Systems and methods for detecting relations between unknown merchants and merchants with a known connection to fraud
An example merchant fraud system may include an automated system for collecting contextual relationship information, plus a routine for analyzing additional data related to sanctions. The system may also include an automated analysis summary routine for creating condensed information subsets or graphlets containing information about sanction entities, some of which can be entities themselves, organized in a data retrieval system, such that an automated relationship examination system can check data from transactions and automatically identify and flag potentially suspect relationship aspects. The system may issue a fraud warning and may review a flagged transaction cluster, accepting transactions when transaction cluster items do not contain links to a known bad entity. Based on a hit with a suspect entity, the breadth of the examined co-related items may be expanded, and if that expansion results in one or more suspect connections, a transaction is rejected and sent for further review.
1. A computerized merchant fraud screening system, comprising:
a bus;
a processing unit coupled with the bus;
a network interface coupled with the bus;
a system memory coupled with the bus and storing instructions configured to instruct the processing unit and the network interface to:
retrieve a list of known fraudulent merchants;
retrieve a plurality of historic cryptocurrency transactions;
generate, an electronic fingerprint for each fraudulent merchant of the known fraudulent merchants, based on one or more related transactions associated with the fraudulent merchant in the plurality of historic cryptocurrency transactions;
identify relationships between the known fraudulent merchants based on electronic fingerprints associated with the known fraudulent merchants;
generate data representing a first graph based on the identified relationships;
receive a set of investigation information about a first merchant, the investigation information comprising an identification of the first merchant and one or more proposed cryptocurrency transactions associated with the first merchant;
generate a first merchant electronic fingerprint for the first merchant based on the set of investigation information;
perform, using a query engine and based on the first merchant electronic fingerprint, a first query against the data representing the first graph to identify a first plurality of relationships of the first merchant to one or more of the known fraudulent merchants;
determine that a first count of the identified first plurality of relationships of the first merchant to one or more of the known fraudulent merchants is above a first threshold;
perform, using the query engine, a second query against the data representing the first graph to identify a second plurality of relationships of the first merchant to one or more of the known fraudulent merchants in the data representing the first graph; and
reject, by the computerized merchant fraud screening system, the one or more proposed cryptocurrency transactions in response to determining that a second count of the identified second plurality of relationships of the first merchant is above a second threshold.
2. The system of claim 1 , wherein the plurality of historic cryptocurrency transactions are recorded by one or more of a cryptocurrency exchange, a cryptocurrency ledger, and a know-your-customer facility.
3. The system of claim 1 , wherein in response to the determination that the first count of the identified first plurality of relationships of the first merchant to one or more of the known fraudulent merchants is above the first threshold, the instructions are further configured to:
pull, from a historic cryptocurrency transaction database, additional information related to the set of investigation information, wherein the additional information includes one or more historical cryptocurrency transactions associated with the first merchant.
4. The system of claim 3 , wherein in response to the determination that the first count of the identified first plurality of relationships of the first merchant to one or more of the known fraudulent merchants is above the first threshold, the instructions are further configured to:
generate an augmented first merchant electronic fingerprint for the first merchant based on the set of investigation information and the additional information.
5. The system of claim 4 , wherein the second query against the data representing the first graph to identify the second plurality of relationships of the first merchant to one or more of the known fraudulent merchants in the data representing the first graph, is performed based on the augmented first merchant electronic fingerprint.
6. The system of claim 1 , wherein the instructions causing the processing unit and the network interface to perform the first query against the data representing the first graph to identify the first plurality of relationships of the first merchant to one or more of the known fraudulent merchants are further configured to extract second data representing at least one condensed information graphlet from the first graph in response to performing the first query, wherein the first plurality of relationships are identified from the second data representing the graphlet.
7. A computer implemented method comprising:
retrieving, via a computer system, a list of known fraudulent merchants;
retrieving, via the computer system, a plurality of historic cryptocurrency transactions;
generating, via the computer system, an electronic fingerprint for each fraudulent merchant of the known fraudulent merchants, based on one or more related transactions associated with the fraudulent merchant in the plurality of historic cryptocurrency transactions;
identifying, via the computer system, relationships between the known fraudulent merchants based on electronic fingerprints associated with the known fraudulent merchants;
generating, via the computer system, data representing a first graph based on the identified relationships;
receiving, via the computer system, a set of investigation information about a first merchant, the investigation information comprising an identification of the first merchant and one or more proposed cryptocurrency transactions associated with the first merchant;
generating, via the computer system, a first merchant electronic fingerprint for the first merchant based on the set of investigation information;
performing via a query engine and based on the first merchant electronic fingerprint, a first query against the data representing the first graph to identify a first plurality of relationships of the first merchant to one or more of the known fraudulent merchants;
determining, via the computer system, that a first count of the identified first plurality of relationships of the first merchant to one or more of the known fraudulent merchants is above a first threshold;
performing, using the query engine, a second query against the data representing the first graph to identify a second plurality of relationships of the first merchant to one or more of the known fraudulent merchants in the data representing the first graph; and
rejecting via the computerized merchant fraud screening system, the one or more proposed cryptocurrency transactions in response to determining that a second count of the identified second plurality of relationships of the first merchant is above a second threshold.
