System and method for detecting merchant points of compromise using network analysis and modeling

1. A system for detecting a merchant point of compromise, the system comprising:

a point of sale terminal located at a merchant location;

at least one of an issuer network, a payment network, and an acquirer network communicating with the point of sale terminal, each of said issuer network, said payment network, and said acquirer network including a server, a switch, or a router; and

a point-of-compromise detector installed in a computer system forming part of the issuer network, the payment network, or the acquirer network, said point-of-compromise detector being implemented at one or more of the issuer network, the payment network, and the acquirer network, said point-of-compromise detector remote from the point of sale terminal and configured to remotely detect fraud occurring at the point of sale terminal by:

electronically receiving the transaction information from the point of sale terminal;

generating at least one of an undirected network or a directed network based on the transaction information;

creating a plurality of nodes in the directed network, wherein each of the nodes represents a merchant;

detecting consecutive transactions made by a fraud account;

identifying a plurality of merchants associated with the consecutive transactions;

connecting at least two of the plurality of nodes in the directed network by edges that represent the plurality of merchants associated with the consecutive transactions;

assigning weights to the edges based on numbers of accounts associated with the consecutive transactions;

extracting features from at least one of the undirected network or the directed network; and

identifying one or more point-of-compromise merchants based on the extracted features.

2. The system of claim 1 , wherein the point-of-compromise detector creates a classification model having the extracted features as input variables, and uses the classification model for classifying a merchant as a point-of-compromise merchant or as a non-point-of-compromise merchant.

3. The system of claim 1 , wherein the generating step comprises generating an undirected network based on establishing a plurality of nodes associated with a plurality of accounts, each node indicating a first suspected fraud transaction associated with an account of the plurality of accounts; and establishing a plurality of undirected edges, each undirected edge connecting a pair of nodes of the plurality of nodes based on the point-of-compromise detector determining that both nodes for each pair of nodes have first suspected fraud transactions associated with a common merchant.

4. The system of claim 3 , wherein generating the undirected network comprises summing similarity variables in the transaction information to estimate a similarity value for a pair of nodes connected by an undirected edge, and assigning a weight to the undirected edge based on the similarity value.

5. The system of claim 4 , wherein the weight of the undirected edge is used by the point-of-compromise detector to perform the step of extracting features.

6. The system of claim 5 , wherein each directed edge indicates an order in which the consecutive transactions occurred.

7. The system of claim 6 , wherein the weight of the first directed edge is used by the point-of-compromise detector to perform the step of extracting features.

8. The system of claim 3 , wherein the point-of-compromise detector further performs the step of identifying within the undirected network a sub-network comprising a subset of nodes of the plurality of nodes, the subset of nodes indicating accounts suspected of being compromised in the common merchant.

9. A method for detecting a merchant point of compromise, comprising the steps of:

providing a point of sale terminal located at a merchant location;

providing at least one of an issuer network, a payment network, and an acquirer network communicating with the point of sale terminal, each of said issuer network, said payment network, and said acquirer network including a server, a switch, or a router;

installing a point-of-compromise detector in a computer system forming part of the issuer network, the payment network, or the acquirer network;

implementing said point-of-compromise detector remote from the point of sale terminal at one or more of the issuer network, the payment network, and the acquirer network;

configuring said point-of-compromise detector to remotely detect fraud occurring at the point of sale terminal;

electronically receiving, at a point-of-compromise detector of a computer system, transaction information from the point of sale terminal;

generating, by the point-of-compromise detector, at least one of an undirected network or a directed network based on the transaction information;

creating a plurality of nodes in the directed network, wherein each of the nodes represents a merchant;

detecting consecutive transactions made by a fraud account;

identifying a plurality of merchants associated with the consecutive transactions;

connecting at least two of the plurality of nodes in the directed network by edges that represent the plurality of merchants associated with the consecutive transactions;

assigning weights to the edges based on numbers of accounts associated with the consecutive transactions;

extracting, by the point-of-compromise detector, features from at least one of the undirected network or the directed network; and

identifying, by the point-of-compromise detector, one or more point-of-compromise merchants based on the extracted features.

10. The method of claim 9 , further comprising the steps of generating a classification model having the extracted features as input variables, and using the classification model for classifying a merchant as a point-of-compromise merchant or as a non-point-of-compromise merchant.

