Fraud detection using predictive modeling

Claim 2

In a computer having a processor and storage, a computer-implemented process for detecting a fraudulent transaction in a customer account, comprising the steps of: obtaining past transaction data for processing by the computer pre-processing the past transaction data to derive past fraud related variables; generating a predictive model with the processor from the past fraud related variables; storing a representation of the predictive model in the computer storage; receiving current transaction data for processing by the processor; receiving customer data for processing by the processor; and generating a computer signal indicative of the likelihood of fraud in the current transaction, wherein the processor generates the computer signal by applying the current transaction data and the customer data to the stored predictive model.

Claim 3

The computer-implemented process of claim 1, wherein the step of obtaining customer data comprises accessing a computer database containing general customer data and a computer database containing customer transactional pattern data.

Claim 4

The computer-implemented process of claim 1, wherein the step of obtaining customer data comprises accessing no more than one profile computer database record containing customer transactional pattern data.

Claim 5

The computer-implemented process of claim 3, wherein the profile computer database record further contains general customer data.

Claim 6

The computer-implemented process of claim 1, wherein the current transaction data and the customer data each comprise a plurality of elements and the computer processes each element by: determining a relative contribution of the element to the determined likelihood of fraud; determining from each relative contribution thus determined a reason code value; and generating a computer signal indicative of the reason code value.

Claim 7

The computer-implemented process of claim 1, further comprising the steps of: comparing the computer signal indicative of the likelihood of fraud with a preset threshold value; and responsive to the computer signal exceeding the preset threshold value, generating a computer signal indicating fraud.

Claim 8

The computer-implemented process of claim 1, further comprising the iterative steps of: determining a cascade threshold value; comparing the computer signal indicative of the likelihood of fraud with the cascade threshold value; and responsive to the computer signal exceeding the cascade threshold value, generating another computer signal indicative of the likelihood of fraud in the current transaction by applying the current transaction data and the customer data to another predictive model.

Claim 9

The computer-implemented process of claim 1, further comprising the steps of: monitoring a performance metric of the computer generated predictive model, wherein the processor monitors the performance metric; comparing the performance metric with a predetermined performance level; and generating and storing a new predictive model from past transaction data responsive to the performance level exceeding the performance metric, wherein the new predictive model is generated by the processor and stored in the computer storage.

Claim 10

the computer-implemented process of claim 8, wherein the performance metric comprises: a fraud detection rate measurement; and a false positive rate measurement.

Claim 11

The computer-implemented process of claim 1, further comprising the steps of: pre-processing the current transaction data to derive current fraud-related variables; and pre-processing the customer data to derive customer fraud-related variables; wherein the computer signal representing the likelihood of fraud is generated responsive to application of the current fraud-related variables and the customer fraud-related variables to the stored predictive model.

Claim 12

The computer-implemented process of claim 10, wherein the past fraud-related variables and the current fraud-related variables each comprise at least: factors obtained from data referring to transaction dollar amounts related to fraud; factors obtained from data referring to transaction dates and times related to fraud; factors obtained from data referring to transaction approvals and declines related to fraud; and factors obtained from data referring to risk groups related to fraud.

Claim 13

The computer-implemented process of claim 10, wherein the past fraud-related variables and the current fraud-related variables each comprise at least: factors obtained from data referring to customers related to fraud; and factors obtained from data referring to merchants related to fraud.

Claim 14

The computer-implemented process of claim 10, further comprising the steps of, for each variable in the set of derived current fraud-related variables and derived customer fraud-related variables: determining a relative contribution of the variable to the determined likelihood of fraud; determining from each relative contribution thus determined a reason code value; and generating a computer signal indicative of the reason code value.

Claim 15

A computer-implemented process for detecting fraud for a transaction on a customer account, comprising the steps of: obtaining past transaction data for processing by the computer; pre-processing the past transaction data to derive past fraud-related variables; training a neural network on the computer with the derived past fraud-related variables; storing the neural network in storage associated with the computer; obtaining current transaction data for processing by the computer; pre-processing the current transaction data to derive current fraud-related variables; obtaining customer data for processing by the computer; pre-processing the customer data to derive customer fraud-related variables; and generating a computer signal representing the likelihood of fraud responsive to application of the current fraud-related variables and the customer fraud-related variables to the stored neural network.

