High resolution transaction-level fraud detection for payment cards in a potential state of fraud

A system and method are disclosed, to distinguish fraudulent transactions from a legitimate transaction, predicated on the notion that the card is considered likely to be in state of fraud. The disclosed system and method can be activated as soon as an account has suspicious activity that causes a high score for potential fraud, but before a bank either can or needs to confirm fraud. The system or method is able to pinpoint the actual fraudulent transactions inside a window of potential fraudulent activity, using a specialized model referred to as the pinpoint model.

TECHNICAL FIELD

The subject matter described herein relates to fraud detection, and more particularly to high resolution transaction-level fraud detection for payment cards in a potential state of fraud.

BACKGROUND

Conventional fraud detection technology, such as the Falcon fraud detection technology developed by Fair Isaac Corporation, is designed to detect fraudulent financial payment cards and accounts. In the case of payment cards, entity transaction profiles contain recursively updated fraud feature detectors for the card based on the card history to enable real-time updates of variable estimates and the production of a neural network score that determines the likelihood that the card is in a state of fraud. In one example, Falcon models by design detect accounts in a state of fraud, and focus less on specific transactions that are fraudulent. In today's digital world, it is desirable for cards that are in a state of highly probable fraud to identify specific transactions that are most likely perpetrated by the fraudster versus the true customer. These digital systems enable automation of decline or reverse of specific transactions deemed likely not performed by the cardholder.

FIG. 1illustrates a Falcon model, which takes the transaction and the entity profiles associated with the card to maintain a recursive set of input features. These feature detectors are updated with each transaction and are used in a neural network model to determine a probability that the card is in a state of fraud. In other words, Falcon models use profiles to keep a snapshot of an account's recent behavior and fraud feature detectors as demonstrated inFIG. 1. The Falcon model uses these stored profile feature detectors in the neural network training to produce a score reflecting the likelihood that the card is in a state of fraud.

The Falcon score directly depends on the state of these profiles. If the feature detectors focus on producing features that point to changes at the card level that are inconsistent with the cardholder or consistent with global fraudulent behaviors, then when a card has unusual transactions, it scores high. During this period, there can be both legitimate and fraudulent transactions when the account is in a probable fraudulent state. On average, about 60% of transactions inside a fraud window are legitimate transactions by the real cardholder. Many banks choose to block future transactions based on knowledge of the card account being in a state of fraud.

Falcon had substantially defined the payment fraud detection analytics state-of-the art for the past two decades. One key to Falcon is that the model detects cards in a state of fraud. These highly refined transactions enable analysts to review cards that may be in a state of fraud. Now with the increase in digital notification SMS, TXT, Apps that allow customers to triage legitimate vs. non-legitimate transactions coupled with the expectation that banks ‘understand’ customer behaviors requires a new transaction classification model to be applied on top of Falcon.

However, while blocking all transactions when the card account is in a state of fraud is a prudent practice, some banks want to determine which transactions are likely still legitimate and allow them to continue. Accordingly, what is needed is a system and method for high-resolution transaction-level fraud detection for payment cards in a potential state of fraud, in order to allow legitimate transactions to be executed.

SUMMARY

This document describes an analytic system and method to distinguish fraudulent transactions from a legitimate transaction, predicated on the notion that the card is considered likely to be in state of fraud. In other words, the disclosed system and method can be activated as soon as an account has suspicious activity that causes a high score for potential fraud, but before a bank either can or needs to confirm fraud. The system or method is able to pinpoint the actual fraudulent transactions inside a window of potential fraudulent activity, using a specialized model hereafter referred to as the “pinpoint model.” This new analytic is better suited to automation of transaction reporting to customers for confirmation and/or reversal.

By training on the transaction data inside the fraud window, the pinpoint model is able to learn specific population dynamics unique to cards in a fraud episode. These include completely different fraud/non-fraud risk factors, fraud rates, and specific fraud tactics associated with fraudsters. The pinpoint model is a cascade model which focuses on cascade population characteristics to learn to differentiate between cardholder transactions vs. fraudster transactions. Examples of fraudster characteristics could include differing transaction values, ATM-cash behaviors/rates, predominance of certain merchant category codes compared to the legitimate cardholder, and others.

Beyond differences between fraud and legitimate transactions in this cascade region, the pinpoint model needs to very specifically understand typical behaviors of legitimate card holders—during these fraud episodes cardholders will have an expectation that the bank would understand their recurrent and typical behaviors. We will discuss technology to address this challenge.

In some aspects, a system, method and computer program product for scoring the legitimacy of specific and subsequent transactions by a payment card that is likely in a state of fraud are presented. The system, method and computer execute a process to receive transaction data for a transaction by a payment card associated with a fraud score indicating the payment card is likely in a state of fraud, the fraud score being generated by a fraud detection computing system in communication with the pinpoint processor, the transaction data including one or more attributes. The process further includes accessing, from a card profile associated with the payment card, a token table having an indexed table of n most frequent tokens associated with the payment card, a frequency table of pseudo-frequencies of the corresponding n most frequent tokens and linked with the token table by a common index, and a ranking table that provides a ranking of the tokens.

