Using machine learning to detect and mitigate transaction fraud

1 . A method, comprising:

accessing an electronic database storing historical merchant transaction data;

identifying, based on the accessing, a plurality of merchants having fraud risks that are above a predefined threshold, wherein the plurality of merchants are associated with a vector of fraud features;

dividing, based on characteristics of the plurality of merchants, the plurality of merchants into a plurality of merchant pools;

generating, for each of the merchant pools of the plurality of merchant pools and using a gradient descent method, a weight matrix for the vector of fraud features, wherein the weight matrix comprises a first number of rows and a second number of columns, the first number of rows corresponding to a number of fraud features in the vector of fraud features, the second number of columns corresponding to a total number of different types of transactions associated with the historical merchant transaction data;

calculating, for each of the merchant pools of the plurality of merchant pools, weighted new features at least in part by multiplying the vector of fraud features with the weight matrix;

performing, on each of the merchant pools of the plurality of merchant pools, a machine learning process using the weighted new features;

generating, for each of the merchant pools of the plurality of merchant pools and based on performing the machine learning process, a plurality of bad-transaction tags, wherein the plurality of bad-transaction tags are machine-generated and each corresponds to a hidden correlation between fraud and a specific combination of the fraud features;

determining a plurality of merchant groups based on the bad-transaction tags, wherein each merchant group of the plurality of merchant groups has a corresponding bad-transaction tag of the plurality of bad-transaction tags;

training, for each of the plurality of merchant groups, a respective multi-level decision tree model, wherein each of the respective multi-level decision tree models includes a first level tree model and a second level tree model, wherein an output of a training of the first level tree model is used as input to train the second level tree model, and wherein the first level tree model is trained using a greater penalty on false negative predictions than false positive predictions; and

predicting, using the trained multi-level decision tree models, transaction fraud risks for future transactions associated with the plurality of merchants of each of the plurality of merchant groups,

wherein the accessing, the identifying, the dividing, the generating the weight matrix, the calculating, the performing, the generating, the determining the plurality of merchant groups, the training, and the predicting are performed at least in part by one or more computers containing one or more hardware processors.

2 . The method of claim 1 , wherein:

the characteristics comprise: a geographical location, an online presence, a business size, or a business type; and

the plurality of merchants in a same merchant pool share at least one of the characteristics.

3 . The method of claim 1 , wherein at least a first subset of the plurality of merchants each have a dominant bad-transaction tag, respectively, and wherein at least a second subset of the plurality of merchants lack any dominant bad-transaction tag.

4 . The method of claim 3 , wherein the machine learning process is a first machine learning process, and wherein the method further comprises:

performing a second machine learning process for the second subset of the plurality of merchants, wherein the second machine learning process comprises a clustering process; and

grouping, based on performing the second machine learning process, the merchants in the second subset of the plurality of merchants into different ones of the plurality of merchant groups.

5 . The method of claim 1 , wherein the multiplying generates a product of the vector of fraud features and mean values of the weight matrix.

6 . The method of claim 1 , wherein the determining the plurality of merchant groups further comprises applying a K-means clustering process.

7 . The method of claim 1 , wherein: the determining the plurality of merchant groups further comprises:

assigning the bad-transaction tags to bad transactions conducted by merchants in each of the merchant pools; and

grouping the merchants having shared bad-transaction tags into a same merchant group.

8 . The method of claim 1 , wherein the training comprises using transactions corresponding to each of the plurality of merchant groups as training data for the respective multi-level decision tree model of that merchant group.

9 . The method of claim 8 , wherein the training further comprises:

sorting the transactions corresponding to each of the plurality of merchant groups in a chronological order; and

assigning greater weights to more recent transactions in the chronological order.

10 . The method of claim 8 , wherein the training further comprises:

training the first level tree model using the training data as an input of the first level tree model, the first level tree model producing a first group of outputs as presumptively good transactions that should be accepted and a second group of outputs as presumptively bad transactions that should be declined; and

training the second level tree model using the second group of outputs as an input of the second level tree model, the second level tree model producing a third group of outputs as presumptively good transactions that should be accepted and a fourth group of outputs as presumptively bad transactions that should be declined.

11 . The method of claim 10 , wherein the training further comprises:

applying a greater penalty to the second level tree model than to the first level tree model in response to a good transaction being falsely identified as a presumptively bad transaction.

12 . The method of claim 10 , wherein the predicting comprises accepting or declining the future transactions based on the third group and the fourth group of outputs of the trained second level tree model.

