Malicious activity detection system capable of efficiently processing data accessed from databases and generating alerts for display in interactive user interfaces

1. A computing system comprising:

a database storing a first data set and a second data set associated with one or more accounts, wherein the first data set comprises a first data section, a second data section, and first data, and wherein the second data set comprises the first data section, a third data section, and second data;

a computer processor; and

a computer readable storage medium storing program instructions configured for execution by the computer processor in order to cause the computing system to:

select a first rule that is associated with a behavior associated with the one or more accounts;

obtain, at a first time, historical data validated by the computing system at a second time before the first time, wherein the first rule, when run on the historical data, causes a first alert to be generated;

retrieve the first data set and the second data set from the database;

merge the historical data with a portion of the first data to form merged data;

run the first rule on the merged data;

determine that the first alert is generated in response to running the first rule on the merged data;

determine that none of the first data set is corrupted or missing in response to the determination that the first alert is generated in response to running the first rule on the merged data;

in response to the determination that none of the first data set is corrupted or missing, generate a third data set that comprises the first data section, the second data section, the third data section, the first data, and the second data;

run the first rule on the third data set to determine whether the behavior results in a violation of a regulation;

generate a second alert in response to a determination that the behavior results in the violation of the regulation; and

transmit the second alert for display in an interactive user interface.

2. The computing system of claim 1 , wherein the interactive user interface comprises a button that allows a user to take an action associated with the displayed second alert.

3. The computing system of claim 1 , wherein the program instructions are further configured to cause the computing system to:

use a clustering process to separate the first data and the second data into a plurality of clusters;

identify a subset of the first data or the second data that falls outside of a first cluster in the plurality of clusters by at least a threshold value; and

generate a third alert for each of the items in the subset of the first data or the second data.

4. The computing system of claim 1 , wherein the first rule is a cash out rule.

5. The computing system of claim 1 , wherein the database receives data from an issuer database in periodic intervals, and wherein the program instructions are further configured to cause the computing system to:

select the first data set, wherein a first subset of the first data is expected to be received at a first time and a second subset of the first data is expected to be received at a second time;

determine that the second subset of the first data was not received at the second time; and

generate a notification for display in the interactive user interface, wherein the notification instructs a user to retrieve the second subset of the first data.

6. The computing system of claim 1 , wherein the first rule is one of a cash out rule, a cash in rule, a sustained cash rule, a behavior outlier rule, a cross-border cash rule, a foreign cash out rule, a high risk countries rule, an external funding rule, a tax refund rule, a card-to-card transfer rule, a watch list rule, or a manual trigger rule.

7. The computing system of claim 1 , wherein the second alert comprises information identifying a user associated with a prepaid card that caused the computing system to determine that the behavior results in the violation of the regulation.

8. The computing system of claim 1 , wherein the program instructions are further configured to cause the computing system to determine that the regulation is violated.

9. The computing system of claim 1 , wherein the program instructions are further configured to cause the computing system to transmit the second alert via one of an email, a push notification, or a text message.

10. The computing system of claim 1 , wherein the second alert comprises a URL, and wherein receipt of the second alert causes a browser to open on a user device and be redirected to a page associated with the URL.

11. The computing system of claim 2 , wherein the program instructions are further configured to cause the computing system to:

receive, from the user, a selection of the button;

update the interactive user interface to display a plurality of actions in response to receiving the selection;

receive, from the user, a second selection of a first action in the plurality of actions; and

generate a report in response to receiving the second selection.

12. The computing system of claim 3 , wherein the program instructions are further configured to cause the computing system to update the clustering process based on actions taken by a user with regard to the generated alerts for each of the items in the subset of the first data or the second data.

13. The computing system of claim 4 , wherein the program instructions are further configured to cause the computing system to:

identify, based on an analysis of the first data and the second data, that a first user withdrew no money on a first day, no money on a second day, a first amount of money on a third day, no money on a fourth day, and no money on a fifth day, wherein a withdrawal of the first amount of money causes the computing system to determine that the behavior results in the violation of the regulation; and

generate the second alert such that the second alert corresponds with the first day, the second day, and the third day, does not correspond with the second day, the third day, and the fourth day, and does not correspond with the third day, the fourth day, and the fifth day.

14. A computer-implemented method comprising:

as implemented by one or more computer systems comprising computer hardware and memory, the one or more computer systems configured with specific executable instructions, selecting a first rule that is associated with a behavior associated with one or more accounts;

obtaining, at a first time, historical data validated by the one or more computer systems at a second time before the first time, wherein the first rule, when run on the historical data, causes a first alert to be generated;

retrieving a first data set and a second data set, wherein the first data set comprises a first data section, a second data section, and first data, and wherein the second data set comprises the first data section, a third data section, and second data;

merging the historical data with a portion of the first data to form merged data;

running the first rule on the merged data;

determining that the first alert is generated in response to running the first rule on the merged data;

determining that none of the first data set is corrupted or missing in response to running the determination that the first alert is generated in response to running the first rule on the merged data;

in response to the determination that none of the first data set is corrupted or missing, generating a third data set that comprises the first data section, the second data section, the third data section, the first data, and the second data;

running the first rule on the third data set to determine whether the behavior results in a violation of a regulation;

generating a second alert in response to a determination that the behavior results in the violation of the regulation; and

transmitting the second alert for display in an interactive user interface.

15. The computer-implemented method of claim 14 , further comprising:

using a clustering process to separate the first data and the second data into a plurality of clusters;

identifying a subset of the first data or the second data that falls outside of a first cluster in the plurality of clusters by at least a threshold value; and

generating a third alert for each of the items in the subset of the first data or the second data.

16. A non-transitory computer-readable medium comprising one or more program instructions recorded thereon, the instructions configured for execution by a computing system comprising one or more processors in order to cause the computing system to:

select a first rule that is associated with a behavior associated with one or more accounts;

obtain, at a first time, historical data validated by the computing system at a second time before the first time, wherein the first rule, when run on the historical data, causes a first alert to be generated;

retrieve a first data set and a second data set, wherein the first data set comprises a first data section, a second data section, and first data, and wherein the second data set comprises the first data section, a third data section, and second data;

merge the historical data with a portion of the first data to form merged data;

run the first rule on the merged data;

determine that the first alert is generated in response to running the first rule on the merged data;

determine that none of the first data set is corrupted or missing in response to the determination that the first alert is generated in response to running the first rule on the merged data;

in response to the determination that none of the first data set is corrupted or missing, generate a third data set that comprises the first data section, the second data section, the third data section, the first data, and the second data;

run the first rule on the third data set to determine whether the behavior results in a violation of a regulation;

generate a second alert in response to a determination that the behavior results in the violation of the regulation; and

transmit the second alert for display in an interactive user interface.

17. The non-transitory computer-readable medium of claim 16 , wherein the instructions are further configured to cause the computing system to:

use a clustering process to separate the first data and the second data into a plurality of clusters;

identify a subset of the first data or the second data that falls outside of a first cluster in the plurality of clusters by at least a threshold value; and

generate a third alert for each of the items in the subset of the first data or the second data.