System and method for detecting malicious payment transaction activity using aggregate views of payment transaction data in a distributed network environment

1. A system comprising a server computer coupled to a plurality of user devices and a plurality of payment gateways through a computer network, comprising:

a data store including aggregated data for a plurality of payment transactions conducted with a plurality of payment gateways through a computer network;

a processor;

a non-transitory computer readable medium, comprising instructions that when executed by the processor, cause the processor to perform steps comprising:

receiving a request from a first user device over the computer network in association with a web page of a merchant organization;

providing at least a portion of the web page to the first user device over the computer network in response to the request, wherein the web page includes one or more fields for entering payment information that are presented to a user in the web page at the first user device;

receiving a first response over the computer network, the first response sent from the web page and including first payment information for a requested first payment transaction;

storing response data as part of the aggregated data;

submitting a gateway request for the requested first payment transaction to a payment gateway of the plurality of payment gateways over the computer network;

receiving a gateway response from the payment gateway over the computer network, wherein the gateway response includes a transaction response code indicating a result of the requested first payment transaction;

storing gateway response data in association with the response data as part of the aggregated data;

accessing a fraud prevention rule, the fraud prevention rule including a pattern for identifying one more sets of data that matches the pattern;

evaluating the fraud prevention rule against the aggregated data to generate an identifier for each matching set of data based on that set of data and storing the identifiers for each of the matching sets of data as a fraud prevention list corresponding to that fraud prevention rule;

accessing the fraud prevention list;

generating a current identifier for a second payment transaction, wherein the current identifier is associated with a second response received from a second user device;

determining whether the current identifier matches any identifier of the fraud prevention list;

identifying the second payment transaction as fraudulent when the current identifier matches any identifier of the fraud prevention list; and

generating a fraud prevention response without submitting the second payment transaction to the plurality of payment gateways.

2. The system of claim 1 , wherein the fraud prevention response is an indication of success of the second payment transaction.

3. The system of claim 1 , wherein the fraud prevention response is not responding to the second user device or an undetermined response.

4. The system of claim 1 , wherein the portion of the web page is a form.

5. The system of claim 1 , wherein the first response is encoded by the portion of the web page.

6. The system of claim 1 , wherein the non-transitory computer readable medium comprises instructions that, when executed by the processor, cause the processor to further perform a step comprising:

receiving analytics data associated with the user's interaction with the portion of the web page, wherein the analytics data is part of the response data stored as part of the aggregated data.

7. The system of claim 1 , wherein the fraud prevention rule is evaluated based on an event trigger.

8. A method implemented at a server computer coupled to a plurality of user devices and a plurality of payment gateways through a computer network, the server computer including a data store including aggregated data for a plurality of payment transactions conducted with the plurality of payment gateways through the computer network, comprising:

receiving, by the server computer, a request from a first user device over the computer network in association with a web page of a merchant organization;

providing, by the server computer, at least a portion of the web page to the first user device over the computer network in response to the request, wherein the web page includes one or more fields for entering payment information that are presented to a user in the web page at the first user device;

receiving, by the server computer, a first response over the computer network, the first response sent from the web page and including first payment information for a requested first payment transaction;

storing, by the server computer, response data as part of the aggregated data;

submitting, by the server computer, a gateway request for the requested first payment transaction to a payment gateway of the plurality of payment gateways over the computer network;

receiving, by the server computer, a gateway response from the payment gateway over the computer network, wherein the gateway response includes a transaction response code indicating a result of the requested first payment transaction;

storing, by the server computer, gateway response data in association with the response data as part of the aggregated data;

accessing, by the server computer, a fraud prevention rule, the fraud prevention rule including a pattern for identifying one more sets of data that matches the pattern;

evaluating, by the server computer, the fraud prevention rule against the aggregated data to generate an identifier for each matching set of data based on that set of data and storing the identifiers for each of the matching sets of data as a fraud prevention list corresponding to that fraud prevention rule;

accessing, by the server computer, the fraud prevention list;

generating, by the server computer, a current identifier for a second payment transaction, wherein the current identifier is associated with a second response received from a second user device;

determining, by the server computer, whether the current identifier matches any identifier of the fraud prevention list;

identifying, by the server computer, the second payment transaction as fraudulent when the current identifier matches any identifier of the fraud prevention list; and

generating, by the server computer, a fraud prevention response without submitting the second payment transaction to the plurality of payment gateways.

