Fraud importance system
Embodiments described herein provide for a fraud detection engine for detecting various types of fraud at a call center and a fraud importance engine for tailoring the fraud detection operations to relative importance of fraud events. Fraud importance engine determines which fraud events are comparative more important than others. The fraud detection engine comprises machine-learning models that consume contact data and fraud importance information for various anti-fraud processes. The fraud importance engine calculates importance scores for fraud events based on user-customized attributes, such as fraud-type or fraud activity. The fraud importance scores are used in various processes, such as model training, model selection, and selecting weights or hyper-parameters for the ML models, among others. The fraud detection engine uses the importance scores to prioritize fraud alerts for review. The fraud importance engine receives detection feedback, which contacts involved false negatives, where fraud events were undetected but should have been detected.
1. A computer-implemented method comprising:
obtaining, by the computer, contact data for one or more contacts, the contact data including one or more attribute values of one or more types of attributes;
generating, by the computer, one or more risk scores corresponding to the one or more types of attribute values, by executing one or more machine-learning models of machine-learning architecture, each machine-learning model trained to generate a risk score using an attribute value of a type of attribute in the contact data of the one or more contacts;
identifying, by the computer, at least one fraud event in the one or more contacts, the risk score of each fraud event satisfying a risk threshold for the type of attribute value corresponding to the risk score; and
for each fraud event,
generating, by the computer, a fraud importance score according to an attribute weight associated with the type of attribute and the attribute value of the type of attribute, wherein the type of attribute for generating the fraud importance score includes a type of account-related information; and
generating, by the computer, a fraud alert in a fraud alert queue according to the fraud importance score.
2. The method according to claim 1 , wherein a second type of attribute of the one or more types of attributes includes at least one of a fraud type, a type of fraud activity information, a type of identity information, a type of spoofing-related information, or a type of false negative information.
3. The method according to claim 1 , further comprising training, by the computer, the machine-learning model to determine the risk score corresponding to a particular type of attribute of an attribute value, by executing the machine-learning model on the contact data of one or more prior contacts and the fraud importance score of each fraud event in the one or more prior contacts.
4. The method according to claim 1 , wherein generating the fraud importance score includes:
receiving, by the computer, from a client device fraud event feedback corresponding to each fraud event, the fraud event feedback containing one or more detection accuracy indicators; and
generating, by the computer, a false negative attribute value based upon the one or more detection accuracy indicators of the fraud event feedback, wherein the fraud importance score is generated based upon the false negative attribute value.
5. The method according to claim 1 , wherein generating the fraud importance score includes generating, by the computer, an age-based attribute value based upon a timestamp in the contact data for the contact, wherein the fraud importance score is generated based upon the age-based attribute value.
6. The method according to claim 1 , wherein generating the fraud importance score includes:
for the contact data of each contact of the one or more contacts:
generating, by the computer, a normalized weight in accordance with an attribute and an attribute value, wherein the fraud importance score is generated based upon the normalized weight generated for the contact data of the particular contact.
7. The method according to claim 6 , wherein generating the normalized weight includes converting, by the computer, the attribute weight representing a ranking for the attribute value to the normalized weight.
8. The method according to claim 1 , wherein executing the machine-learning architecture includes selecting, by the computer, a machine-learning model corresponding to a type of fraud in accordance with an attribute, an attribute value, and an attribute weight, wherein the attribute value indicates the type of fraud and the attribute weight indicates the comparative importance for the attribute value.
9. The method according to claim 1 , wherein the one or more attributes include at least one of: the type of fraud, a fraud activity, a cross-channel fraud activity, a penetration level associated with authentication, account information, fraudster identity, and spoofing information.
10. The method according to claim 9 , wherein executing the machine-learning model includes extracting, by the computer, one or more features from the contact data of the contact for executing the machine-learning model selected by the computer.
11. A system comprising:
a server comprising a processor configured to:
obtain contact data for one or more contacts, the contact data including one or more attribute values of one or more types of attributes;
generate one or more risk scores corresponding to the one or more types of attribute values, by executing one or more machine-learning models of machine-learning architecture, each machine-learning model trained to generate a risk score using an attribute value of a type of attribute in the contact data of the one or more contacts;
identify at least one fraud event in the one or more contacts, the risk score of each fraud event satisfies a risk threshold for the type of attribute value corresponding to the risk score; and
for each fraud event,
generate a fraud importance score according to an attribute weight associated with the type of attribute and the attribute value of the type of attribute, wherein the type of attribute for generating the fraud importance score includes a type of account-related information; and
generate a fraud alert in a fraud alert queue according to the fraud importance score.
12. The system according to claim 11 , wherein a second type of attribute of the one or more types of attributes includes at least one of a fraud type, a type of fraud activity information, a type of identity information, a type of spoofing-related information, or a type of false negative information.
13. The system according to claim 11 , wherein the server is further configured to train the machine-learning model to determine the risk score corresponding to a particular type of fraud in an attribute value, by executing the machine-learning model using training contact data and the fraud importance score of each fraud event in the training contact data.
14. The system according to claim 11 , wherein to generate the fraud importance score the server is further configured to:
receive from a client device fraud event feedback corresponding to each fraud event, the fraud event feedback containing one or more detection accuracy indicators; and
generate a false negative attribute value based upon the one or more detection accuracy indicators of the fraud event feedback, wherein the fraud importance score is generated based upon the false negative attribute value.
15. The system according to claim 11 , wherein to generate the fraud importance score the server is further configured to generate an age-based attribute value based upon a timestamp in the contact data for the contact, wherein the fraud importance score is generated based upon the age-based attribute value.
16. The system according to claim 11 , wherein to generate the fraud importance score the server is further configured to:
for the contact data of each contact of the one or more contacts:
generate a normalized weight in accordance with an attribute and an attribute value, wherein the fraud importance score is generated based upon the normalized weight generated for the contact data of the particular contact.
17. The system according to claim 16 , wherein to generate the normalized weight the server is further configured to convert the attribute weight representing a ranking for the attribute value to the normalized weight.
18. The system according to claim 11 , wherein to execute the machine-learning architecture the server is further configured to select a machine-learning model corresponding to a type of fraud in accordance with an attribute, an attribute value, and an attribute weight, wherein the attribute value indicates the type of fraud and the attribute weight indicates the comparative importance for the attribute value.
19. The system according to claim 11 , wherein the one or more attributes include at least one of: the type of fraud, a fraud activity, a cross-channel fraud activity, a penetration level associated with authentication, account information, fraudster identity, and spoofing information.
20. The system according to claim 19 , wherein to execute the machine-learning model the server is further configured to extract one or more features from the contact data of the contact for executing the machine-learning model selected by the computer.