Mastercard Technologies Canada Ulc

Nudata Security Inc.

Randy Lukashuk

Christopher Bailey

Gary Wayne Richardson

Christopher Everett Bailey

John Hearty

Anton Laptiev

Parin Prashant Shah

Igor Opushnyev

Jonathan Cunningham

Hanhan Wu

Perry McGee

Jake Madison

Sik Suen Chan

Andrian Sevastyanov

Kenny Wan

Yi Wei Tseng

Amiran Gigiberia

Andrew Giblin

Carrie Ka Lai Cheung

A fraud prevention system that includes a client server and a fraud prevention server. The fraud prevention server includes an electronic processor and a memory. The memory includes an online application origination (OAO) service. When executing the OAO service, the electronic processor is configured to determine a fraud score of an online application based on an online application origination (OAO) model that differentiates between a behavior of a normal user and a behavior of a nefarious actor during a submission of the online application on a device, and control the client server to approve, hold, or deny the online application based on the fraud score that is determined.

Online application origination (OAO) service for fraud prevention systems

Systems, methods, devices, and computer readable media related to fraud detection. Fraud detection is achieved using a flexible scripting language and syntax that simplifies the generation of fraud detection rules. The rules are structured as conditional IF-THEN statements that include data objects referred to as Anchors and Add-Ons. The Anchors and Add-Ons used to generate the rules also correspond to a distinct data path for the retrieval data from any of a variety of data sources. The retrieval of data from the various data sources is optimized based on data dependencies within the rules. By knowing the data dependencies of each rule and utilizing parallelization of rule execution, the retrievals of data from the data sources is achieved efficiently so the rules can be executed quickly.

Optimized execution of fraud detection rules

Systems, methods, devices, and computer readable media related to fraud detection. Fraud detection is achieved using a flexible scripting language and syntax that simplifies the generation of fraud detection rules. The rules are structured as conditional IF-THEN statements that include data objects referred to as Anchors and Add-Ons. The Anchors and Add-Ons used to generate the rules also correspond to a distinct data path for the retrieval data from any of a variety of data sources. The generated rules with distinct data paths are then converted using a transpiler from the scripting language into native language source code (e.g., PHP, Java, etc.) for deployment in a particular environment. The rules are then executed in real-time in the environment to detect potential fraudulent activity.

Transpiration of fraud detection rules to native language source code

An account recommendation system that includes a server. The server is operable to identify a user account based on a server-side persistent device identification. The server includes a processor and a memory. The server is configured to receive a request including one or more attributes related to a client device, identify the server-side persistent device identification ('PDI') record for the client device based on the one or more attributes of the client device, identify one or more candidate accounts based on the server-side persistent device identification, determine confidence scores for each of the one or more candidate accounts, generate a recommendation signal for the user account associated with the client device based on the confidence scores, and transmit the recommendation signal to a merchant server.

Account recommendation based on server-side, persistent device identification

A fraud prevention system that includes a server. The server is operable to receive a first attribute of a client device from the client device and associated with a first transaction, receive a second attribute of the client device from the client device and associated with the first transaction, receive a third attribute related to the client device and associated with the first transaction, and generate a persistent device identification ('PDI') record including the first attribute, the second attribute, and the third attribute, store the PDI record in a memory, receive the third attribute related to the client device and associated with a second transaction, and identify the client device using the PDI record based on the third attribute without receiving, in association with the second transaction, the first attribute of the client device and the second attribute of the client device.

Server-side persistent device identification for fraud prevention systems

Systems and methods for matching and scoring sameness. In some embodiments, a computer-implemented method is provided, comprising acts of: identifying a plurality of first-degree anchor values from the first digital interaction, wherein the plurality of first-degree anchor values comprise first-degree anchor values X and Y; accessing a profile of the first-degree anchor value X, wherein: the profile of the first-degree anchor value X comprises a plurality of sets of second-degree anchor values; and each set of the plurality of sets of second-degree anchor values corresponds to a respective anchor type and comprises one or more second-degree anchor values of that anchor type; determining how closely the first-degree anchor values X and Y are associated; and generating an association score indicative of how closely the plurality of first-degree anchors are associated, based at least in part on how closely the first-degree anchor values X and Y are associated.

