Systems and methods for modeling and classification of fraudulent transactions

1 . A multi-class fraudulent classification computer system comprising at least one processor and a memory in communication with the at least one processor, the memory comprising computer-executable instructions stored therein, the computer-executable instructions being executable to cause the at least one processor to:

retrieve, from a historical transaction database, a plurality of transaction records, each transaction record associated with a corresponding one of a plurality of historical transactions and including a transaction classification identifier, a merchant identifier, and a transaction amount, wherein the transaction classification identifier is associated with a transaction type assigned to the historical transaction from among a plurality of transaction types, the plurality of transactions types including a genuine type and at least two fraudulent types, the at least two fraudulent types including a bank identification number (BIN) fraud type;

generate, from the retrieved plurality of transaction records, for subject transactions of the plurality of transactions, a transaction velocity by one of counting or summing a parameter for a set of transaction records recorded during a period of time prior to a respective one of the subject transactions;

generate, from the retrieved plurality of transaction records, model training data for the subject transactions of the plurality of transactions, wherein the model training data comprises, for each subject transaction, the transaction type and the generated transaction velocity;

train, in a first stage, using the model training data and a machine learning algorithm, a single multi-class fraud prediction model to receive an input transaction velocity for an input transaction and output a score for each of the plurality of transaction types, the score for each of the transaction types indicating a relative likelihood that the input transaction is of the transaction type, wherein the scores output by the model for each input transaction sum to unity across the plurality of transaction types;

receive a current transaction request message associated with a current payment transaction, the current transaction request message including an account identifier of a payment card used to initiate the transaction, a merchant identifier of the merchant and a transaction amount for the current payment transaction;

determine a current transaction velocity relative to a transaction time of the current payment transaction;

apply the trained single multi-class fraud prediction model to the current transaction comprising inputting the current transaction velocity and data included within the current transaction request message to the trained multi-class fraud prediction model and obtaining an output, in real-time, comprising, for each of the plurality of transaction types including a genuine type and at least two fraudulent types, the score for each transaction type indicating the relative likelihood that the current payment transaction is of the transaction type;

identify, based on the output, a most likely transaction type for the current payment transaction by comparing a magnitude of the scores including comparing the genuine score to each of the two fraudulent scores;

generate a transaction classification message for the current payment transaction, the transaction classification message including each of the plurality of transaction types including the genuine type and the at least two fraudulent types, the score for each transaction type indicating the relative likelihood that the current payment transaction is of the transaction type, and the identified most likely transaction type and the score associated with the identified most likely transaction type;

transmit the classification message to a computing device associated with an issuer of the payment card;

determine that the most likely transaction type of the current payment transaction is the BIN fraud type;

deploy, in response to the determination that the most likely transaction type of the current payment transaction is the BIN fraud type, computational resources to mitigate, for transactions subsequent to the current payment transaction, fraud associated with the most likely transaction type, wherein to deploy computational resources, the computer-executable instructions are executable to further cause the at least one processor to deploy a server that increases scrutiny of transactions subsequent to the current payment transaction having the same BIN as the current payment transaction; and

retrain, in a second stage, the single multi-class fraud prediction model using second model training data including at least the current payment transaction and outputs from the fraud prediction model including each of the plurality of transaction types including a genuine type and at least two fraudulent types and a previously determined score for each of the genuine type and the at least two fraudulent types, wherein all of the scores included in the retraining sum to unity across the plurality of transaction types.

2 . The multi-class fraudulent classification computer system in accordance with claim 1 , wherein the current transaction request message is a real-time authorization request message.

3 . The multi-class fraudulent classification computer system in accordance with claim 2 , wherein the computer-executable instructions being executable to further cause the at least one processor to append the transaction classification message to the real-time authorization request message.

4 . The multi-class fraudulent classification computer system in accordance with claim 1 , wherein the transaction classification message includes a reason code, wherein the reason code is associated with the identified most likely transaction type.

5 . The multi-class fraudulent classification computer system in accordance with claim 1 , wherein the computer-executable instructions are executable to further cause the at least one processor to:

determine the current transaction velocity relative to the transaction time of the current payment transaction by determining a number of transactions occurring with the merchant prior to the transaction time.

6 . The multi-class fraudulent classification computer system in accordance with claim 1 , wherein the computer-executable instructions are executable to further cause the at least one processor to:

determine the current transaction velocity relative to the transaction time of the current payment transaction by determining an average transaction amount for a plurality of transactions occurring over a period of time prior to the transaction time.

