Systems and methods for enhanced fraud detection based on transactions at potentially compromised locations

A computer-implemented method for enhancing fraud detection based on transactions at potentially compromised locations is provided. The method includes determining a list of potentially compromised transaction locations, storing the list of potentially compromised transaction locations, and receiving from a first transaction location a first authorization request message for a first transaction. The first authorization request message is associated with a first payment account. The method also includes determining the first transaction location based on the first authorization request message, determining if the first transaction location is in the list of potentially compromised transaction locations, and if the determination is that the first transaction location is included in the list of potentially compromised transaction locations, flagging the first payment account as potentially compromised so that a fraud score for a future transaction is associated with the first payment account is adjusted based on the potentially compromised flag.

BACKGROUND OF THE DISCLOSURE

The field of the disclosure relates generally to enhancing fraud detection, and more specifically to methods and systems for detecting potentially compromised locations and updating the fraud scoring of payment cards that conduct transactions at those potentially compromised locations.

Many online merchants store payment card information, including payment card numbers, for their returning customers, to process returns, and for purchase trend research. This payment card information may include other cardholder identifying information. In many cases, this information is stored for processing recurring transactions or to improve the speed of the checkout process for future online transactions. The stored payment card information allows a customer to avoid having to re-enter his or her payment card information every time the customer makes an online purchase from the merchant. However, this payment card information has the potential to be stolen. Over the past several years, many cases of security breaches, also known as account data compromises, have been reported. While some breaches have been for a few payment cards, other breaches have affected millions of payment cards. The stolen payment card information may then be used to perform fraudulent transactions.

Additionally, card present transactions can lead to compromised payment cards at merchant locations and ATMs. The compromised payment cards can then be used for future fraudulent transactions at other locations. For example, an employee steals credit card information and uses that stolen credit card information to perform fraudulent transactions. Additionally, while the compromise may only occur at Merchant A, the subsequent fraudulent transactions may be transacted with multiple different merchants. Determining the source of the breaches can be difficult. Furthermore, additional payment card accounts that also may have been breached at Merchant A are difficult to identify.

BRIEF DESCRIPTION OF THE DISCLOSURE

In one aspect, a computer-implemented method for enhancing fraud detection based on transactions at potentially compromised locations is provided. The method is implemented using a fraud location analyzing computer device in communication with a memory. The method includes determining by the fraud location analyzing computer device a list of potentially compromised transaction locations, storing in the memory the list of potentially compromised transaction locations, and receiving from a first transaction location a first authorization request message for a first transaction. The first authorization request message is associated with a first payment account. The method also includes determining by the fraud location analyzing computer the first transaction location based on the first authorization request message, determining by the fraud location analyzing computer device if the first transaction location is in the list of potentially compromised transaction locations, and if the determination is that the first transaction location is included in the list of potentially compromised transaction locations, flagging the first payment account as potentially compromised so that a fraud score for a future transaction is associated with the first payment account is adjusted based on the potentially compromised flag.

In another aspect, a fraud location analyzing computer device used to enhance fraud detection based on transactions at potentially compromised locations is provided. The fraud location analyzing computer device comprising a processor communicatively coupled to a memory device. The processor is programmed to determine a list of potentially compromised transaction locations, store the list of potentially compromised transaction locations, and receive a first authorization request message for a first transaction at a first transaction location. The first authorization request message is associated with a first payment account. The processor is also programmed to determine the first transaction location based on the first authorization request message, determine if the first transaction location is in the list of potentially compromised transaction locations, and if the determination is that the first transaction location is included in the list of potentially compromised transaction locations, flag the first payment account as potentially compromised so that a fraud score for a future transaction is associated with the first payment account is adjusted based on the potentially compromised flag.

