# US 10,373,140 B1 · Method and system for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,373,140 B1
- Document ID: US10373140B1
- Status: Granted
- Kind: B1
- Application number: 14/922,643
- Filed: 2015-10-26
- Granted: 2019-08-06
- Earliest claimed: 2015-10-26
- Assignees: Intuit Inc.
- Applicants: Intuit Inc.
- Inventors: Eva Diane Chang; Michael Brener
- Web page: https://patentgrep.com/patent/US10373140B1

## CPC

- G06Q 20/14: specially adapted for billing systems
- G06F 16/24575: {using context}
- G06F 16/24578: {using ranking}
- G06N 5/04: Inference or reasoning models
- G06N 5/046: Forward inferencing; Production systems
- G06N 20/00: Machine learning
- G06N 20/20: Ensemble learning
- G06Q 20/085: {involving remote charge determination or related payment systems}
- G06Q 20/102: {Bill distribution or payments}
- G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- G06Q 30/04: Billing or invoicing
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

A method and system for detecting fraudulent bill payment service transactions using dynamic multi-parameter predictive modeling provides for detecting fraudulent bill payment transactions more accurately. Therefore, a technical solution to the long standing technical problem of inaccurate fraudulent bill payment transaction detection is provided. In addition, the method and system for detecting fraudulent bill payment service transactions using dynamic multi-parameter predictive modeling is capable of self-learning and dynamically adapting to new data and/or a changing threat environment. Consequently, a technical solution to the long standing technical problem of static and inflexible fraudulent bill payment transaction detection is also provided.

## Claims

### Claim 1

A method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling, the method comprising:
collecting historical bill payment transaction data representing bill payment transactions conducted through a bill payment system;
obtaining historical fraudulent bill payment transactions data representing historical fraudulent bill payment transactions;
processing the obtained historical fraudulent bill payment transactions data using one or more machine learning algorithms and identifying fraudulent bill payment parameters, the fraudulent bill payment parameters including rules evidencing common characteristics associated with individual fraudulent transactions of the historical bill payment transactions data;
generate fraudulent bill payment transaction scoring parameters data representing the identified fraudulent bill payment rules;
using the fraudulent bill payment transaction scoring parameters data to create a fraudulent bill payment transaction scoring engine, the fraudulent bill payment transaction scoring engine assigning a fraudulent bill payment transaction score to current bill payment transaction data representing a current bill payment transaction, the fraudulent bill payment transaction score being based, at least in part, on analysis of one or more interconnected fraudulent bill payment parameters identified in the current bill payment transaction and the fraudulent bill payment transaction scoring parameters data;
defining one or more threshold fraudulent bill payment transaction score values;
generating threshold fraudulent bill payment transaction score value data representing the one or more threshold fraudulent bill payment transaction score values;
receiving current bill payment transaction data representing a current bill payment transaction being requested through the bill payment system by a user of the current bill payment transaction;
before allowing the current bill payment transaction, providing the current bill payment transaction data to the fraudulent bill payment transaction scoring engine for analysis;
determining a fraudulent bill payment transaction score value to be associated with the current bill payment transaction data, based, at least in part, on the analysis of the current bill payment transaction data by the fraudulent bill payment transaction scoring engine; and
based, at least in part, on an analysis of the fraudulent bill payment transaction score value data associated with the current bill payment transaction data and the threshold fraudulent bill payment transaction score value data, taking one of the following actions:
preventing the current bill payment from being completed;
placing a hold on the current bill payment transaction by forwarding the current bill payment transaction data to a bill payment transaction inspection system and not forwarding and/or allowing the current bill payment transaction to the payee until the current bill payment transaction is authorized through the bill payment transaction inspection system; and
allowing the current bill payment transaction to be completed;
updating, on a recurring basis, the historical fraudulent bill payment transactions data and recurringly processing the obtained historical fraudulent bill payment transactions data using one or more machine learning algorithms of a fraudulent activity predictive model and identifying one or more new fraudulent bill payment parameters, the fraudulent bill payment parameters including new rules evidencing common characteristics associated with individual fraudulent transactions of the updated historical bill payment transactions data and generating fraudulent bill payment transaction scoring parameters data representing the identified new fraudulent bill payment rules.

