Paypal, Inc.

Zahid Nasiruddin Shaikh

Srivathsan Narasimhan

Yuval Arie Bercovich

Maayan Liat Zohar

Elad Bichman

Ido Kantor

Methods and systems for a device identification system may be provided. The device identification system may determine an identity of a user device associated with a transaction. The identity may be determined by network address information, hard link information, soft link information, and/or other such information. The network address information may include IPv4 information, IPv6 information, a device ID, and/or other such information. The identity of the user device may be determined and a transaction conducted from the user device may be assigned a fraudulent transaction risk score according to the information. Transactions that are determined to be at a high risk of fraud may be reviewed or otherwise flagged and/or canceled.

Device identification systems

A computer system receives a first information detailing a TLS fingerprint. A computer system determines an amount of bad transactions associated with the TLS fingerprint, wherein a bad transaction is a transaction involved in one or more fraudulent activities. The computer system determines whether the amount of bad transactions associated with the TLS fingerprint exceeds a threshold amount.

Utilizing transport layer security (TLS) fingerprints to determine agents and operating systems

The systems and methods that identify fraud committed using native applications and web applications are provided. A native application executing on a client device generates a pairing identifier. The pairing identifier is associated with native attributes that are used by a fraud detection system to identify fraudulent transactions. The native application also activates a browser and passes the pairing identifier to the browser. The browser associates the pairing identifier with web attributes that store browser data collected on the client device. The client device transmits native attributes together with the pairing identifier and also the web attributes together with the pairing identifier to the fraud detection system. The fraud detection system links the native attributes and the web attributes by the pair identifier, and uses the native attributes and the web attributes to identify fraud that is initiated on the client device.

Acquiring browser data with application data

A computer system receives, from a first set of computing devices, a first information. The computer system creates a model based on the first information, wherein the model correlates one or more TLS fingerprints to one or more agents. The computer system receives a second information, wherein the second information includes a TLS fingerprint. The computer system determines a predicted operating system based on comparing the TLS fingerprint to the model.

A computer system receives, from a first set of computing devices, a first information. The computer system creates a model based on the first information, wherein the model correlates one or more TLS fingerprints to one or more agents. The computer system receives a second information, wherein the second information includes a TLS fingerprint and a declared agent. The computer system determines a predicted agent based on comparing the TLS fingerprint included in the second information to the model. The computer system determines whether the predicted agent matches the declared agent included in the second information.

Growing community of inventors

Timonium, MD, United States of America

Zahid Nasiruddin Shaikh