Granted Patent B2

US 12,591,898 · App. 18/965,057 · Granted Mar 31, 2026

Inventors: Pushkar Joglekar (Emeryville, CA); Ajit Gaddam (Foster City, CA); Ara Jermakyan (Northridge, CA)

Assignee: Visa International Service Association

G06Q30/0185G06F18/22G06F21/552G06Q30/0201G06Q30/0215G06F11/3438

Abstract

Claims (66)

1 . A method comprising:

in response to and immediately after a new entity being added to a fraud detection system, wherein the new entity does not have a behavior history for generating a behavior profile from which to detect anomalous behavior for the new entity:

generating, with at least one processor, a doppelganger behavior profile for the new entity, wherein generating the doppelganger behavior profile comprises:

generating a plurality of similarity scores for each entity of a plurality of pre-existing entities based on inputting a portion of feature data of the new entity and a portion of feature data of the plurality of pre-existing entities into a plurality of machine-learning models, wherein each similarity score of the plurality of similarity scores defines a similarity between the new entity and an entity of the plurality of pre-existing entities based on an output of a machine-learning model of the plurality of machine-learning models;

ranking the plurality of pre-existing entities to produce a ranking;

selecting two or more pre-existing entities of the plurality of pre-existing based on the ranking; and

combining behavior profiles of the two or more preexisting entities to produce the doppelganger behavior profile for the new entity;

assigning, with at least one processor, the doppelganger behavior profile to the new entity;

detecting, with at least one processor, at least one anomaly in an activity of the new entity based on the doppelganger behavior profile assigned to the new entity; and

in response to detection of the at least one anomaly, automatically cancelling, at a transaction processing server, a current transaction being attempted by the new entity.

2 . The method of claim 1 , wherein generating the plurality of similarity scores for each entity of the plurality of pre-existing entities further comprises:

converting the feature data of the new entity into a feature vector;

converting the feature data of the plurality of pre-existing entities into a feature matrix; and

inputting the feature vector and the feature matrix into the plurality of machine-learning models.

3 . The method of claim 1 , further comprising monitoring, with at least one processor, transaction data of the new entity with respect to the doppelganger behavior profile assigned to the new entity.

4 . The method of claim 3 , wherein detecting the at least one anomaly further comprises:

detecting the at least one anomaly based on a comparison of the transaction data to the doppelganger behavior profile.

5 . The method of claim 1 , wherein combining the behavior profiles of the two or more preexisting entities to produce the doppelganger behavior profile for the new entity further comprises:

averaging parameters of the behavior profiles of the two or more preexisting entities to produce averaged parameters; and

assigning the averaged parameters to the doppelganger behavior profile.

6 . The method of claim 1 , wherein the feature data comprises at least one of the following parameters: ages of account holders, genders of account holders, credit ratings of account holders, occupations of account holders, account or card type of account holders, applications used by account holders, countries of origin of account holders, locations of account holders, billing addresses of account holders, issuer banks of account holders, issuer bank addresses of account holders, or any combination thereof.

7 . The method of claim 1 , further comprising, in response to detection of the at least one anomaly, transmitting, with at least one processor, information associated with the new entity to a merchant point-of-sale system associated with the current transaction.

8 . A system comprising:

at least one processor configured to:

in response to and immediately after a new entity being added to a fraud detection system, wherein the new entity does not have a behavior history for generating a behavior profile from which to detect anomalous behavior for the new entity:

generate a doppelganger behavior profile for the new entity, wherein, when generating the doppelganger behavior profile, the at least one processor is configured to:

generate a plurality of similarity scores for each entity of a plurality of pre-existing entities based on inputting a portion of feature data of the new entity and a portion of feature data of the plurality of pre-existing entities into a plurality of machine-learning models, wherein each similarity score of the plurality of similarity scores defines a similarity between the new entity and an entity of the plurality of pre-existing entities based on an output of a machine-learning model of the plurality of machine-learning models;

rank the plurality of pre-existing entities to produce a ranking;

select two or more pre-existing entities of the plurality of pre-existing based on the ranking; and

combine behavior profiles of the two or more preexisting entities to produce the doppelganger behavior profile for the new entity;

assign the doppelganger behavior profile to the new entity;

detect at least one anomaly in an activity of the new entity based on the doppelganger behavior profile assigned to the new entity; and

in response to detection of the at least one anomaly, automatically cancel, at a transaction processing server, a current transaction being attempted by the new entity.