7 . The multi-class fraudulent classification computer system in accordance with claim 1 , wherein the computer-executable instructions are executable to further cause the at least one processor to:

determine the current transaction velocity relative to the transaction time of the current payment transaction by determining a number of account numbers within a range of account numbers for a plurality of transactions occurring over a period of time prior to the transaction time.

8 . A computer-implemented method, the method implemented using a computing device including at least one processor and a memory in communication with the at least one processor, said method comprising computer-executable instructions executed by the at least one processor of:

retrieving, from a historical transaction database, a plurality of transaction records, each transaction record associated with a corresponding one of a plurality of historical transactions and including a transaction classification identifier, a merchant identifier, and a transaction amount, wherein the transaction classification identifier is associated with a transaction type assigned to the historical transaction from among a plurality of transaction types, the plurality of transactions types including a genuine type and at least two fraudulent types;

generating, from the retrieved plurality of transaction records, for subject transactions of the plurality of transactions, a transaction velocity by one of counting or summing a parameter for a set of transaction records recorded during a period of time prior to a respective one of the subject transactions;

generating, from the retrieved plurality of transaction records, model training data for the subject transactions of the plurality of transactions, wherein the model training data comprises, for each subject transaction, the transaction type and the generated transaction velocity;

training, using the model training data and a machine learning algorithm, a single multi-class fraud prediction model to receive an input transaction velocity for an input transaction and output a score for each of the plurality of transaction types, the score for each of the transaction types indicating a relative likelihood that the input transaction is of the transaction type, wherein the scores output by the model for each input transaction sum to unity across the plurality of transaction types;

receiving a current transaction request message associated with a current payment transaction, the current transaction request message including an account identifier of a payment card used to initiate the transaction, a merchant identifier of the merchant and a transaction amount for the current payment transaction;

determining a current transaction velocity relative to a transaction time of the current payment transaction;

applying the trained single multi-class fraud prediction model to the current transaction comprising inputting the current transaction velocity and data included within the current transaction request message to the trained multi-class fraud prediction model and obtaining an output, in real-time, comprising, for each of the plurality of transaction types including a genuine type and at least two fraudulent types, the score for each transaction type indicating the relative likelihood that the current payment transaction is of the transaction type;

identifying, based on the output, a most likely transaction type for the current payment transaction by comparing a magnitude of the scores including comparing the genuine score to each of the two fraudulent scores;

generating a transaction classification message for the current payment transaction, the transaction classification message including each of the plurality of transaction types including the genuine type and the at least two fraudulent types, the score for each transaction type indicating the relative likelihood that the current payment transaction is of the transaction type, and the identified most likely transaction type and the score associated with the identified most likely transaction type;

transmitting the classification message to a computing device associated with an issuer of the payment card;

determining that the most likely transaction type of the current payment transaction is one of the at least two fraudulent types;

deploying, in response to the determination that the most likely transaction type of the current payment transaction is one of the at least two fraudulent types, computational resources to mitigate, for transactions subsequent to the current payment transaction, fraud associated with the most likely transaction type, wherein deploying computational resources, the computer-executable instructions are executable to further cause the at least one processor to deploy a server that increases scrutiny of transactions subsequent to the current payment transaction; and

retraining, in a second stage, the single multi-class fraud prediction model using second model training data including at least the current payment transaction and outputs from the fraud prediction model including each of the plurality of transaction types including a genuine type and at least two fraudulent types and a previously determined score for each of the genuine type and the at least two fraudulent types, wherein all of the scores included in the retraining sum to unity across the plurality of transaction types.

9 . The computer-implemented method in accordance with claim 8 , wherein determining the current transaction velocity relative to the transaction time of the current payment transaction further comprises:

determining a number of transactions occurring with the merchant prior to the transaction time.

10 . The computer-implemented method in accordance with claim 8 , wherein determining the current transaction velocity relative to the transaction time of the current payment transaction further comprises:

determining an average transaction amount for a plurality of transactions occurring over a period of time prior to the transaction time.

11 . The computer-implemented method in accordance with claim 8 , wherein determining the current transaction velocity relative to the transaction time of the current payment transaction further comprises:

determining a number of account numbers within a range of account numbers for a plurality of transactions occurring over a period of time prior to the transaction time.

12 . The computer-implemented method of claim 8 , wherein

determining that the most likely transaction type is one of the at least two fraudulent types comprises determining that the most likely transaction type of the current payment transaction is a BIN fraud type, and wherein deploying computational resources comprises deploying at least one more server than a current number of already deployed servers that increases scrutiny of transactions subsequent to the current payment transaction having the same BIN as the current payment transaction.

