Patent Description:
This invention relates generally to a system architecture as an omnichannel fraud solution not geographically limited.

According to the Identity Theft Resource Center, there were <NUM> tracked data breaches in <NUM> where consumer data was stolen. There are many more breaches that go undetected or unreported. <NUM> of these breaches resulted in over <NUM> million social security numbers being stolen. Credit card accounts can be closed, but social security numbers provide an ongoing opportunity for fraudulent activity. In <NUM> the number of breaches increased to <NUM>,<NUM> and there have already been over <NUM>,<NUM> in <NUM> including the Equifax breach where <NUM> social security numbers were compromised. According to Javelin, losses attributable to identity theft topped $16B.

Fraudsters take the stolen data and systematically attack the consumer, enterprises and government entities through the contact center, Interactive Voice Response (IVR) systems, and other self-service channels. The IVR provides the means for a fraudster to access account information in anonymity without facing any interrogation by an agent.

In a <NUM> Aite Group study, <NUM>% of financial services executives indicated that fraud in the contact center is on the increase and <NUM>% indicated that they didn't know, likely because they don't have the processes in place to identify the fraud in the call center let alone prevent it. Account Takeover (ATO) fraud accounts for <NUM>% of all identity theft fraud in financial services and has a <NUM>% CAGR. Fraudulent activity is so prevalent in the contact center that Aite says, "Account Takeover is so commonly enabled in the contact center that it should be renamed the cross-channel fraud enablement channel.

<CIT> is directed towards systems and methods for counteracting the various shortcomings of conventional fraud detection systems by more accurately identifying fraudulent events, where customer care operations, operations that make transactions or make changes to a customer's account, are identified. <CIT> relates to a configurable system, method and computer program product for detecting and automatically acting upon new and evolving patterns where network event records representing telephone calls are generated from service records of the calls.

In accordance with the purpose(s) of this invention, as embodied and broadly described herein, this invention, in one aspect, relates to a method of detecting fraud in a client contact system including receiving a contact from a user, the contact corresponding to event data, the event data including at least one of a channel type and an identifier; and checking the event data against at least one criteria to determine a risk associated with the event data, wherein at least one of the criteria comprises at least one of behavior criterion, situation criterion and reputation criterion.

In another aspect, the invention relates to An architecture for fraud detection in an interactive voice response system, that includes a client system that interacts with a user on a channel; a Shared Composite Application Programming Interface (API) that receives event data from the client system; a fraud ingestion service ingestion processor that receives the event data from the shared composite API; a fraud detail record topic that receives the event data from the fraud ingestion service; a fraud service aggregator that receives the event data from the fraud detail record topic, the fraud service aggregator in communication with a fraud record service for comparing the event data to prior event data for providing to a scoring topic, the scoring topic providing at least one a plurality of checks on the event data to determine if the event data represents a fraud risk.

Preferred embodiments are recited by the dependent claims.

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate (one) several embodiment(s) of the invention and together with the description, serve to explain the principles of the invention.

The present invention may be understood more readily by reference to the following detailed description of preferred embodiments of the invention and the Examples included therein and to the Figures and their previous and following description.

In this specification and in the claims which follow, reference will be made to a number of terms which shall be defined to have the following meanings:
Reference will now be made in detail to the embodiment(s) of the invention, an example(s) of which is [are] illustrated in the accompanying drawings. Wherever possible, the same reference numbers are used throughout the drawings to refer to the same or like parts.

The intent of this disclosure is a fraud solution that can ingest data from a variety of 3rd party systems, analyze the data in real-time and take prescribed actions based on the perceived threat level. The solution is intended as an omnichannel fraud solution and the architecture has no geographical restrictions.

The use of artificial intelligence (AI) in fraud detection holds major promise. Keeping fraud at bay is an ever-evolving battle in which both sides are adapting as quickly as possible.

The subject of this disclosure involves data analysis and machine learning in a customizable gated process that looks at behavior, reputation, and situational analysis to determine how far outside the norm a user is who is interacting with the system.

Behavior analysis looks at how users are interacting with the system and reputation analysis is a historical account of how an individual has used the system in the past.

Lastly, situational analysis is where the caller is (geography), the time of day and other situational data points. In the data analysis and in machine learning, some or all the data processed depends on how we intend to interact with the system. We use supervised machine learning and statistics - to discover new rules and patterns and subsequently unsupervised machine learning to detect outliers that are or could be potential threats.

