Fraud alerting using mobile phone location

1. A system, comprising:

one or more hardware processors; and

a memory storing computer-executable instructions, that in response to execution by the one or more hardware processors, causes the system to perform operations comprising:

receiving a first payment request corresponding to a transaction between a merchant and a user, the first payment request indicating a payment instrument to be used for payment;

calculating a digital fingerprint corresponding to a transaction device associated with the user by generating a hash value based on system configuration information associated with the transaction device, wherein the system configuration information comprises information associated with at least one of an operating system, a screen resolution, a web browser, a plug-in, a browser extension, a software library, an Internet Protocol address, and a geolocation;

determining that the transaction device is not authorized to use the payment instrument by accessing a database to determine whether the database stores an association between the payment instrument and the digital fingerprint;

in response to the determining that the transaction device is not authorized, determining a location of the transaction device based on clustering network geolocation information from a plurality of network geolocation vendors;

determining a location of a mobile device associated with the user; and

determining whether to approve the transaction based on a distance between the location of the transaction device and the location of the mobile device.

2. The system of claim 1 , wherein the determining whether to approve the transaction further comprises:

determining that the distance is greater than a predetermined distance threshold.

3. The system of claim 2 , wherein the operations further comprise:

in response to the determining that the distance is greater than the predetermined distance threshold, declining the transaction.

4. The system of claim 2 , wherein the operations further comprise:

in response to the determining that the distance is greater than the predetermined distance threshold, transmitting a request for additional authentication information.

5. The system of claim 1 , wherein the operations further comprise:

determining that the distance is less than or equal to a predetermined distance threshold; and

approving the transaction.

6. The system of claim 1 , wherein the network geolocation information comprises a plurality of associations between Internet Protocol (IP) address and geolocations.

7. The system of claim 1 , wherein the determining the location of the transaction device further comprises:

determining a set of network geolocation clusters based on the network geolocation information;

identifying a first network geolocation cluster from the set of network geolocation clusters, the first network geolocation cluster being larger than any other cluster in the set of network geolocation clusters; and

calculating, based on a size of the first network geolocation cluster, a confidence level in a first location represented by the first network geolocation cluster.

8. The system of claim 1 , wherein the operations further comprise:

subsequent to receiving a second payment request, generating a second hash value for a second transaction device based on second system configuration information associated with the second transaction device, wherein the second system configuration information is the same as the system configuration information associated with the transaction device, and wherein the second hash value is different than the hash value generated for the transaction device.

9. A method, comprising:

receiving, by a system comprising one or more hardware processors, a first payment request to use a payment instrument for a transaction between a transaction device associated with a user account and a merchant server associated with a merchant;

calculating a digital fingerprint corresponding to the transaction device by generating a hash value based on system configuration information associated with the transaction device, wherein the system configuration information comprises information associated with at least one of an operating system, a screen resolution, a web browser, a plug-in, a browser extension, a software library, an Internet Protocol address, and a geolocation;

determining that the transaction device is not authorized to use the payment instrument by accessing a database to determine whether the database stores an association between the payment instrument and the digital fingerprint;

in response to the determining that the transaction device is not authorized, determining a location of the transaction device based on network geolocation information corresponding to the transaction device;

determining a location of a mobile device associated with the user account; and

determining whether to approve the transaction based on a distance between the location of the transaction device and the location of the mobile device.

10. The method of claim 9 , wherein the determining whether to approve the transaction further comprises:

determining whether the distance is greater than a predetermined distance threshold.

11. The method of claim 10 , further comprising:

in response to determining that the distance is greater than the predetermined distance threshold, generating an alert for potential fraud.

12. The method of claim 9 , wherein the calculating the digital fingerprint further comprises:

generating a hash value based on system configuration information associated with the transaction device, the system configuration information comprising information associated with at least one of an operating system, a screen resolution, a web browser, a plug-in, a browser extension, a software library, an Internet Protocol address, and a geolocation.

13. The method of claim 9 , wherein the determining the location of the transaction device further comprises:

determining a set of network geolocation clusters based on the network geolocation information;

identifying a first network geolocation cluster from the set of network geolocation clusters, the first network geolocation cluster being larger than any other cluster in the set of network geolocation clusters; and

calculating, based on a size of the first network geolocation cluster, a confidence level in a first location represented by the first network geolocation cluster.

14. The method of claim 9 , wherein the network geolocation information comprises a plurality of associations between Internet Protocol (IP) address and geolocations.

15. The method of claim 9 , further comprising:

subsequent to receiving a second payment request, generating a second hash value for a second transaction device based on second system configuration information associated with the second transaction device, wherein the second system configuration information is the same as the system configuration information associated with the transaction device, and wherein the second hash value is different than the hash value generated for the transaction device.

16. A non-transitory computer readable medium storing computer-executable instructions that in response to execution by one or more hardware processors, causes a service provider system to perform operations comprising:

receiving a first payment request to use a payment instrument for a transaction between a transaction device associated with a user account and a merchant server associated with a merchant;

calculating a digital fingerprint corresponding to the transaction device by generating a hash value based on system configuration information associated with the transaction device, wherein the system configuration information comprises information associated with at least one of an operating system, a screen resolution, a web browser, a plug-in, a browser extension, a software library, an Internet Protocol address, and a geolocation;

determining that the transaction device is not authorized to use the payment instrument by accessing a database to determine whether the database stores an association between the payment instrument and the digital fingerprint;

in response to the determining that the transaction device is not authorized, determining a location of the transaction device based on network geolocation information corresponding to the transaction device;

determining a location of a mobile device associated with the user account; and

determining whether to approve the transaction based on a distance between the location of the transaction device and the location of the mobile device.

17. The non-transitory computer readable medium of claim 16 , wherein the operations further comprise:

in response to determining that the distance is greater than a predetermined distance threshold, generating an alert for potential fraud.

18. The non-transitory computer readable medium of claim 16 , wherein the operations further comprise:

subsequent to receiving a second payment request, generating a second hash value for a second transaction device based on second system configuration information associated with the second transaction device, wherein the second system configuration information is the same as the system configuration information associated with the transaction device, and wherein the second hash value is different than the hash value generated for the transaction device.

19. The non-transitory computer readable medium of claim 16 , wherein the operations further comprise:

in response to the determining that the distance is greater than a predetermined distance threshold, declining the transaction.

20. The non-transitory computer readable medium of claim 16 , wherein the operations further comprise:

determining that the distance is less than or equal to a predetermined distance threshold; and

approving the transaction.