In a further aspect, at least one non-transitory computer-readable storage media having computer-executable instructions embodied thereon is provided. When executed by an actual geographic location analyzer computer device having at least one processor coupled to at least one memory device, the computer-executable instructions cause the processor to determine a list of potentially compromised transaction locations, store the list of potentially compromised transaction locations, and receive a first authorization request message for a first transaction at a first transaction location. The first authorization request message is associated with a first payment account. The computer-executable instructions also cause the processor to determine the first transaction location based on the first authorization request message, determine if the first transaction location is in the list of potentially compromised transaction locations, and if the determination is that the first transaction location is included in the list of potentially compromised transaction locations, flag the first payment account as potentially compromised so that a fraud score for a future transaction is associated with the first payment account is adjusted based on the potentially compromised flag.

DETAILED DESCRIPTION OF THE DISCLOSURE

The following detailed description of the embodiments of the disclosure refers to the accompanying drawings. The same reference numbers in different drawings may identify the same or similar elements. Also, the following detailed description does not limit the claims.

A payment card processing network receives a plurality of payment transactions for processing. The processing network stores these payment transactions in a database. A fraud location analyzer (“FLA”) computer device is in communication with the payment network database. The FLA computer device determines a list of compromised payment accounts where fraudulent transactions have been detected. For each payment account on the list of compromised payment accounts, the FLA computer device retrieves from the payment processing network a plurality of payment transactions that occurred before the fraudulent transaction. The FLA computer device aggregates the retrieved payment transactions to determine common transaction locations, such as merchants, that the different compromised payment accounts transacted with prior to reporting fraudulent transactions. Each common transaction location is given a confidence score based on the likelihood that that the transaction location was breached and caused the later fraudulent transactions. If a transaction location's confidence score exceeds a predetermined threshold (e.g., >95%), the FLA computer device adds the transaction location to a potentially compromised list.

When the FLA computer device receives an authorization request message, the FLA computer device compares the originating transaction location associated with the authorization request message to the potentially compromised list. If the originating transaction location matches an entry in the potentially compromised list, then the FLA computer device flags the payment account associated with the authorization request message as potentially compromised. In any future transaction that the flagged payment account performs, the FLA computer device adjusts the fraud score of the future transaction to indicate that the payment account transacted at a potentially compromised merchant. In the example embodiment, the FLA computer device receives the authorization request message while the transaction is processing. In other embodiments, the FLA computer device receives a plurality of transaction data for a plurality of transaction that occurred over a period of time (e.g., over the previous day).

In some embodiments, a transaction location is notified when the transaction location is placed on the potentially compromised list. In other embodiments, the potentially compromised list is updated on a regular basis to keep the list of potentially compromised transaction locations as current as possible. A transaction location can be, but is not limited to, an individual merchant location, an online store, or an ATM.

The methods and systems described herein may be implemented using computer programming or engineering techniques including computer software, firmware, hardware, or any combination or subset. As disclosed above, at least one technical problem with known systems is that there is no efficient way to determine where payment account breaches might have occurred and further to adjust fraud scoring of payment accounts that transact with potentially breached transaction locations. The systems and methods described herein address that technical problem. The technical effect of the systems and processes described herein is achieved by performing at least one of the following steps: (a) determining a list of potentially compromised locations; (b) determining a plurality of compromised payment accounts, wherein each compromised payment account is associated with at least one fraudulent transaction; (c) receiving for each of the plurality of compromised payment account historical transaction data including a plurality of payment transactions conducted by the corresponding compromised payment account within a predetermined period of time prior to the payment account's at least one fraudulent transaction; (d) determining one or more common transaction locations based on the plurality of compromised payment accounts and the historical data where each compromised payment account conducted at least one payment transaction with one of the one or more common transaction locations; (e) determining a first number of payment accounts that transacted with an individual transaction location; (f) determining a second number of payment accounts that reported fraudulent transactions after transacting with the individual transaction location; (g) calculating a confidence score that the individual transaction location is potentially compromised based on the first number and the second number; (h) comparing a plurality of confidence scores for a plurality of transaction locations; (i) adjusting each confidence score based on the comparison; (j) adding the determined one or more common transaction locations to the list of potentially compromised transaction locations; (k) flagging as potentially compromised each payment account that transacted with the one or more determined transaction locations based on the historical transaction data; (l) receiving from a first transaction location a first authorization request message for a first transaction, the authorization request message associated with a first payment account; (l) determining that the first transaction location is on the list of potentially compromised transaction locations; (n) flagging the first payment account as potentially compromised so that a fraud score for a future transaction associated with the first payment account is adjusted based on the potentially compromised flag; (o) receiving from a second transaction location a second authorization request message for a second transaction associated with the first payment account; (p) determining that a potentially compromised flag is associated with the first payment account; and (q) calculating a fraud score for the second transaction based, at least in part, on the potentially compromised flag associated with the first payment account. The resulting technical effect is that more accurate fraud scoring is captured by including whether or not the payment account transacted at a potentially compromised transaction location. An additional technical effect is that potentially compromised transaction locations are quickly and efficiently identified.