### Claim 2 (depends on 1)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 1 wherein the bill payment system is a bill payment system selected from the group of bill payment systems consisting of:
a computing system implemented bill payment system;
an online bill payment system; and
the MintBills bill payment system.

### Claim 3 (depends on 1)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 1 further comprising repeating:
collecting historical bill payment transaction data representing bill payment transactions conducted through the bill payment system;
identifying historical fraudulent bill payment transactions;
obtaining historical fraudulent bill payment transactions data representing the historical fraudulent bill payment transactions; and
processing the historical fraudulent bill payment transactions data using one or more machine learning algorithms of a fraudulent activity predictive model, on a periodic basis to dynamically update the fraudulent bill payment transaction scoring parameters data on a periodic basis to create a self-learning method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling.

### Claim 4 (depends on 1)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 1 wherein the fraudulent bill payment transaction scoring parameters data is generated based, at least in part, on the values of one or more interconnected fraudulent activity parameter/rule input variables identified in the historical fraudulent bill payment transactions data, at least one of the one or more individual fraudulent activity parameter/rule input variables being selected from the group of individual fraudulent activity parameter/rule input variable types consisting of:
personal data associated with the user of the bill payment system;
account information data associated with the account being utilized;
historical user data representing historical bill payment transactions made through the bill payment system; and
current bill payment transaction details data.

### Claim 5 (depends on 4)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 4 wherein the personal data associated with the user individual fraudulent activity parameter/rule input variable type includes at least one individual fraudulent activity parameter/rule input variable selected form the group of individual fraudulent activity parameter/rule input variables consisting of:
the domain name of an email address associated with the user; and
the zip code of an address associated with the user.

### Claim 6 (depends on 4)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 4 wherein the account information data associated with the account being utilized individual fraudulent activity parameter/rule input variable type includes at least one individual fraudulent activity parameter/rule input variable selected form the group of individual fraudulent activity parameter/rule input variables consisting of:
a creation timestamp indicating when the user's account was created;
a day of week obtained from the creation timestamp;
an hour of day obtained from the creation timestamp;
a day of month obtained from the creation timestamp;
a month obtained from the creation timestamp;
a year obtained from the creation timestamp;
the number of anonymous provider/biller accounts;
the number of anonymous ACH/bank accounts;
the number of anonymous credit cards;
the number of linked provider/biller accounts;
the number of linked ACH/bank accounts; and
the number of linked credit cards.

### Claim 7 (depends on 4)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 4 wherein the historical user data representing historical bill payment transactions made through the bill payment system individual fraudulent activity parameter/rule input variable type includes at least one individual fraudulent activity parameter/rule input variable selected form the group of individual fraudulent activity parameter/rule input variables consisting of:
number of logins to a mobile bill pay system application;
number of distinct IP addresses used when logging into a mobile bill pay system application;
number of logins to the bill pay system;
number of distinct IP addresses used when logging into the bill pay system;
number of logins to a web application associated with the bill pay system;
number of distinct IP addresses used when logging into a web application associated with the bill pay system;
number of logins to other applications;
number of distinct IP addresses used when logging into other applications;
number of payments classified as “good funds with error;”
total amount of payments classified as “good funds with error;”
fees associated with payments classified as “good funds with error;”
number of payments classified as fraud;
total amount of payments classified as fraud;
fees associated with payments classified as fraud;
number of payments resulting in money owed;
total amount of payments resulting in money owed;
fees associated with payments resulting in money owed;
number of payments processed successfully;
total amount of payments processed successfully; and
fees associated with payments processed successfully.

### Claim 8 (depends on 4)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 4 wherein the current bill payment transaction details data individual fraudulent activity parameter/rule input variable type includes at least one individual fraudulent activity parameter/rule input variable selected form the group of individual fraudulent activity parameter/rule input variables consisting of:
whether for the current bill payment transaction, the payment method is anonymous;
whether for the current bill payment transaction, the biller anonymous;
when the current bill payment transaction was created;
the amount of the current bill payment transaction;
the fee associated with the current bill payment transaction;
the category of the biller/payee; and
whether for the current bill payment transaction the payment method is a credit card or bank account.