The goal of this system is the combination of data mining and statistics allowing the before-mentioned inputs to be modeled in a way allowing the detection of aberrant or uncharacteristic system use suspected as fraud. Applied to machine learning, the before-mentioned model is used in the scoring and decisions process predicting to a level of certainty if the combined behavior, situation, and reputation are outside the norm (outliers). In the disclosed system, data points within the models can be used strategically to control the flow of data. IVR, Intelligent Virtual Assistant (IVA) and other systems can at times produce millions of records per minute each of which can be checked in phases and promoted for further analysis in ever increasing levels of computation. The decision on what to check is dependent on how the system is used and therefore the present disclosure includes a configurable mechanism for grouping and prioritizing how the model(s) can be chained in a multi-phase gating process used to check and promote further analysis. What this allows for is an intelligent processing pipeline using simple checks and machine learning to reason about data points. As IVR and IVA apps largely differ from one domain to the next being able to configure behavior and reputation data points and how they are checked and combined is also a subject of this disclosure. The presently disclosed system allows for data points to be combined in a configuration step based on the domain model and then used to control the flow of a high-volume system that will eventually filter data down propagating only interactions that are considered risky. Those practiced in the art will also realize that the subject and application of this system and architecture is not limited for phone-based systems. The same principles can apply to any high-volume transaction-based system including Internet Protocol (IP) addresses, emails, and any other user interaction systems.

A channel address is a generic term used to refer to a point of contact made by an individual. The following represents channel addresses that are ingress points:.

<FIG> shows an upper level architecture of a system according to principles described herein. In <FIG>, the data moves from the left to the right. As it moves through the pipeline it is assessed in multiples stages using, security checks, format checks, conditionals, data aggregation for enriching events with context data and finally thresholds check as well as more advanced Machine Learning Techniques.

Client systems <NUM> that interact with a user on a channel (e.g. phone, IP, email, and others) send event data to a Shared Composite API <NUM>. Shared Composite API <NUM> is a secured API via a token. If the token is valid it is forwarded to the Fraud Service ingestion.

Fraud Service ingestion <NUM> checks and can correct the format of the data (contract). If valid the event is forwarded to the record topic. The Fraud Service Ingestion may include a memory and CPU to perform these tasks.

The Fraud Detail Record Topic <NUM> is a pub/sub high speed data pipe. Any service can subscribe to the events on the pipe. In this case for events there is currently only one however it is not limited to one. The fraud service aggregator is the next step in the process.

Fraud Service Aggregator <NUM> picks up the event from the published topic and augments the event with additional context data. It then checks the event channel address against a white list <NUM> and black list and the augmented event is forwarded on to the scoring topic <NUM>. The Fraud Service Aggregator may also look up other information about an ANI, for example, how many contacts from that ANI in a predetermined period of time, such as over a <NUM>, <NUM>, or <NUM>-day period. Information may be provided by the Fraud Service Aggregator accessing Fraud Service Records <NUM>.

The scoring topic <NUM> is subscribed to by one to many scoring services, some of which may be simple threshold checks while others are Machine Learning (ML) based. Depending on the channel address in use one or many scoring services are used to check for multiple broad or very specific attack vectors. Extending the process of a high-volume system to multiple parallel and replicated services assists in allowing the events that need actions (are identified as suspect) are forwarded on to the scoring topic <NUM>. The scoring processes can be simple threshold checks or more advanced ML based solutions. Some of the categories include:.

Based on a potentially large list of factors from simple counts to more complicated ML based predictions a level of threat is used to determine if the call should be forwarded for analysis.

Beyond the fraud scoring service <NUM> are actionable receivers used to engage with a fraud analyst or systems that are monitoring for fraud. Scoring services <NUM> use the Scoring topic to publish suspect events to a record topic <NUM> and series of reporters, such as Fraud Service Alerts <NUM>, Fraud Alert Emails <NUM> and/or other Fraud Service Reporting mechanisms <NUM>.

Reporters are any service used to notify on a suspicious or potentially fraudulent channel address. These can include Short Message Service (SMS), email, an API used by other services or web dashboards, and lastly the report service contains extensive details about the event and any scoring outcomes provided by the one or many scoring services. The report service <NUM> is used with a Fraud dashboard that allows an analyst or other user to monitor the system for fraud in near real-time.

In order to support the broad categories of data from many channels that change a flexible and extensible pipeline approach is used to filter down a very large number of events to support a near real-time approach to capturing users that intend fraudulent activity. By pipelining the data and performing data aggregation across multiple service we gain the ability to add additional data and services for analysis without stopping the pipeline.