Described herein are computer systems such as FLA computer devices and related computer systems. As described herein, all such computer systems include a processor and a memory. However, any processor in a computer device referred to herein may also refer to one or more processors wherein the processor may be in one computing device or a plurality of computing devices acting in parallel. Additionally, any memory in a computer device referred to herein may also refer to one or more memories wherein the memories may be in one computing device or a plurality of computing devices acting in parallel.

In one embodiment, a computer program is provided, and the program is embodied on a computer readable medium. In an example embodiment, the system is executed on a single computer system, without requiring a connection to a sever computer. In a further embodiment, the system is being run in a Windows® environment (Windows is a registered trademark of Microsoft Corporation, Redmond, Wash.). In yet another embodiment, the system is run on a mainframe environment and a UNIX® server environment (UNIX is a registered trademark of X/Open Company Limited located in Reading, Berkshire, United Kingdom). The application is flexible and designed to run in various different environments without compromising any major functionality. In some embodiments, the system includes multiple components distributed among a plurality of computing devices. One or more components may be in the form of computer-executable instructions embodied in a computer-readable medium.

As used herein, the terms “transaction card,” “financial transaction card,” and “payment card” refer to any suitable transaction card, such as a credit card, a debit card, a charge card, a membership card, a promotional card, a frequent flyer card, an identification card, a prepaid card, a gift card, and/or any other device that may hold payment account information, such as mobile phones, Smartphones, personal digital assistants (PDAs), key fobs, and/or computers. Each type of transactions card can be used as a method of payment for performing a transaction. In addition, consumer card account behavior can include but is not limited to purchases, management activities (e.g., balance checking), bill payments, achievement of targets (meeting account balance goals, paying bills on time), and/or product registrations (e.g., mobile application downloads).

The systems and processes are not limited to the specific embodiments described herein. In addition, components of each system and each process can be practiced independent and separate from other components and processes described herein. Each component and process also can be used in combination with other assembly packages and processes.

The following detailed description illustrates embodiments of the disclosure by way of example and not by way of limitation. It is contemplated that the disclosure has general application to detecting potentially compromised locations and updating the fraud scoring of payment cards that conduct transactions at those potentially compromised locations.

FIG. 1is a schematic diagram illustrating an example multi-party transaction card industry system120for enabling payment-by-card transactions in which merchants124and card issuers130do not need to have a one-to-one special relationship. Embodiments described herein may relate to a transaction card system, such as a credit card payment system using the MasterCard® interchange network. The MasterCard® interchange network is a set of proprietary communications standards promulgated by MasterCard International Incorporated® for the exchange of financial transaction data and the settlement of funds between financial institutions that are members of MasterCard International Incorporated®. (MasterCard is a registered trademark of MasterCard International Incorporated located in Purchase, N.Y.).