Claim 16

A computer-implemented process for detecting fraud for a transaction on a customer account, comprising the steps of: obtaining past transaction data for processing by the computer; pre-processing the past transaction data to derive past fraud-related variables; training a neural network on the computer with the derived past fraud-related variables; storing the neural network in storage associated with the computer; obtaining current transaction data for processing by the computer; pre-processing the current transaction data to derive current fraud-related variables; obtaining customer data for processing by the computer; pre-processing the customer data to derive customer fraud-related variables; and generating a computer signal representing the likelihood of fraud responsive to application of the current fraud-related variables and the customer fraud-related variables to the stored neural network.

Claim 17

In a computer having a processor and storage, a computer-implemented process of training a neural network, the neural network for predicting fraudulent transactions in a customer account based on selected data, the neural network being represented on the computer and stored in the computer storage and comprising a plurality of interconnected processing elements, each processing element comprising: a plurality of inputs; a plurality of weights, wherein each weight is associated with a corresponding input by the processor to generate weighted inputs; means for combining the weighted inputs; and a transfer function for processing the combined weighted inputs on the processor to produce an output; the training process comprising the iterative steps of: applying input data to the neural network to generate output data, wherein the processor applies the input data to the neural network and generates the output data; comparing the generated output data to a desired output, wherein the processor performs the comparison; adjusting operation of the neural network responsive to the results of the comparing step; and after the iterative steps of applying, comparing, and adjusting, storing the neural network in the computer storage.

Claim 18

In a computer having a processor and storage, a computer-implemented process of training a neural network, the neural network for predicting fraudulent transactions in a customer account based on selected data, the neural network being represented on the computer and stored in the computer storage and comprising a plurality of interconnected processing elements, each processing element comprising: a plurality of inputs; a plurality of weights, wherein each weight is associated with a corresponding input by the processor to generate weighted inputs; means for combining the weighted inputs; and a transfer function for processing the combined weighted inputs on the processor to produce an output; the training process comprising the iterative steps of: applying input data to the neural network to generate output data, wherein the processor applies the input data to the neural network and generates the output data; comparing the generated output data to a desired output, wherein the processor performs the comparison; adjusting operation of the neural network responsive to the results of the comparing step; and after the iterative steps of applying, comparing, and adjusting, storing the neural network in the computer storage.

Claim 19

The computer-implemented process of claim 15, wherein the step of adjusting operation of the neural network comprises the substeps of: selecting a subset of the weights to be decayed; and decaying the selected subset of weights.

Claim 20

The computer-implemented process of claim 16, wherein the substep of selecting a subset of the weights to be decayed comprises applying and minimizing a cost function including an interlayer gain multiplier which varies a decay rate responsive to the location of a weight within the network.

Claim 21

The computer-implemented process of claim 17, wherein the cost function is of the form: ##EQU3## wherein: D represents a data set; target k represents a target value for element k of the data set; output k represents a network output for element k of the data set; g represents the interlayer gain multiplier; λ represents the relative importance of the complexity term; W represents a weight set; ω i represents a value of weight i; and c 1 represents a constant.

Claim 24

The system of claim 19, wherein the model development component derives past fraud-related variables as a function of the past transaction data, and said past fraud-related variables are used to train the predictive model.

Claim 25

The system of claim 19, wherein: the predictive model component comprises a neural network, coupled to the processor; and the model development component trains the neural network based on the past transaction data in accordance with program instructions in the program memory and executed by the processor, thereby generating a trained neural network; wherein the processor generates the computer signal by applying the current transaction data and the customer data to the trained neural network.

Claim 26

The system of claim 19, further comprising: a past transaction data pre-processor, coupled to the processor, for deriving past fraud-related variables from the past transaction data; wherein the model development component trains the predictive model based on the past fraud-related variables in accordance with program instructions in the program memory and executed by the processor, thereby generating the trained predictive model; a current transaction data pre-processor, coupled to the processor, for deriving current fraud-related variables from the current transaction data; and a customer data pre-processor, coupled to the processor, for deriving customer fraud-related variables from the customer data; wherein the processor generates the computer signal by applying the current fraud-related variables and the customer fraud-related variables to the trained predictive model.

