Exclusion of nodes from link analysis
A payment processing system continuously processes transactions. Upon arrival, in real-time, a transaction is parsed and each entity is used to retrieve other previous transactions associated with that entity in order to build a link analysis web. Iteratively, each entity in the retrieved transactions is used to retrieve other associated transactions, etc. Before retrieval of associated transactions, each entity is checked whether it appears in a bypass table. If so, that entity is not used to retrieve transactions. Once built, transactions and entities within the link analysis web are analyzed to determine whether the current transaction is fraudulent. Off-line or online, risk metrics such as address mismatch rate, bank decline rate, ticket decline rate and new payment device rate, along with the proportion of a linked entity is used to determine whether that linked entity is erroneous and should be placed into the bypass table and excluded from the web.
1. A method of outputting in real time a result of an electronic, card-not-present transaction using link analysis, said method comprising:
receiving a plurality of payment transactions in a payment processing system from a plurality of computing devices, wherein each of said plurality of payment transactions is associated with a payment device and includes a plurality of data elements, and wherein each of said plurality of data elements is specific to said each payment transaction or to one of said computing devices, said plurality of payment transactions including a current payment transaction from an individual, and wherein said plurality of data elements include at least one of a payment card number, an expiration date, a name of an individual, an address, a geographical location, an amount of said each payment transaction, an e-mail address, a shipping name and address, an IP address, a telephone number, device information, an Internet service provider (ISP), a device fingerprint, or a social media network link;
determining that an IP address in said current payment transaction is not an indicator of a fraudulent payment transaction;
determining that said IP address is flagged to be excluded from a link analysis web;
building said link analysis web using at least one data element of said current payment transaction other than said IP address and using at least one of the data elements of said plurality of payment transactions, those of said payment transaction including said IP address not being used to build said link analysis web, wherein said link analysis web includes links between data elements of said plurality of payment transactions, and wherein each data element of said link analysis web represents one of said plurality of payment transactions;
outputting a set of said represented plurality of payment transactions in said link analysis web;
determining whether said current payment transaction is fraudulent by determining that a ratio of fraudulent payment transactions within said set of represented plurality of payment transactions in said link analysis web over the total number of said set of represented plurality of payment transactions in said link analysis web exceeds a threshold; and
processing or declining said current payment transaction in real time, depending upon a result of said determining whether said current payment transaction is fraudulent.
2. A method as recited in claim 1 wherein said processing or declining occurs on the order of seconds after said receiving.
3. A method as recited in claim 1 further comprising:
calculating at least one risk metric of said represented plurality of payment transactions in said link analysis web indicating lower risk;
determining that a node of said link analysis web that includes a second data element is linked to a proportion of said payment devices within said link analysis web greater than a threshold; and
removing said second data element from said link analysis web.
4. A method as recited in claim 1 wherein said IP address is flagged by being present in a bypass table.
5. A method as recited in claim 1 further comprising:
iteratively building said link analysis web.
6. A method as recited in claim 1 , further comprising:
not delivering digital goods or services associated with said current payment transaction from a merchant which had submitted said current payment transaction to said payment processing system based upon said associated payment device to said individual when it is determined that said current payment transaction is fraudulent.
7. A method as recited in claim 1 , further comprising:
delivering digital goods or services associated with said current payment transaction from a merchant which had submitted said current payment transaction to said payment processing system based upon said associated payment device to said individual when it is determined that said current payment transaction is not fraudulent.
8. A method as recited in claim 1 , further comprising:
outputting said set of all data elements in said link analysis web of the same type; and
determining whether said current payment transaction is fraudulent using said set of all data elements.
9. A method as recited in claim 8 , further comprising:
not delivering digital goods or services associated with said current payment transaction from a merchant which had submitted said current payment transaction to said payment processing system based upon said associated payment device to said individual when it is determined that said current payment transaction is fraudulent.
10. A method as recited in claim 8 , further comprising:
delivering digital goods or services associated with said current payment transaction from a merchant which had submitted said current payment transaction to said payment processing system based upon said associated payment device to said individual when it is determined that said current payment transaction is not fraudulent.