In a typical transaction card system, a financial institution called the “issuer” issues a transaction card or electronic payments account identifier, such as a credit card, to a consumer or cardholder122, who uses the transaction card to tender payment for a purchase from a merchant124. To accept payment with the transaction card, merchant124must normally establish an account with a financial institution that is part of the financial payment system. This financial institution is usually called the “merchant bank,” the “acquiring bank,” or the “acquirer.” When cardholder122tenders payment for a purchase with a transaction card, merchant124requests authorization from a merchant bank126for the amount of the purchase. The request may be performed over the telephone, but is usually performed through the use of a point-of-sale terminal, which reads cardholder's122account information from a magnetic stripe, a chip, or embossed characters on the transaction card and communicates electronically with the transaction processing computers of merchant bank126. Alternatively, merchant bank126may authorize a third party to perform transaction processing on its behalf. In this case, the point-of-sale terminal will be configured to communicate with the third party. Such a third party is usually called a “merchant processor,” an “acquiring processor,” or a “third party processor.”

Using an interchange network128(also known as a payment network), computers of merchant bank126or merchant processor will communicate with computers of an issuer bank130to determine whether cardholder's122account132is in good standing and whether the purchase is covered by cardholder's122available credit line. Based on these determinations, the request for authorization will be declined or accepted. If the request is accepted, an authorization code is issued to merchant124.

When a request for authorization is accepted, the available credit line of cardholder's122account132is decreased. Normally, a charge for a payment card transaction is not posted immediately to cardholder's122account132because bankcard associations, such as MasterCard International Incorporated®, have promulgated rules that do not allow merchant124to charge, or “capture,” a transaction until goods are shipped or services are delivered. However, with respect to at least some debit card transactions, a charge may be posted at the time of the transaction. When merchant124ships or delivers the goods or services, merchant124captures the transaction by, for example, appropriate data entry procedures on the point-of-sale terminal. This may include bundling of approved transactions daily for standard retail purchases. If cardholder122cancels a transaction before it is captured, a “void” is generated. If cardholder122returns goods after the transaction has been captured, a “credit” is generated. Interchange network128and/or issuer bank130stores the transaction card information, such as a category of merchant, a merchant identifier, a location where the transaction was completed, amount of purchase, date and time of transaction, in a database220(shown inFIG. 2).

After a purchase has been made, a clearing process occurs to transfer additional transaction data related to the purchase among the parties to the transaction, such as merchant bank126, interchange network128, and issuer bank130. More specifically, during and/or after the clearing process, additional data, such as a time of purchase, a merchant name, a type of merchant, purchase information, cardholder account information, a type of transaction, itinerary information, information regarding the purchased item and/or service, and/or other suitable information, is associated with a transaction and transmitted between parties to the transaction as transaction data, and may be stored by any of the parties to the transaction. In the example embodiment, when cardholder122purchases travel, such as airfare, a hotel stay, and/or a rental car, at least partial itinerary information is transmitted during the clearance process as transaction data. When interchange network128receives the itinerary information, interchange network128routes the itinerary information to database220.

For debit card transactions, when a request for a personal identification number (PIN) authorization is approved by the issuer, cardholder's account132is decreased. Normally, a charge is posted immediately to cardholder's account132. The payment card association then transmits the approval to the acquiring processor for distribution of goods/services or information, or cash in the case of an automated teller machine (ATM).

After a transaction is authorized and cleared, the transaction is settled among merchant124, merchant bank126, and issuer bank130. Settlement refers to the transfer of financial data or funds among merchant's124account, merchant bank126, and issuer bank130related to the transaction. Usually, transactions are captured and accumulated into a “batch,” which is settled as a group. More specifically, a transaction is typically settled between issuer bank130and interchange network128, and then between interchange network128and merchant bank126, and then between merchant bank126and merchant124.

