Device, system, and method of differentiating over multiple accounts between legitimate user and cyber-attacker
Devices, systems, and methods of user authentication, as well as automatic differentiation between a legitimate user and a cyber-attacker. A system detects that two different accounts of the same computerized service, were accessed by a single computing device over a short period of time. The system may employ various techniques in order to determine automatically whether a legitimate user accessed the two different account, such as, a husband accessing his own bank account and shortly after that accessing also his wife's bank account, or a payroll company accessing bank accounts of two clients for payroll management purposes. Conversely, the system is able to detect that the same user exhibited the same pattern of interactions when operating the two accounts, a pattern of interactions that does not frequently appear in the general population of legitimate users, thereby indicating that the single user is a cyber-attacker.
1. A method comprising:
(a) detecting that within a pre-defined period of time, a single user is attempting to access, via a single computing device,
a first account that belongs to a first account-owner, and a second account that belongs to a second account-owner;
(b) querying a database that stores data about real-life relationship between people, and determining existence of a real-life family linkage or a real-life business linkage, between the first account owner and the second account-owner;
(c) based on said real-life linkage, determining that said single user is a legitimate human user that is genuinely associated with each one of said accounts, and is not a cyber-attacker that is illegitimately attempting to access multiple accounts.
2. The method of claim 1 , wherein the determining of step (c) is performed by generating a fraud-probability score, which indicates a probability that said single user is a cyber-attacker.
3. The method of claim 1 , wherein the determining of step (c) is performed by generating a binary-type indication which indicates either: (I) a determination that said single user is a legitimate human user that is genuinely associated with each one of said two or more accounts, or (II) a determination that said single user is a cyber-attacker that is illegitimately attempting to access multiple accounts.
4. The method of claim 1 , wherein,
if the generated linkage score value that indicates the strength of real-life linkage between the first account owner and the second account-owner, is greater than a pre-defined threshold value, then determining that said single user is a legitimate human user that is genuinely associated with each one of said two or more accounts;
if the generated linkage score value that indicates the strength of real-life linkage between the first account owner and the second account-owner, is smaller than said pre-defined threshold value, then determining that said single user is a cyber-attacker that is illegitimately attempting to access multiple accounts.
5. The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that the first account-owner and the second account-owner have different first-names and also have the same family-name;
(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
6. The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that the first account-owner and the second account-owner have different first-names; and further determining that the family-name of the first account-owner comprises (i) the family name of the second account-owner, and also (ii) an additional string;
(B) based on the two determining operations of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
7. The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that the first account-owner and the second account-owner are associated with the same real-life address;
(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
8. The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that the first account-owner and the second account-owner were previously accessed by two legitimate users from a same, single, Internet Protocol (IP) address;
(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
9. The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that the first account-owner and the second account-owner were previously accessed by two legitimate users from a same, single, electronic device;
(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
10. The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that the first account-owner and the second account-owner are associated with the same single employer;
(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
11. The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that the first account-owner and the second account-owner are associated with the same single corporate entity;
(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
12. The method of claim 1 , wherein the determining of step (c) comprises:
(A) by querying a database that stores data about real-life relationship between people, determining that there exists a family relationship between the first account-owner and the second account-owner even though the first and account-owner and the second account-owner do not have the same last-name;
(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
13. The method of claim 1 , wherein the determining of step (c) comprises:
(A) by querying a database that stores data about real-life relationship between people, determining that the first account-owner is a spouse of the second account-owner;
(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
14. The method of claim 1 , wherein the determining of step (c) comprises:
(A) by querying a database that stores data about real-life relationship between people, determining that the first account-owner is a parent of the second account-owner;
(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
15. The method of claim 1 , wherein the determining of step (c) comprises:
(A) by querying a database that stores data about corporate relationship among corporate entities, determining that: the first account-owner, who is a first corporate entity, is affiliated by a corporate relationship with the second account-owner, who is a second corporate entity;
(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
16. The method of claim 1 , wherein the determining of step (c) comprises:
(A) by querying a database that stores data about corporate relationship among corporate entities, determining that: the first account-owner, who is a first corporate entity, is a subsidiary of the second account-owner, who is a second corporate entity;
(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
17. The method of claim 1 , wherein the determining of step (c) comprises:
(A) by querying a database that stores data about corporate relationship among corporate entities, determining that the same majority shareholder owns a majority interest in the first account-owner and also owns a majority interest in the second account-owner;
(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
18. The method of claim 1 , wherein the determining of step (c) comprises:
(A) analyzing a similarity between (i) a corporate name of the first account-owner, and (ii) a corporate name of the second account-owner; and based on said analyzing, determining that: the first account-owner, who is a first corporate entity, is affiliated by a corporate relationship with the second account-owner, who is a second corporate entity;
(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
19. The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that said single user accessed said first account and said second account, via the same single computing device which is associated with a funds-managing entity that manages funds for clients;
(B) determining that the first account belongs to a first client of said funds-managing entity;
(C) determining that the second account belongs to a second client of said funds-managing entity;
(D) based on the determining operations of steps (A) and (B) and (C), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
20. The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that said single user accessed said first account and said second account, via the same single computing device which is associated with an accounting service provider that provides accounting services to clients;
(B) determining that the first account belongs to a first client of said accounting service provider;
(C) determining that the second account belongs to a second client of said accounting service provider;
(D) based on the determining operations of steps (A) and (B) and (C), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
21. The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that said single user accessed said first account and said second account, via the same single computing device which is associated with a payroll service provider that provides payroll services to clients;
(B) determining that the first account belongs to a first client of said payroll service provider;
(C) determining that the second account belongs to a second client of said payroll service provider;
(D) based on the determining operations of steps (A) and (B) and (C), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
22. The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that said single user accessed said first account and said second account, via the same single computing device which is associated with a consulting service provider that provides consulting services to clients;
(B) determining that the first account belongs to a first client of said consulting service provider;
(C) determining that the second account belongs to a second client of said consulting service provider;
(D) based on the determining operations of steps (A) and (B) and (C), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
23. The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that the first account-owner is a legal custodian of the second account-owner;
(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
24. The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that there exists a trustee-and-beneficiary relationship between the first account-owner and the second account-owner;
(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
25. The method of claim 1 , wherein the determining of step (c) comprises:
(A) determining that the first account and the second account are currently non-linked to each other; and further determining that the first account and the second account used to be linked to each other at a past time-point;
(B) based on the determining of step (A), determining that said single user is a legitimate human user that is genuinely associated with each one of said first account and second account.