The process further includes executing a look-up of the token table based on the one or more attributes in the transaction data to determine a frequency and a rank of each of the one or more attributes that correspond with a token, and calculating one or more variables based on the frequency and the rank of each of the one or more attributes. The process further includes generating, using a pinpoint model, a score that represents a likelihood of the transaction being legitimate.

The process further includes updating the token table, the frequency table, and the ranking table based on the transaction data for access by the pinpoint processor for the subsequent transactions. In some aspects, the pinpoint model employs a Recursive Frequency List (RFL) to summarize a transaction history of the payment card and associated cardholder, as described in further detail below.

DETAILED DESCRIPTION

This document describes a system and method to determine and allow legitimate (i.e. non-fraud) financial transactions by a card to continue, when the card account is likely in a state of fraud. By doing so, implementing the disclosed system and method allows banks to minimize negative customer impact by allowing legitimate transactions to continue, removing highly likely fraud transactions from the account automatically, and allowing for fraud losses on these transactions to be reversed in a timely fashion.

In accordance with exemplary implementations, a “pinpoint model” is described herein. The pinpoint model is a model that distinguishes between fraudulent and legitimate transactions of a card account within a period of fraudulent activity. Once the card account is flagged by a fraud detection system as likely being in a state of fraud, the pinpoint model can differentiate specific transactions as being likely either those of the legitimate cardholder or of a fraudster. The operational flow of the pinpoint model is shown inFIG. 2. When a card account scores above a threshold indicating the card is likely in a state of fraud, the pinpoint model is then used to score the specific and subsequent transactions as whether they are legitimate or fraudulent.

The pinpoint model is trained on transactions within the fraud window for a payment card. This model is focused on a highly enriched transaction environment where there is a high probability of transactions being actual fraud. The model then focuses on only the class of transactions occurring during these episodes of fraud on the payment card to focus the score on differentiating between legitimate and illegitimate transaction data. A visualization of this is shown inFIG. 3. The Falcon model is trained on PAN-level tagged data. As shown here, once an account is perceived to be in a state of fraud, all transactions inside the fraud window are perceived fraudulent by the Falcon model, which is focused on card fraud probability. The pinpoint models focus on leveraging Falcon to detect fraudulent cards, and then differentiating between legitimate and fraudulent transactions in the perceived likely fraud episode.

The pinpoint model subsequently is trained on a dataset that is a small fraction of the data on which the Falcon model is trained, but has completely different characteristics. For example, the transaction fraud rate inside the fraud episode is about 60%, as such a much enriched fraud/non-fraud population compared to the base Falcon model which drives detection of fraud on the payment cards.

These cascade models allow transactions to be identified as fraudulent based on detailed models that determine whether the transaction meets a customer's recurrences in their transaction history and the details of how fraud is occurring in the ecosystem. The best of these pinpoint models are fully adaptive that respond and continuously reweight based on recently worked fraud and non-fraud transactions within a fraud case.

The pinpoint model employs a Recursive Frequency List (RFL) to mathematically summarize the cardholder's transaction history. These RFL lists are very important as these recurrent behaviors are extremely hard, if not impossible, for fraudsters to replicate unless they observe all prior transaction history. In situations where card numbers and details are purchased on the dark web, i.e. part of the Web not indexed by search engines, these transaction histories and in fact the specific identification and subsequent observation of cardholders are not only unlikely but cost prohibitive. Therefore, focusing on understanding recurrences of legitimate behavior can help drive better transaction models in the cascade region, e.g. transactions at the same grocery stores, gas stations, ATMs, CNP merchants, etc., (and such transactions are likely the cardholder), versus transactions with new merchants that are more likely to be fraudulent and not legitimate.

The Recursive Frequency List utilizes the following three tables, stored in a card profile in a memory, and accessible by a fraud score computing system:

1. A table of most frequent tokens (“token table”)

2. A table of pseudo-frequencies of the corresponding most frequent tokens (“frequency table”)

3. A table of ranking for these tokens (“ranking table”)

These three tables are collectively referred to as the Recursive Frequency List in the following description. It should be noted that the “frequencies” stored in the frequency table are not true “frequencies” but are pseudo-frequencies that approximate or estimate the true frequencies and apply over a decayed time or event window.

For illustrative purposes, the following is an example of a frequent-token list, as shown inFIG. 4. At least one token table and at least one frequency table are coupled via common indices. From the token table and frequency table, the frequency for token “1111” (with index 1 in the token table) is 0.2. The frequency for token “2222” (with index 2 in the Token table) is 0.7. The frequency for token “4321” (with index 14) is 0.4. The ranking table stores the common indices of token table and frequency table in the decreasing order of the frequency. For example, referring to the ranking table, index 11 in the token table (corresponding to token “1234”) has the highest frequency (3.1), index 13 (corresponding to the token “3434”) the second-highest frequency (2.3), and so on.

