Patent Document ID: 10115111
Application ID: 12483887
Patent Flag: 1

Claim One:
1. A method comprising: automatically generating, with at least one processor, a predictive user model representing non-fraudulent activities undertaken by a user in multiple channels in association with an account of the user by transforming data representing the non-fraudulent activities of the user into relationships forming the predictive user model, wherein automatically generating the predictive user model comprises: generating, with the at least one processor, a plurality of components of the predictive user model from event parameters associated with a first set of events undertaken by the user when the user electronically accesses information associated with the account of the user, wherein the event parameters comprise data associated with the non-fraudulent activities undertaken by the user when the user electronically accesses information associated with an account of the user via a plurality of channels of the multiple channels that is collected during the first set of events, wherein the event parameters comprise IP address data or HTTP data and information associated with an ATM, information associated with a call center system, or information associated with an offline interaction, and wherein the IP address data or HTTP data comprises one or more of: IP address data or HTTP data associated with a login event of a session involving the user, IP address data or HTTP data associated with a termination event of a session involving the user, IP address data or HTTP data associated with an account access event of a session involving the user, IP address data or HTTP data associated with an activity event during a session involving the user, or any combination thereof; predicting, with the at least one processor and based on generating the plurality of components of the predictive user model, expected behavior of the user during a second set of events using the predictive user model, wherein the second set of events is associated with the non-fraudulent activities undertaken by the user when the user electronically accesses the account of the user, wherein predicting the expected behavior of the user during the second set of events comprises: generating a statistical relationship between the event parameters associated with the first set of events and derived parameters, wherein the derived parameters include one or more of: a geographic area from which a first device having the IP address data or identified by the HTTP data, that is conducting a session involving the user during the first set of events, a location within the geographic area of the first device having the IP address data or identified by the HTTP data, that is conducting a session involving the user during the first set of events, an identification of the first device having the IP address data or identified by the HTTP data, that is conducting a session involving the user during the first set of events, an electronic service provider of the first device having the IP address data or identified by the HTTP data, that is conducting a session involving the user during the first set of events, or any combination thereof; generating, with the at least one processor and from data representing fraudulent activities of a plurality of fraudsters in a plurality of third party accounts, a predictive fraud model; generating, with the at least one processor, data representing a prediction of expected behavior of a fraudster associated with a third set of events using the predictive fraud model, wherein the third set of events is associated with fraudulent activities undertaken by the fraudster in association with an additional account, wherein the predictive fraud model is independent of the predictive user model and is generated using the data representing the fraudulent activities of the plurality of fraudsters in the plurality of third party accounts; and calculating, with the at least one processor, a risk score associated with at least one fourth event that is conducted in real-time, wherein the risk score comprises an indication that the at least one fourth event is performed by the user instead of the fraudster, where the at least one fourth event is associated with electronically accessing the account of the user, wherein calculating the risk score comprises: calculating the risk score by comparing the expected behavior of the user during the second set of events predicted using the predictive user model, the data representing the prediction of expected behavior of the fraudster associated with the third set of events generated using the predictive fraud model, and IP address data or HTTP data of a second device conducting a session associated with the at least one fourth event; and generating, with the at least one processor, an alert associated with the account of the user based on calculating the risk score associated with the at least one fourth event.