Patent ID: 8600872

Claim:
A method of identifying a point of compromise, comprising: accessing data stored in a data storage system, the data being associated with a plurality of accounts including both compromised and non-compromised accounts; identifying a plurality of at-risk accounts from the plurality of accounts including both the compromised and the non-compromised accounts; identifying a plurality of common points of transaction using computer implemented compromise detection logic, each of the plurality of common points of transaction being associated with a minimum number of the plurality of identified at-risk accounts; and identifying a point of compromise from the plurality of common points of transaction using the computer implemented compromise detection logic based on (i) the number of the identified at-risk accounts involved in transactions executed via each common point of transaction during a time period, and (ii) a total number of accounts involved in transactions executed via the common point of transaction during the time period; identifying an exposure time period for the point of compromise and identifying additional accounts that are identified at-risk accounts, the exposure time period being selected from a plurality of different time periods based on (i) the percentage of the identified at-risk accounts involved in transactions executed via the point of compromise during each of the plurality of time periods, and (ii) a total number of accounts involved in transactions executed via the point of compromise during each of the plurality of time periods; wherein at least a portion of the identified at-risk accounts are identified by analyzing transaction history data to identify clusters of potentially fraudulent transactions, the clusters of potentially fraudulent transactions being identified based on thresholds of (i) a minimum number of transactions executed via a single transaction location, (ii) a minimum dollar amount for each of the minimum number of transactions, and (iii) a maximum period of time during which the minimum number of transactions are executed.