Granted Patent B2

US 11,210,674 · App. 16/872,381 · Granted Dec 28, 2021

Inventors: Itai Novick (Rehovot, IL); Avi Turgeman (Cambridge, MA)

Assignee: BIOCATCH LTD.

G06Q20/4016G06Q20/10

Abstract

Claims (60)

1. A method comprising:

(a) monitoring interactions of a user of a computing device during online access to a banking account, and analyzing user interactions that were performed during multiple usage sessions in which said online banking account was accessed;

(b) detecting that the user interactions in said multiple usage sessions, comprise: (I) multiple incoming funds transfers that are incoming from a plurality of different countries, and (II) multiple outgoing funds transfers that are outgoing to a single country that is different from said plurality of different countries; and

further detecting that each incoming funds transfer is followed, within N hours, by an outgoing funds transfer of at least K percent of the incoming funds;

wherein N is a pre-defined positive value;

wherein K is a pre-defined positive value;

(c) based on step (b), generating a notification alert that said online banking account is utilized for money laundering or terror funding.

2. The method of claim 1 , further comprising:

analyzing user interactions with multiple bank accounts that are known to be money laundering bank accounts; and extracting a common playbook of interactions that characterizes a utilization of a bank account as a money laundering bank account;

wherein the generating of step (c) is further based on detection of a match between (I) user interactions monitored in said online banking account, and (II) said common playbook of interactions that characterizes utilization of a bank account as a money laundering bank account.

3. The method of claim 1 , further comprising:

analyzing user interactions with multiple bank accounts that are known to be terror funding laundering bank accounts; and extracting a common playbook of interactions that characterizes a utilization of a bank account as a terror funding bank account;

wherein the generating of step (c) is further based on detection of a match between (I) user interactions monitored in said online banking account, and (II) said common playbook of interactions that characterizes utilization of a bank account as a terror funding bank account.

4. The method of claim 1 ,

wherein monitoring interactions of the user comprises both (I) monitoring user-gestures performed via input units of the computing device of the user, and also (II) monitoring banking transactions performed in said online bank account;

wherein the generating of step (c) is based cumulatively on (I) monitored user-gestures performed via input units of the computing device of the user, and also (II) monitored banking transactions performed in said online bank account.

5. The method of claim 1 ,

wherein monitoring interactions of the user comprises both (I) monitoring user-gestures performed via a touch-screen of the computing device of the user, and also (II) monitoring banking transactions performed in said online bank account;

wherein the generating of step (c) is based cumulatively on (I) monitored user-gestures performed via a touch-screen of the computing device of the user, and also (II) monitored banking transactions performed in said online bank account.

6. The method of claim 1 ,

wherein monitoring interactions of the user comprises: performing user-transparent continuous monitoring of user interactions and user gestures in a background of a usage session without the user being aware that his interactions and gestures are monitored.

7. A method comprising:

(A) monitoring multiple interactions of a particular user that utilizes a computing device to access a particular banking account;

(B) upon detecting that a frequency of said multiple interactions is below a pre-defined threshold, determining that said particular user is located remotely from said computing device and is controlling remotely said computing device via a remote access channel;

(C) based on detection of utilization of said remote access channel to remotely control said particular bank account, and based on analysis of transactions performed in said particular bank account, generating a notification alert that said online banking account is used as a mule bank account or as a money laundering bank account;

wherein the method determines utilization of said remote access channel to remotely control said particular bank account, by taking into account: a detected mismatch between (I) accelerometer data, gyroscope data, and device orientation data of said computing device, and (II) touch-based gestures of a touch-screen of said computing device.

8. The method of claim 7 ,

wherein the method determines utilization of said remote access channel to remotely control said particular bank account by taking into account also: a detection that said computing device is accessing said particular bank account via a proxy server.

9. The method of claim 7 ,

wherein the method determines utilization of said remote access channel to remotely control said particular bank account by taking into account also: detecting a detection that said computing device is accessing said particular bank account via a virtual machine.

10. A non-transitory storage medium having stored thereon instructions that, when executed by a hardware processor, cause the hardware processor to perform a method:

(a) monitoring interactions of a user of a computing device during online access to a banking account, and analyzing user interactions that were performed during multiple usage sessions in which said online banking account was accessed;

(b) detecting that the user interactions in said multiple usage sessions, comprise: (I) multiple incoming funds transfers that are incoming from a plurality of different countries, and (II) multiple outgoing funds transfers that are outgoing to a single country that is different from said plurality of different countries; and

further detecting that each incoming funds transfer is followed, within N hours, by an outgoing funds transfer of at least K percent of the incoming funds;

wherein N is a pre-defined positive value;

wherein K is a pre-defined positive value;

(c) based on step (b), generating a notification alert that said online banking account is utilized for money laundering or terror funding.

11. A non-transitory storage medium having stored thereon instructions that, when executed by a hardware processor, cause the hardware processor to perform a method:

(A) monitoring multiple interactions of a particular user that utilizes a computing device to access a particular banking account;

(B) upon detecting that a frequency of said multiple interactions is below a pre-defined threshold, determining that said particular user is located remotely from said computing device and is controlling remotely said computing device via a remote access channel;

(C) based on detection of utilization of said remote access channel to remotely control said particular bank account, and based on analysis of transactions performed in said particular bank account, generating a notification alert that said online banking account is used as a mule bank account or as a money laundering bank account;

wherein the method determines utilization of said remote access channel to remotely control said particular bank account, by taking into account: a detected mismatch between (I) accelerometer data, gyroscope data, and device orientation data of said computing device, and (II) touch-based gestures of a touch-screen of said computing device.

12. A system comprising:

one or more processors configured to execute code;

one or more memory units configured to store code;

wherein the one or more processors are configured to perform a process comprising:

(a) monitoring interactions of a user of a computing device during online access to a banking account, and analyzing user interactions that were performed during multiple usage sessions in which said online banking account was accessed;

(b) detecting that the user interactions in said multiple usage sessions, comprise: (I) multiple incoming funds transfers that are incoming from a plurality of different countries, and (II) multiple outgoing funds transfers that are outgoing to a single country that is different from said plurality of different countries; and

further detecting that each incoming funds transfer is followed, within N hours, by an outgoing funds transfer of at least K percent of the incoming funds;

wherein N is a pre-defined positive value;

wherein K is a pre-defined positive value;

(c) based on step (b), generating a notification alert that said online banking account is utilized for money laundering or terror funding.

13. A system comprising:

one or more processors configured to execute code;

one or more memory units configured to store code;

wherein the one or more processors are configured to perform a process comprising:

(A) monitoring multiple interactions of a particular user that utilizes a computing device to access a particular banking account;

(B) upon detecting that a frequency of said multiple interactions is below a pre-defined threshold, determining that said particular user is located remotely from said computing device and is controlling remotely said computing device via a remote access channel;

(C) based on detection of utilization of said remote access channel to remotely control said particular bank account, and based on analysis of transactions performed in said particular bank account, generating a notification alert that said online banking account is used as a mule bank account or as a money laundering bank account;

wherein the process determines utilization of said remote access channel to remotely control said particular bank account, by taking into account: a detected mismatch between (I) accelerometer data, gyroscope data, and device orientation data of said computing device, and (II) touch-based gestures of a touch-screen of said computing device.

Assignments (1)

Continuity (32)

Cited By (1)

US 12,641,120