Identifying and labeling fraudulent store return activities

Abstract

A method and system for identifying and labeling fraudulent store return activities includes receiving, by a server, retailer events from an online transaction system of a retailer, the retailer events comprising records of transactions between customers and the retailer, including sale, exchange and return activities across multiple stores. The retailer events are processed to build a network that associates stores, transactions, payment instruments, and customer identification over related activity sequences of transactions. Return fraud labels are generated for the retailer events representing returns based on identified fraud characteristics of the related activity sequences by: representing behavior variables extracted from activity sequences by respective signature vectors; calculating pairwise similarity between the signature vectors; identifying clusters of the signature vectors having common behavior patterns based on the calculated pairwise similarity; and labeling the identified clusters of signature vectors as non-fraudulent behavior or fraudulent behavior.