Granted Patent B2

US 12,627,708 · App. 17/981,743 · Granted May 12, 2026

Inventors: Jinna Zevulun Kim (Charlotte, NC); Katherine Kei-Zen Dintenfass (Lincoln, RI); Jo-Ann Taylor (Godalming, GB); Christine D. Black (Brooksville, ME); Jennifer Tiffany Renckert (Middleburg, FL); Vijaya L. Vemireddy (Plano, TX)

Assignee: BANK OF AMERICA CORPORATION

H04L63/1483G06F40/205H04L63/1416

Abstract

Claims (76)

1 . A system for detection of data misappropriation attempts across electronic communication platforms, the system comprising:

a memory device with computer-readable program code stored thereon;

at least one processing device operatively coupled to the memory device and at least one communication device, wherein executing the computer-readable program code is configured to cause the at least one processing device to:

identify a recipient user account and an associated recipient account identifier, wherein the recipient user account has received a current communication;

identify recipient account characteristics associated with the recipient account identifier;

parse the current communication to identify at least one order for the recipient user account;

identify at least one potential outcome based on the at least one order for the recipient user account;

determine the potential outcome comprises a misappropriation;

collect a set of previous recipient account identifiers associated with a set of previous threat communications and a set of previous recipient account characteristics associated with the set of previous recipient account identifiers;

create a recipient account threat training data set comprising the collected set of previous recipient account identifiers and the set of previous recipient account characteristics;

train a misappropriation attempt engine using the recipient account threat training data set;

apply the trained misappropriation attempt engine to the current communication, wherein the application of the trained misappropriation attempt engine comprises an analysis of the recipient account characteristics compared to the set of previous recipient account characteristics;

determine, by the trained misappropriation attempt engine, one or more of the recipient account characteristics matches at least one of the set of previous recipient account characteristics; and

generate, by the misappropriation attempt engine, a misappropriation attempt rating for the current communication based on the potential outcome comprising the misappropriation and the matching, using the trained misappropriation attempt engine, of the one or more recipient account characteristics with at least one of the set of previous recipient account characteristics.

2 . The system of claim 1 , wherein the current communication comprises at least one of a verbal electronic communication or an electronic message communication.

3 . The system of claim 1 , wherein the determination the potential outcome comprises a misappropriation further comprises an acceptance by the recipient user account of the at least one order of the current communication.

4 . The system of claim 1 , wherein the processing device is further configured to:

collect a set of previous threat communications, wherein the set of previous threat communications comprise at least one background tactic type;

create a background tactic training data set comprising the collected set of previous threat communications; and

train the misappropriation attempt engine using the background tactic training data set.

5 . The system of claim 4 , wherein the at least one background tactic type comprises at least one of a threat communication marker, a threat communication tone, a threat communication language, a threat communication noise, or a threat communication request type.

6 . The system of claim 5 , wherein the processing device is further configured to:

receive at least one current background tactic type associated with the current communication;

apply the at least one current background tactic type to the misappropriation attempt engine; and

generate, by the misappropriation attempt engine, the misappropriation attempt rating of the current communication based on the at least one current background tactic type.

7 . The system of claim 1 , wherein the processing device is further configured to:

collect a set of previous threat communications, wherein the set of previous threat communications comprise at least one previous order and at least one previous outcome;

create a previous outcome training data set comprising the collected set of previous threat communications; and

train the misappropriation attempt engine with the previous outcome training data set.

8 . The system of claim 1 , wherein the processing device is further configured to:

identify a current recipient account identifier based on the recipient user account associated with the current communication;

apply the current recipient account identifier to the misappropriation attempt engine; and

generate, by the misappropriation attempt engine, the misappropriation attempt rating of the current communication based on the current recipient account identifier.

9 . The system of claim 1 , wherein the processing device is further configured to:

collect a set of previous unverified sender account identifiers associated with a set of previous threat communications;

create a sender account threat training data set comprising the collected set of previous unverified sender account identifiers; and

train the misappropriation attempt engine using the sender account threat training data set.

10 . The system of claim 9 , wherein the processing device is further configured to:

identify a current unverified sender account identifier associated with the current communication;

transmit an authentication request to a verified sender user account associated with the unverified sender account identifier;

receive an authentication response from the verified sender user account; and

generate, based on the authentication response from the verified sender user account, a misappropriation attempt rating of the current communication.

