System and method for detecting malicious payment transaction activity using aggregate views of payment transaction data in a distributed network environment
Embodiments of systems and methods for fraud prevention in an online distribution network are disclosed. In certain embodiments, service providers that provide forms in association with merchant's web sites for submission of transactions may implement pro-active threat detection based on an aggregate view of transactions in that distributed computer network.
1. A system, comprising
a server computer coupled to a plurality of user devices and a plurality of payment gateways through a computer network, the server computer including:
a data store including aggregated data for a plurality of payment transactions conducted with the plurality of payment gateways through the computer network;
a form generation engine:
receiving a form request from a first user device over the computer network in association with a web page of a merchant organization including a widget;
providing a form definition to the first user device over the computer network in response to the form request, wherein a form having one or more fields for entering payment information is presented to a user in the web page at the first user device when the form definition is rendered by the widget; and
storing form definition data as part of the aggregated data;
a transaction processing engine:
receiving a first form response over the computer network, the first form response sent using the form and including first payment information for a requested first payment transaction;
storing first form response data associated with the first form response in association with the form definition data as part of the aggregated data;
submitting a gateway request for the requested first payment transaction to a payment gateway over the computer network;
receiving a gateway response from the payment gateway over the computer network, wherein the gateway response includes a transaction response code indicating a result of the requested first payment transaction; and
storing gateway response data associated with the gateway response in association with the form response data and form definition data as part of the aggregated data;
a fraud prevention rule engine:
at a time interval,
accessing a fraud prevention rule, the fraud prevention rule including a pattern for identifying one more sets of data that matches the pattern; and
evaluating the fraud prevention rule against the aggregated data, including generating an identifier for each matching set of data based on that set of data and storing the identifiers for each of the matching sets of data as a fraud prevention list corresponding to that fraud prevention rule; and
a fraud prevention analysis engine:
accessing the fraud prevention list;
generating a current identifier for a second payment transaction based on a second form response received from a second user device;
determining that the current identifier matches any identifier of the fraud prevention list and identifying the second payment transaction as fraudulent based on the determination that the current identifier matches any identifier of the fraud prevention list; and
generating a fraud prevention response without submitting the second payment transaction to the payment gateway based on the identification of the second payment transaction as fraudulent.
2. The system of claim 1 , wherein the fraud prevention rule engine operates asynchronously to the transaction processing engine and the fraud prevention analysis engine.
3. The system of claim 2 , wherein the identifier is an IP address or a financial identity, the financial identity comprising at least a portion of a credit card number, an expiration date and a name.
4. The system of claim 3 , wherein the fraud prevention rule comprises executable code.
5. The system of claim 2 , wherein the first form response data and second form response data includes an IP address, browser type, language or encoding.
6. The system of claim 1 , the transaction processing engine: normalizing the gateway response and storing the normalized response in association with the gateway response data, the form definition data and the first form response data as part of the aggregated data.
7. The system of claim 1 , wherein the fraud prevention response is an indication of success of the second payment transaction.
8. A method, comprising
at a server computer coupled to a plurality of user devices and a plurality of payment gateways through a computer network, the server computer including a data store including aggregated data for a plurality of payment transactions conducted with the plurality of payment gateways through the computer network:
receiving a form request from a first user device over the computer network in association with a web page of a merchant organization including a widget;
providing a form definition to the first user device over the computer network in response to the form request, wherein a form having one or more fields for entering payment information is presented to a user in the web page at the first user device when the form definition is rendered by the widget;
storing form definition data as part of the aggregated data;
receiving a first form response over the computer network, the first form response sent using the form and including first payment information for a requested first payment transaction;
storing first form response data associated with the first form response in association with the form definition data as part of the aggregated data;
submitting a gateway request for the requested first payment transaction to a payment gateway over the computer network;
receiving a gateway response from the payment gateway over the computer network, wherein the gateway response includes a transaction response code indicating a result of the requested first payment transaction;
storing gateway response data associated with the gateway response in association with the form response data and form definition data as part of the aggregated data;
at a time interval:
accessing a fraud prevention rule, the fraud prevention rule including a pattern for identifying one more sets of data that matches the pattern, and
evaluating the fraud prevention rule against the aggregated data, including generating an identifier for each matching set of data based on that set of data and storing the identifiers for each of the matching sets of data as a fraud prevention list corresponding to that fraud prevention rule;
accessing the fraud prevention list;
generating a current identifier for a second payment transaction based on a second form response received from a second user device;
determining that the current identifier matches any identifier of the fraud prevention list and identifying the second payment transaction as fraudulent based on the determination that the current identifier matches any identifier of the fraud prevention list; and
generating a fraud prevention response without submitting the second payment transaction to the payment gateway based on the identification of the second payment transaction as fraudulent.
