Patent ID: 11941633
Assignee: U.S. BANCORP, NATIONAL ASSOCIATION
Field: IT methods for management (Electrical engineering)
Classification: CPC G | IPC G

Claim 14:
15. A computerized method comprising:
collecting, by a computer processor, location data for suspicious fraud transactions involving a plurality of transaction cards at a first location over a first time window;
constructing, by the computer processor, a three-dimensional matrix using collected locations and associated transaction cards over a plurality of time windows, wherein the constructing includes:
incrementing a different counter for each of the plurality of transaction cards that performed a fraudulent transaction at a second location subsequent to performing a non-fraudulent transaction at the first location during the first time window; and
inserting the incremented counters into separate rows of the three-dimensional matrix that each corresponds to a different transaction card of the plurality of transaction cards;

updating, by the computer processor, indicators in the three-dimensional matrix after each new time window;
generating, by the computer processor, from indicators in the three-dimensional matrix at each update a candidate point-of-compromise (POC) location;
responsive to identifying the POC location, determining, by the computer processor, a number of transaction cards having suspicious fraud activity at the POC location for each of a plurality of time slices of the first time window;
identifying, by the computer processor, an initial POC time slice that has a highest number of transaction cards having suspicious fraud activity of the plurality of time slices;
determining, by the computer processor, an end POC time slice after the initial POC time slice based on the end POC time slice being the first time slice after the initial POC time slice having a number of transaction cards having suspicious fraud activity below a value determined from a number of transaction cards having suspicious fraud activity of the plurality of time slices, wherein a time period beginning at the initial POC time slice and ending at the end POC time slice is a window of compromise;
determine one or more transaction cards of the plurality of transaction cards that performed non-fraudulent transactions at the POC location during the first time window but outside and not within the window of compromise between the initial POC time slice and the end POC time slice; and
responsive to the determination of the one or more transaction cards that performed non-fraudulent transactions at the POC location during the first time window but outside and not within the window of compromise between the initial POC time slice and the end POC time slice, remove each row containing an incremented counter for one of the one or more transaction cards from the three-dimensional matrix.