### Claim 9 (depends on 1)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 1 wherein the fraudulent activity predictive model assigns interrelated weights to the one or more interconnected fraudulent bill payment parameters and/or combinations of the one or more interconnected fraudulent bill payment parameters identified in the historical fraudulent bill payment transactions data to generate fraudulent bill payment transaction scoring parameters data.

### Claim 10 (depends on 1)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 1 wherein the one or more threshold fraudulent bill payment transaction score values include a first threshold fraudulent bill payment transaction score value and a second threshold fraudulent bill payment transaction score value, the first and second threshold fraudulent bill payment transaction score values being defined such that:
if a fraudulent bill payment transaction score value associated with a current bill payment transaction data is greater than the first defined threshold fraudulent bill payment transaction score value, the current bill payment transaction is prevented;
if a fraudulent bill payment transaction score value associated with a current bill payment transaction data is less than the first defined threshold fraudulent bill payment transaction score value and greater than the second threshold fraudulent bill payment transaction score value, the current bill payment transaction is put on hold; and
if a fraudulent bill payment transaction score value associated with a current bill payment transaction data is less than the second defined threshold fraudulent bill payment transaction score value, the current bill payment transaction is allowed.

### Claim 11

A method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling, the method comprising:
collecting historical bill payment transaction data representing bill payment transactions conducted through a bill payment system;
obtaining historical fraudulent bill payment transactions data representing historical fraudulent bill payment transactions;
processing the obtained historical fraudulent bill payment transactions data using one or more machine learning algorithms and identifying fraudulent bill payment parameters, the fraudulent bill payment parameters including rules evidencing common characteristics associated with individual fraudulent transactions of the historical bill payment transactions data;
generate fraudulent bill payment transaction scoring parameters data based, at least in part, on the values of one or more interconnected fraudulent activity parameter/rule input variables identified in the historical fraudulent bill payment transactions data representing the identified fraudulent bill payment rules;
using the fraudulent bill payment transaction scoring parameters data to create a fraudulent bill payment transaction scoring engine, the fraudulent bill payment transaction scoring engine assigning a fraudulent bill payment transaction score to provided current bill payment transaction data representing a current bill payment transaction, the fraudulent bill payment transaction score being based, at least in part, on analysis of one or more interconnected fraudulent bill payment parameters and/or the values of one or more interconnected fraudulent activity parameter/rule input variables identified in the current bill payment transaction and the one or more interconnected fraudulent bill payment parameters and/or the values of one or more interconnected fraudulent activity parameter/rule input variables identified in the historical fraudulent bill payment transactions data;
defining one or more threshold fraudulent bill payment transaction score values;
generating threshold fraudulent bill payment transaction score value data representing the one or more threshold fraudulent bill payment transaction score values;
receiving current bill payment transaction data representing a current bill payment transaction being requested through the bill payment system by a user of the current bill payment transaction;
before allowing the current bill payment transaction, providing the current bill payment transaction data to the fraudulent bill payment transaction scoring engine for analysis;
determining a fraudulent bill payment transaction score value to be associated with the current bill payment transaction data, based, at least in part, on the analysis of the current bill payment transaction data by the fraudulent bill payment transaction scoring engine; and
based, at least in part, on an analysis of the fraudulent bill payment transaction score value data associated with the current bill payment transaction data and the threshold fraudulent bill payment transaction score value data, taking one of the following actions:
not allowing the current bill payment transaction to be completed;
placing a hold on the current bill payment transaction by forwarding the current bill payment transaction data to a bill payment transaction inspection system and not forwarding and/or allowing the current bill payment transaction to the payee until the current bill payment transaction is authorized through the bill payment transaction inspection system; and
allowing the current bill payment transaction be completed;
updating, on a recurring basis, the historical fraudulent bill payment transactions data and recurringly processing the obtained historical fraudulent bill payment transactions data using one or more machine learning algorithms of a fraudulent activity predictive model and identifying one or more new fraudulent bill payment parameters, the fraudulent bill payment parameters including new rules evidencing common characteristics associated with individual fraudulent transactions of the updated historical bill payment transactions data and generating fraudulent bill payment transaction scoring parameters data representing the identified new fraudulent bill payment rules.

### Claim 12 (depends on 11)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 11 wherein the bill payment system is a bill payment system selected from the group of bill payment systems consisting of:
a computing system implemented bill payment system;
an online bill payment system; and
the MintBills bill payment system.