Systems and methods for matching and scoring sameness

Systems and methods for detecting and scoring anomalies. In some embodiments, a method is provided, comprising acts of: (A) identifying a plurality of values of an attribute, each value of the plurality of values corresponding respectively to a digital interaction of the plurality of digital interactions; (B) dividing the plurality of values into a plurality of buckets; (C) for at least one bucket of the plurality of buckets, determining a count of values from the plurality of values that fall within the at least one bucket; (D) comparing the count of values from the plurality of values that fall within the at least one bucket against historical information regarding the attribute; and (E) determining whether the attribute is anomalous based as least in part on a result of the act (D).

Systems and methods for detecting and scoring anomalies

Techniques for ascertaining legitimacy of communications received during a digital interaction with a client device. The techniques include: receiving a communication; identifying from the communication a first secured token; processing the first secured token by: obtaining, from the first secured token, information indicating a state of the digital interaction; and using the information indicating the state to determine whether the communication is from the client device; and when it is determined that the communication is from the client device, causing at least one action responsive to the communication to be performed; updating the information indicating the state of the digital interaction to obtain updated information indicating the state of the digital interaction; and providing a second secured token to the client device for use in a subsequent communication during the digital interaction, the second secured token comprising the updated information indicating the state of the digital interaction.

Systems and methods for detecting and preventing spoofing

Techniques for detecting application program spoofing. The techniques include: receiving a communication from an application program executing on a client device different from the at least one computer; identifying from the communication an asserted identity of the application program; and verifying the asserted identity of the application program at least in part by: interacting with the client device to obtain additional information about the application program, and determining whether the additional information about the application program is consistent with the asserted identity of the application program.

A technique for distinguishing between a human user and a software robot. The technique includes: receiving a first communication from a device different from the at least one computer; identifying, from the first communication, a request to access a web resource; generating a shuffled image that encodes a challenge text, the generating comprising: generating an initial image encoding the challenge text; dividing the initial image into image portions; and generating the shuffled image as a shuffled arrangement of the image portions; generating decoding information for revealing the challenge text encoded in the shuffled image; transmitting the shuffled image and the decoding information to the device; receiving a second communication from the device; identifying, from the second communication, a response text; and providing the device with access to the web resource based on a comparison between the challenge text and the response text.

Systems and methods for distinguishing among human users and software robots

A technique for distinguishing between a human user and a software robot. The technique includes: receiving a first communication from a device different from the at least one computer; identifying, from the first communication, a request to access a web resource; transmitting software code and location information to the device, wherein the location information specifies a plurality of locations encoding a visual representation of a challenge text, and wherein the software code, when executed by an Internet browser, causes a plurality of graphical elements to be displayed at the plurality of locations in a webpage so that the webpage displays the challenge text; receiving a second communication from the device; identifying, from the second communication, a response text; and providing the device with access to the web resource based on a comparison between the challenge text and the response text.

A technique for distinguishing between a human user and a software robot. The technique includes: receiving a first communication from a device different from the at least one computer; identifying, from the first communication, a request to access a web resource; generating an image that encodes a challenge text, the image comprising data stored in a plurality of channels including a transparency channel, the generating comprising: generating decoding information representing the challenge text; and storing the decoding information in the transparency channel of the image; transmitting, via the at least one network, the generated image to the device; receiving a second communication from the device; identifying, from the second communication, a response text; and providing the device with access to the web resource based on a comparison between the challenge text and the response text.

Techniques for detecting device type spoofing. The techniques include: receiving a communication from a client device different from the at least one computer; identifying from the communication an asserted type of the client device; and verifying the asserted type of the client device at least in part by: interacting with the client device to obtain additional information about the client device, and determining whether the additional information about the client device is consistent with the asserted type of the client device.

Growing community of inventors

Errington, Canada

Randy Lukashuk