System and method for dynamically predicting fraud using machine learning

1 . A computer system comprising:

a computing device;

a central server for detecting a fraudulent transaction in a customer account;

a requesting device;

an endpoint device;

a network for connecting the computing device, the central server, the requesting device, and the endpoint device,

wherein the computing device has a processor coupled to a memory, the memory storing instructions, which when executed by the processor, configure the computing device to:

communicate with the central server via the network to receive from a current database containing a data store of current policy information for insurance holders associated with an insurance provider, an insurance information package comprising current transactions relating to a target claim for a claimant associated with the requesting device as requested from an entity associated with the endpoint device and past transactions for past claims including prior transactions flagged as fraudulent;

generate a set of text-based features derived from a plurality of descriptions of communications between the requesting device and the endpoint device when requesting the target claim from the entity, the text-based features describing the target claim, by automatically translating the descriptions of communication into an array of vectors, wherein a vector of the array is created for each word used in the description and having a number of dimensions, the array of vectors averaged to provide a representation of entire semantic properties of the description into vector-based features;

generate a set of graph-based features derived from the insurance information package relating to all claims, wherein each node identifies a particular claim selected from the target claim and the past claims and captures attributes of the particular claim and associated policy; each edge links two nodes based on one or more overlapping attributes; and the set of graph-based features:

generating a network graph and comprising two categories of features:

count features representing counts of information associated with a target node of the network graph, the target node being itself a representation of one insurance claimant, within a network of insurance claimant information, and

neighbourhood features comprising information beyond the target node within the network of insurance claimant information comprising a neighbourhood of nodes surrounding the target node, wherein the neighbourhood features are derived via a breadth first search comprising:  gathering information from a set of neighbour nodes immediately connected to the target node, and  repeating the gathering in an extended neighbour search for a set of extended neighbour nodes immediately connected to each of the neighbour nodes, and repeating the gathering again until at least a pre-defined number of extended neighbour searches have been performed from the target node;

generate a set of tabular features comprising details related to claim information and exposure details of the past claims and the target claim from both the current database containing the data store of current policy information for insurance holders associated with an insurance provider, and a legacy database containing the corresponding data store of transaction information related to past insurance fraud investigations, and where the tabular features comprise claim-based features; and

generate a computer signal providing an indication of a likelihood of electronic fraudulent transaction in the current transactions for the target claim by applying the set of text-based features, the set of graph-based features and the set of tabular features as input into a predictive machine learning model using gradient boosted decision trees and responsive to the generation of the computer signal, to cause a computerized action for denying subsequent transactions from parties associated with the target claim comprising the requesting device to be triggered on the requesting device and generate an alert notification on affected devices processing the claims via the central server for triggering actions on the subsequent transactions, wherein the predictive machine learning model using gradient boosted decision trees is trained by:

collecting past insurance information packages from the legacy database containing a corresponding data store of the past claims;

generating the set of text-based features, the set of graph-based features and the set of tabular features from the past insurance information packages contained in the legacy database;

flagging each past claim within the past insurance information packages as one of: fraudulent or not fraudulent transaction;

creating a training data set comprising the set of text-based features, the set of graph-based features and the set of tabular features extracted from the past insurance information package and the past claims as flagged; and

training the predictive machine learning model using the training set to predict and thereby generate the computer signal by producing a plurality of decision tree-based decisions with each new decision tree in the gradient boosted decision trees trained on residuals of previous decision trees.

2 . The computer system of claim 1 , wherein the instructions configure the computing device to first synthesize the insurance information package in the current database into two distinct tables prior to extracting the set of features, the two distinct tables comprising:

an insurance information table comprising: general insurance information relating to both present and past claimants, claims, and fraud investigations, and;

an edge table, consisting of information relating to connections between various claimants connected to the entity.

3 . The computer system of claim 1 , wherein the edge links the two nodes along with a timestamp indicating when a relationship between the two nodes started, the relationship for use by the predictive machine learning model in predicting the likelihood of fraud.

4 . The computer system of claim 1 , wherein the description is text-based and the set of text-based features generated further comprise at least one of: a total number of relevant words used in the description, a description length, a number of tokens defining text building blocks.

