Mastercard International Incorporated

Joshua A Allbright

Christopher John Merz

Felix Johannes Flory

Peng Yang

Amudhan Venkatesan

Melanie Gersten

Simon R Hunt

Adam Kenneth Hosp

Srinivas Kosaraju

Hima Bindu Nagisetty

Jeffery David Hiatt

A system for identifying complete account identifiers from partial account identifiers is provided. The system includes an account identification computing device including at least one processor and a memory device in communication with the at least one processor. The processor is configured to receive transaction data including unique merchant identifiers, build a merchant table using the transaction data, and receive a list including partial account identifiers. The processor is further configured to determine, for each unique merchant identifier, a number of candidate account identifiers and calculate at least one metric based on the number of candidate account identifiers. The processor is further configured to identify a source unique merchant identifier and match at least one candidate account identifier to a complete account identifier by matching one of the partial account identifiers to the at least one candidate account identifier.

Systems and methods for identifying full account numbers from partial account numbers

An inverse recommender system for detecting out-of-pattern payment transactions includes a memory device and a processor programmed to receive transaction data. The transaction data corresponds to historical payment transactions between account holders and merchants. The processor is programmed to generate a merchant correspondence matrix including the merchants and counters indicating the number of historical payment transactions between merchant pairs of the merchants and the account holders. The processor is programmed to store the merchant correspondence matrix in a memory device linking the merchant pairs to each account holder. The processor receives additional transaction data associated with a new payment transaction between an account holder and a merchant, and to generate an inverse recommender score for the new payment transaction based on the account holder's historical payment transaction data. The account holder's historical payment transaction data includes historical payment transaction data associated with the merchants visited by the account holder.

Systems and methods for detecting out-of-pattern transactions

A method and system for detecting fraudulent network events in a payment card network by incorporating breach velocities into fraud scoring models are provided. A potential compromise event is detected, and payment cards that transacted at a compromised entity associated with the potential compromise event are identified. Subsequent transaction activity for the payment cards is reviewed, and a data structure for the payment cards are generated. The data structure sorts subsequent transaction activity into fraud score range stripes. The data structure is parsed over a plurality of time periods, and at least one cumulative metric is calculated for each of the time periods in each fraud score range stripe. A plurality of ratio striping values are determined, and a set of feature inputs is generated using the ratio striping values. The feature inputs are applied to a scoring model used to score future real-time transactions initiated using the payment cards.

Systems and methods for incorporating breach velocities into fraud scoring models

A method and system for detecting fraudulent network events in a payment card network are provided. A plurality of scored payment card transaction authorization requests is received, originating from a plurality of merchants, and data structures for each of a plurality of merchant groups are generated. Each data structure sorts the scored authorization requests into fraud score range stripes. The data structures are parsed over a plurality of time periods, and at least one cumulative metric is calculated for each merchant group for each of the time periods in each fraud score range stripe. A plurality of ratio striping values is determined for each merchant group, and a set of feature inputs is generated using the ratio striping values. A second fraud detection model is applied to the scored authorization requests. Parameters of the second fraud detection model are configured to change based on the generated set of feature inputs.

Systems and methods for improved detection of network fraud events

A common point of purchase (CPP) system for identifying a common point of purchases involved in fraudulent or unauthorized payment transactions is provided. The CPP system includes a common point of purchase (CPP) computing device that is configured to receive transaction data and build a table in a database, the table including recording pairing merchant and account identifiers. The CPP computing device is also configured to receive a list of flagged account identifiers and compare the list to the table. The CPP computing device is further configured to compute a metric and build a merchant profile for each merchant, for display at a client system.

Systems and methods for identifying fraudulent common point of purchases

A computing system for detecting a pattern of fraudulent network events in a payment card network is configured to continuously receive a plurality of scored transaction authorization requests each including a respective account number and a respective fraud score. The computing system is also configured to sort the scored transaction authorization requests into account ranges based the account number, and sort the transaction authorization requests within each of the account ranges into a fraud score range stripes based on the corresponding fraud score. The computing system is further configured to calculate, for the scored transaction authorization requests within each fraud score range stripe, a ratio of a cumulative metric for a shorter time period over a longer time period, and detect, in near real-time, a fraud event associated with one of the account ranges based on the ratio for one of the fraud score range stripes within the account range.

Systems and methods for early detection of network fraud events

A message tracking computing device for identifying anomalous activity in real-time is provided. The message tracking computing device is programmed to receive real-time transaction data including a plurality of transaction records. Each transaction record associated with a payment transaction. The message tracking computing device is also programmed to sort the plurality of transaction records into a plurality of channels. The message tracking computing device is further programmed to compute, for each channel, a normalized velocity score by computing a streaming mean, computing a streaming standard deviation, and computing the normalized velocity score based on the streaming mean, the streaming standard deviation, and a transaction ratio. In addition, the message tracking computing device is programmed to analyze the computed normalized velocity score for each channel to detect anomalous activity, automatically generate an alert message identifying the anomalous activity, and transmit the alert message to a remote computing device.

Systems and methods for real-time institution analysis based on message traffic

A common point of purchase (CPP) system for identifying a common point of purchases involved in fraudulent or unauthorized payment transactions is provided. The CPP system includes a common point of purchase (CPP) computing device that is configured to receive transaction data, store the transaction data in a database, and perform a look up within the database. The CPP computing device is also configured to build a merchant table, receive a card list, and compare a plurality of flagged account identifiers in the card list to account identifiers in the merchant table. The CPP computing device is further configured to retrieve a unique merchant identifier and/or a merchant name identifier associated with the merchant table account identifiers matched with the flagged account identifiers, aggregate the unique merchant identifier using the merchant name identifier, and determine a first number of the flagged account identifiers associated with the merchant name identifier.

The methods described herein are configured to obtain a first record pattern associated with the unidentified entity and select a second record pattern associated with an entity identifier of a known entity. Based on the first record pattern matching the second record pattern, the entity identifier of the known entity is associated to the unidentified entity to indicate that the unidentified entity and the known entity are the same. Determining the entity identifier of the unidentified entity enables the linking of separate identifier systems of data structures to facilitate communication and/or interaction between the data structures.

Entity identification based on a record pattern

A message tracking computing device for identifying anomalous activity in real-time is provided. The message tracking computing device includes a memory in communication with a processor. The processor is programmed to receive a transaction dataset including a plurality of transaction records, each transaction record associated with a payment transaction. The processor is further programmed to compute, for a subset of transaction records of the plurality of transaction records, a normalized velocity score by computing a streaming mean, computing a streaming standard deviation, and computing the normalized velocity score based on the streaming mean, the streaming standard deviation, and a transaction ratio. The processor is further programmed to analyze the at least one computed normalized velocity score to detect anomalous activity, automatically generate an alert message identifying the anomalous activity, and transmit the alert message to a remote computing device.

Systems and methods for message tracking using real-time normalized scoring

An analytics computing system for analyzing payment transaction data to identify merchants having a recurring payment program is provided. The analytics computing system is configured to receive first payment transaction data for a plurality of transactions associated with a merchant, generate an actual transaction amount distribution, compare the actual transaction amount distribution to a stored model distribution, compare an angle distance to a predefined threshold value, and identify whether the merchant is a merchant performing recurring payment transactions. The analytics computing system is also configured to store that the merchant is a recurring payment merchant and alert an analyst that the merchant is a recurring payment merchant by transmitting an alert message to a user computing device in communication with the analytics computing device.

Growing community of inventors

Valley Park, MO, United States of America

Joshua A Allbright