IP Library › Granted Patent US 12682364
Granted Patent B2
US 12682364 · App. 18/775,926 · Granted Jul 14, 2026

Detecting unauthorized online applications using machine learning

Inventors: Timothy Kramme (Parker, TX); Elizabeth Flowers (Bloomington, IL); Reena Batra (Alpharetta, GA); Miriam Valero (Bloomington, IL); Puneit Dua (Bloomington, IL); Shanna L. Phillips (Bloomington, IL); Russell Ruestman (Minonk, IL); Bradley A Craig (Normal, IL)
Assignee: State Farm Mutual Automobile Insurance Company
G06Q30/0185G06N5/046G06N20/00G06Q20/102G06Q20/20G06Q20/24G06Q20/3224G06Q20/34G06Q20/401G06Q20/4016G06Q20/407G06Q20/409G06Q30/0225G06V30/194G06V30/41G06Q30/0248
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12682364
App. No.
18/775,926
Granted
Jul 14, 2026
Kind
B2
Abstract

A method of detecting whether electronic fraud alerts are false positives includes receiving data detailing a financial transaction, inputting the data into a rules-based engine that determines whether to generate an electronic fraud alert for the financial transaction based upon the data, and, when an electronic fraud alert is generated, inputting the data into a machine learning program trained to identify one or more facts indicated by the data. The method may also include determining whether the identified facts can be verified by customer data and, in response to determining that the facts can be verified, retrieving or receiving first customer data. The method may further include verifying that the electronic fraud alert is not a false positive based upon analysis of the first customer data, and transmitting the verified electronic fraud alert to a mobile device of the customer to alert the customer to fraudulent activity.

Claims (77)

1 . A non-transitory, computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations for authorizing online applications based upon search history data, the operations comprising:

receiving a plurality of search history records, wherein each record of the plurality of search history records includes:

search-related data associated with an online search tool; and

a fraud determination label associated with the search-related data;

determining, based on the plurality of search history records, an association between a first set of search-related data and a first fraud determination label;

generating an authorization rule including the first set of search-related data and the first fraud determination label;

receiving, from an applicant computing device, online application input data associated with an online application, wherein the online application input data includes an applicant identifier;

retrieving search history data associated with at least one of the applicant identifier or the applicant computing device;

determining, by executing the authorization rule and based on the online application input data and the search history data, an indication of whether the online application is unauthorized; and

allowing or preventing processing of the online application based on the indication of whether the online application is unauthorized.

2 . The non-transitory, computer-readable medium of claim 1 , wherein determining the indication of whether the online application is unauthorized comprises:

providing the online application input data and the search history data as input to a machine learning program trained to predict whether the online application is unauthorized.

3 . The non-transitory, computer-readable medium of claim 2 , wherein the machine learning program is trained using historical online application records including:

(i) historical application data submitted in connection with a plurality of previous online applications;

(ii) historical search history data associated with the plurality of previous online applications; and

(iii) historical authorization determinations made in connection with the plurality of previous online applications.

4 . The non-transitory, computer-readable medium of claim 1 , wherein executing the authorization rule comprises at least one of:

determining that one or more search terms in the search history data corresponds to information included in the online application input data;

determining that a name included in the search history data corresponds to a name included in the online application input data;

determining that the one or more search terms are directed to discovering an address associated with the applicant identifier; or

determining that the one or more search terms are directed to discovering an employment history associated with the applicant identifier.

5 . The non-transitory, computer-readable medium of claim 1 , wherein generating the authorization rule comprises:

providing, as input to a machine learning program, the plurality of search history records; and

generating the authorization rule based at least in part on an output of the machine learning program.

6 . The non-transitory, computer-readable medium of claim 1 , wherein the first set of search-related data comprises a first search term entered into the online search tool in a user-initiated search query.

7 . The non-transitory, computer-readable medium of claim 1 , wherein the first set of search-related data comprises a first search result returned by the online search tool in response to a user-initiated search query.

8 . The non-transitory, computer-readable medium of claim 1 , wherein retrieving the search history data comprises:

requesting, from the applicant computing device, online search records associated with a search engine operating on the applicant computing device.