FIG. 2is a simplified block diagram of an example system200used for enhancing fraud detection based on transactions at potentially compromised transaction locations in accordance with one example embodiment of the present disclosure. In the example embodiment, system200may be used for processing cardholder transactions. In addition, system200is a payment processing system that includes a fraud location analyzer (“FLA”) computer device224configured to determine potentially compromised transaction locations and adjust the fraud scoring of payment accounts who transacted with those potentially compromised transaction locations. As described below in more detail, FLA computer device224is configured to store a list of potentially compromised transaction locations, receive an authorization request message for a first transaction at a first transaction location, determine that the first transaction location is on the list of potentially compromised transaction locations, and flag the first payment account as potentially compromised.

In the example embodiment, client systems214are computers that include a web browser or a software application, which enables client systems214to access server system212using the Internet. More specifically, client systems214are communicatively coupled to the Internet through many interfaces including, but not limited to, at least one of a network, such as the Internet, a local area network (LAN), a wide area network (WAN), or an integrated services digital network (ISDN), a dial-up-connection, a digital subscriber line (DSL), a cellular phone connection, and a cable modem. Client systems214can be any device capable of accessing the Internet including, but not limited to, a desktop computer, a laptop computer, a personal digital assistant (PDA), a cellular phone, a smartphone, a tablet, a phablet, or other web-based connectable equipment.

A database server216is communicatively coupled to a database220that stores data. In one embodiment, database220includes flagged accounts, a list of potentially compromised transaction locations, compromised accounts, and historical transaction data. In the example embodiment, database220is stored remotely from server system212. In some embodiments, database220is decentralized. In the example embodiment, a person can access database220via client systems214by logging onto server system212, as described herein.

FLA computer device224is communicatively coupled with server system212. FLA computer device224can access server system212to store and access data and to communicate with the client systems214through server system212. In some embodiments, FLA computer device224may be associated with, or is part of payment system120, or in communication with payment card system120, shown inFIG. 1. In other embodiments, FLA computer device224is associated with a third party and is merely in communication with the payment card system120. In some embodiments, FLA computer device224may be associated with, or be part of merchant bank126, interchange network128, and issuer bank130, all shown inFIG. 1.

One or more point of sale systems222are communicatively coupled with server system212. The one or more point of sale systems222can be merchants124shown inFIG. 1, where point of sale systems222are communicatively coupled with server system212through the payment card system120. In the example embodiment, point of sale systems222may be, but are not limited to, machines that accept card swipes, online payment portals, or stored payment card numbers for recurring transactions.

In some embodiments, server system212may be associated with a financial transaction interchange network128shown inFIG. 1, and may be referred to as an interchange computer system. Server system212may be used for processing transaction data and analyzing for fraudulent transactions. In addition, at least one of client systems214may include a computer system associated with an issuer of a transaction card. Accordingly, server system212and client systems214may be utilized to process transaction data relating to purchases a cardholder122(shown inFIG. 1) makes utilizing a transaction card processed by the interchange network128and issued by the associated issuer130. At least one client system214may be associated with a user or a cardholder seeking to register, access information, or process a transaction with at least one of the interchange network, the issuer, or the merchant. In addition, client systems214or point of sales devices222may include point-of-sale (POS) devices associated with a merchant and used for processing payment transactions. At least one client system214may be used for investigating potential breaches.

FIG. 3illustrates an example configuration of client system214shown inFIG. 2, in accordance with one embodiment of the present disclosure. User computer device302is operated by a user301. User computer device302may include, but is not limited to, client systems214and FLA computer device224(both shown inFIG. 2). User computer device302includes a processor305for executing instructions. In some embodiments, executable instructions are stored in a memory area310. Processor305may include one or more processing units (e.g., in a multi-core configuration). Memory area310is any device allowing information such as executable instructions and/or transaction data to be stored and retrieved. Memory area310may include one or more computer readable media.