11. The method of claim 9 , wherein the generating step comprises generating an undirected network based on establishing a plurality of nodes associated with a plurality of accounts, each node indicating a first suspected fraud transaction associated with an account of the plurality of accounts; and establishing a plurality of undirected edges, each undirected edge connecting a pair of nodes of the plurality of nodes based on the point-of-compromise detector determining that both nodes for each pair of nodes have first suspected fraud transactions associated with a common merchant.

12. The method of claim 11 , wherein generating the undirected network further comprises summing similarity variables in the transaction information to estimate a similarity value of a pair of nodes connected by an undirected edge, and assigning a weight to the undirected edge based on the similarity value.

13. The method of claim 12 , wherein the weight of the undirected edge is used by the point-of-compromise detector to perform the step of extracting features.

14. The method of claim 13 , wherein the directed edges indicate an order in which the consecutive transactions occurred.

15. The method of claim 14 , wherein the weight of the first directed edge is used by the point-of-compromise detector to perform the step of extracting features.

16. The method of claim 11 , further comprising the step of identifying within the undirected network a sub-network comprising a subset of nodes of the plurality of nodes, the subset of nodes indicating accounts suspected of being compromised in the common merchant.

17. A computer-readable medium having computer-readable instructions stored thereon which, when executed by a point-of-compromise detector of the computer system, cause the point-of-compromise detector to perform the steps of:

providing a point of sale terminal located at a merchant location;

providing at least one of an issuer network, a payment network, and an acquirer network communicating with the point of sale terminal, each of said issuer network, said payment network, and said acquirer network including a server, a switch, or a router;

installing a point-of-compromise detector in a computer system forming part of the issuer network, the payment network, or the acquirer network;

implementing said point-of-compromise detector remote from the point of sale terminal at one or more of the issuer network, the payment network, and the acquirer network;

configuring said point-of-compromise detector to remotely detect fraud occurring at the point of sale terminal;

electronically receiving transaction information from the point of sale terminal;

generating at least one of an undirected network or a directed network based on the transaction information;

creating a plurality of nodes in the directed network, wherein each of the nodes represents a merchant;

detecting consecutive transactions made by a fraud account;

identifying a plurality of merchants associated with the consecutive transactions;

connecting at least two of the plurality of nodes in the directed network by edges that represent the plurality of merchants associated with the consecutive transactions;

assigning weights to the edges based on numbers of accounts associated with the consecutive transactions;

extracting features from at least one of the undirected network or the directed network; and

identifying one or more point-of-compromise merchants based on the extracted features.

18. The computer-readable medium of claim 17 , which, when executed by the point-of-compromise detector, cause the point-of-compromise detector to perform the steps of generating a classification model having the extracted features as input variables, and using the classification model for classifying a merchant as a point-of-compromise merchant or as a non-point-of-compromise merchant.

19. The computer-readable medium of claim 17 , wherein the generating step comprises generating an undirected network based on establishing a plurality of nodes associated with a plurality of accounts, each node indicating a first suspected fraud transaction associated with an account of the plurality of accounts; and establishing a plurality of undirected edges, each undirected edge connecting a pair of nodes of the plurality of nodes based on the point-of-compromise detector determining that both nodes for each pair of nodes have first suspected fraud transactions associated with a common merchant.

20. The computer-readable medium of claim 19 , wherein generating the undirected network comprises summing similarity variables in the transaction information to estimate a similarity value of a pair of nodes connected by an undirected edge, and assigning a weight to the undirected edge based on the similarity value.

21. The computer-readable medium of claim 20 , which further cause the point-of-compromise detector to use the weight of the undirected edge to perform the step of extracting features.

22. The computer-readable medium of claim 21 , wherein the directed edges indicate an order in which the consecutive transactions occurred.

23. The computer-readable medium of claim 22 , which further cause the point-of-compromise detector to use the weight of the first directed edge to perform the step of extracting features.

24. The computer-readable medium of claim 19 , which, when executed by the point-of-compromise detector, cause the point-of-compromise detector to further perform the step of identifying within the undirected network a sub-network comprising a subset of nodes of the plurality of nodes, the subset of nodes indicating accounts suspected of being compromised in the common merchant.