<FIG> illustrates a detailed architecture according to principles described herein. The aim of the illustrated architecture (<FIG>) and the following description of modules contained within are used to monitor and assess individual 'channel addresses' from which Fraudsters conduct attacks.

IVR and Other <NUM>: Channel addresses that can produce call interaction details that include ANI (automatic number identification), IP addresses, SIP addresses, emails, from which can be acquired a standardized yet extensible set of data for analysis.

Fraud Composite API and Composite APP <NUM>: Both composite components act as secured routing for services that are directly accessible to end users.

Shared Service Profile <NUM>: Provides an API to return an immediate snapshot of a channel address that can be used by an external system to make immediate decisions on how to handle a caller on a specific channel address. A score based on a combination of immediate situational analysis and prior behavioral analysis will be calculated and returned to the external system.

Fraud Service Ingestion <NUM>: A contractual API for consuming data from channel addresses. That include but not limited to the following:
<IMG>
<IMG>
<IMG>.

The ingestion service is a contract-based Representational State Transfer (REST) API containing a high-speed pub-sub data producer that can quickly publish the data out to a topic that is subscribed to by listening consumers that store and aggregate the data.

Fraud Detail Record Topic <NUM>: A messaging topic on a high-speed pub-sub data pipe used by the 'Fraud Service Ingestion' to distribute channel address events to multiple endpoints for processing. In the attached drawing databases and the 'aggregation' microservice receive events. There are multiple receivers.

Fraud Service Records and DB <NUM>: Microservice and database storing all ingested channel address events. Running record of all events received and processed. To support high throughput and the ability to sort and search events key attributes in the received data are used to generate a unique key that is indexed and used to quickly sort and count events. Data is partitioned using a unique hash key that is generated by combining the following:.

Data is further sorted by event date. The benefit of partitioning on a combined single unique key is increased search and sort performance.

Fraud Aggregator <NUM>: Aggregates data from events via 'Fraud Records Service' as well as other sources. This microservice collates and collects data that is used initially for pre-screening. During prescreen data points can be checked to determine if the channel address is known or trusted otherwise it will be published to the scoring topic for further analysis. This service collects the before mentioned behavioral, situational, and reputation against the channel address.

Score Topic <NUM>: Used by the Aggregator to send fraud records to scoring services.

Fraud Service Scoring <NUM>: A service or services that receive aggregated records to score. The received record contains the channel address aggregate report. The Scoring module itself can employ threshold based and/or machine learning for processing the record. Each service is configurable leveraging <NUM> or many data points. Multiple modes can run simultaneously. Each micro-service scoring module can be replicated as demand requires. For example: With average scoring speed of <NUM> milliseconds (ms), one scoring service can handle <NUM> requests/second, <NUM>/minute, <NUM>,<NUM>/hour. Running <NUM> scoring services can handle <NUM>,<NUM>*<NUM> = <NUM>,<NUM>,<NUM> requests/hour. Any combination of scoring service types can be combined to improve the performance throughput and the accuracy of the detection.

PPROCESING - The scoring service uses conditional checking to determine whether a channel address should continue to be processed. If conditional checking determines the channel is risky behavioral processing using unsupervised learning (ML) will run further analyzing the channel address caller behavior.

STEP <NUM> Situational/Conditional Processing: The scoring service may employ simple conditionals. e.g.
if (blacklist == true) {run a full analysis report and automatically generate a report and alert.

In this simple conditional the channel address has been marked as blacklisted. Meaning it has been determined that the user of the channel address is a fraudster therefore the report will be processed. if feedback responses are available the scoring service may halt the process and notify the external system that the address is blacklisted and redirect the caller to an agent (see 'Active call analysis' later in the description). Other conditionals may also be configured. For example:
if (country == Russia or country X or country Y) {continue processing report.

In this case the algorithm is effectively looking for specific conditionals that are unlikely or suspect. For example, if the operating country is U. based customers it is very unlikely that a caller from Russia is a customer. Conditionals can include the carrier as well. For example, if the carrier is Verizon it is less likely fraud as fraudsters will prefer more obscure carriers to carry out attacks.

There are multiple conditionals that can be configured to either stop the reporting process or to ensure it is executed. One or many conditionals may be used to determine if a channel address should be processed. A configuration screen is used in this system to allow conditionals to be enabled/disabled and loaded with match lists for conditionals with many targets e.g. countries. Conditionals can also be weighted and use in a combined manner to score the overall situation which in turn is used to stop or move the process forward to the behavioral phase. (see section on Scoring (ANI and API)).