5 . The computer system of claim 1 , wherein the predictive machine learning model comprises a model using extreme gradient boosting.

6 . A computer implemented method for detecting a fraudulent transaction in a customer account, the method comprising:

receiving via a network at an endpoint device a request related to a target claim from a requesting device for a claimant associated with the requesting device;

communicating via the network by a computing device with a central server to receive from a current database containing a data store of current policy information for insurance holders associated with an insurance provider an insurance information package comprising current transactions relating to the target claim for the claimant associated with the requesting device as requested from an entity associated with the endpoint device and past transactions for past claims including prior transactions flagged as fraudulent;

generating a set of text-based features derived from a plurality of descriptions of communications between the requesting device and the endpoint device when requesting the target claim from the entity, the text-based features describing the target claim, by automatically translating the descriptions of communication into an array of vectors, wherein a vector of the array is created for each word used in the description and having a number of dimensions, the array of vectors averaged to provide a representation of entire semantic properties of the description into vector-based features;

generating a set of graph-based features derived from the insurance information package relating to all claims, wherein each node identifies: a particular claim selected from the target claim and the past claims; and captures attributes of the particular claim and associated policy; each edge links two nodes based on one or more overlapping attributes; and the set of graph-based features:

generating a network graph and comprising two categories of features:

count features representing counts of information associated with a target node of the network graph, the target node being itself a representation of one insurance claimant, within a network of insurance claimant information, and

neighbourhood features comprising information beyond the target node within the network of insurance claimant information comprising a neighbourhood of nodes surrounding the target node, wherein the neighbourhood features are derived via a breadth first search comprising:

gathering information from a set of neighbour nodes immediately connected to the target node, and

repeating the gathering in an extended neighbour search for a set of extended neighbour nodes immediately connected to each of the neighbour nodes, and repeating the gathering again until at least a pre-defined number of extended neighbour searches have been performed from the target node;

generating a set of tabular features comprising details related to claim information and exposure details of the past claims and the target claim from both the current database containing the data store of current policy information for insurance holders associated with an insurance provider, and a legacy database containing the corresponding data store of transaction information related to past insurance fraud investigations, and where the tabular features comprise claim-based features; and

generating a computer signal providing an indication of a likelihood of electronic fraudulent transaction in the current transactions for the target claim by applying the set of text-based features, the set of graph-based features and the set of tabular features as input into a predictive machine learning model using gradient boosted decision trees and responsive to the generation of the computer signal, to cause a computerized action for denying subsequent transactions from parties associated with the target claim comprising the requesting device to be triggered on the requesting device and generate an alert notification on affected devices processing the claims via the central server for triggering actions on the subsequent transactions, wherein the predictive machine learning model using gradient boosted decision trees is trained by:

collecting past insurance information packages from the legacy database containing a corresponding data store of the past claims;

generating the set of text-based features, the set of graph-based features and the set of tabular features from the past insurance information packages contained in the legacy database;

flagging each past claim within the past insurance information packages as one of: fraudulent or not fraudulent transaction;

creating a training data set comprising the set of text-based features, the set of graph-based features and the set of tabular features extracted from the past insurance information package and past claims as flagged; and

training the predictive machine learning model using the training set to predict and thereby generate the computer signal by producing a plurality of decision tree-based decisions with each new decision tree in the gradient boosted decision trees trained on residuals of previous decision trees.

7 . The method of claim 6 , further comprising: first synthesizing the insurance information package in the current database into two distinct tables prior to extracting the set of features, the two distinct tables comprising:

an insurance information table comprising: general insurance information relating to both present and past claimants, claims, and fraud investigations; and

an edge table, consisting of information relating to connections between various claimants connected to the entity.

8 . The method of claim 6 , wherein the edge links the two nodes along with a timestamp indicating when a relationship between the two nodes started, the relationship for use by the predictive machine learning model in predicting the likelihood of fraud.

9 . The method of claim 6 , wherein the description is text-based and the set of text-based features generated further comprise at least one of: a total number of relevant words used in the description, a description length, a number of tokens defining text building blocks.

10 . The method of claim 6 , wherein the predictive machine learning model comprises a model using extreme gradient boosting.