Granted Patent B2

US 12,198,150 · App. 18/474,317 · Granted Jan 14, 2025

Inventors: Pushkar Joglekar (Emeryville, CA); Ajit Gaddam (Foster City, CA); Ara Jermakyan (Northridge, CA)

Assignee: Visa International Service Association

G06Q30/0185G06F18/22G06F21/552G06Q30/0201G06Q30/0215G06Q30/0224H04L67/535

Abstract

Claims (72)

1. A method comprising:

in response to and immediately after a new entity being added to a fraud detection system, wherein the new entity does not have a behavior history sufficient for generating a behavior profile from which to detect anomalous behavior for the new entity:

generating, with at least one processor, a doppelganger behavior profile for the new entity based at least partially on a set of parameters of feature data of the new entity and feature data of a plurality of pre-existing entities, wherein generating the doppelganger behavior profile comprises:

generating a plurality of similarity scores for each entity of the plurality of pre-existing entities based on inputting a portion of the feature data of the new entity and a portion of the feature data of the plurality of pre-existing entities into a plurality of machine-learning models, wherein each similarity score of the plurality of similarity scores defines a similarity between the new entity and an entity of the plurality of pre-existing entities based on an output of a machine-learning model of the plurality of machine-learning models;

determining a single similarity score for each entity of the plurality of pre-existing entities based on the plurality of similarity scores for the entity;

ranking the plurality of pre-existing entities based on the single similarity score for each entity of the plurality of pre-existing entities, to produce a ranking;

selecting two or more pre-existing entities of the plurality of pre-existing based on the ranking; and

combining behavior profiles of the two or more preexisting entities to produce the doppelganger behavior profile for the new entity;

assigning, with at least one processor, the doppelganger behavior profile to the new entity;

monitoring, with at least one processor, activity data of the new entity with respect to the doppelganger behavior profile assigned to the new entity, the activity data comprising transaction parameters associated with transactions initiated with a portable financial device of the new entity;

analyzing, with at least one processor, the activity data of the new entity with respect to the doppelganger behavior profile assigned to the new entity;

detecting, with at least one processor, in an activity of the new entity at least one of fraud, an anomaly, and malicious intent, based on the doppelganger behavior profile assigned to the new entity; and

in response to detection of the at least one of fraud, an anomaly, and malicious intent, automatically cancelling, at a transaction processing server, a current transaction being attempted by the new entity.

2. The method of claim 1 , wherein generating the plurality of similarity scores for each entity of the plurality of pre-existing entities further comprises:

converting the feature data of the new entity into a feature vector;

converting the feature data of the plurality of pre-existing entities into a feature matrix; and

inputting the feature vector and the feature matrix into the plurality of machine-learning models.

3. The method of claim 1 , wherein ranking the plurality of pre-existing entities further comprises:

determining that the plurality of pre-existing entities are ranked above a threshold ranking by a threshold number of the plurality of machine-learning models.

4. The method of claim 1 , wherein the new entity is a new account holder.

5. The method of claim 1 , wherein combining the behavior profiles of the two or more preexisting entities to produce the doppelganger behavior profile for the new entity further comprises:

averaging parameters of the behavior profiles of the two or more preexisting entities to produce averaged parameters; and

assigning the averaged parameters to the doppelganger behavior profile.

6. The method of claim 1 , wherein the feature data comprises at least one of the following parameters: ages of account holders, genders of account holders, credit ratings of account holders, occupations of account holders, account or card type of account holders, applications used by account holders, countries of origin of account holders, locations of account holders, billing addresses of account holders, issuer banks of account holders, issuer bank addresses of account holders, or any combination thereof.

7. A system comprising at least one processor programmed and/or configured to:

in response to and immediately after a new entity being added to a fraud detection system, wherein the new entity does not have a behavior history sufficient for generating a behavior profile from which to detect anomalous behavior for the new entity:

generate a doppelganger behavior profile for the new entity based at least partially on a set of parameters of feature data of the new entity and feature data of a plurality of pre-existing entities, wherein, when generating the doppelganger behavior profile, the at least one processor is programmed and/or configured to:

generate a plurality of similarity scores for each entity of the plurality of pre-existing entities based on inputting a portion of the feature data of the new entity and a portion of the feature data of the plurality of pre-existing entities into a plurality of machine-learning models, wherein each similarity score of the plurality of similarity scores defines a similarity between the new entity and an entity of the plurality of pre-existing entities based on an output of a machine-learning model of the plurality of machine-learning models;

determine a single similarity score for each entity of the plurality of pre-existing entities based on the plurality of similarity scores for the entity;

rank the plurality of pre-existing entities based on the single similarity score for each entity of the plurality of pre-existing entities, to produce a ranking;

select two or more pre-existing entities of the plurality of pre-existing based on the ranking; and

combine behavior profiles of the two or more preexisting entities to produce the doppelganger behavior profile for the new entity;

assign the doppelganger behavior profile to the new entity;

monitor activity data of the new entity with respect to the doppelganger behavior profile assigned to the new entity;

analyze the activity data of the new entity with respect to the doppelganger behavior profile assigned to the new entity, the activity data comprising transaction parameters associated with transactions initiated with a portable financial device of the new entity;

detect in an activity of the new entity at least one of fraud, an anomaly, and malicious intent, based on the doppelganger behavior profile assigned to the new entity; and

in response to detection of the at least one of fraud, an anomaly, and malicious intent, automatically cancel, at a transaction processing server, a current transaction being attempted by the new entity.