STEP <NUM> Behavioral Processing Analysis with ML Standard Deviation: standard deviation is the simple measure of how spread out numbers are. The formula is defined as follows.

Looking primarily at the behaviors we can detect when a behavior is outside the norm. For example, looking at a sample set of data over a three-month period and calculating the standard deviation we find that most channel addresses call into the system at a calculated mean of <NUM> times (<NUM> calls from the same number or channel address in that period). The standard deviation is the space around the mean where channel address volumes fall and can consider expect behavior.

In the conceptual graphic in <FIG>, it can be seen that <NUM>% of all channel address volumes fall within <NUM> standard deviation of the mean. Depending on the sample size and the behavior characteristic, the standard deviation can be used to determine if the report should be marked as potential fraud. In this model, for example, the channel address call volume is configured to be reported as a potential fraud case if the volume is outside +- <NUM> standard deviation( ± <NUM> σ ) from the mean. If the call falls within <NUM> standard deviation the report is not generated, and the process ends. For high volume systems to be efficient only those cases that fall outside a configured standard deviation are processed. Channel address access-volumes or call-volumes are only one behavior to consider. The number of accounts a channel address accesses is also an indicator of a Fraudster trying to access several accounts.

Depending on the fraudster and the application in question any behavior captured could be applied to standard deviation processing. Each behavior can be configured based on period and simple calculation or training step where a sample set is taken and analyzed. The resultant analysis can be used to determine how many standard deviations away from the mean a behavior is to be consider for report processing. Pooled Standard Deviation and other methods. In some cases, behaviors are related, and an average standard deviation can be applied across multiple behaviors. Pooled standard deviation leverages combined averaged standard deviation across multiple behavioral inputs.

Random forests and Random Cut Forests algorithms can also be used however it should be noted that a single optimal decision tree is not likely as small variations in the data might result in a completely different tree being generated. IVR and IVA workflows from one customer/domain to another can vary greatly so it is likely that for each a new tree would have to generated. Decision trees can still be helpful, and the problem can be mitigated by using decisions trees within an ensemble where some trees are standardized trees common across all workflows, where others are specific to the domain in question. A note about behaviors: The approach a fraudster takes is often a brute force strategy in which we see many calls across multiple accounts. Another approach is for multiple fraudsters to collaborate to simultaneously attack one or more specific accounts from different channel addresses. These characteristics manifest with positive deviations from the mean. negative deviations or low volume attacks may also take place where more patient fraudsters conduct attacks using multiple channels with access periods that go beyond <NUM> or <NUM> days. Standard deviation allows us to see both high call volume attacks as well as long period attacks. Low volume outliers might be considered and analyzed as potential attack vectors.

Using standard deviation and simple graphing, a user can visualize the behaviors and set thresholds against the mean. Using standard deviation across all behavior counts provides an intuitive interface requiring limited skill to visualize, understand, and configure how far outside the norm (error) a value must be to be considered risky and processed further. Most of the attributes classified as behaviors are counts. number of calls per month, number of accounts accessed by one channel address, number of times a channel address/caller exits the system in a similar place, number of times a channel address fails an authentication, number of times a channel address/user attempts a re-pin.

In an example embodiment a sample configuration screen might look as illustrated in <FIG>.

In the present example, a training data set is loaded, the period of the calculation is set, and the deviation displayed. This User Interface (UI) allows an ability to set the standard deviation for threshold testing in the live running process. In this case call volumes greater than two standard deviations away from the mean would be processed.

Additionally, and as mentioned prior. A graduated scale could also be set indicating low, elevated, and high-risk channel addresses using a range of standard deviation. (see fraud service config).

Standard deviation provides a compelling visual and clues on how to set threshold markers that can inform the process on when to proceed with further report processing.

Starting from aggregation and running all the way through to the behavior processing, a profile or case is being built and decisions being made along the way that can quickly weed-out those channel addresses that are unlikely to be fraudulent. Using a series of graduated techniques starting with simple conditions all the way up to the use of unsupervised ML, this system allows a user to build a case and put in place distributed processing and decision points capable of operating efficiently in high traffic systems.

Fraud Config DB Contains score weights and score configuration thresholds use to determine if a channel address and events are suspect and thus if the channel address should be broadcast on the Report Topic for consumption in dashboard or notification services. The configuration is cached for performance and is long lived (e.g. cached items live for long periods of time). If the thresholds are changed by the user, they are auto flushed so they are retrieved fresh the next time a channel address is scored.