9. The method of claim 8 , wherein the steps of accessing a fraud prevention rule and evaluating the fraud prevention rule are performed asynchronously to the steps of generating a current identifier for a second payment transaction, determining that the current identifier matches any identifier of the fraud prevention list, identifying the second payment transaction as fraudulent and generating a fraud prevention response.
10. The method of claim 9 , wherein the identifier is an IP address or a financial identity, the financial identity comprising at least a portion of a credit card number, an expiration date and a name.
11. The method of claim 10 , wherein the fraud prevention rule comprises executable code.
12. The method of claim 9 , wherein the first form response data and second form response data includes an IP address, browser type, language or encoding.
13. The method of claim 8 , further comprising normalizing the gateway response and storing the normalized response in association with the gateway response data, the form definition data and the form response data as part of the aggregated data.
14. The method of claim 8 , wherein the fraud prevention response is an indication of success of the second payment transaction.
15. A non-transitory computer readable media, comprising instructions for:
receiving a form request from a first user device over the computer network in association with a web page of a merchant organization including a widget, wherein the form request is received at a server computer coupled to a plurality of user devices and a plurality of payment gateways through the computer network, the server computer including a data store including aggregated data for a plurality of payment transactions conducted with the plurality of payment gateways through the computer network;
providing a form definition to the first user device over the computer network in response to the form request, wherein a form having one or more fields for entering payment information is presented to a user in the web page at the first user device when the form definition is rendered by the widget;
storing form definition data as part of the aggregated data;
receiving a first form response over the computer network, the first form response sent using the form and including first payment information for a requested first payment transaction;
storing first form response data associated with the first form response in association with the form definition data as part of the aggregated data;
submitting a gateway request for the requested first payment transaction to a payment gateway over the computer network;
receiving a gateway response from the payment gateway over the computer network, wherein the gateway response includes a transaction code indicating a result of the requested first payment transaction;
storing gateway response data associated with the gateway response in association with the form response data and form definition data as part of the aggregated data;
at a time interval:
accessing a fraud prevention rule, the fraud prevention rule including a pattern for identifying one more sets of data that matches the pattern, and
evaluating the fraud prevention rule against the aggregated, including generating an identifier for each matching set of data based on that set of data and storing the identifiers for each of the matching sets of data as a fraud prevention list corresponding to that fraud prevention rule;
accessing the fraud prevention list;
generating a current identifier for a second payment transaction based on a second form response received from a second user device;
determining that the current identifier matches any identifier of the fraud prevention list and identifying the second payment transaction as fraudulent based on the determination that the current identifier matches any identifier of the fraud prevention list; and
generating a fraud prevention response without submitting the second payment transaction to the payment gateway based on the identification of the second payment transaction as fraudulent.
16. The non-transitory computer readable media of claim 15 , wherein the instructions for accessing a fraud prevention rule and evaluating the fraud prevention rule are executed asynchronously to the instructions for generating a current identifier for a second payment transaction, determining that the current identifier matches any identifier of the fraud prevention list, identifying the second payment transaction as fraudulent and generating a fraud prevention response.
17. The non-transitory computer readable media of claim 16 , wherein the identifier is an IP address or a financial identity, the financial identity comprising at least a portion of a credit card number, an expiration date and a name.
18. The non-transitory computer readable media of claim 17 , wherein the fraud prevention rule comprises executable code.
19. The non-transitory computer readable media of claim 16 , wherein the first form response data and second form response data includes an IP address, browser type, language or encoding.
20. The non-transitory computer readable media of claim 15 , wherein the instructions are further for: normalizing the gateway response and storing the normalized response in association with the gateway response data, the form definition data and the form response data as part of the aggregated data.
21. The non-transitory computer readable media of claim 15 , wherein the fraud prevention response is an indication of success of the second payment transaction.