Self-learning real-time prioritization of telecommunication fraud control actions

1. A computer implemented method for detecting system fraud on a network, comprising:

receiving at least one data record of an activity by a customer of a service from a company provides said service;

checking the data record against a plurality of rules, said rules defined by said company;

responsive to a determination that at least one of the rules has been satisfied by the data record, generating an alert; and

scoring the alert by a predictive model to determine a likelihood that the activity is fraudulent;

wherein scoring alerts by a predictive model further comprises:

inputting into the predictive model data extracted from the alert, related instances of unusual activity, and risk data.

2. The method of claim 1 , further comprising associating the alert with a case, the case containing additional data related to the caller.

3. The method of claim 2 , further comprising:

queuing the case according to the scored alerts within the case;

determining whether fraud exists within the case; and

updating the predictive model based on the determination of whether fraud exists.

4. The method of claim 2 , wherein the additional data related to the customer includes an alert profile, containing historical alert data about the customer.

5. A method for detecting systems fraud, comprising:

receiving a record of systems activity by a customer; and

responsive to a determination that the record includes unusual activity of the customer with respect to either the customer's prior activities or rules defining unusual activity:

using a predictive model to determine a likelihood that the unusual activity is associated with systems fraud;

wherein using a predictive model further comprises:

providing as input to the predictive model the unusual activity found in the record, related instances of unusual activity, and risk data; and

obtaining as output from the predictive model a score indicative of the likelihood that the unusual activity in the record is the result of fraud.

6. The method of claim 5 , wherein the systems activity is a telephone call.

7. The method of claim 5 , further comprising:

receiving confirming information indicating whether the unusual activity is actually associated with systems fraud; and

updating the predictive model using the confirming information.

8. The method of claim 7 , wherein the confirming information is received from a fraud analyst.

9. The method of claim 5 , wherein a determination that the record includes unusual activity includes a determination that a detail of the record exceeds a preset threshold.

10. The method of claim 5 , further comprising:

transmitting the unusual activity and the score to an analyst; and

receiving from the analyst a decision indicating whether the unusual activity is the result of fraud.

11. A system for detecting systems fraud comprising:

a network server for receiving data records;

a rule engine, communicatively coupled to the network server, for evaluating data records against preset rules and generating alerts;

a rule database, communicatively coupled to the rule engine, for storing the preset rules;

a customer alert database, communicatively coupled to the rule engine, for maintaining customer alert profiles;

a case engine, communicatively coupled to the rule engine, for associating a generated alert with a case;

a case database, communicatively coupled to the case engine, for storing case data;

a predictive model, communicatively coupled to the case engine, for determining a likelihood that an alert is a result of fraudulent activity;

a queuing engine, communicatively coupled to the predictive model, for queuing cases according to a priority; and

at least one risk table, communicatively coupled to the predictive model, for providing risk data to the predictive model.