An interface to an external system that can check validity on a given channel address and when combined with other scores, helps to determine combined level of threat for the channel address.

Used by the Fraud Service Scoring modules to send identified fraud cases to a series of services for reporting. There are currently <NUM> risk levels for fraud based on configured thresholds. Only low, elevated and high-risk channel reports are forwarded.

Service listening on the 'Fraud Score' topic for positively identified fraud events for a given channel address. When received notifications of a fraud event are sent to configured email(s).

A service listening for fraud events. The 'Fraud Service Alerts' service will store the event and notify a web application dashboard of a new or updated channel address identified as a fraud risk.

A service listening for fraud events. The Fraud Service Reporting will store newly received and updated scores for a channel address. Reports contain a more comprehensive view of channel address that are suspect and are used by the report dashboard to display a more comprehensive via of the analysis.

Contains the reports for a given identified channel address.

A Service API used to capture and deliver threshold and standard deviation weights to a UI for examination and modification.

A web user interface allowing configuration settings for a particular customer and app to be set. The config dashboard allows users to update thresholds for rules in fraud detection.

Stores configuration thresholds and weights for rules to be used during processing of channel addresses.

A web user interface showing fraud alerts and status of newly received calls/connections on channel addresses (from 'Fraud service reporting').

The Fraud Service ingestion' will capture the following data for use in scoring for channel addresses where it is then propagated to the Fraud Service Scoring module(s) for evaluation. In some cases, the 'channelType' will determine what data is available for processing. IP address channels and ANI will differ in what data is available for processing. The 'Fraud Service Scoring' will process only what it can based on the channel type identified. :
<IMG>
<IMG>.

Additional context can be any further details about the account in a Payment Card Industry Data Security Standard (PCI) compliant format.

The following high-level application intents are supported. Active call analysis: Channel addresses that are in the active or connected STATE can be analyzed during a call or session e.g. on-the-fly assessment. Events received via the ingress can be quickly processed and if identified as a suspect and a notification can be returned to the originating event producer allowing:.

Call analysis after a call/session completes resulting in a report for a given channel address showing threat level. Reports on a channel address can be analyzed over a <NUM> day, <NUM> day, current month, or other arbitrary (random) time period.

Supplemental data may be supplied to further access threat patterns/behaviors. By using the ANI, IP address or other supplied data we can capture additional useful information from third parties that can then be used in a series of rules. Data available but not limited to are as follows:.

The 'Fraud Service Scoring' Module(s) can score as many data points based on the channel type producing a report for a given channel address. This process is dependent on the channel address and the information it provides. The following types of scoring are used.

Based on 3rd party ANI blacklist and IP blacklist requests.

Based on application, customer, and local ANI blacklist and IP blacklist. This score is combined with the threat scoring above. It is assumed that local scoring may identify fraudulent channel addresses that are not registered with third parties or vice versa. Therefore, a check of local application blacklists is required.

Each of the following has <NUM> threshold levels most are applicable to multiple channel address types.

The following data can be capture and use for scoring: Caller ID, IP whois, Autonomous System Number (ASN) lookup, Geographic (GEO) IP look up, white pages lookup. These scores may be used individually or combined in any number or combinations to increase specificity and sensitivity:.

Qualifiers are used/configured for these and is dependent on how an individual app is configured. For example, email addresses that are greater than <NUM> year old might be assigned a risk level of <NUM> and one that is a week old assigned a risk level of <NUM>. These values are then used in a weighted averages calculation as defined later in this disclosure. For more broad categories like countries, a simple listing of suspect countries would be assigned a risk level of <NUM> and all other a default value of <NUM>.

New channel addresses tend to be riskier than those known. A channel address is considered new if we haven't seen it in the last <NUM>/<NUM> days. An age qualifier is used to determine either a single threat level or multiple e.g., Not seen in <NUM> days equates to a threat level = <NUM>, not seen in <NUM> days equates to a medium threat = <NUM>, and finally not seen in <NUM> days equates to minimum threat <NUM>.

There are three approaches considered for this system. The system employs conditional processing, standard deviation in an unsupervised learning model, and weighted averages. Behaviors, situation and reputation are all processed via weighted averages. Behaviors are qualified via a calculation that determines how far they are from the mean. All others are qualified by configuration, in some cases by an analyst. Scores from all are used in combination scoring, which generates an overall risk score that may be used to determination whether a report on the channel address is propagated to the fraud report service and the dashboard for further action and review in real-time.

