Systems and methods for detecting relations between unknown merchants and merchants with a known connection to fraud
An example merchant fraud system may include an automated system for collecting contextual relationship information, plus a routine for analyzing additional data related to sanctions. The system may also include an automated analysis summary routine for creating condensed information subsets or graphlets containing information about sanction entities, some of which can be entities themselves, organized in a data retrieval system, such that an automated relationship examination system can check data from transactions and automatically identify and flag potentially suspect relationship aspects. The system may issue a fraud warning and may review a flagged transaction cluster, accepting transactions when transaction cluster items do not contain links to a known bad entity. Based on a hit with a suspect entity, the breadth of the examined co-related items may be expanded, and if that expansion results in one or more suspect connections, a transaction is rejected and sent for further review.
1. A computerized merchant fraud screening system, comprising:
a bus;
a processing unit coupled with the bus;
a network interface coupled with the bus;
a system memory coupled with the bus and storing instructions configured to instruct the processing unit and the network interface to:
retrieve a list of known fraudulent merchants;
retrieve a plurality of historic transactions, the plurality of historic transactions recorded by one or more of a cryptocurrency exchange, a cryptocurrency ledger, and a know-your-customer facility;
analyze the plurality of historic transactions to identify a cluster of related historic transactions related to the known fraudulent merchants;
generate, an electronic fingerprint for each of the known fraudulent merchants, wherein an electronic fingerprint for a known fraudulent merchant is based on one or more of the related historic transactions associated with the fraudulent merchant;
identify relationships between the known fraudulent merchants based on electronic fingerprints associated with the known fraudulent merchants;
generate data representing a first graph based on the identified relationships;
receive a set of investigation information about a first merchant, the investigation information comprising an identification of the first merchant and one or more proposed transactions associated with the first merchant;
generate a first merchant electronic fingerprint for the first merchant based on the set of investigation information;
perform, using a query engine and based on first merchant electronic fingerprint, a first query against the data representing the first graph to identify a first plurality of ties of the first merchant to one or more of the known fraudulent merchants;
determining that a first count of the identified first plurality of ties of the first merchant to one or more of the known fraudulent merchants is above a first threshold, and in response to the determination:
pull, from a historic transaction database, additional information related to the set of investigation information, wherein the additional information includes one or more historical transactions associated with the first merchant, and
generate an augmented first merchant electronic fingerprint for the first merchant based on the set of investigation information and the additional information;
perform, using the query engine and based on the augmented first merchant electronic fingerprint, a second query against the data representing the first graph to identify a second plurality of ties of the first merchant to one or more of the known fraudulent merchants in the data representing the first graph; and
reject, by the computerized merchant fraud screening system, the one or more proposed transactions in response to determining that a second count of the second plurality of ties of the first merchant to the second set of fraudulent merchant entities in the first graph is above a second threshold.
2. The system of claim 1 , wherein the instructions causing the processing unit and the network interface to perform the first query against the data representing the first graph to identify the first plurality of ties of the first merchant to one or more of the known fraudulent merchants are further configured to extracts second data representing at least one condensed information graphlet from the first graph in response to performing the first query, wherein the first plurality of ties are identified from the second data representing the graphlet.