8. The system of claim 7 , wherein, when generating the plurality of similarity scores for each entity of the plurality of pre-existing entities, the at least one processor is further programmed and/or configured to:

convert the feature data of the new entity into a feature vector;

convert the feature data of the plurality of pre-existing entities into a feature matrix; and

input the feature vector and the feature matrix into the plurality of machine-learning models.

9. The system of claim 7 , wherein, when ranking the plurality of pre-existing entities, the at least one processor is further programmed and/or configured to:

determine that the plurality of pre-existing entities are ranked above a threshold ranking by a threshold number of the plurality of machine-learning models.

10. The system of claim 7 , wherein the new entity is a new account holder.

11. The system of claim 7 , wherein, when combining the behavior profiles of the two or more preexisting entities to produce the doppelganger behavior profile for the new entity, the at least one processor is further programmed or configured to:

average parameters of the behavior profiles of the two or more preexisting entities to produce averaged parameters; and

assign the averaged parameters to the doppelganger behavior profile.

12. The system of claim 7 , wherein the feature data comprises at least one of the following parameters: ages of account holders, genders of account holders, credit ratings of account holders, occupations of account holders, account or card type of account holders, applications used by account holders, countries of origin of account holders, locations of account holders, billing addresses of account holders, issuer banks of account holders, issuer bank addresses of account holders, or any combination thereof.

13. A computer program product comprising at least one non-transitory computer-readable medium including program instructions that, when executed by at least one processor, cause the at least one processor to:

in response to and immediately after a new entity being added to a fraud detection system, wherein the new entity does not have a behavior history sufficient for generating a behavior profile from which to detect anomalous behavior for the new entity:

generate a doppelganger behavior profile for the new entity based at least partially on a set of parameters of feature data of the new entity and feature data of a plurality of pre-existing entities, wherein, when generating the doppelganger behavior profile, the at least one processor is programmed and/or configured to:

generate a plurality of similarity scores for each entity of the plurality of pre-existing entities based on inputting a portion of the feature data of the new entity and a portion of the feature data of the plurality of pre-existing entities into a plurality of machine-learning models, wherein each similarity score of the plurality of similarity scores defines a similarity between the new entity and an entity of the plurality of pre-existing entities based on an output of a machine-learning model of the plurality of machine-learning models;

determine a single similarity score for each entity of the plurality of pre-existing entities based on the plurality of similarity scores for the entity;

rank the plurality of pre-existing entities based on the single similarity score for each entity of the plurality of pre-existing entities, to produce a ranking;

select two or more pre-existing entities of the plurality of pre-existing based on the ranking; and

combine behavior profiles of the two or more preexisting entities to produce the doppelganger behavior profile for the new entity;

assign the doppelganger behavior profile to the new entity;

monitor activity data of the new entity with respect to the doppelganger behavior profile assigned to the new entity;

analyze the activity data of the new entity with respect to the doppelganger behavior profile assigned to the new entity, the activity data comprising transaction parameters associated with transactions initiated with a portable financial device of the new entity;

detect in an activity of the new entity at least one of fraud, an anomaly, and malicious intent, based on the doppelganger behavior profile assigned to the new entity; and

in response to detection of the at least one of fraud, an anomaly, and malicious intent, automatically cancel, at a transaction processing server, a current transaction being attempted by the new entity.

14. The computer program product of claim 13 , wherein the program instructions that cause the at least one processor to generate the plurality of similarity scores for each entity of the plurality of pre-existing entities further cause the at least one processor to:

convert the feature data of the new entity into a feature vector;

convert the feature data of the plurality of pre-existing entities into a feature matrix; and

input the feature vector and the feature matrix into the plurality of machine-learning models.

15. The computer program product of claim 13 , wherein the program instructions that cause the at least one processor to rank the plurality of pre-existing entities further cause the at least one processor to:

determine that the plurality of pre-existing entities are ranked above a threshold ranking by a threshold number of the plurality of machine-learning models.

16. The computer program product of claim 13 , wherein the new entity is a new account holder.

17. The computer program product of claim 13 , wherein the program instructions that cause the at least one processor to combine the behavior profiles of the two or more preexisting entities to produce the doppelganger behavior profile for the new entity further cause the at least one processor to:

average parameters of the behavior profiles of the two or more preexisting entities to produce averaged parameters; and

assign the averaged parameters to the doppelganger behavior profile.

18. The computer program product of claim 13 , wherein the feature data comprises at least one of the following parameters: ages of account holders, genders of account holders, credit ratings of account holders, occupations of account holders, account or card type of account holders, applications used by account holders, countries of origin of account holders, locations of account holders, billing addresses of account holders, issuer banks of account holders, issuer bank addresses of account holders, or any combination thereof.

Assignments (1)

Continuity (2)

References Cited (51)