User computer device302also includes at least one media output component315for presenting information to user301. Media output component315is any component capable of conveying information to user301. In some embodiments, media output component315includes an output adapter (not shown) such as a video adapter and/or an audio adapter. The output adapter is operatively coupled to processor305and operatively coupleable to an output device such as a display device (e.g., a cathode ray tube (CRT), liquid crystal display (LCD), light emitting diode (LED) display, or “electronic ink” display) or an audio output device (e.g., a speaker or headphones). In some embodiments, media output component315is configured to present a graphical user interface (e.g., a web browser and/or a client application) to user301. A graphical user interface may include, for example, an online store interface for viewing and/or purchasing items, and/or a wallet application for managing payment information. In some embodiments, user computer device302includes an input device320for receiving input from user301. User301may use input device320to, without limitation, select and/or enter one or more items to purchase and/or a purchase request, or to access credential information, and/or payment information. Input device320may include, for example, a keyboard, a pointing device, a mouse, a stylus, a touch sensitive panel (e.g., a touch pad or a touch screen), a gyroscope, an accelerometer, a position detector, a biometric input device, and/or an audio input device. A single component such as a touch screen may function as both an output device of media output component315and input device320.

User computer device302may also include a communication interface325, communicatively coupled to a remote device such as server system212(shown inFIG. 2). Communication interface325may include, for example, a wired or wireless network adapter and/or a wireless data transceiver for use with a mobile telecommunications network.

Stored in memory area310are, for example, computer readable instructions for providing a user interface to user301via media output component315and, optionally, receiving and processing input from input device320. A user interface may include, among other possibilities, a web browser and/or a client application. Web browsers enable users, such as user301, to display and interact with media and other information typically embedded on a web page or a website from server system212. A client application allows user301to interact with, for example, server system212. For example, instructions may be stored by a cloud service, and the output of the execution of the instructions sent to the media output component315.

Processor305executes computer-executable instructions for implementing aspects of the disclosure. In some embodiments, the processor305is transformed into a special purpose microprocessor by executing computer-executable instructions or by otherwise being programmed. For example, the processor305is programmed with instruction such as illustrated inFIGS. 7 and 8.

FIG. 4illustrates an example configuration of server system212shown inFIG. 2, in accordance with one embodiment of the present disclosure. Server computer device401may include, but is not limited to, server system212and database server216(shown inFIG. 2). Server computer device401also includes a processor405for executing instructions. Instructions may be stored in a memory area410. Processor405may include one or more processing units (e.g., in a multi-core configuration).

Processor405is operatively coupled to a communication interface415such that server computer device401is capable of communicating with a remote device such as another server computer device401, client systems214, or FLA computer device224(both shown inFIG. 2). For example, communication interface415may receive requests from client systems214via the Internet, as illustrated inFIG. 2.

Processor405may also be operatively coupled to a storage device434. Storage device434is any computer-operated hardware suitable for storing and/or retrieving data, such as, but not limited to, data associated with database220(shown inFIG. 2). In some embodiments, storage device434is integrated in server computer device401. For example, server computer device401may include one or more hard disk drives as storage device434. In other embodiments, storage device434is external to server computer device401and may be accessed by a plurality of server computer devices401. For example, storage device434may include a storage area network (SAN), a network attached storage (NAS) system, and/or multiple storage units such as hard disks and/or solid state disks in a redundant array of inexpensive disks (RAID) configuration.

In some embodiments, processor405is operatively coupled to storage device434via a storage interface420. Storage interface420is any component capable of providing processor405with access to storage device434. Storage interface420may include, for example, an Advanced Technology Attachment (ATA) adapter, a Serial ATA (SATA) adapter, a Small Computer System Interface (SCSI) adapter, a RAID controller, a SAN adapter, a network adapter, and/or any component providing processor405with access to storage device434.

FIG. 5is a schematic view500of potential interactions between a plurality of cardholders and a plurality of merchants in accordance with system200shown inFIG. 2. One of the difficulties with detecting breaches of payment card information is that the breach usually occurs at a different transaction location as where the fraudulent transactions occur. Transaction locations include, but are not limited to merchant physical locations, online webstores, and ATMs. For example, an employee steals payment card information for a plurality of transactions that occurred where the employee works. Then the employee fraudulently uses that stolen payment card information at other transaction locations. By correlating the fraudulent transactions with the transaction locations visited by the payment card accounts prior to those fraudulent transactions, the source of the breach may be determined.