8. The computer-implemented method of claim 7 , wherein the plurality of historic cryptocurrency transactions are recorded by one or more of a cryptocurrency exchange, a cryptocurrency ledger, and a know-your-customer facility.
9. The computer-implemented method of claim 7 , wherein in response to the determination that the first count of the identified first plurality of relationships of the first merchant to one or more of the known fraudulent merchants is above the first threshold, the instructions are further configured to:
pull, from a historic cryptocurrency transaction database, additional information related to the set of investigation information, wherein the additional information includes one or more historical cryptocurrency transactions associated with the first merchant.
10. The computer-implemented method of claim 9 , wherein in response to the determination that the first count of the identified first plurality of relationships of the first merchant to one or more of the known fraudulent merchants is above the first threshold, the instructions are further configured to:
generate an augmented first merchant electronic fingerprint for the first merchant based on the set of investigation information and the additional information.
11. The computer-implemented method of claim 10 , wherein the second query against the data representing the first graph to identify the second plurality of relationships of the first merchant to one or more of the known fraudulent merchants in the data representing the first graph, is performed based on the augmented first merchant electronic fingerprint.
12. The computer-implemented method of claim 7 , wherein the instructions causing the processing unit and the network interface to perform the first query against the data representing the first graph to identify the first plurality of relationships of the first merchant to one or more of the known fraudulent merchants are further configured to extract second data representing at least one condensed information graphlet from the first graph in response to performing the first query, wherein the first plurality of relationships are identified from the second data representing the graphlet.
13. A non-transitory computer-readable storage medium having computer-executable instructions, which when executed perform a method comprising:
retrieving a list of known fraudulent merchants;
retrieving a plurality of historic cryptocurrency transactions;
generating an electronic fingerprint for each fraudulent merchant of the known fraudulent merchants, based on one or more related transactions associated with the fraudulent merchant in the plurality of historic cryptocurrency transactions;
identifying relationships between the known fraudulent merchants based on electronic fingerprints associated with the known fraudulent merchants;
generating data representing a first graph based on the identified relationships;
receiving a set of investigation information about a first merchant, the investigation information comprising an identification of the first merchant and one or more proposed cryptocurrency transactions associated with the first merchant;
generating a first merchant electronic fingerprint for the first merchant based on the set of investigation information;
performing via a query engine and based on the first merchant electronic fingerprint, a first query against the data representing the first graph to identify a first plurality of relationships of the first merchant to one or more of the known fraudulent merchants;
determining that a first count of the identified first plurality of relationships of the first merchant to one or more of the known fraudulent merchants is above a first threshold;
performing, using the query engine, a second query against the data representing the first graph to identify a second plurality of relationships of the first merchant to one or more of the known fraudulent merchants in the data representing the first graph; and
rejecting via the computerized merchant fraud screening system, the one or more proposed cryptocurrency transactions in response to determining that a second count of the identified second plurality of relationships of the first merchant is above a second threshold.
14. The non-transitory computer-readable storage medium of claim 13 , wherein the plurality of historic cryptocurrency transactions are recorded by one or more of a cryptocurrency exchange, a cryptocurrency ledger, and a know-your-customer facility.
15. The non-transitory computer-readable storage medium of claim 13 , wherein in response to determining that the first count of the identified first plurality of relationships of the first merchant to one or more of the known fraudulent merchants is above the first threshold:
pulling, from a historic cryptocurrency transaction database, additional information related to the set of investigation information, wherein the additional information includes one or more historical cryptocurrency transactions associated with the first merchant.
16. The non-transitory computer-readable storage medium of claim 15 , wherein in response to determining that the first count of the identified first plurality of relationships of the first merchant to one or more of the known fraudulent merchants is above the first threshold:
generating an augmented first merchant electronic fingerprint for the first merchant based on the set of investigation information and the additional information.
17. The non-transitory computer-readable storage medium of claim 16 , wherein the second query against the data representing the first graph to identify the second plurality of relationships of the first merchant to one or more of the known fraudulent merchants in the data representing the first graph, is performed based on the augmented first merchant electronic fingerprint.
18. The non-transitory computer-readable storage medium of claim 13 , wherein the method further comprises, extracting second data representing at least one condensed information graphlet from the first graph in response to performing the first query, wherein the first plurality of relationships are identified from the second data representing the graphlet.