DETECTION AND PREVENTION OF EXTERNAL FRAUD
Techniques for detecting instances of external fraud by monitoring digital activities that are performed with accounts associated with an enterprise are disclosed. In one example, a threat detection platform determines the likelihood that an incoming email is indicative of external fraud based on the context and content of the incoming email. To understand the risk posed by an incoming email, the threat detection platform may seek to determine not only whether the sender normally communicates with the recipient, but also whether the topic is one normally discussed by the sender and recipient. In this way, the threat detection platform can establish whether the incoming email deviates from past emails exchanged between the sender and recipient.
1 . A system comprising:
a processor configured to:
obtain a first set of emails received by employees of an enterprise;
examine content of the first set of emails so as to identify a second set of emails that contain invoices, wherein the second set of emails is a subset of the first set of emails;
receive input indicative of labels for the second set of emails that are provided through an interface, wherein each label indicates whether the corresponding email is representative of a legitimate request for payment; and
train a model to identify legitimate requests for payment by providing (i) the second set of emails and (ii) the labels to the model as training data; and
a memory coupled to the processor and configured to provide the processor with instructions.
2 . The system of claim 1 , wherein the processor is further configured to:
perform a resolution procedure so as to identify email addresses from which the first set of emails are received; and
establish that each email included in the second set of emails is transmitted by a vendor based on the corresponding email address.
3 . The system of claim 1 , wherein the processor is further configured to apply heuristic functions to the first set of emails to identify the second set of emails that contain invoices.
4 . The system of claim 1 , wherein the interface includes an entity labeler platform configured to allow manual labeling of the second set of emails.
5 . The system of claim 1 , wherein the labels includes human-defined labels that establish a ground truth dataset for training the model.
6 . The system of claim 1 , wherein the processor is further configured to: obtain an incoming email; and apply the trained model to the incoming email to determine a likelihood that the incoming email includes a request for payment.
7 . The system of claim 6 , wherein applying the trained model to the incoming email comprises analyzing at least one of a subject, a body, or an attachment of the incoming email to determine whether the incoming email contains an invoice.
8 . The system of claim 6 , wherein applying the trained model to the incoming email comprises analyzing text included in a body of the incoming email using a bag-of-words model.
9 . The system of claim 6 , wherein applying the trained model to the incoming email comprises determining whether an attachment of the incoming email contains a dollar sign or a physical address.
10 . The system of claim 6 , wherein applying the trained model to the incoming email comprises analyzing terms contained in an invoice attached to the incoming email using optical character recognition or text analysis.
11 . The system of claim 6 , wherein the processor is further configured to perform a vendor resolution procedure to identify a vendor involved in the incoming email.
12 . The system of claim 11 , wherein performing the vendor resolution procedure comprises applying a natural language processing algorithm or a computer vision algorithm to a body of the incoming email to establish an identity of the vendor.
13 . The system of claim 11 , wherein performing the vendor resolution procedure comprises fetching records of domain age from a database to determine an age of a domain from which the incoming email originated.
14 . The system of claim 6 , wherein the processor is further configured to: determine, based on the trained model, that the incoming email is representative of a request to pay an invoice; and upload the incoming email to a vendor database representing a record of counts built off a history of invoice-related conversations.
15 . The system of claim 14 , wherein the processor is further configured to generate a metric indicative of risk for the incoming email based on a degree of similarity between the incoming email and past emails for which information is available in the vendor database.
16 . The system of claim 15 , wherein the processor is further configured to implement a filter to at least temporarily prohibit emails from a vendor associated with the incoming email responsive to the metric.
17 . The system of claim 16 , wherein the processor is further configured to cause display of a notification including information regarding the incoming email responsive to the metric indicating that a risk in communicating with a vendor associated with the incoming email is high.
18 . The system of claim 1 , wherein the processor is further configured to include synthetic emails in the training data, wherein the synthetic emails are not actually sent by a sender to a recipient.
19 . A method comprising:
obtaining a first set of emails received by employees of an enterprise;
examining content of the first set of emails so as to identify a second set of emails that contain invoices, wherein the second set of emails is a subset of the first set of emails;
receiving input indicative of labels for the second set of emails that are provided through an interface, wherein each label indicates whether the corresponding email is representative of a legitimate request for payment; and
training a model to identify legitimate requests for payment by providing (i) the second set of emails and (ii) the labels to the model as training data.
20 . A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
obtaining a first set of emails received by employees of an enterprise;
examining content of the first set of emails so as to identify a second set of emails that contain invoices, wherein the second set of emails is a subset of the first set of emails;
receiving input indicative of labels for the second set of emails that are provided through an interface, wherein each label indicates whether the corresponding email is representative of a legitimate request for payment; and
training a model to identify legitimate requests for payment by providing (i) the second set of emails and (ii) the labels to the model as training data.