Claim 27

In a system for detecting fraud in a transaction on an account belonging to a customer, the system including a computer processor for executing programmed instructions and for storing and retrieving data, a computer readable memory storing thereon: a neural network, coupled to the processor, for determining the likelihood of a fraudulent transaction; past transaction data storage, coupled to the processor, for receiving, storing, and sending past transaction data; a past transaction data pre-processor, coupled to the processor, for deriving past fraud-related variables from the past transaction data; a model development component, coupled to the processor, for training the neural network based on the past fraud-related variables, thereby generating a trained neural network; current transaction data storage, coupled to the processor, for receiving, storing, and sending current transaction data; a current transaction data pre-processor, coupled to the processor, for deriving current fraud-related variables from the current transaction data; customer data storage, coupled to the processor, for receiving, storing, and sending customer data; and a customer data pre-processor, coupled to the processor, for deriving customer fraud-related variables from the customer data; wherein the processor generates a computer signal indicative of the likelihood of fraud in a transaction, said computer signal being responsive to the application of the current fraud-related variables and the customer fraud-related variables to the trained neural network.

Claim 28

In a system for detecting fraud in a transaction on an account belonging to a customer, the system including a computer processor for executing programmed instructions and for storing and retrieving data, a computer readable memory storing thereon: a neural network, coupled to the processor, for determining the likelihood of a fraudulent transaction; past transaction data storage, coupled to the processor, for receiving, storing, and sending past transaction data; a past transaction data pre-processor, coupled to the processor, for deriving past fraud-related variables from the past transaction data; a model development component, coupled to the processor, for training the neural network based on the past fraud-related variables, thereby generating a trained neural network; current transaction data storage, coupled to the processor, for receiving, storing, and sending current transaction data; a current transaction data pre-processor, coupled to the processor, for deriving current fraud-related variables from the current transaction data; customer data storage, coupled to the processor, for receiving, storing, and sending customer data; and a customer data pre-processor, coupled to the processor, for deriving customer fraud-related variables from the customer data; wherein the processor generates a computer signal indicative of the likelihood of fraud in a transaction, said computer signal being responsive to the application of the current fraud-related variables and the customer fraud-related variables to the trained neural network.

Claim 29

In a computer-controlled transaction processing system including predictive modeling means for receiving current transaction data, processing the current transaction data, and outputting a plurality of output values, including a score value representing a likelihood of a fraudulent transaction, an improved computer-implemented process for identifying and determining fraudulent transaction data, comprising the steps of: prior to receiving the current transaction data for at least one current transaction; generating a consumer profile for each of a plurality of consumers from a plurality of past fraud-related variables and from consumer data, each consumer profile describing historical spending patterns of a corresponding consumer, the past fraud-related variables being derived by pre-processing past transaction data, the past transaction data including values for a plurality of transaction variables for a plurality of past transactions, the consumer data including values for each consumer for a plurality of consumer variables; training the predictive modeling means with the consumer profiles and with the past fraud-related variables to obtain a predictive model; and storing the obtained predictive model in the computer; receiving current transaction data for a current transaction of a consumer; receiving consumer data associated with the consumer; receiving the consumer profile associated with the consumer; pre-processing the obtained current transaction data, consumer data, and consumer profile to derive current fraud-related variables for the current transaction; determining the likelihood of fraud in the current transaction by applying the current fraud-related variables to the predictive model; and outputting from the predictive modeling means an output signal indicating the likelihood that the current transaction is fraudulent.

Claim 30

In a computer-controlled transaction processing system including predictive modeling means for receiving current transaction data, processing the current transaction data, and outputting a plurality of output values, including a score value representing a likelihood of a fraudulent transaction, an improved computer-implemented process for identifying and determining fraudulent transaction data, comprising the steps of: prior to receiving the current transaction data for at least one current transaction; generating a consumer profile for each of a plurality of consumers from a plurality of past fraud-related variables and from consumer data, each consumer profile describing historical spending patterns of a corresponding consumer, the past fraud-related variables being derived by pre-processing past transaction data, the past transaction data including values for a plurality of transaction variables for a plurality of past transactions, the consumer data including values for each consumer for a plurality of consumer variables; training the predictive modeling means with the consumer profiles and with the past fraud-related variables to obtain a predictive model; and storing the obtained predictive model in the computer; receiving current transaction data for a current transaction of a consumer; receiving consumer data associated with the consumer; receiving the consumer profile associated with the consumer; pre-processing the obtained current transaction data, consumer data, and consumer profile to derive current fraud-related variables for the current transaction; determining the likelihood of fraud in the current transaction by applying the current fraud-related variables to the predictive model; and outputting from the predictive modeling means an output signal indicating the likelihood that the current transaction is fraudulent.