9 . The system of claim 8 , wherein, when generating the plurality of similarity scores for each entity of the plurality of pre-existing entities, the at least one processor is further configured to:

convert the feature data of the new entity into a feature vector;

convert the feature data of the plurality of pre-existing entities into a feature matrix; and

input the feature vector and the feature matrix into the plurality of machine-learning models.

10 . The system of claim 8 , wherein the at least one processor is further configured to monitor transaction data of the new entity with respect to the doppelganger behavior profile assigned to the new entity.

11 . The system of claim 10 , wherein, when detecting the at least one anomaly, the at least one processor is further configured to:

detect the at least one anomaly based on a comparison of the transaction data to the doppelganger behavior profile.

12 . The system of claim 8 , wherein, when combining the behavior profiles of the two or more preexisting entities to produce the doppelganger behavior profile for the new entity, the at least one processor is further configured to:

average parameters of the behavior profiles of the two or more preexisting entities to produce averaged parameters; and

assign the averaged parameters to the doppelganger behavior profile.

13 . The system of claim 8 , wherein the feature data comprises at least one of the following parameters: ages of account holders, genders of account holders, credit ratings of account holders, occupations of account holders, account or card type of account holders, applications used by account holders, countries of origin of account holders, locations of account holders, billing addresses of account holders, issuer banks of account holders, issuer bank addresses of account holders, or any combination thereof.

14 . The system of claim 8 , wherein the at least one processor is further configured to, in response to detection of the at least one anomaly, transmit information associated with the new entity to a merchant point-of-sale system associated with the current transaction.

15 . A computer program product comprising at least one non-transitory computer-readable medium including program instructions that, when executed by at least one processor, cause the at least one processor to:

in response to and immediately after a new entity being added to a fraud detection system, wherein the new entity does not have a behavior history for generating a behavior profile from which to detect anomalous behavior for the new entity:

generate a doppelganger behavior profile for the new entity, wherein the program instructions that cause the at least one processor to generate the doppelganger behavior profile cause the at least one processor to:

generate a plurality of similarity scores for each entity of a plurality of pre-existing entities based on inputting a portion of feature data of the new entity and a portion of feature data of the plurality of pre-existing entities into a plurality of machine-learning models, wherein each similarity score of the plurality of similarity scores defines a similarity between the new entity and an entity of the plurality of pre-existing entities based on an output of a machine-learning model of the plurality of machine-learning models;

rank the plurality of pre-existing entities to produce a ranking;

select two or more pre-existing entities of the plurality of pre-existing based on the ranking; and

combine behavior profiles of the two or more preexisting entities to produce the doppelganger behavior profile for the new entity;

assign the doppelganger behavior profile to the new entity;

detect at least one anomaly in an activity of the new entity based on the doppelganger behavior profile assigned to the new entity; and

in response to detection of the at least one anomaly, automatically cancel, at a transaction processing server, a current transaction being attempted by the new entity.

16 . The computer program product of claim 15 , wherein the program instructions that cause the at least one processor to generate the plurality of similarity scores for each entity of the plurality of pre-existing entities further cause the at least one processor to:

convert the feature data of the new entity into a feature vector;

convert the feature data of the plurality of pre-existing entities into a feature matrix; and

input the feature vector and the feature matrix into the plurality of machine-learning models.

17 . The computer program product of claim 15 , wherein the program instructions further cause the at least one processor to monitor transaction data of the new entity with respect to the doppelganger behavior profile assigned to the new entity.

18 . The computer program product of claim 17 , wherein the program instructions that cause the at least one processor to detect the at least one anomaly cause the at least one processor to:

detect the at least one anomaly based on a comparison of the transaction data to the doppelganger behavior profile.

19 . The computer program product of claim 15 , wherein the program instructions that cause the at least one processor to combine the behavior profiles of the two or more preexisting entities to produce the doppelganger behavior profile for the new entity further cause the at least one processor to:

average parameters of the behavior profiles of the two or more preexisting entities to produce averaged parameters; and

assign the averaged parameters to the doppelganger behavior profile.

20 . The computer program product of claim 15 , wherein the feature data comprises at least one of the following parameters: ages of account holders, genders of account holders, credit ratings of account holders, occupations of account holders, account or card type of account holders, applications used by account holders, countries of origin of account holders, locations of account holders, billing addresses of account holders, issuer banks of account holders, issuer bank addresses of account holders, or any combination thereof.

Assignments (1)

Continuity (3)

References Cited (67)