9 . The non-transitory, computer-readable medium of claim 1 , wherein retrieving the search history data comprises:

determining an Internet Protocol (IP) address associated with the applicant computing device; and

retrieving, from a computer server associated with a search engine, search terms submitted to the search engine via the IP address associated with the applicant computing device.

10 . A computer-implemented method for authorizing online applications based upon search history, the computer-implemented method comprising:

receiving a plurality of search history records, wherein each record of the plurality of search history records includes:

search-related data associated with an online search tool; and

a fraud determination label associated with the search-related data;

determining, based on the plurality of search history records, an association between a first set of search-related data and a first fraud determination label;

generating an authorization rule including the first set of search-related data and the first fraud determination label;

receiving, from an applicant computing device, online application input data associated with an online application, wherein the online application input data includes an applicant identifier;

retrieving search history data associated with at least one of the applicant identifier or the applicant computing device;

determining, by executing the authorization rule and based on the online application input data and the search history data, an indication of whether the online application is unauthorized; and

allowing or preventing processing of the online application based on the indication of whether the online application is unauthorized.

11 . The computer-implemented method of claim 10 , wherein executing the authorization rule comprises at least one of:

determining that one or more search terms in the search history data corresponds to information included in the online application input data;

determining that a name included in the search history data corresponds to a name included in the online application input data;

determining that the one or more search terms are directed to discovering an address associated with the applicant identifier; or

determining that the one or more search terms are directed to discovering an employment history associated with the applicant identifier.

12 . The computer-implemented method of claim 10 , wherein generating the authorization rule comprises:

providing, as input to a machine learning program, the plurality of search history records; and

generating the authorization rule based at least in part on an output of the machine learning program.

13 . The computer-implemented method of claim 10 , wherein the first set of search-related data comprises a first search term entered into the online search tool in a user-initiated search query.

14 . The computer-implemented method of claim 10 , wherein the first set of search-related data comprises a first search result returned by the online search tool in response to a user-initiated search query.

15 . The computer-implemented method of claim 10 , wherein retrieving the search history data comprises:

requesting, from the applicant computing device, online search records associated with a search engine operating on the applicant computing device.

16 . The computer-implemented method of claim 10 , wherein retrieving the search history data comprises:

determining an Internet Protocol (IP) address associated with the applicant computing device; and

retrieving, from a computer server associated with a search engine, search terms submitted to the search engine via the IP address associated with the applicant computing device.

17 . A computer system for authorizing online applications based upon search history data, the computer system comprising:

a search history database configured to store data associated with a plurality of Internet searches;

one or more processors; and

a non-transitory memory storing instructions that, when executed by the one or more processors, cause the one or more processors to:

receive a plurality of search history records, wherein each record of the plurality of search history records includes:

search-related data associated with an online search tool; and

a fraud determination label associated with the search-related data;

determine, based on the plurality of search history records, an association between a first set of search-related data and a first fraud determination label;

generate an authorization rule including the first set of search-related data and the first fraud determination label;

receive, from an applicant computing device, online application input data associated with an online application, wherein the online application input data includes an applicant identifier;

retrieve search history data associated with at least one of the applicant identifier or the applicant computing device;

determine, by executing the authorization rule and based on the online application input data and the search history data, an indication of whether the online application is unauthorized; and

allow or prevent processing of the online application based on the indication of whether the online application is unauthorized.

18 . The computer system of claim 17 , wherein generating the authorization rule comprises:

providing, as input to a machine learning program, the plurality of search history records; and

generating the authorization rule based at least in part on an output of the machine learning program.

19 . The computer system of claim 17 , wherein retrieving the search history data comprises:

requesting, from the applicant computing device, online search records associated with a search engine operating on the applicant computing device.

20 . The computer system of claim 17 , wherein retrieving the search history data comprises:

determining an Internet Protocol (IP) address associated with the applicant computing device; and

retrieving, from a computer server associated with a search engine, search terms submitted to the search engine via the IP address associated with the applicant computing device.