Claim 31

The computer-implemented process of claim 24, wherein the generating step comprises the substeps of: receiving past transaction data for a plurality of past transactions, the past transaction data providing values for a plurality of transaction variables; receiving consumer data for each of a plurality of consumers, the consumer data providing values for a plurality of consumer variables for each consumer; pre-processing the past transaction data to derive past fraud-related variables wherein at least some of the past fraud-related variables are not present in the plurality of variables in the past transaction data; and generating a consumer profile for each consumer from the past fraud-related variables and the received consumer data, each consumer profile describing historical spending patterns of the consumer.

Claim 32

The computer-implemented process of claim 24, further comprising the step of updating the received consumer profile with the received current transaction data.

Claim 33

The computer-implemented process of claim 24, wherein the step of training the predictive modeling means comprises the substeps of: applying the consumer profile and the derived past fraud-related variables to the predictive modeling means; ranking output data from the predictive modeling means as a function of a quality measurement; adjusting the predictive modeling means as a function of the ranking step; and repeating the applying, ranking, and adjusting steps until the quality measurement exceeds a predetermined level indicating that the predictive modeling means is adequately trained.

Claim 34

The computer-implemented process of claim 27, wherein the step of training the neural network comprises the substeps of: applying the consumer profile and the derived past fraud-related variables to the neural network; ranking output data from the neural network as a function of a quality measurement; adjusting the neural network as a function of the ranking step; and repeating the applying, ranking, and adjusting steps until the quality measurement exceeds a predetermined level indicating that the neural network is adequately trained.

Claim 35

The computer-implemented process of claim 24, wherein the step of training the predictive modeling means comprises training a neural network organized as a plurality of input processing elements for receiving the plurality of data values in the transaction data, a plurality of hidden processing elements coupled to the input processing elements for processing the transaction data, and a plurality of output processing elements coupled to the hidden processing elements for outputting the plurality of output values.

Claim 36

The computer-implemented process of claim 29, wherein the neural network comprises a plurality of processing elements linked by connections characterized by weights, and the step of adjusting the predictive model comprises the steps of: selecting a subset of the weights to be decayed; and decaying the selected subset of weights.

Claim 37

The computer-implemented process of claim 30, wherein the substep of selecting a subset of the weights to be decayed comprises applying and minimizing a cost function including an interlayer gain multiplier which varies a decay rate responsive to the location of a weight within the network.

Claim 38

The computer-implemented process of claim 31, wherein the cost function is of the form: ##EQU4## wherein: D represents a data set; target k represents a target value for element k of the data set; output k represents a network output for element k of the data set; g represents the interlayer gain multiplier; l represents the relative importance of the complexity term; W represents a weight set; w i represents a value of weight i; and c 1 represents a constant.

Claim 39

The computer-implemented process of claim 24, wherein the current transaction data, the consumer profile, and the consumer data each comprise a plurality of data elements, further comprising the steps of, for at least one of the data elements: determining a relative contribution value of the data element to the output signal indicating the likelihood that the current transaction is fraudulent; determining a reason code as a function of the relative contribution value; retrieving an explanation associated with the determined reason code value; and outputting a computer signal indicative of the reason code and the explanation.

Claim 40

The computer-implemented process of claim 24, further comprising the steps of: monitoring a performance metric of the predictive modeling means, the performance metric comprising at least one of a fraud detection rate measurement and a false positive rate measurement; comparing the performance metric with a predetermined performance level for the performance metric; and responsive to the predetermined performance level exceeding the performance metric, repeating the step of training the predictive modeling means.

Claim 41

The computer-implemented process of claim 24, wherein the past fraud-related variables and the current fraud-related variables each comprise at least: transaction dollar amounts of past transactions; transaction dates and times of past transactions; transaction approvals and declines of past transactions; risk groups of past transactions; and merchants of past transactions.

Claim 42

In a computer system comprising: a computer-readable memory; and a neural network stored in the computer readable memory, the neural network comprising a plurality of interconnected processing elements, each processing element being in a layer of the neural network, each layer having a distance to an input layer, each processing element comprising: a plurality of inputs (x); a plurality of weights (w), each weight w associated with a corresponding input (x) to form weighted inputs; a summation function for combining the weighted inputs; and, a transfer function for processing the combined weighted inputs into an output (z); an improved computer-implemented process for training the neural network characterized by: iteratively decaying the weights of at least one processing element by a cost function that varies a decay rate for decaying the weights by a function of the distance of the input layer from the layer containing the processing element.