Upon each transaction, the system looks up the respective token table to determine whether the associated attribute is frequently occurring for that cardholder utilizing the rank of the token from the ranking table. These tokens could include any of the following attributes:Postal codeMerchant IDMerchant category codeCNP transaction amountHigh dollar amountsDollar amount×MCCATM IDCountry codeEtc.

Then, various variables are calculated based on whether transaction and associated extracted token(s) are frequent or not. Once the lookup is complete, the tables are updated as follows:All the frequencies in the frequency table are decayed by a multiplicative factor β, 0<β<1;Then, token table and frequency table are updated as follows:If the current token is not in the token table, then the least-frequent token (determined by the ranking table) is replaced with the current token if the least frequent token's frequency (based on the frequency table) is less than a threshold δ,

0<δ<11-β.
In another implementation for determining the threshold δ, adaptive thresholds can be used based on match rates and recycling rates associated with the token table. The frequency of the current token is initialized to be α.If the current token is already in the token table, then its frequency is increased by λFinally, the ranking table is updated accordingly to reflect any changes to the ranking of tokens in the token table based on the update.

“Frequencies” in the frequency table are not true frequencies but based on a ranking associated with the values of α, β, and λ which are dependent on application and can vary based on the type of transaction tokens being monitored in the token table.

Placement on the recurrence tables can then drive whether or not the specific transaction is likely that of the cardholder, recognizing that fraudsters rarely have such detailed understanding of the cardholder's transaction behaviors for the card data that they compromise or purchase from the dark web. References to recurrence lists are included in U.S. Pat. No. 8,090,648 USPO.

Adaptive Analytics

Given that pinpoint is operating on specific fraud episode activity and fraudsters change their behavior over time, pinpoint models require utilizing adaptive model updates/learning. Adaptive analytics is discussed in U.S. patent application Ser. No. 12/040,796, which is incorporated by reference herein for all purposes. In some implementations, a Naïve Bayesian (NB) adaptive learner model can be used. This model operates on a fixed size of live training exemplars where models are made adaptive by continuously updating fraud and non-fraud first-in-first-out (FIFO) queues (also referred to as fraud and non-fraud tables) from which model parameters are estimated. The FIFO queues are populated with transaction records labeled by a fraud analyst.

A fraud tag that specifies whether each record is fraudulent or non-fraudulent, and the model is regularly updated based on this rotating set of fraud and non-fraud examples. The model is trained to produce a score that indicates the probability of fraud. These fraud/non-fraud queues are important to reflect the current fraud rates associated with the current fraud attack vectors and allows for improved analytics compared to static models which have dated historical relationships between fraud and non-fraud transactions. Model parameters can include the prior probabilities (the priors), which are the overall probability of a record being fraud and the overall probability of a record being non-fraud in the feedback data.

Once the fraud and non-fraud transaction tables are full, insertion of a new record causes the oldest record in the corresponding table to be removed in a first-in, first-out (FIFO) mode. In the case of the Naïve Bayes classifier, separate frequency tables are also maintained and updated for each feature with the counts of records having values in the individual bins. It should be apparent to those skilled in the art that for continuous variables binning technologies can be applied to make all features discrete to facilitate use of Naïve Bayes classifiers. It should also be apparent to those skilled in the art that a variety of other classifiers can be applied to these fraud and non-fraud tables.

Records to be scored are presented to the model and the model computes the likelihoods of the input data values given that the record is fraudulent and given that the record is non-fraudulent. These likelihoods are combined with the prior probabilities to calculate the marginal probabilities of the input data. The marginal probabilities are combined via Bayes formula (Equation 1: Bayes Equation) to compute the posterior probability. The posterior or some value monotonically related to the posterior becomes the output score.

Pinpoint Model Transaction Performance

As explained above, pinpoint model employed focuses on transaction classification based on identification of cards with a high likelihood of being in a state of fraud. This transaction dataset focuses on the transaction characteristics of the highest fraud risk transactions. The models utilize both transaction characteristics to monitor the fraud attack tactics and recurrence list transaction activity to determine, using adaptive model technology (or static models), which transactions are most likely legitimate in the fraud window. The cascade Falcon score threshold for determining cards in a likely state of fraud is variable, and once set, the pinpoint model can find the appropriate weighting of transaction model features to classify transactions.

To compare transaction-level performance, the same false positive ratio (TFPR) is compared. The TFPR measures the number of legitimate transactions flagged incorrectly for each fraud transaction correctly identified. To show the value of using pinpoint models, an improvement over the standard Falcon model used by the majority of card issuers today can be shown. As shown inFIG. 5, at TFPR 1:1, the pinpoint model detects 86.66% of fraudulent transactions and 91.49% of fraudulent dollars. This is roughly 30% better relative performance on correctly rank-ordering transactions in terms of legitimate fraud within the fraud window.

At a TFPR of 0.5:1, the pinpoint model detects 56.66% of the fraudulent dollars and 45.66% of fraudulent transactions. The standard Falcon score in this evaluation was unable to meet a 0.5:1 TFPR. This demonstrates that, for banks that want a strong fraud transaction identification at a rate of two fraud transactions to one non-fraud transaction flagged ratio, pinpoint is a preferred option.