Fraud detection

1. A system, comprising:

a processor coupled to a memory that stores instructions that, when executed by the processor, cause the processor to:

monitor access point information associated with an access point, the access point information including a designated internet protocol address, an internet service provider, and device information;

analyze the access point information for an event of an account at a financial institution associated with the access point to determine a risk level of the access point, wherein to determine the risk level, the processor is caused to:

compare at least some of the access point information for the event to a risk threshold value;

determine the event is associated with a cluster of first party fraud events based on the comparison; and

designate the event associated with the access point as risky based on the determination; and

based on the analysis of the access point information for the event, implement fraud response measures selected from a plurality of fraud response measures, wherein implementing the fraud response measures includes:

designate the access point as risky;

deem subsequent events performed on the access point and associated with the account to have a high probability of including first party fraud irrespective of a comparison of access point information for the subsequent events to the risk threshold value; and

require additional verification information for the subsequent events through an additional channel different from an access channel of the access point utilized for the event.

2. The system of claim 1 , wherein the instructions further cause the processor to determine whether to designate the event as risky based on a comparison between the risk threshold value and information associated with an additional event previously designated as risky.

3. The system of claim 2 , wherein the information associated with the additional event comprises one or more of a fraud rate or a fraud velocity.

4. The system of claim 2 , wherein the additional event comprises at least one offline event.

5. The system of claim 2 , wherein the additional event comprises at least one event that is associated with one or more of prevented fraud or unconfirmed fraud.

6. The system of claim 1 , wherein the cluster of first party fraud events is associated with a common modus operandi.

7. The system of claim 1 , wherein the instructions further cause the processor to at least one of alert an owner of an account at the financial institution, freeze the account, or require additional information or acts to access the account.

8. The system of claim 1 , wherein the instructions further cause the processor to designate the event as risky based on a determination that the event is associated with an access point previously designated as risky.

9. The system of claim 1 , wherein the instructions further cause the processor to determine one or more of a likelihood of potential fraud or a type of potential fraud associated with the event.

10. The system of claim 9 , wherein the instructions further cause the processor to implement one or more response measures based on one or more of the likelihood of potential fraud or the type of potential fraud.

11. A method, comprising:

monitoring access point information associated with an access point, the access point information including a designated internet protocol address, an internet service provider, and device information;

analyzing the access point information for an event of an account at a financial institution associated with the access point to determine a risk level of the access point by:

comparing at least some of the access point information for the event to a risk threshold value;

determining the event is associated with a cluster of first party fraud events based on the comparison; and

designating the event associated with the access point as risky based on the determination; and

based on the analysis of the access point information for the event, implementing fraud response measures selected from a plurality of fraud response measures, wherein implementing the fraud response measures includes:

designating the access point as risky;

deeming subsequent events performed on the access point and associated with the account to have a high probability of including first party fraud irrespective of a comparison of access point information for the subsequent events to the risk threshold value; and

requiring additional verification information for the subsequent events through an additional channel different from an access channel of the access point utilized for the event.

12. The method of claim 11 , further comprising implementing one or more fraud response measures.

13. The method of claim 12 , further comprising implementing the one or more fraud response measures based on one or more of a determined likelihood of potential fraud or type of potential fraud.

14. The method of claim 12 , further comprising at least one of alerting an owner of an account at the financial institution, freezing the account, or requiring additional information or action to access the account.

15. The method of claim 11 , further comprising designating the event as risky based on a determination that the event is associated with an access point previously designated as risky.

16. The method of claim 11 , further comprising:

comparing at least one of fraud rate, fraud velocity or past fraud on the access point to a threshold; and

designating the access point as risky when a result of the comparing exceeds the threshold.

17. A method, comprising:

executing, on a processor, instructions that cause the processor to perform operations comprising:

monitoring access point information associated with an access point, the access point information including a designated internet protocol address, an internet service provider, and device information;

analyzing the access point information for an event of an account at a financial institution associated with the access point to determine a risk level of the access point by:

comparing at least some of the access point information for the event to a risk threshold value;

determining the event is associated with a cluster of first party fraud events based on the comparison; and

designating the event associated with the access point as risky based on the determination;

based on the analysis of the access point information for the event, storing an indication in a database designating subsequent events performed on the access point as risky; and

implementing fraud response measures selected from a plurality of fraud response measures, wherein implementing the first party fraud response measures includes:

designating the access point as risky;

deeming subsequent events performed on the access point and associated with the account to have a high probability of including first party fraud irrespective of a comparison of access point information for the subsequent events to the risk threshold value; and

requiring additional verification information for the subsequent events through an additional channel different from an access channel of the access point utilized for the event.

18. The method of claim 17 , wherein the operations further comprising at least one of alerting an owner of the account, freezing the account, or requiring additional information or action to access the account.

19. The method of claim 17 , wherein the operations further comprise:

comparing at least one of fraud rate, fraud velocity or past fraud on the access point to a threshold; and

designating the access point as risky when a result of the comparing exceeds the threshold.