Vesta Corporation

Jianning Le

Jiaqi Yu

Robert Marssdorf

John Lei

Charles Firkins

Eric L Hopper

Sanjay Khare

Fang Li

Yvette Bohanan

A payment processing system continuously processes transactions. Multiple modeling technologies are used within a fraud detection system to each handle different blocks of segmented transaction data in order to detect fraud. Model data is created from recent segmented transaction data that is currently handled by an existing model; each transaction includes a fraud flag as to whether it was fraudulent or not. The model data is used to train, validate and test any of a number of types of models where the fraud flag is the target. Performance metrics such as Sensitivity, Review Rate and False Positives are calculated for each trained model. An operational objective is used to determine a value for a particular performance metric which then dictates values for other performance metrics for each model. The best model is chosen by optimizing the performance metrics. The best model is configured and deployed to replace the existing model.

Training and selection of multiple fraud detection models

A payment processing system continuously processes transactions. A group of transactions satisfying criteria within a recent measurement window are extracted from transaction data. A second group of transactions satisfying the criteria within a past baseline window are also extracted. An attribute of transactions is selected for analysis and a risk metric value is calculated for transactions in the measurement window having a particular attribute value. The same risk metric is used to calculate a baseline value for transactions in the baseline window having the same attribute value. The baseline value may be normalized and adjusted. The risk metric value is compared to the baseline value and an alert is generated if the risk metric value is greater. Any of a variety of risk metrics are used. Total dollar amount and total order count from the measurement window compared to similar from the baseline window are also used to inform the alert.

Anomaly detection in groups of transactions

A payment processing system continuously processes transactions. Upon arrival, in real-time, a transaction is parsed and each entity is used to retrieve other previous transactions associated with that entity in order to build a link analysis web. Iteratively, each entity in the retrieved transactions is used to retrieve other associated transactions, etc. Before retrieval of associated transactions, each entity is checked whether it appears in a bypass table. If so, that entity is not used to retrieve transactions. Once built, transactions and entities within the link analysis web are analyzed to determine whether the current transaction is fraudulent. Off-line or online, risk metrics such as address mismatch rate, bank decline rate, ticket decline rate and new payment device rate, along with the proportion of a linked entity is used to determine whether that linked entity is erroneous and should be placed into the bypass table and excluded from the web.

Exclusion of nodes from link analysis

A payment processing system continuously processes transactions having data elements. A profile table exists for each data element of the transactions and is continuously updated with risk variables in real time. Risk metrics of various types are calculated in real-time if criteria are met. A risk metric percentage is compared to one of two thresholds to determine whether or not to trigger a strike and whether or not to turn on alert for a particular data element of a profile table. If an alert is turned on then the thresholds become more restrictive for that particular data element for future transactions. Fraud model parameters are also adjusted if a strike is triggered or an alert is turned on. An alert is turned off after passage of time and if the risk metric for a future transaction is below a threshold. Rules are created in real time if an alert is on.

Optimization of fraud detection model in real time

A pre-collections system identifies debtors when they contact a company for a new purchase. A customer service representative (or other automated process) takes payment for the prior debt in real time. The pre-collections system is tightly integrated with an order processing system. Order processing system channels (web site, IVR, CSR, etc.) are enabled to redirect the customer debtor into a corresponding pre-collections system channel. Customers are routed back seamlessly in real time to the point in the order processing system where they left off. The customer is re-instated immediately when their payment is cleared. The system keeps track of blacklisted customers. Logic determines whether to resubmit an item, reclaim a product or service or to immediately collect upon the debt.

Growing community of inventors

Lake Oswego, OR, United States of America

Jianning Le