13 . A system, comprising:

a non-transitory memory; and

one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:

determining a plurality of fraud features for a plurality of merchants, the plurality of fraud features associated with a plurality of transactions involving the plurality of merchants;

training a weight matrix of coefficients for the plurality of fraud features, the weight matrix comprising a plurality of rows corresponding to a total number of the plurality of fraud features and a plurality of columns corresponding to a total number of different transaction types in the plurality of transactions;

transforming the plurality of fraud features at least in part by weighting the plurality of fraud features with the weight matrix of coefficients;

applying an unsupervised machine learning process to the transformed plurality of fraud features;

generating, based on applying the unsupervised machine learning process, a plurality of tags that correspond to different types of transaction fraud, respectively, wherein the plurality of tags are generated without direct human input, and wherein each of the tags in the plurality of tags corresponds to a correlation between a specific type of fraud and a set of circumstances or conditions involving one or more merchants of the plurality of merchants;

clustering the plurality of merchants into a plurality of different merchant groups based on the tags, such that each merchant group of the plurality of different merchant groups has a corresponding tag of the plurality of tags;

training, for each of the plurality of merchant groups, a respective decision tree model, wherein the training comprises: training a first level tree with transactions from said merchant group, and training a second level tree with an output of the first level tree, wherein the first level tree is trained with a greater emphasis on coverage of potentially fraudulent transactions than the second level tree, and wherein the second level tree is trained with a greater emphasis on precision of identifying fraudulent transactions than the first level tree; and

processing transactions associated with each of the plurality of merchant groups at least in part by using the decision tree model trained for said merchant group.

14 . The system of claim 13 , wherein the determining the fraud features comprises determining the fraud features from merchants that share similarities with respect to a geographical location, an online presence, a business size, or a business type.

15 . The system of claim 13 , wherein the training the weight matrix is obtained at least in part via a gradient descent process.

16 . The system of claim 13 , wherein the plurality of fraud features is in a form of a vector, and wherein the transforming the plurality of fraud features comprises multiplying the vector with the weight matrix of coefficients.

17 . The system of claim 13 , wherein:

the training of the first level tree further comprises using chronologically sorted and weighted transactions from said merchant group as training samples; and

the second level tree has more branches than the first level tree.

18 . A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:

identifying a vector of fraud features that are associated with a plurality of transactions conducted at least in part by a plurality of merchants;

training a weight matrix that contains a plurality of weight coefficients for the vector of fraud features, wherein the weight matrix comprises a first number of rows and a second number of columns, the first number of rows corresponding to a number of fraud features in the vector of fraud features, the second number of columns corresponding to a total number of different types of transactions associated with the plurality of transactions, and wherein the training comprises calculating probabilities of fraud using a gradient descent;

calculating weighted new features at least in part by multiplying the vector of fraud features and the trained weight matrix;

applying an unsupervised machine learning process on the weighted new features;

machine-generating a plurality of transaction tags based on the applying, the plurality of transaction tags each corresponding to a correlation between a specific type of fraud and a set of values associated with the vector of fraud features;

dividing the plurality of merchants into a plurality of merchant pools, each merchant pool being associated with a respective one of the transaction tags;

training, for each of the merchant pools, a decision tree model, wherein the training of the decision tree model further comprises:

training a first level tree of the decision tree model with transactions of each of the merchant pools as an input;

training a second level tree of the decision tree model with an output of the first level tree as an input of the second level tree, and wherein the second level tree has more branches than the first level tree;

applying a greater penalty, to the first level tree than the second level tree, when a fraudulent transaction is mistakenly predicted as a non-fraudulent transaction; and

applying a greater penalty, to the second level tree than the first level tree, when a non-fraudulent transaction is mistakenly predicted as a fraudulent transaction; and

processing future transactions of the merchant pools at least in part based on respective decision tree models that are trained for the merchant pools, wherein the processing comprises using the decision tree models to detect fraud and declining transactions where fraud has been detected.

19 . The non-transitory machine-readable medium of claim 18 , wherein the dividing comprises applying a K-means clustering process to group at least some of the merchants into a same merchant pool.

20 . The non-transitory machine-readable medium of claim 18 , wherein:

the training the first level tree generates a first group of outputs as presumptively good transactions that should be accepted and a second group of outputs as presumptively bad transactions that should be declined; and

the training the second level tree model generates a third group of outputs as presumptively good transactions that should be accepted and a fourth group of outputs as presumptively bad transactions that should be declined.