Detecting fraud by calculating email address prefix mean keyboard distances using machine learning optimization

Abstract

This disclosure relates to systems and methods for identifying fraudulent email addresses associated with an electronic payment service. In some implementations, a computing device receives an email with a prefix having a number of characters and characterized by a prefix length indicative of the number of characters in the prefix. The computing device identifies each of a number of bigrams is identified within the prefix, and determines a row and column distance for each bigram between two consecutive characters of the bigram as positioned on a keyboard. The computing device calculates a Euclidean distance between the two consecutive characters of the bigram based on the row and column distances, and determines a normalized distance based on the prefix length and an average of the Euclidean distances calculated for the number of bigrams in the prefix. The normalized distance is compared with a value to classify the email as suspicious or as not suspicious.