System and method for detection and prevention of computer fraud
In a networked computer system, a user accesses a webserver via a web interface presenting credentials comprising a user identification. The webserver is communicatively connected to an application server. If fraud with respect to the user identification is detected, the application server sends a notification or alert to add the user identification to a list of compromised user identifications. The system also comprises a database for storing the list of compromised user identifications on a computer. Another category of user identifications is created referred to as phish phood which is comprised of fabricated user identifications.
1. A method for detection and prevention of computer fraud in a computer network comprised of a webserver, an application server having an identity manager application, and a database server having a database application and an authentication database,
wherein the webserver, application server and database server are communicatively connected to one another, the method comprising:
receiving by the application server, from a user using a web interface, a request to assign a proposed user identification to the user during a browser session,
checking by the identity manager application of the application server the proposed user identification against a list of compromised user identifications stored in a table of the authentication database to verify that the proposed user identification is not on the list, and
assigning by the identity manager application the proposed user identification to the user provided it is not on the list of compromised user identifications.
2. The method according to claim 1 , wherein the computer network is of a financial institution.
3. The method according to claim 1 , wherein the user is a customer of the financial institution.
4. A method for detection and prevention of computer fraud in a computer network comprised of a webserver, an application server having an identity manager application, and a database server having a database application and an authentication database,
wherein the webserver, application server and database server are communicatively connected to one another, the method comprising:
receiving a request for access to the webserver from a user providing a user identification during a browser session,
checking by the identity manager application of the application server the provided user identification against a list of compromised user identifications stored in a table of the authentication database,
tracking other access attempts made within the browser session to identify other compromised credentials, the browser session remaining open to ensure tracking is during same browser session, and
adding any other identified compromised credentials to the list of compromised user identifications.
5. The method according to claim 4 , wherein the list of compromised user identifications is stored on a computer.
6. The method according to claim 4 , further comprising monitoring credentials used to commit fraud across a series of interne protocol addresses.
7. A method for detection and prevention of computer fraud in a computer network comprised of a webserver, an application server having an identity manager application, and a database server having a database application and an authentication database,
wherein the webserver, application server and database server are communicatively connected to one another, the method comprising:
fabricating by a first party a user identification, and
adding by the first party the fabricated user identification to a list of compromised user identifications,
storing the list in a table of the authentication database, and
monitoring fraudulent use of the fabricated user identification in a browser session to link other compromised credentials used in the same browser session, the browser session remaining open to ensure monitoring is during the same browser session.
8. The method according to claim 7 , further comprising assigning a prefix to the fabricated user identification.
9. The method according to claim 7 , further comprising appending a unique identifier to the fabricated user identification.
10. The method according to claim 7 , further comprising entering by the first party the fabricated user identification in a website not of the first party.
11. The method according to claim 7 , further comprising monitoring by the first party a request by a second party for access to a website of the first party using the fabricated user identification.
12. The method according to claim 11 , further comprising denying access to or tracking the second party via a web browser session to identify additional compromised credentials.
13. The method according to claim 10 , wherein the website is a phishing website.
14. A computer system for detection and prevention of computer fraud, the computer system comprising:
a web interface for providing access to a financial account to a user,
a web server communicatively connected to the web interface,
a database server having a database application and an authentication database, and
an application server for receiving from the user a request to assign a proposed user identification to the user, the application server having an identity manager application for checking the proposed user identification against a list of compromised user identifications stored in a table of the authentication database to verify that the proposed user identification is not on the list, and for assigning the proposed user identification to the user provided it is not on the list of compromised user identifications.
15. The system according to claim 14 , wherein the list further comprises a fabricated user identification.
16. The system according to claim 14 , wherein the list of compromised user identifications is associated with at least one financial account.
17. The system according to claim 14 , wherein the webserver is of a financial institution.
18. A computer system for detection and prevention of computer fraud, the computer system comprising:
a web interface for providing access to a financial account to a user,
a web server communicatively connected to the web interface,
a database server having a database application and an authentication database, and
an application server for receiving a request for access to the web server from the user providing a user identification during a browser session, the application server having an identity manager application for checking the provided user identification against a list of compromised user identifications stored in a table of the authentication database and for tracking other access requests made during the browser session using compromised user identifications, the browser session remaining open to ensure tracking is during the same browser session.
19. The system according to claim 18 , wherein the list further comprises a fabricated user identification.
20. The system according to claim 18 , wherein the list of compromised user identifications is associated with at least one financial account.
21. The system according to claim 18 , wherein the web server is of a financial institution.
22. A method for detection and prevention of computer fraud in a computer network comprised of a webserver, an application server having an identity manager application, and a database server having a database application and an authentication database,
wherein the webserver, application server and database server are communicatively connected to one another, the method comprising:
receiving by the application server, from a user using a web interface, a request to assign a proposed user identification to the user during a browser session,
checking by the identity manager application of the application server the proposed user identification against a list of compromised user identifications stored in a table of the authentication database to verify that the proposed user identification is not on the list,
assigning by the identity manager application the proposed user identification to the user provided it is not on the list of compromised user identifications, and
monitoring credentials used to commit fraud by linking other credentials used in the browser session, the browser session remaining open to ensure tracking is during same browser session.
23. The method according to claim 22 , further comprising monitoring credentials used to commit fraud across a series of internet protocol addresses.
24. A method for detection and prevention of computer fraud in a computer network comprised of a webserver, an application server having an identity manager application, and a database server having a database application and an authentication database,
wherein the webserver, application server and database server are communicatively connected to one another, the method comprising:
receiving a request for access to a webserver from a user providing a user identification during a browser session,
checking by the identity manager application of the application server the provided user identification against a list of compromised user identifications stored in a table of the authentication database,
monitoring credentials used to commit fraud by linking other credentials used in the browser session, the browser session remaining open to ensure same browser session and
adding any linked credentials to the list of compromised user identifications.