TRANSACTION SEQUENCE MODELING FOR FRAUD DETECTION
The probabilities of transitioning between states of a given transaction sequence for a given transaction are calculated and a non-fraud score is calculated from the probabilities. The non-fraud score is provided to a fraud-detection system for determining whether the transaction sequence is more likely or less likely to be associated with fraud.
1 . A method, comprising:
receiving events associated with a transaction at a transaction terminal;
calculating a non-fraud score for the transaction based on probabilities assigned to transitions between the events and representing a likelihood of a sequence defined by the events for the transaction being non-fraudulent; and
providing the non-fraud score to a fraud detection system for further fraud evaluation based on the non-fraud score.
2 . The method of claim 1 further comprising, raising an alert with the non-fraud score to the fraud detection system when the non-fraud score falls below a configured threshold value.
3 . The method of claim 1 further comprising, processing the method as a Software-as-a-Service (SaaS) to a retailer associated with the transaction terminal and the fraud detection system.
4 . The method of claim 1 , wherein receiving further includes obtaining the events from a transaction agent of the transaction terminal when the transaction completes on the transaction terminal.
5 . The method of claim 4 , wherein obtaining further includes identifying an operator identifier for an operator of the transaction terminal from the transaction agent.
6 . The method of claim 5 , wherein calculating further includes filtering out first events associated with invalid login attempts or failed login attempts made by the operator leaving second events remaining from the events.
7 . The method of claim 6 , wherein filtering further includes selecting a machine-learning model based on a transaction type associated with the transaction.
8 . The method of claim 7 further comprising, determining whether a selection of the machine-learning model should be revised based on an item count or items associated with the transaction.
9 . The method of claim 8 , wherein determining further includes aggregating any second event associated with suspending the transaction with a corresponding second event associated with reactivating/recalling the transaction producing modified events from the second events.
10 . The method of claim 9 further comprising, providing the modified events as input to the machine-learning model and receiving as output from the machine-learning model the non-fraud score.
11 . The method of claim 1 , wherein providing further includes providing an operator identifier for an operator of the transaction terminal to the fraud detection system for inclusion in a fraud profile associated with the operator.
12 . The method of claim 1 , wherein providing further includes batching the fraud detection score when the fraud detection score is above a threshold, maintaining additional fraud detection scores for additional transactions at the transaction terminal, and reporting the fraud detection score and the additional fraud detection scores at a predefined interval of time to the fraud detection system.
13 . A method, comprising:
training machine-learning models on state transitions representing sequences of transactions based on transaction types, each machine-learning model adapted after training to calculate probabilities associated with transitioning between any two states represented in a given sequence for a given transaction of a given transaction type, each machine-learning model further adapted to provide a non-fraud score from the corresponding probabilities of the given transaction as output;
receiving a current transaction sequence comprised of transaction events representing transaction states for a current transaction;
selecting a particular machine-learning model based on a current transaction type associated with the current transaction;
providing the transaction events to the particular machine-learning model as input data;
obtaining a current non-fraud score from the particular machine-learning model as output data; and
providing the current non-fraud score to a fraud detection system for further evaluation as to whether the current transaction is or is not more likely to be associated with fraud.
14 . The method of claim 13 , wherein receiving further includes identifying an operator identifier associated with an operator of a transaction terminal that processed the current transaction.
15 . The method of claim 14 , wherein providing the transaction events further includes preprocessing the transaction events to filter out some events and to aggregate other events.
16 . The method of claim 15 , wherein providing the current non-fraud score further includes providing the operator identifier with the current non-fraud score to the fraud detection system.
17 . The method of claim 13 , wherein providing the current non-fraud score batching the current non-fraud score with other non-fraud scores associated with other transactions before providing to the fraud detection system when the current non-fraud score and the other non-fraud scores are above a threshold score.
18 . The method of claim 13 further comprising, processing the method as a Software-as-a-Service (SaaS) to a retailer associated with a transaction terminal that processes the current transaction.
19 . A system, comprising:
a cloud server comprising at least one processor and a non-transitory computer-readable storage medium;
the non-transitory computer-readable storage medium comprises executable instructions;
the executable instructions when provided to and executed by the at least one processor from the non-transitory computer-readable storage medium cause the at least one processor to perform operations comprising:
receiving a transaction sequence of events for a transaction processed on a transaction terminal;
selecting a trained machine-learning model based on a transaction type associated with the transaction;
filtering select events producing second events;
aggregating select additional events producing third events;
providing the third events to the trained machine-learning model as input;
receiving as output from the trained machine-learning model a non-fraud score that is based on probabilities of transitions between the third events within the transaction sequence of the transaction; and
providing the non-fraud score to a fraud detection system for further evaluation of any fraud that may be associated with the transaction.
20 . The system of claim 19 , wherein the executable instructions are accessible as a Software-as-a-Service (SaaS) to a retailer server associated with a retailer of the transaction terminal that processes the transaction.