### Claim 13 (depends on 11)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 11 further comprising repeating:
collecting historical bill payment transaction data representing bill payment transactions conducted through the bill payment system;
identifying historical fraudulent bill payment transactions;
obtaining historical fraudulent bill payment transactions data representing the historical fraudulent bill payment transactions; and
processing the historical fraudulent bill payment transactions data using one or more machine learning algorithms of a fraudulent activity predictive model, on a periodic basis to dynamically update the fraudulent bill payment transaction scoring parameters data on a periodic basis to create a self-learning method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling.

### Claim 14 (depends on 11)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 11 wherein at least one of the one or more individual fraudulent activity parameter/rule input variables is selected from the group of individual fraudulent activity parameter/rule input variable types consisting of:
personal data associated with the user of the bill payment system;
account information data associated with the account being utilized;
historical user data representing historical bill payment transactions made through the bill payment system; and
current bill payment transaction details data.

### Claim 15 (depends on 14)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 14 wherein the personal data associated with the user individual fraudulent activity parameter/rule input variable type includes at least one individual fraudulent activity parameter/rule input variable selected form the group of individual fraudulent activity parameter/rule input variables consisting of:
the domain name of an email address associated with the user; and
the zip code of an address associated with the user.

### Claim 16 (depends on 14)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 14 wherein the account information data associated with the account being utilized individual fraudulent activity parameter/rule input variable type includes at least one individual fraudulent activity parameter/rule input variable selected form the group of individual fraudulent activity parameter/rule input variables consisting of:
a creation timestamp indicating when the user's account was created;
a day of week obtained from the creation timestamp;
an hour of day obtained from the creation timestamp;
a day of month obtained from the creation timestamp;
a month obtained from the creation timestamp;
a year obtained from the creation timestamp;
the number of anonymous provider/biller accounts;
the number of anonymous ACH/bank accounts;
the number of anonymous credit cards;
the number of linked provider/biller accounts;
the number of linked ACH/bank accounts; and
the number of linked credit cards.

### Claim 17 (depends on 14)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 14 wherein the historical user data representing historical bill payment transactions made through the bill payment system individual fraudulent activity parameter/rule input variable type includes at least one individual fraudulent activity parameter/rule input variable selected form the group of individual fraudulent activity parameter/rule input variables consisting of:
number of logins to a mobile bill pay system application;
number of distinct IP addresses used when logging into a mobile bill pay system application;
number of logins to the bill pay system;
number of distinct IP addresses used when logging into the bill pay system;
number of logins to a web application associated with the bill pay system;
number of distinct IP addresses used when logging into a web application associated with the bill pay system;
number of logins to other applications;
number of distinct IP addresses used when logging into other applications;
number of payments classified as “good funds with error;”
total amount of payments classified as “good funds with error;”
fees associated with payments classified as “good funds with error;”
number of payments classified as fraud;
total amount of payments classified as fraud;
fees associated with payments classified as fraud;
number of payments resulting in money owed;
total amount of payments resulting in money owed;
fees associated with payments resulting in money owed;
number of payments processed successfully;
total amount of payments processed successfully; and
fees associated with payments processed successfully.

### Claim 18 (depends on 14)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 14 wherein the current bill payment transaction details data individual fraudulent activity parameter/rule input variable type includes at least one individual fraudulent activity parameter/rule input variable selected form the group of individual fraudulent activity parameter/rule input variables consisting of:
whether for the current bill payment transaction, the payment method is anonymous;
whether for the current bill payment transaction, the biller anonymous;
when the current bill payment transaction was created;
the amount of the current bill payment transaction;
the fee associated with the current bill payment transaction;
the category of the biller/payee; and
whether for the current bill payment transaction the payment method is a credit card or bank account.

### Claim 19 (depends on 11)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 11 wherein the fraudulent activity ensemble method model assigns interrelated weights to the one or more interconnected fraudulent bill payment parameters and/or combinations of the one or more interconnected fraudulent bill payment parameters identified in the historical fraudulent bill payment transactions data to generate fraudulent bill payment transaction scoring parameters data.