13 . A non-transitory computer-readable storage medium that includes computer-executable instructions executable by at least one processor of a multi-class fraudulent classification computer system to cause the at least one processor to:

retrieve, from a historical transaction database, a plurality of transaction records, each transaction record associated with a corresponding one of a plurality of historical transactions and including a transaction classification identifier, a merchant identifier, and a transaction amount, wherein the transaction classification identifier is associated with a transaction type assigned to the historical transaction from among a plurality of transaction types, the plurality of transactions types including a genuine type and at least two fraudulent types;

generate, from the retrieved plurality of transaction records, for subject transactions of the plurality of transactions, a transaction velocity by one of counting or summing a parameter for a set of transaction records recorded during a period of time prior to a respective one of the subject transactions;

generate, from the retrieved plurality of transaction records, model training data for the subject transactions of the plurality of transactions, wherein the model training data comprises, for each subject transaction, the transaction type and the generated transaction velocity;

train, using the model training data and a machine learning algorithm, a single multi-class fraud prediction model to receive an input transaction velocity for an input transaction and output a score for each of the plurality of transaction types, the score for each of the transaction types indicating a relative likelihood that the input transaction is of the transaction type, wherein the scores output by the model for each input transaction sum to unity across the plurality of transaction types;

receive a current transaction request message associated with a current payment transaction, the current transaction request message including an account identifier of a payment card used to initiate the transaction, a merchant identifier of the merchant and a transaction amount for the current payment transaction;

determine a current transaction velocity relative to a transaction time of the current payment transaction;

apply the trained single multi-class fraud prediction model to the current transaction comprising inputting the current transaction velocity and data included within the current transaction request message to the trained multi-class fraud prediction model and obtaining an output, in real-time, comprising, for each of the plurality of transaction types including a genuine type and at least two fraudulent types, the score for each transaction type indicating the relative likelihood that the current payment transaction is of the transaction type;

identify, based on the output, a most likely transaction type for the current payment transaction by comparing a magnitude of the scores including comparing the genuine score to each of the two fraudulent scores;

generate a transaction classification message for the current payment transaction, the transaction classification message including each of the plurality of transaction types including the genuine type and the at least two fraudulent types, the score for each transaction type indicating the relative likelihood that the current payment transaction is of the transaction type, and identified the most likely transaction type and the score associated with the identified most likely transaction type; and

transmit the classification message to a computing device associated with an issuer of the payment card;

determine that the most likely transaction type of the current payment transaction is one of the at least two fraudulent types;

deploy, in response to the determination that the most likely transaction type of the current payment transaction is one of the at least two fraudulent types, computational resources to mitigate, for transactions subsequent to the current payment transaction, fraud associated with the most likely transaction type, wherein to deploy computational resources, the computer-executable instructions are executable to further cause the at least one processor to deploy a server that increases scrutiny of transactions subsequent to the current payment transaction; and

retrain, in a second stage, the single multi-class fraud prediction model using second model training data including at least the current payment transaction and outputs from the fraud prediction model including each of the plurality of transaction types including a genuine type and at least two fraudulent types and a previously determined score for each of the genuine type and the at least two fraudulent types, wherein all of the scores included in the retraining sum to unity across the plurality of transaction types.

14 . The non-transitory computer-readable storage medium in accordance with claim 13 , wherein the computer-executable instructions cause the processor to:

determine the current transaction velocity relative to the transaction time of the current payment transaction by determining a number of transactions occurring with the merchant prior to the transaction time.

15 . The non-transitory computer-readable storage medium in accordance with claim 13 , wherein the computer-executable instructions cause the processor to:

determine the current transaction velocity relative to the transaction time of the current payment transaction by determining an average transaction amount for a plurality of transactions occurring over a period of time prior to the transaction time.

16 . The non-transitory computer-readable storage medium in accordance with claim 13 , wherein the computer-executable instructions cause the processor to:

determine the current transaction velocity relative to the transaction time of the current payment transaction by determining a number of account numbers within a range of account numbers for a plurality of transactions occurring over a period of time prior to the transaction time.

17 . The non-transitory computer-readable storage medium in accordance with claim 13 , wherein to determine that the most likely transaction type of the current payment transaction is one of the at least two fraudulent types, the computer-executable instructions are executable by the at least one processor to determine that the most likely transaction type of the current payment transaction is a BIN fraud type, and wherein to deploy computational resources, the computer-executable instructions are executable by the at least one processor deploy at least one more server than a current number of already deployed servers that increases scrutiny of transactions subsequent to the current payment transaction having the same BIN as the current payment transaction.