US6163604A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Automated fraud management in transaction-based networks
Assignee: Nokia of America Corp
•
Filing: 1999-04-01
•
Granted: 2000-12-19
•
Expires: 2019-04-01
Abstract
Abstract Fraud losses in a communication network are substantially reduced by automatically generating fraud management recommendations in response to suspected fraud and by deriving the recommendations as a function of selected attributes of the fraudulent activity. More specifically, a programmable rules engine automatically generates recommendations based on call-by-call fraud scoring so that the recommendations correspond directly to the type and amount of suspected fraudulent activity. Using telecommunications fraud as an example, an automated fraud management system receives call detail records that have been previously scored to identify potentially fraudulent calls. Fraud scoring estimates the probability of fraud for each call based on the learned behavior of an individual subscriber as well as that of fraud perpetrators. Scoring also provides an indication of the contribution of various elements of the call detail record to the fraud score for that call. A case analysis is initiated and previously scored call detail records are separated into innocuous and suspicious groups based on fraud scores. Each group is then characterized according to selected variables and scoring for its member calls. These characterizations are combined with subscriber information to generate a set of decision variables. A set of rules is then applied to determine if the current set of decision variables meets definable conditions. When a condition is met, prevention measures associated with that condition are recommended for the account. As one example, recommended prevention measures may be automatically implemented via provisioning functions in the telecommunications network.
Inventors
- 👤 Gerald Donald Baulier
- 👤 Michael H. Cahill
- 👤 Virginia Kay Ferrara
- 👤 Diane Lambert
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-07 11:03
CPC Classifications
H; H04; H04M; H04M15/00; H04M15/47; H04M15/58; H04M3/00; H04M3/22; H04M3/36; H04M3/38; H04M3/382; H04W; H04W12/00; H04W12/12; H04W12/126; H04M2203/00; H04M2203/60; H04M2203/6027; H04M2215/00; H04M2215/01; H04M2215/0148; H04M2215/0188; H04M3/2218
Claims Analysis
Total Claims: 36
Claim 1
Independent Claim
78 words
A computer-implemented method for managing fraud in a telecommunications network, comprising the step of: automatically generating one or more recommendations for responding to suspected fraudulent activity in the telecommunications network, wherein the recommendations are derived as a function of calls scored for the likelihood of fraud, and wherein the recommendations correspond to attributes of the suspected fraudulent activity so that a recommended response to the suspected fraudulent activity is targeted to the type of fraud that is occurring.
Claim 2
Dependent Claim
78 words
A computer-implemented method for managing fraud in a telecommunications network, comprising the step of: automatically generating one or more recommendations for responding to suspected fraudulent activity in the telecommunications network, wherein the recommendations are derived as a function of calls scored for the likelihood of fraud, and wherein the recommendations correspond to attributes of the suspected fraudulent activity so that a recommended response to the suspected fraudulent activity is targeted to the type of fraud that is occurring.
Claim 3
Dependent Claim
14 words
The computer-implemented method of claim 1, wherein scoring is done on a call-by-call basis.
Claim 4
Dependent Claim
62 words
The computer-implemented method of claim 2, further comprising the steps of: receiving call detail records which have been scored to identify potentially fraudulent activity, wherein a scored call detail record provides an indication of the contribution of a plurality of predetermined call variables to the fraud score; and initiating a case analysis based on predetermined criteria relating to changes in fraud scores.
Claim 5
Dependent Claim
121 words
The computer-implemented method of claim 3, wherein the step of initiating a case analysis comprises the steps of: a) separating a plurality of scored call detail records, based on fraud scores, into at least a first group representative of non-suspicious activity and a second group representative of suspicious activity; b) characterizing each group according to predetermined variables and fraud scores for individual calls in the respective groups; c) generating one or more decision variables based on step b) and subscriber information; d) applying one or more rules to the one or more decision variables to determine if a predefined condition is met; and e) when a predefined condition is met, recommending one or more prescribed fraud responses corresponding to that condition.
Claim 6
Dependent Claim
45 words
The computer-implemented method of claim 4, wherein a fraud score of an individual call is representative of the likelihood of fraud based on the learned behavior of a subscriber comprising a subscriber signature and the learned behavior of fraudulent calling activity comprising a fraud signature.
Claim 7
Dependent Claim
17 words
The computer-implemented method of claim 5, wherein the one or more prescribed fraud responses includes prevention measures.
Claim 8
Dependent Claim
17 words
The computer-implemented method of claim 6, wherein one of the prevention measures includes implementing provisioning-based fraud prevention.
Claim 9
Dependent Claim
16 words
The computer-implemented method of claim 1, wherein the recommendations further correspond to attributes of legitimate activity.