### Claim 20 (depends on 11)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 11 wherein the one or more threshold fraudulent bill payment transaction score values include a first threshold fraudulent bill payment transaction score value and a second threshold fraudulent bill payment transaction score value, the first and second threshold fraudulent bill payment transaction score values being defined such that:
if a fraudulent bill payment transaction score value associated with a current bill payment transaction data is greater than the first defined threshold fraudulent bill payment transaction score value, the current bill payment transaction is prevented;
if a fraudulent bill payment transaction score value associated with a current bill payment transaction data is less than the first defined threshold fraudulent bill payment transaction score value and greater than the second threshold fraudulent bill payment transaction score value, the current bill payment transaction is put on hold; and
if a fraudulent bill payment transaction score value associated with a current bill payment transaction data is less than the second defined threshold fraudulent bill payment transaction score value, the current bill payment transaction is allowed.

### Claim 21

A method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling comprising:
providing a bill payment system using one or more computing systems;
obtaining historic bill payment transaction data;
identifying historical fraudulent bill payment transaction data in the historical bill payment transactions data;
processing the historical fraudulent bill payment transactions data using one or more processors and one or more machine learning algorithms of an ensemble method model and/or a regression and classification fraudulent activity model;
generating fraudulent bill payment transaction scoring parameters data based on the analysis of the historical fraudulent bill payment transactions data using the one or more processors and one or more machine learning algorithms of the ensemble method model and/or a regression and classification fraudulent activity model and identifying fraudulent bill payment parameters, the fraudulent bill payment parameters including rules evidencing common characteristics associated with individual fraudulent transactions of the historical bill payment transactions data;
creating a fraudulent bill payment transaction scoring engine using the fraudulent bill payment transaction scoring parameters data;
generating threshold fraudulent bill payment transaction score value data representing one or more defined threshold fraudulent bill payment transaction score values;
receiving current bill payment transaction data representing a current bill payment transaction being requested through the bill payment system by a user of the current bill payment transaction;
before allowing the current bill payment transaction to be conducted, providing the current bill payment transaction data to the fraudulent bill payment transaction scoring engine for analysis;
based, at least in part, on the analysis of the current bill payment transaction data by the fraudulent bill payment transaction scoring engine determining and assigning fraudulent bill payment transaction score value data to the current bill payment transaction data; and
based, at least in part, on an analysis of the fraudulent bill payment transaction score value data associated with the current bill payment transaction data and the threshold fraudulent bill payment transaction score value data, taking one of the following actions:
preventing the current bill payment transaction represented by the current bill payment transaction data from being completed;
placing a hold on the current bill payment transaction represented by the current bill payment transaction data; and
allowing the current bill payment transaction represented by the current bill payment transaction data to be completed;
updating, on a recurring basis, the historical fraudulent bill payment transactions data and recurringly processing the obtained historical fraudulent bill payment transactions data using one or more machine learning algorithms of a fraudulent activity predictive model and identifying one or more new fraudulent bill payment parameters, the fraudulent bill payment parameters including new rules evidencing common characteristics associated with individual fraudulent transactions of the updated historical bill payment transactions data and generating fraudulent bill payment transaction scoring parameters data representing the identified new fraudulent bill payment rules.

### Claim 22 (depends on 21)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 21 wherein the bill payment system is a bill payment system selected from the group of bill payment systems consisting of:
a computing system implemented bill payment system;
an online bill payment system; and
the MintBills bill payment system.

### Claim 23 (depends on 21)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 21 further comprising repeating:
obtaining historic bill payment transaction data;
identifying historical fraudulent bill payment transaction data in the historical bill payment transactions data;
processing the historical fraudulent bill payment transactions data using one or more processors and one or more machine learning algorithms of an ensemble method model and/or a regression and classification fraudulent activity model; and
generating fraudulent bill payment transaction scoring parameters data based on the analysis of the historical fraudulent bill payment transactions data using the one or more processors and one or more machine learning algorithms of the ensemble method model and/or a regression and classification fraudulent activity model on a periodic basis to dynamically update the fraudulent bill payment transaction scoring parameters data on a periodic basis to create a self-learning method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling.

### Claim 24 (depends on 21)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 21 wherein at least one of the one or more individual fraudulent activity parameter/rule input variables is selected from the group of individual fraudulent activity parameter/rule input variable types consisting of:
personal data associated with the user of the bill payment system;
account information data associated with the account being utilized;
historical user data representing historical bill payment transactions made through the bill payment system; and
current bill payment transaction details data.