26. The method of claim 1 , comprising:
(A) monitoring operations that said single user performs as logged-in user in said first account;
(B) determining a first pattern of operations that said single user performed as logged-in user in said first account;
(C) monitoring operations that said single user performs as logged-in user in said second account;
(D) determining a second pattern of operations that said single user performed as logged-in user in said second account;
(E) determining that the first pattern of operations is identical to the second pattern of operations;
(F) based on the determining of step (E), determining that said single user is a cyber-attacker attempting to attack said first account and said second account.
27. The method of claim 1 , comprising:
(A) monitoring operations that said single user performs as logged-in user in said first account;
(B) determining a first pattern of operations that said single user performed as logged-in user in said first account;
(C) monitoring operations that said single user performs as logged-in user in said second account;
(D) determining a second pattern of operations that said single user performed as logged-in user in said second account;
(E) determining that the first pattern of operations is similar, beyond a pre-defined level of similarity, to the second pattern of operations;
(F) based on the determining of step (E), determining that said single user is a cyber-attacker attempting to attack said first account and said second account.
28. The method of claim 1 , comprising:
(A) monitoring operations that said single user performs as logged-in user in said first account;
(B) determining a first pattern of operations that said single user performed as logged-in user in said first account;
(C) monitoring operations that said single user performs as logged-in user in said second account;
(D) determining a second pattern of operations that said single user performed as logged-in user in said second account;
(E) determining that the first pattern of operations is identical to the second pattern of operations, and further determining that the first account is not related to the second account;
(F) based on the determining operations of step (E), determining that said single user is a cyber-attacker attempting to attack said first account and said second account.
29. The method of claim 1 , comprising:
(A) monitoring operations that said single user performs as logged-in user in said first account;
(B) determining a first pattern of operations that said single user performed as logged-in user in said first account;
(C) monitoring operations that said single user performs as logged-in user in said second account;
(D) determining a second pattern of operations that said single user performed as logged-in user in said second account;
(E) determining that the first pattern of operations is similar, beyond a pre-defined level of similarity, to the second pattern of operations, and further determining that the first account is not related to the second account;
(F) based on the determining operations of step (E), determining that said single user is a cyber-attacker attempting to attack said first account and said second account.
30. The method of claim 1 , comprising:
(A) monitoring operations that said single user performs as logged-in user in said first account;
(B) determining a first pattern of operations that said single user performed as logged-in user in said first account;
(C) monitoring operations that said single user performs as logged-in user in said second account;
(D) determining a second pattern of operations that said single user performed as logged-in user in said second account;
(E) determining that the first pattern of operations is identical to the second pattern of operations, and further determining that the first pattern of operations is abnormal relative to a general distribution of operation patterns of a general group of users of said computerized service;
(F) based on the determining of step (E), determining that said single user is a cyber-attacker attempting to attack said first account and said second account.
31. The method of claim 1 , comprising:
(A) monitoring operations that said single user performs as logged-in user in said first account;
(B) determining a first pattern of operations that said single user performed as logged-in user in said first account;
(C) monitoring operations that said single user performs as logged-in user in said second account;
(D) determining a second pattern of operations that said single user performed as logged-in user in said second account;
(E) determining that the first pattern of operations is similar, beyond a pre-defined level of similarity, to the second pattern of operations, and further that the first pattern of operations is abnormal relative to a general distribution of operation patterns of a general group of users of said computerized service;
(F) based on the determining of step (E), determining that said single user is a cyber-attacker attempting to attack said first account and said second account.
32. The method of claim 1 , comprising:
(A) monitoring operations that said single user performs as logged-in user in said first account;
(B) determining a first pattern of operations that said single user performed as logged-in user in said first account;
(C) monitoring operations that said single user performs as logged-in user in said second account;
(D) determining a second pattern of operations that said single user performed as logged-in user in said second account;
(E) determining that the first pattern of operations is identical to the second pattern of operations, and further determining that the first account is non-related to the second account, and further determining that the first pattern of operations is abnormal relative to a general distribution of operation patterns of a general group of users of said computerized service;
(F) based on the determining of step (E), determining that said single user is a cyber-attacker attempting to attack said first account and said second account.
33. The method of claim 1 , comprising:
(A) monitoring operations that said single user performs as logged-in user in said first account; and determining a first pattern of operations that said single user performed as logged-in user in said first account;
(B) monitoring operations that said single user performs as logged-in user in said second account; and determining a second pattern of operations that said single user performed as logged-in user in said second account;
(C) determining that the first pattern of operations is similar, beyond a pre-defined level of similarity, to the second pattern of operations, and further determining that the first account is non-related to the second account, and further that the first pattern of operations is abnormal relative to a general distribution of operation patterns of a general group of users of said computerized service;
(D) based on the determining of step (C), determining that said single user is a cyber-attacker attempting to attack said first account and said second account.