en) | Method and system for detecting fraud in a credit card transaction over a computer network | |
US8032449B2 (en) | Method of processing online payments with fraud analysis and management system | |
US7539644B2 (en) | Method of processing online payments with fraud analysis and management system | |
AU777445B2 (en) | Method and system for detecting fraud in non-personal transactions | |
US20030195859A1 (en) | System and methods for authenticating and monitoring transactions | |
US11714913B2 (en) | System for designing and validating fine grained fraud detection rules | |
US20030172036A1 (en) | Online financial transaction veracity assurance mechanism | |
US20080162202A1 (en) | Detecting inappropriate activity by analysis of user interactions | |
EP1279125A1 (en) | System and method for detecting fraudulent transactions | |
CA2557132C (en) | Computer-implemented method, system and apparatus for the dynamic verification of a consumer engaged in a transaction with a merchant and authorization of the transaction | |
US7797229B2 (en) | Credit authorization systems and methods | |
US12045357B2 (en) | System for designing and validating fine grained fraud detection rules |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
17P | Request for examination filed |
Effective date: 20030520 |
|
AK | Designated contracting states |
Kind code of ref document: A2 Designated state(s): AT BE CH CY DE DK ES FI FR GB GR IE IT LI LU MC NL PT SE TR |
|
AX | Request for extension of the european patent |
Extension state: AL LT LV MK RO SI |
|
RBV | Designated contracting states (corrected) |
Designated state(s): CH DE FR GB LI NL |
|
A4 | Supplementary search report drawn up and despatched |
Effective date: 20050420 |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R003 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE APPLICATION HAS BEEN REFUSED |
|
18R | Application refused |
Effective date: 20151018 |