Claim 10
Dependent Claim
20 words
The computer-implemented method of claim 8, wherein the recommendations further correspond to subscriber information and attributes associated with a case.
Claim 11
Dependent Claim
55 words
The computer-implemented method according to claim 3, wherein the plurality of predetermined call variables are variables selected from the group consisting of day of week, time of day, duration of call, time between consecutive calls, origination, destination, use of special call features, appearance of network security alert, carrier selection, and use of international completion services.
Claim 12
Dependent Claim
33 words
The method according to claim 4, wherein a case is capable of being updated on a iterative and adaptive basis as a function of newly scored calls and newly generated fraud response recommendations.
Claim 13
Dependent Claim
42 words
The computer-implemented method according to claim 5, wherein the subscriber signature is derived from attributes of calling behavior selected from the group consisting of calling rate, day of week timing, hour of day timing, call duration, method of billing, and geographical associations.
Claim 14
Dependent Claim
21 words
The computer-implemented method according to claim 5, wherein the attributes of calling behavior are derived from information in call detail records.
Claim 15
Dependent Claim
25 words
The computer-implemented method according to claim 5, wherein the fraud signature is derived from attributes of calling behavior associated with suspected and confirmed fraudulent calls.
Claim 16
Dependent Claim
93 words
The computer-implemented method of claim 5, wherein suspected fraudulent activity is indicated by factors selected from the group consisting of a fraud score that exceeds a predetermined value, a fraud score indicative of a change in fraud score of a prescribed amount over a prescribed number of calls, a collision event indicated by an overlap in time for two or more calls, and a velocity violation event indicated by an inconsistent change in origination point for each of two or more calls given the amount of time between the two or more calls.
Claim 17
Dependent Claim
80 words
A computer-implemented method for managing fraud in a network where transactions occur, comprising the step of: automatically generating one or more recommendations for responding to suspected fraudulent activity in the network, wherein the recommendations are derived as a function of transactions scored for the likelihood of fraud, and wherein the recommendations correspond to selected attributes of the suspected fraudulent activity so that a recommended response to the suspected fraudulent activity is targeted to the type of fraud that is occurring.
Claim 18
Dependent Claim
80 words
A computer-implemented method for managing fraud in a network where transactions occur, comprising the step of: automatically generating one or more recommendations for responding to suspected fraudulent activity in the network, wherein the recommendations are derived as a function of transactions scored for the likelihood of fraud, and wherein the recommendations correspond to selected attributes of the suspected fraudulent activity so that a recommended response to the suspected fraudulent activity is targeted to the type of fraud that is occurring.
Claim 19
Dependent Claim
60 words
The computer-implemented method of claim 16, further comprising the steps of: receiving transaction records which have been scored to identify potentially fraudulent activity, wherein a scored transaction record provides an indication of the contribution of a plurality of predetermined transaction variables to the fraud score; and initiating a case analysis based on predetermined criteria relating to changes in fraud scores.
Claim 20
Dependent Claim
120 words
The computer-implemented method of claim 17, wherein the step of initiating a case analysis comprises the steps of: a) separating a plurality of scored transaction records, based on fraud scores, into at least a first group representative of non-suspicious activity and a second group representative of suspicious activity; b) characterizing each group according to predetermined variables and fraud scores for individual transactions in the respective groups; c) generating one or more decision variables based on step b) and subscriber information; d) applying one or more rules to the one or more decision variables to determine if a predefined condition is met; and e) when a predefined condition is met, recommending one or more prescribed fraud responses corresponding to that condition.
Claim 21
Dependent Claim
44 words
The computer-implemented method of claim 18, wherein a fraud score of an individual transaction is representative of the likelihood of fraud based on the learned behavior of a subscriber comprising a subscriber signature and the learned behavior of fraudulent activity comprising a fraud signature.
Claim 22
Dependent Claim
17 words
The computer-implemented method of claim 19, wherein the one or more prescribed fraud responses includes prevention measures.
Claim 23
Dependent Claim
20 words
The computer-implemented method of claim 20, wherein one of the prevention measures includes implementing provisioning-based fraud prevention in the network.
Claim 24
Dependent Claim
14 words
The computer-implemented method of claim 16, wherein scoring is done on a transaction-by-transaction basis.
Claim 25
Dependent Claim
17 words
The computer-implemented method of claim 16, wherein the recommendations further correspond to attributes of legitimate transaction activity.
Claim 26
Dependent Claim
14 words
The computer-implemented method of claim 23, wherein the recommendations further correspond to subscriber information.