Different cardholders may visit different merchants (also known as transaction locations) or the same merchant in different orders. This variety complicates determining where a breach may have occurred. There are many different situations that may occur, so determining where a breach may have occurred is complicated. As shown in schematic view500, a first cardholder502visits a merchant A510, a merchant B512, and a merchant C514. A second cardholder504visits merchant A510and merchant B512. A third cardholder506visits merchant B512and merchant C514.

In a first example, if second cardholder504later reports fraudulent transactions, then a breach could have occurred at merchant A510or merchant B512. If first cardholder502and third cardholder506also report fraudulent transactions, it is more likely that the breach occurred at merchant B512than at merchant A510, since third cardholder506did not transact with merchant A510. If only first cardholder502reports fraudulent transactions, then it is more likely that the breach occurred at merchant A510. However, there is still a possibility that merchant B512was compromised and third cardholder's information was stolen and just not used in a fraudulent transaction yet. Additionally, both merchant A510and merchant B512could have been breached.

In a second example, first cardholder502and third cardholder506report later fraudulent transactions, while second cardholder504does not. The highest likelihood is that the merchant C514was compromised. However, there is a possibility that merchant B512was compromised and second cardholder504will report fraudulent transactions in the future. Or that merchant A510and merchant C514were both compromised and second cardholder's information was either not taken or second cardholder504will report fraudulent transactions in the future. These examples only display three merchants and three cardholders. As the number of cardholders that transact with each merchant increases, the complexity of determining which merchant might be source of the breach is increased.

FIG. 6is a graphical timeline600of the interactions between a merchant and a plurality of cardholders as shown inFIG. 5. First cardholder502visits602merchant A510(both shown inFIG. 5). Later a breach occurs604at merchant A510. Fraudulent activity is detected606on first cardholder's account. Based on the fraudulent activity on first cardholder's account, merchant A510is determined to be a potentially compromised transaction location. Second cardholder504(shown inFIG. 5) visits608merchant A510. In the example embodiment, since there is a breach at merchant A510, then second cardholder's information may have been stolen. Therefore, second cardholder's account should be flagged as potentially compromised for visiting breached merchant A510.

The potentially compromised flag allows payment card system120(shown inFIG. 1) to adjust the fraud scoring of future transactions of second cardholder504. In some embodiments, the potentially compromised flag will cause the fraud score to be calculated using additional variables. In other embodiments, the potentially compromised flag will adjust the fraud model or fraud rules that are used in calculating the fraud score. The potentially compromised flag is considered a potential predictor or trigger of future fraud.

FIG. 7is a flow chart of a process700of generating a list of potentially compromised transaction locations using system200shown inFIG. 2. In the example embodiment, process700is performed by FLA computer device224(shown inFIG. 2).

FLA computer device224receives705a plurality of transaction data for a plurality of transactions performed at a plurality of transaction locations. In the example embodiment, each of the transactions includes at least a payment account identifier, a transaction location, and a transaction date and time. FLA computer device224determines710the plurality of transaction locations from the plurality of transaction data. For each transaction location of the plurality of transaction locations, FLA computer device224identifies715a plurality of payment accounts that transacted with the transaction location, within a predetermined period of time. For example, the predetermined period of time may be a week or a month period of time. For each identified payment account, FLA computer device224determines720if the identified payment account reported at least one fraudulent transaction after visiting the transaction location. FLA computer device224determines725if there are more identified payment accounts. If there are more identified payment accounts, then FLA computer device224returns to Step720. Otherwise FLA computer device224determines730if there are more transaction locations to analyze. If there are more transaction locations, then FLA computer device224returns to Step715. Otherwise FLA computer device224calculates735a confidence score for each transaction location.

