Systems and methods for incorporating breach velocities into fraud scoring models
A method and system for detecting fraudulent network events in a payment card network by incorporating breach velocities into fraud scoring models are provided. A potential compromise event is detected, and payment cards that transacted at a compromised entity associated with the potential compromise event are identified. Subsequent transaction activity for the payment cards is reviewed, and a data structure for the payment cards are generated. The data structure sorts subsequent transaction activity into fraud score range stripes. The data structure is parsed over a plurality of time periods, and at least one cumulative metric is calculated for each of the time periods in each fraud score range stripe. A plurality of ratio striping values are determined, and a set of feature inputs is generated using the ratio striping values. The feature inputs are applied to a scoring model used to score future real-time transactions initiated using the payment cards.
1. A computing system for detecting and preventing fraudulent network events, said computing system comprising a memory communicatively coupled to a processor, the memory having computer-executable instructions stored thereon that when executed by the processor implement:
a compromise detection and prevention (CDP) engine configured to:
in response to detecting a potential compromise event associated with a compromised entity, review, for a plurality of payment cards associated with the potential compromise event, subsequent transaction activity that occurred after the potential compromise event, the respective subsequent transaction activity for each payment card including one or more subsequent payment card transactions, each subsequent payment card transaction associated with a respective fraud score calculated using a fraud scoring model executing one or more machine learning algorithms;
generate a data structure that classifies each subsequent payment card transaction over a plurality of fraud score range stripes based on the respective fraud score;
determine, from the generated data structure, a plurality of ratio striping values;
detect a potential fraud wave associated with one or more of the plurality of payment cards based on the plurality of ratio striping values; and
transmit, to a fraud detection module, a set of feature inputs generated using the determined plurality of ratio striping values, the set of feature inputs indicative of the potential fraud wave, wherein transmitting the set of feature inputs to the fraud detection model causes the fraud detection model to i) apply the set of feature inputs to update the one or more machine learning algorithms executed by the fraud scoring model to generate an updated fraud scoring model, and ii) execute the updated fraud scoring model on a plurality of real-time payment card transactions by increasing, based on the updated one or more machine learning algorithms, the fraud score for any of the real-time payment card transactions associated with any one of the plurality of payment cards associated with the potential compromise event.
2. The computing system of claim 1 , wherein the CDP engine is further configured to generate a graphical user interface including a graph having an x-axis graduated in units of time and a y-axis graduated in units of fraud score, the graph showing the plurality of fraud score range stripes extending horizontally, each delineated by an upper fraud score threshold and a lower fraud score threshold, the graph showing vertically extending time period boundaries intersecting the x-axis, the graphical user interface displayable on a display screen of a user computer device.
3. The computing system of claim 1 , wherein the CDP engine is further configured to output a potential fraud wave alert in response to the detection of the potential fraud wave.
4. The computing system of claim 1 , wherein the CDP engine is configured to determine the ratio striping values based on a tally of each subsequent payment card transaction scored within each fraud score range stripe.
5. The computing system of claim 1 , wherein the CDP engine is configured to determine the ratio striping values based on a cumulative total of transaction amounts of subsequent payment card transactions scored within each fraud score range stripe.
6. The computing system of claim 1 , wherein the CDP engine is configured to determine the ratio striping values based on a count of declined subsequent payment card transactions scored within each fraud score range stripe.
7. The computing system of claim 1 , wherein the CDP engine is further configured to generate the set of feature inputs as being equal to the determined plurality of ratio striping values.
8. The computing system of claim 1 , wherein the CDP engine is further configured to:
detect the potential fraud wave by comparing one or more of the plurality of ratio striping values to a threshold ratio value indicating a likelihood of the potential fraud wave.