Claim 27
Dependent Claim
17 words
The computer-implemented method of claim 24, wherein the recommendations further correspond to attributes associated with a case.
Claim 28
Independent Claim
81 words
A system for managing fraud in a network where transactions occur, comprising: means for deriving one or more recommendations for responding to suspected fraudulent activity in the network as a function of transactions scored for the likelihood of fraud; and means for automatically generating the one or more recommendations, wherein the recommendations correspond to selected attributes of the suspected fraudulent activity so that a recommended response to the suspected fraudulent activity is targeted to the type of fraud that is occurring.
Claim 29
Independent Claim
81 words
A system for managing fraud in a network where transactions occur, comprising: means for deriving one or more recommendations for responding to suspected fraudulent activity in the network as a function of transactions scored for the likelihood of fraud; and means for automatically generating the one or more recommendations, wherein the recommendations correspond to selected attributes of the suspected fraudulent activity so that a recommended response to the suspected fraudulent activity is targeted to the type of fraud that is occurring.
Claim 30
Independent Claim
135 words
A system for managing fraud in a telecommunications network, comprising: at least one memory device for receiving, storing, and supplying call detail records that have been scored to identify potentially fraudulent activity, wherein a scored call detail record provides an indication of the contribution to the fraud score of a plurality of predetermined call variables; and a computer processor, coupled to the at least one memory device, for executing programmed instructions to automatically generate one or more recommendations for responding to suspected fraudulent activity in the telecommunications network, wherein the recommendations are derived as a function of the scored call detail records, and wherein the recommendations correspond to selected attributes of the suspected fraudulent activity so that a recommended response to the suspected fraudulent activity is targeted to the type of fraud that is occurring.
Claim 31
Independent Claim
135 words
A system for managing fraud in a telecommunications network, comprising: at least one memory device for receiving, storing, and supplying call detail records that have been scored to identify potentially fraudulent activity, wherein a scored call detail record provides an indication of the contribution to the fraud score of a plurality of predetermined call variables; and a computer processor, coupled to the at least one memory device, for executing programmed instructions to automatically generate one or more recommendations for responding to suspected fraudulent activity in the telecommunications network, wherein the recommendations are derived as a function of the scored call detail records, and wherein the recommendations correspond to selected attributes of the suspected fraudulent activity so that a recommended response to the suspected fraudulent activity is targeted to the type of fraud that is occurring.
Claim 32
Independent Claim
94 words
A system for managing fraud in a telecommunication network, comprising: a call scoring element responsive to call detail records generated within the network for scoring a call to determine the likelihood of fraud; and a case analysis element responsive to scored call detail records and subscriber account information for analyzing a case of suspected fraud and for automatically generating recommendations for responding to the suspected fraud, wherein recommended fraud responses correspond to attributes of the suspected fraud so that management of the suspected fraud is targeted to the type of fraud that is occurring.
Claim 33
Independent Claim
94 words
A system for managing fraud in a telecommunication network, comprising: a call scoring element responsive to call detail records generated within the network for scoring a call to determine the likelihood of fraud; and a case analysis element responsive to scored call detail records and subscriber account information for analyzing a case of suspected fraud and for automatically generating recommendations for responding to the suspected fraud, wherein recommended fraud responses correspond to attributes of the suspected fraud so that management of the suspected fraud is targeted to the type of fraud that is occurring.
Claim 34
Dependent Claim
20 words
The computer-implemented method according to claim 28, wherein the case analysis element includes a programmable rules-based engine for generating recommendations.
Claim 35
Dependent Claim
21 words
The system according to claim 28, further comprising a provisioning function for implementing one or more of the recommended fraud responses.
Claim 36
Dependent Claim
53 words
The system according to claim 30, wherein the one or more recommended fraud responses are selected from the group of responses consisting of blocking the call, disabling one or more call features for a particular account associated with the suspected fraud, and forwarding a next call on the particular account to an attendant.
References Cited (Backward Citations)
US4799255A
Cited
US5375244A
Cited
US5357564A
Cited
US5819226A
Cited
US5345595A
Cited
US5506893A
Cited
EP0618713A2
Cited
US5706338A
Cited
US5602906A
Cited
US5448760A
Cited
US5566234A
Cited
US5504810A
Cited
EP0653868A2
Cited
US5495521A
Cited
EP0661863A2
Cited
US5627886A
Cited
US5768354A
Cited
GB2303275A
Cited
WO1997037486A1
Cited
WO1999005844A1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-12-19 | 2004-06-19 | 2004-12-19 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-12-19 | 2008-06-19 | 2008-12-19 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-12-19 | 2012-06-19 | 2012-12-19 | $7700.00 | Window Closed / Lapsed |