### Claim 25 (depends on 24)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 24 wherein the personal data associated with the user individual fraudulent activity parameter/rule input variable type includes at least one individual fraudulent activity parameter/rule input variable selected form the group of individual fraudulent activity parameter/rule input variables consisting of:
the domain name of an email address associated with the user; and
the zip code of an address associated with the user.

### Claim 26 (depends on 24)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 24 wherein the account information data associated with the account being utilized individual fraudulent activity parameter/rule input variable type includes at least one individual fraudulent activity parameter/rule input variable selected form the group of individual fraudulent activity parameter/rule input variables consisting of:
a creation timestamp indicating when the user's account was created;
a day of week obtained from the creation timestamp;
an hour of day obtained from the creation timestamp;
a day of month obtained from the creation timestamp;
a month obtained from the creation timestamp;
a year obtained from the creation timestamp;
the number of anonymous provider/biller accounts;
the number of anonymous ACH/bank accounts;
the number of anonymous credit cards;
the number of linked provider/biller accounts;
the number of linked ACH/bank accounts; and
the number of linked credit cards.

### Claim 27 (depends on 24)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 24 wherein the historical user data representing historical bill payment transactions made through the bill payment system individual fraudulent activity parameter/rule input variable type includes at least one individual fraudulent activity parameter/rule input variable selected form the group of individual fraudulent activity parameter/rule input variables consisting of:
number of logins to a mobile bill pay system application;
number of distinct IP addresses used when logging into a mobile bill pay system application;
number of logins to the bill pay system;
number of distinct IP addresses used when logging into the bill pay system;
number of logins to a web application associated with the bill pay system;
number of distinct IP addresses used when logging into a web application associated with the bill pay system;
number of logins to other applications;
number of distinct IP addresses used when logging into other applications;
number of payments classified as “good funds with error;”
total amount of payments classified as “good funds with error;”
fees associated with payments classified as “good funds with error;”
number of payments classified as fraud;
total amount of payments classified as fraud;
fees associated with payments classified as fraud;
number of payments resulting in money owed;
total amount of payments resulting in money owed;
fees associated with payments resulting in money owed;
number of payments processed successfully;
total amount of payments processed successfully; and
fees associated with payments processed successfully.

### Claim 28 (depends on 24)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 24 wherein the current bill payment transaction details data individual fraudulent activity parameter/rule input variable type includes at least one individual fraudulent activity parameter/rule input variable selected form the group of individual fraudulent activity parameter/rule input variables consisting of:
whether for the current bill payment transaction, the payment method is anonymous;
whether for the current bill payment transaction, the biller anonymous;
when the current bill payment transaction was created;
the amount of the current bill payment transaction;
the fee associated with the current bill payment transaction;
the category of the biller/payee; and
whether for the current bill payment transaction the payment method is a credit card or bank account.

### Claim 29 (depends on 21)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 21 wherein the ensemble method model and/or a regression and classification fraudulent activity model assigns interrelated weights to the one or more interconnected fraudulent bill payment parameters and/or combinations of the one or more interconnected fraudulent bill payment parameters identified in the historical fraudulent bill payment transactions data to generate fraudulent bill payment transaction scoring parameters data.

### Claim 30 (depends on 21)

The method for detecting fraudulent bill payment transactions using dynamic multi-parameter predictive modeling of claim 21 wherein the one or more threshold fraudulent bill payment transaction score values include a first threshold fraudulent bill payment transaction score value and a second threshold fraudulent bill payment transaction score value, the first and second threshold fraudulent bill payment transaction score values being defined such that:
if a fraudulent bill payment transaction score value associated with a current bill payment transaction data is greater than the first defined threshold fraudulent bill payment transaction score value, the current bill payment transaction is prevented;
if the a fraudulent bill payment transaction score value associated with a current bill payment transaction data is less than the first defined threshold fraudulent bill payment transaction score value and greater than the second threshold fraudulent bill payment transaction score value, the current bill payment transaction is put on hold; and
if the a fraudulent bill payment transaction score value associated with a current bill payment transaction data is less than the second defined threshold fraudulent bill payment transaction score value, the current bill payment transaction is allowed.