In the example embodiment, to calculate735a confidence score FLA computer device224determines a number of visitors to the transaction location during a first time period. FLA computer device224determines a number of visitors that reported fraudulent transactions after visiting the transaction location during the first time period. FLA computer device224calculates the ratio of visitors with fraud reported to number of visitors. FLA computer device224determines a number of visitors for a second time period, a number of visitors with fraud reports for the second time period, and a second ratio. The first time period is before the second time period. For example, the first time period is week1, and the second time period is week2. FLA computer device224calculates735the confidence score for each transaction location using the following z-score equation:
Z=1−((p1−p2)/SE)  Eq. (1)
where p1 is the ratio during the first time period, p2 is the proportion in the second time period, and SE is the standard error of the sampling distribution.

Using the calculated confidence score, FLA computer device224determines740one or more merchants whose confidence score exceeds a predetermined threshold. In the example embodiment, the predetermined threshold is where the z-score is less than 0.05 (i.e., the transaction location has a confidence score of 95%). FLA computer device224adds745the one or more determined transaction locations to a list of potentially compromised locations. In one embodiment, the list of potentially compromised locations is generated from scratch on a regular basis, e.g., every week. In other embodiments, potentially compromised transaction locations are added to a pre-existing list. In still other embodiments, potentially compromised transaction locations are removed from the list based on, for example, changes in the associated confidence score or length of time since the transaction location was added to the list.

FIG. 8is a flow chart of a process800of processing transactions using the list of potentially compromised transaction locations generated by process700shown inFIG. 7. In the example embodiment, process800is performed by FLA computer device224(shown inFIG. 2).

FLA computer device224stores805a list of potentially compromised transaction locations. In the example embodiment, the list of potentially compromised transaction locations is generated through process700. FLA computer device224receives810a first authorization request message from a first transaction location for a first transaction for a first payment account from payment network120(shown inFIG. 1). In the example embodiment, FLA computer device224receives the first authorization request message while the corresponding transaction is processing with payment network120. FLA computer device224determines815that the first transaction location is on the list of potentially compromised transaction locations. FLA computer device224flags820the first payment account as potentially compromised based on the first transaction location being on the list of potentially compromised transaction locations. At a later time, FLA computer device224receives825a second authorization request message from a second transaction location for a second transaction for the first payment account. FLA computer device224determines830that the first payment account has potentially compromised flag associated with it. FLA computer device224calculates835a fraud score for the second transaction based, at least in part, on the potentially compromised flag.

While in the example embodiment, process800is performed by FLA computer device224. In additional embodiments, process800is performed by server system212(shown inFIG. 2) as a part of processing transactions, where server system212is a part of payment card system120(shown inFIG. 1). Additionally, process800may be divided up where Steps805-820are performed by FLA computer device224and Steps825-835are performed by server system212. In some embodiments, Steps805-820may be performed after the first transaction has occurred, while Steps825-835are performed in real-time during the processing of the second transaction.

FIG. 9is a diagram900of components of one or more example computing devices that may be used in system200shown inFIG. 2. In some embodiments, computing device910is similar to server system212; computing device910may also be similar to FLA computer device224(both shown inFIG. 2). Database920may be coupled with several separate components within computing device910, which perform specific tasks. In this embodiment, database920includes flagged accounts922, potentially compromised transaction locations924, compromised accounts926, and historical transaction data928. In some embodiments, database920is similar to database220(shown inFIG. 2).

Computing device910includes database920, as well as data storage devices930. Computing device910also includes a communication component940for receiving810a first authorization request message and receiving825a second authorization request message (both shown inFIG. 8). Computing device910also includes a determining component950for determining815that the first transaction location is on the list of potentially compromised locations and determining830that a potentially compromised flag is associated with the first payment account (both shown inFIG. 8). Computing device910further includes a flagging component960for flagging820the first payment account as potentially compromised (shown inFIG. 8). Moreover, computing device910includes a calculating component970for calculating835a fraud score (shown inFIG. 8). A processing component980assists with execution of computer-executable instructions associated with the system.