Claim 43

In a computer system comprising: a computer-readable memory; and a neural network stored in the computer readable memory, the neural network comprising a plurality of interconnected processing elements, each processing element being in a layer of the neural network, each layer having a distance to an input layer, each processing element comprising: a plurality of inputs (x); a plurality of weights (w), each weight w associated with a corresponding input (x) to form weighted inputs; a summation function for combining the weighted inputs; and, a transfer function for processing the combined weighted inputs into an output (z); an improved computer-implemented process for training the neural network characterized by: iteratively decaying the weights of at least one processing element by a cost function that varies a decay rate for decaying the weights by a function of the distance of the input layer from the layer containing the processing element.

Claim 44

The computer-implemented process of claim 36, wherein the cost function is of the form: ##EQU5## wherein: D represents a data set; target k represents a target value for an element k of the data set; output k represents a neural network output for element k of the data set; g represents an interlayer gain multiplier that varies as a function of the distance between the input layer and the layer containing the processing element; l represents the relative importance of the decay rate term; W represents a weight set; w i represents a value of weight i; and c 1 represents a constant.

Claim 45

In a computer-controlled transaction processing system including predictive modeling means for receiving current transaction data, processing the current transaction data, and outputting a plurality of output values, including a score value representing a likelihood of a fraudulent transaction, an improvement for identifying and determining fraudulent transaction data, comprising: a model development component for developing a predictive model, comprising: means for receiving past transaction data for a plurality of past transactions, the past transaction data providing values for a plurality of transaction variables; means for receiving consumer data for each of a plurality of consumers, the consumer data providing values for a plurality of consumer variables for each consumer; means for pre-processing the past transaction data to derive past fraud-related variables wherein at least some of the past fraud-related variables are not present in the plurality of variables in the past transaction data; means for generating a consumer profile for each individual consumer, from the past fraud-related variables and the received consumer data, the consumer profile describing historical spending patterns of the consumer; means for training the predictive model with the consumer profiles and with the past fraud-related variables; and means for storing the trained predictive model in the computer; and a model application component, for applying the trained predictive model, comprising: means for receiving current transaction date for a transaction of a consumer; means for receiving consumer data associated with the consumer; means for receiving the consumer profile associated with the consumer; a current transaction data pre-processor, for pre-processing the obtained current transaction data, consumer data, and consumer profile to derive current fraud-related variables for the current transaction; means for determining the likelihood of fraud in the current transaction by applying the current fraud-related variables to the predictive model; and means for outputting from the predictive model an output signal indicating the likelihood that the current transaction is fraudulent.

Claim 46

In a computer-controlled transaction processing system including predictive modeling means for receiving current transaction data, processing the current transaction data, and outputting a plurality of output values, including a score value representing a likelihood of a fraudulent transaction, an improvement for identifying and determining fraudulent transaction data, comprising: a model development component for developing a predictive model, comprising: means for receiving past transaction data for a plurality of past transactions, the past transaction data providing values for a plurality of transaction variables; means for receiving consumer data for each of a plurality of consumers, the consumer data providing values for a plurality of consumer variables for each consumer; means for pre-processing the past transaction data to derive past fraud-related variables wherein at least some of the past fraud-related variables are not present in the plurality of variables in the past transaction data; means for generating a consumer profile for each individual consumer, from the past fraud-related variables and the received consumer data, the consumer profile describing historical spending patterns of the consumer; means for training the predictive model with the consumer profiles and with the past fraud-related variables; and means for storing the trained predictive model in the computer; and a model application component, for applying the trained predictive model, comprising: means for receiving current transaction date for a transaction of a consumer; means for receiving consumer data associated with the consumer; means for receiving the consumer profile associated with the consumer; a current transaction data pre-processor, for pre-processing the obtained current transaction data, consumer data, and consumer profile to derive current fraud-related variables for the current transaction; means for determining the likelihood of fraud in the current transaction by applying the current fraud-related variables to the predictive model; and means for outputting from the predictive model an output signal indicating the likelihood that the current transaction is fraudulent.