Systems and methods for large-scale testing activities discovery

1. A server computer, comprising:

a processor; and

a non-transitory computer-readable medium, comprising code executable by the processor for implementing a method comprising:

generating a development data set by sampling a first plurality of ascertained testing transactions and a first plurality of non-testing transactions, the first plurality of ascertained testing transactions including transactions for which fraud was reported within a predetermined time period;

identifying, using one or more statistical analysis techniques, multiple features of the development data set based on the first plurality of testing transactions, the multiple features of the development data set being identified as being highly correlated to the first plurality of ascertained testing transactions and not highly correlated to the first plurality of non-testing transactions within the predetermined time period;

generating at least one multi-level feature derived from a combination of the identified multiple distinct features, the multi-level feature being specific to the development data set;

generating a testing model based at least in part on the at least one multi-level feature and the development data set, the testing model comprising a Bayesian model;

receiving a first authorization message for a first transaction using an account;

determining a testing transaction score for the first transaction using the testing model and based on a value for the multi-level feature associated with the first transaction, wherein the testing transaction score for the first transaction is determined in a batch process along with a plurality of other transactions;

determining that the first transaction is a testing transaction based on the testing transaction score, the testing transaction being a transaction used by an unauthorized entity to test if the account is valid and usable for payment transactions;

receiving a second authorization message for a second transaction using the account conducted after the first transaction; and

declining the second transaction using the same account conducted after the first transaction based on the testing transaction score for the first transaction.

2. The server computer of claim 1 , wherein the multiple features comprise at least one of:

a fraud score,

a type of merchant,

a category of item,

a transaction velocity,

a transaction amount, or

an authorization response code.

3. The server computer of claim 1 , wherein the method further comprises:

determining a validation data set by sampling a second plurality of ascertained testing transactions and a second plurality of non-testing transactions; and

evaluating the performance of the testing model using the validation data set; and

determining that the testing model exceeds a level of performance before using the testing model to determine the testing transaction score for the first transaction.

4. The server computer of claim 1 , wherein each of the ascertained testing transactions is determined by:

identifying a candidate testing transaction;

determining that an account associated with the candidate testing transaction was reported for fraud after the candidate testing transaction occurred; and

classifying that the candidate testing transaction as an ascertained testing transaction based on the reported fraud.

5. The server computer of claim 1 , wherein the method further comprises:

classifying the first transaction as an ascertained testing transaction; and

updating the testing model using the first transaction.

6. The server computer of claim 1 , wherein the testing transaction score is sent in an authorization request message to an issuer computer associated with the account.

7. The server computer of claim 1 , wherein a batch file comprising testing transaction scores for a plurality of transactions is sent to an issuer computer associated with the plurality of transactions.

8. The server computer of claim 7 , wherein the batch file is generated by subjecting the plurality of transactions to the testing model in a single batch.

9. The server computer of claim 1 , wherein a Bayes' rule is used to determine the testing transaction score for the first transaction, and the testing transaction score represents a conditional probability that the first transaction is a testing transaction.

10. A computer-implemented method comprising:

receiving, by a processor, a first authorization message for a first transaction using an account;

determining, by the processor, a development data set by sampling a first plurality of ascertained testing transactions and a first plurality of non-testing transactions, the first plurality of ascertained testing transactions including transactions for which fraud was reported within a predetermined time period;

identifying, using one or more statistical analysis techniques, multiple distinct features of the development data set based on the first plurality of ascertained testing transactions, the multiple distinct features of the development data set being identified as being highly correlated to the first plurality of ascertained testing transactions and not highly correlated to the first plurality of non-testing transactions within the predetermined time period;

generating, by the processor, one or more multi-level features derived from a combination of the identified multiple distinct features, the one or more multi-level features being specific to the development data set; and

generating, by the processor, the testing model using the multi-level features and the development data set, the testing model comprising a Bayesian model;

determining, by the processor, a testing transaction score for the first transaction using a testing model and based on a value for the multi-level feature associated with the first transaction, wherein the testing transaction score for the first transaction is determined in a batch process along with a plurality of other transactions; and

determining, by the processor, that the first transaction is a testing transaction based on the testing transaction score, wherein the testing transaction score for the first transaction is used for declining a second transaction using the account conducted after the first transaction, wherein the testing transaction score is determined prior to initiation of the second transaction.

11. The computer-implemented method of claim 10 , wherein the multi-level features comprise at least one of:

a fraud score;

a transaction amount; and

an authorization response code.

12. The computer-implemented method of claim 10 , further comprising:

determining, by the processor, a validation data set by sampling a second plurality of ascertained testing transactions and a second plurality of non-testing transactions;

evaluating, by the processor, the performance of the testing model using the validation data set; and

determining, by the processor, that the testing model exceeds a level of performance before using the testing model to determine the testing transaction score for the first transaction.

13. The computer-implemented method of claim 10 , wherein each of the ascertained testing transactions is determined using a method comprising:

identifying, by the processor, a candidate testing transaction;

determining, by the processor, that an account associated with the candidate testing transaction was reported for fraud after the candidate testing transaction occurred; and

classifying, by the processor, the candidate testing transaction as an ascertained testing transaction based on the reported fraud.

14. The computer-implemented method of claim 13 , wherein the candidate testing transaction is classified as an ascertained testing transaction only when the fraud is reported within a predetermined time of the candidate testing transaction.

15. The computer-implemented method of claim 10 , further comprising:

classifying, by the processor, the first transaction as an ascertained testing transaction; and

updating, by the processor, the testing model using the first transaction.

16. The computer-implemented method of claim 10 , wherein the testing transaction score is sent in an authorization request message to an issuer computer associated with the account.

17. The computer-implemented method of claim 10 , wherein a batch file comprising testing transaction scores for a plurality of transactions is sent to an issuer computer associated with the plurality of transactions.