9. The method of claim 8 , wherein the fraud prevention response is an indication of success of the second payment transaction.

10. The method of claim 8 , wherein the fraud prevention response is not responding to the second user device or an undetermined response.

11. The method of claim 8 , wherein the portion of the web page is a form.

12. The method of claim 8 , wherein the first response is encoded by the portion of the web page.

13. The method of claim 8 , further comprising receiving, by the server computer, analytics data associated with the user's interaction with the portion of the web page, wherein the analytics data is part of the response data stored as part of the aggregated data.

14. The method of claim 8 , wherein the fraud prevention rule is evaluated based on an event trigger.

15. A non-transitory computer readable media at a server computer coupled to a plurality of user devices and a plurality of payment gateways through the computer network, the server including a data store including aggregated data for a plurality of payment transactions conducted with the plurality of payment gateways through the computer network, the non-transitory computer readable medium comprising instructions that, when executed by the server computer, cause the server computer to perform steps comprising:

receiving, by the server computer, a request from a first user device over the computer network in association with a web page of a merchant organization;

providing, by the server computer, at least a portion of the web page to the first user device over the computer network in response to the request, wherein the web page includes one or more fields for entering payment information that are presented to a user in the web page at the first user device;

receiving, by the server computer, a first response over the computer network, the first response sent from the web page and including first payment information for a requested first payment transaction;

storing, by the server computer, response data as part of the aggregated data;

submitting, by the server computer, a gateway request for the requested first payment transaction to a payment gateway of the plurality of payment gateways over the computer network;

receiving, by the server computer, a gateway response from the payment gateway over the computer network, wherein the gateway response includes a transaction response code indicating a result of the requested first payment transaction;

storing, by the server computer, gateway response data in association with the response data as part of the aggregated data;

accessing, by the server computer, a fraud prevention rule, the fraud prevention rule including a pattern for identifying one more sets of data that matches the pattern;

evaluating, by the server computer, the fraud prevention rule against the aggregated data to generate an identifier for each matching set of data based on that set of data and storing the identifiers for each of the matching sets of data as a fraud prevention list corresponding to that fraud prevention rule;

accessing, by the server computer, the fraud prevention list;

generating, by the server computer, a current identifier for a second payment transaction, wherein the current identifier is associated with a second response received from a second user device;

determining, by the server computer, whether the current identifier matches any identifier of the fraud prevention list;

identifying, by the server computer, the second payment transaction as fraudulent when the current identifier matches any identifier of the fraud prevention list; and

generating, by the server computer, a fraud prevention response without submitting the second payment transaction to the plurality of payment gateways.

16. The non-transitory computer readable media of claim 15 , wherein the fraud prevention response is an indication of success of the second payment transaction.

17. The non-transitory computer readable media of claim 15 , wherein the fraud prevention response is not responding to the second user device or an undetermined response.

18. The non-transitory computer readable media of claim 15 , wherein the portion of the web page is a form.

19. The non-transitory computer readable media of claim 15 , wherein the first response is encoded by the portion of the web page.

20. The non-transitory computer readable media of claim 15 , further comprising instructions that, when executed by the server computer, cause the server computer to further perform steps comprising:

receiving analytics data associated with the user's interaction with the portion of the web page, wherein the analytics data is part of the response data stored as part of the aggregated data.

21. The non-transitory computer readable media of claim 15 , wherein the fraud prevention rule is evaluated based on an event trigger.