Combination scores are calculated by the combination of threat scoring, behavioral scoring, situational scoring, and reputation scores. The combination of scores is entirely configurable and interchangeable and often dependent on the channel address type and what data is available from it. Before scores are calculated, modus ponens with forward chaining is used. Due to the use of multiple channel address types and the availability of data, the need for a diverse rule set is required. To start the process, one or many conditionals might be used, for example a basic set of modus ponen rules might look as follows.

If conditional process doesn't redirect the process, the scoring process is started. Behavior counts are processed via weighted averages of the percent deviation from the mean or expected behavior. All others (situational and reputation) are calculated using weighted averages. Rules can be added and included in processing as new data becomes available via configuration step.

The scoring engine starts with the data and reasons its way to the answer. It can do this by combining one or many rules weighting the outcomes of each and concluding a risk level. The effect of this method is an ability to add and apply combinations of rule sets to generate the likelihood of fraud. It also allows for easy addition of new rules as the fraudsters apply new attack vectors. For a given channel address there can be <NUM> to N rule combinations that when combined provide a Fraud risk score.

Taking the data input, using modus ponens in a forward chaining algorithm, analyzing via standard deviation and applying weighted thresholds provides a unique, single solution to assess fraud on multiple channels in a way that allows for the addition of new rules or modification of those rules. Based on the channel type and combination of rules, outputs can be combined and weighted to provide the likelihood of Fraud. As a data driven approach, the addition of data can allow for better sensitivity and specificity. Being able to configure the solution provides added flexibility to adjust in dynamic environment where inputs change based on the domain.

Weighted average of a Deviation from the expected.

As we discussed prior, using standard deviation is one way to look at the data and determine if a behavior qualifies as an outlier. Standard deviation allows us the ability to visualize the domain and even make decisions about processing. The mean and average deviation is used to calculate the percent of deviation that a behavior is from the expected (mean). The percent deviation from the mean can be applied to a weighted average calculation to come up with an overall average or likelihood that a call is risky.

Knowing the mean, we can calculate the percent deviation of a behavior from the expected. Percent deviation measures the distance in percentage of a data point from the mean.

We start by calculating the distance of our behavior count from the mean:
the distance, D, of a data point equal to the absolute value of the data point's value, d, minus the mean, m: <MAT>.

The mean and deviation are used to find the percent deviation. Dividing the deviation by the mean, then multiply by <NUM>, will show how far in terms of percentage a point is from the expected. Next, for each count we take and apply a weighted average across the data as such.

Weighted average of all percent deviations: <MAT> x - Percent Deviation.

The weighted average we take each behavior and it's percent deviation and apply a weight to it. The combined cumulative weight should be <NUM>. So, for each value of x a weight is assigned.

A simple example:
In this simple example, we use a call volume and accounts accessed that look to be outliers while both the reputation and situation scores are lower (as configured by the application).

We configure the weights for each based on an analysis of the application usage.

Claim 1:
A method of detecting fraud for controlling flow of electronic communication interactions in a client contact system, comprising:
receiving at a shared composite API (<NUM>) a contact from a user via an electronic communication channel (<NUM>), the contact corresponding to event data, the event data including at least one of a channel type and an event channel address the event channel address selected from an automated number identification, an IP address, a session initiation protocol address, email address or other unique identifier of a point of contact;
forwarding the event data to a Fraud Service Ingestion (<NUM>) comprising a memory and a processor in communication with a Fraud Record Topic (<NUM>), wherein the Fraud Record Topic is a data pipe, the Fraud Service Ingestion in communication a Fraud Service Aggregator (<NUM>), such that the Fraud Service Aggregator retrieves the event data from the Fraud Record Topic;
the Fraud Service Aggregator checking the event channel address against a white list (<NUM>) and, upon determining that the event channel address is in the white list, providing the event channel address to a scoring service via a scoring topic;
the scoring service comprising machine learning for checking the event data against at least one criteria to determine a risk associated with the event data, wherein at least one of the criteria comprises at least one of behavior criterion, situation criterion and reputation criterion, wherein the behavior criterion represents caller and channel address behavior, with attributes thereof representing counts of how many times a user accesses the client contact system; situation criterion represents whitelisting or blacklisting of the channel address and location; and reputation criterion represents how the user has used the client contact system in the past, such that the machine learning of the scoring service updates the criteria based on detected rules and patterns; and
generating an overall risk score using behavior, situation and reputation criteria to determine whether a report for the channel address is propagated via fraud service alert (<NUM>), fraud alert email (<NUM>), or fraud service reporting (<NUM>) and propagating said report.