9. A computer-implemented method for detecting fraudulent network events, said method implemented using at least one computing device having at least one processor, said method comprising:
in response to detecting a potential compromise event associated with a compromised entity, reviewing, for a plurality of payment cards associated with the potential compromise event, subsequent transaction activity that occurred after the potential compromise event, the respective subsequent transaction activity for each payment card including one or more subsequent payment card transactions, each subsequent payment card transaction associated with a respective fraud score calculated using a fraud scoring model executing one or more machine learning algorithms;
generating a data structure that classifies each subsequent payment card transaction over a plurality of fraud score range stripes based on the respective fraud score;
determining, from the generated data structure, a plurality of ratio striping values;
detecting a potential fraud wave associated with one or more of the plurality of payment cards based on the plurality of ratio striping values; and
transmitting, to a fraud detection module, a set of feature inputs generated using the determined plurality of ratio striping values, the set of feature inputs indicative of the potential fraud wave, wherein transmitting the set of feature inputs to the fraud detection model causes the fraud detection model to i) apply the set of feature inputs to update the one or more machine learning algorithms executed by the fraud scoring model to generate an updated fraud scoring model, and ii) execute the updated fraud scoring model on a plurality of real-time payment card transactions by increasing, based on the updated one or more machine learning algorithms, the fraud score for any of the real-time payment card transactions associated with any one of the plurality of payment cards associated with the potential compromise event.
10. The computer-implemented method of claim 9 , further comprising generating a graphical user interface including a graph having an x-axis graduated in units of time and a y-axis graduated in units of fraud score, the graph showing the plurality of fraud score range stripes extending horizontally, each delineated by an upper fraud score threshold and a lower fraud score threshold, the graph showing vertically extending time period boundaries intersecting the x-axis, the graphical user interface displayable on a display screen of a user computer device.
11. The computer-implemented method of claim 9 , further comprising the steps of outputting a potential fraud attack alert in response to the detection of the potential fraud wave.
12. The computer-implemented method of claim 9 , wherein determining the ratio striping values comprises determining the ratio striping values based on at least one of i) a tally of each subsequent payment card transaction scored within each fraud score range stripe, ii) a cumulative total of transaction amounts of subsequent payment card transactions scored within each fraud score range stripe, and iii) a count of declined subsequent payment card transactions scored within each fraud score range stripe.
13. The computer-implemented method of claim 9 , wherein detecting the potential fraud wave further comprises:
comparing, by the at least one processor, one or more of the plurality of ratio striping values to a threshold ratio value indicating a likelihood of the potential fraud wave.
14. At least one non-transitory computer-readable storage media having computer-executable instructions embodied thereon wherein, when executed by at least one processor, the computer-executable instructions cause the at least one processor to:
in response to detecting a potential compromise event associated with a compromised entity, review, for a plurality of payment cards associated with the potential compromise event, subsequent transaction activity that occurred after the potential compromise event, the respective subsequent transaction activity for each payment card including one or more subsequent payment card transactions, each subsequent payment card transaction associated with a respective fraud score calculated using a fraud scoring model executing one or more machine learning algorithms;
generate a data structure that classifies each subsequent payment card transaction over a plurality of fraud score range stripes based on the respective fraud score;
determine, from the generated data structure, a plurality of ratio striping values;
detect a potential fraud wave associated with one or more of the plurality of payment cards based on the plurality of ratio striping values; and
transmit, to a fraud detection module, a set of feature inputs generated using the determined plurality of ratio striping values, the set of feature inputs indicative of the potential fraud wave, wherein transmitting the set of feature inputs to the fraud detection model causes the fraud detection model to i) apply the set of feature inputs to update the one or more machine learning algorithms executed by the fraud scoring model to generate an updated fraud scoring model, and ii) execute the updated fraud scoring model on a plurality of real-time payment card transactions by increasing, based on the updated one or more machine learning algorithms, the fraud score for any of the real-time payment card transactions associated with any one of the plurality of payment cards associated with the potential compromise event.
15. The computer-readable storage media of claim 14 , wherein the computer-executable instructions cause the processor to determine the plurality of ratio striping values based on a tally of each subsequent payment card transaction scored within each fraud score range stripe.
16. The computer-readable storage media of claim 14 , wherein the computer-executable instructions cause the processor to determine the plurality of ratio striping values based on a cumulative total of transaction amounts of subsequent payment card transactions scored within each fraud score range stripe.
17. The computer-readable storage media of claim 14 , wherein the computer-executable instructions cause the processor to determine the plurality of ratio striping values based on a count of declined subsequent payment card transactions scored within each fraud score range stripe.
18. The computer-readable storage media of claim 14 , wherein the computer-executable instructions further cause the processor to:
detect the potential fraud wave by comparing one or more of the plurality of ratio striping values to a threshold ratio value indicating a likelihood of the potential fraud wave.