11 . The system of claim 10 , wherein the misappropriation attempt rating of the current communication comprises a high rating, in an instance the authentication response comprises a negative response.

12 . The system of claim 10 , wherein the misappropriation attempt rating of the current communication comprises a low rating, in an instance the authentication response comprises a positive response.

13 . A computer program product for detection of data misappropriation attempts across electronic communication platforms, wherein the computer program product comprises at least one non-transitory computer-readable medium having computer-readable program code portions embodied therein, the computer-readable program code portions which when executed by a processing device are configured to cause the processing device to:

identify a recipient user account and an associated recipient account identifier, wherein the recipient user account has received a current communication;

identify recipient account characteristics associated with the recipient account identifier;

parse the current communication to identify at least one order for the recipient user account;

identify at least one potential outcome based on the at least one order for the recipient user account;

determine the potential outcome comprises a misappropriation;

collect a set of previous recipient account identifiers associated with a set of previous threat communications and a set of previous recipient account characteristics associated with the set of previous recipient account identifiers;

create a recipient account threat training data set comprising the collected set of previous recipient account identifiers and the set of previous recipient account characteristics;

train a misappropriation attempt engine using the recipient account threat training data set;

apply the trained misappropriation attempt engine to the current communication, wherein the application of the trained misappropriation attempt engine comprises an analysis of the recipient account characteristics compared to the set of previous recipient account characteristics;

determine, by the trained misappropriation attempt engine, one or more of the recipient account characteristics matches at least one of the set of previous recipient account characteristics; and

generate, by the misappropriation attempt engine, a misappropriation attempt rating for the current communication based on the potential outcome comprising the misappropriation and the matching, using the trained misappropriation attempt engine, of the one or more recipient account characteristics with at least one of the set of previous recipient account characteristics.

14 . The computer program product of claim 13 , wherein the current communication comprises at least one of a verbal electronic communication or an electronic message communication.

15 . The computer program product of claim 13 , wherein the determination the potential outcome comprises a misappropriation further comprises an acceptance by the recipient user account of the at least one order of the current communication.

16 . The computer program product of claim 13 , wherein the processing device is further configured to cause the processing device to:

collect a set of previous threat communications, wherein the set of previous threat communications comprise at least one background tactic type;

create a background tactic training data set comprising the collected set of previous threat communications; and

train the misappropriation attempt engine using the background tactic training data set.

17 . A computer-implemented method for detection of data misappropriation attempts across electronic communication platforms, the computer-implemented method comprising:

identifying a recipient user account and an associated recipient account identifier, wherein the recipient user account has received a current communication;

identifying recipient account characteristics associated with the recipient account identifier;

parsing the current communication to identify at least one order for the recipient user account;

identifying at least one potential outcome based on the at least one order for the recipient user account;

determining the potential outcome comprises a misappropriation;

collecting a set of previous recipient account identifiers associated with a set of previous threat communications and a set of previous recipient account characteristics associated with the set of previous recipient account identifiers;

creating a recipient account threat training data set comprising the collected set of previous recipient account identifiers and the set of previous recipient account characteristics;

training a misappropriation attempt engine using the recipient account threat training data set;

applying the trained misappropriation attempt engine to the current communication, wherein the application of the trained misappropriation attempt engine comprises an analysis of the recipient account characteristics compared to the set of previous recipient account characteristics;

determining, by the trained misappropriation attempt engine, one or more of the recipient account characteristics matches at least one of the set of previous recipient account characteristics; and

generating, by the misappropriation attempt engine, a misappropriation attempt rating for the current communication based on the potential outcome comprising the misappropriation and the matching, using the trained misappropriation attempt engine, of the one or more recipient account characteristics with at least one of the set of previous recipient account characteristics.

18 . The computer-implemented method of claim 17 , wherein the current communication comprises at least one of a verbal electronic communication or an electronic message communication.

19 . The computer-implemented method of claim 17 , wherein the determination the potential outcome comprises a misappropriation further comprises an acceptance by the recipient user account of the at least one order of the current communication.

Assignments (1)

Continuity (1)

References Cited (68)