Systems and methods for identifying suspect illicit merchants

A computer-implemented method for identifying illicit websites and merchants using an illicit activity monitoring (IAM) computer system including a payment processing network server and an illicit website identifying (IWI) computing device including a processor in communication with a memory, said method comprising:

• storing, at the payment processing network server, a plurality of merchant codes, wherein the payment processing network server is configured to process payment card transactions over a payment processing network using a set of proprietary communication standards for the exchange of financial transaction data and the settlement of funds between financial institutions that are members of the payment processing network and wherein each merchant code associated with a corresponding one of a plurality of merchants registered to submit transactions to the payment processing network via one of the member financial institutions;
• receiving, at the payment processing network server, a plurality of authorization request messages including payment transaction data for a payment transaction, the payment transaction data including one of the merchant codes;
• storing, by the payment processing network server, the payment transaction data in a transaction history database;
• providing, by the IWI computing device, keywords associated with an illicit product to a web-crawler;
• receiving, by the IWI computing device, suspect website data from the web-crawler;
• storing, at the memory by the IWI computing device, a log of suspect illicit websites identified from the suspect website data, the log including respective website content associated with each suspect illicit website, wherein each suspect illicit website is associated with a respective merchant;
• storing, at the memory by the IWI computing device, one or more rules for confirming the suspect illicit websites as illicit based on the payment transaction data, the one or more rules including at least one of a match of a merchant country code in the payment transaction data with a high-risk country code and a threshold deviation of a payment amount in the payment transaction data from an expected price;
• matching, by the IWI computing device, at least one payment transaction from the transaction history database to a first suspect illicit website of the log of suspect illicit websites by identifying at least a portion of the website content associated with the first suspect illicit website in at least one data field of the least one payment transaction;
• confirming, by the IWI computing device applying the one or more rules to the matched at least one payment transaction, the first suspect illicit website as illicit;
• identifying, by the IWI computing device, the merchant associated with the matched at least one payment transaction by matching the merchant code in the matched at least one payment transaction against the plurality of merchant codes stored by the payment processing network;
• and
• generating, by the IWI computing device, an identification report including the identified illicit website and the identified merchant.

At least one non-transitory computer-readable storage media having (i) a first set of computer-executable instructions embodied thereon for execution by a payment processing network server configured to process payment card transactions over a payment processing network using a set of proprietary communication standards for the exchange of financial transaction data and the settlement of funds between financial institutions that are members of the payment processing network, and (ii) a second set of computer-executable instructions embodied thereon for execution by an illicit website identifying (IWI) computing device, the IWI computing device including at least one processor in communication with a memory, wherein the first set of computer-executable instructions cause the payment processing network server to:

• store a plurality of merchant codes, each merchant code associated with a corresponding one of a plurality of merchants registered to submit transactions to the payment processing network via one of the member financial institutions;
• receive a plurality of authorization request messages, each authorization request message including payment transaction data for a payment transaction, the payment transaction data including one of the merchant codes;
• store the payment transaction data in a transaction history database;
• and wherein the second set of computer-executable instructions, when executed by the IWI computing device, cause the IWI computing device to:
• provide keywords associated with an illicit product to a web-crawler;
• receive suspect website data from the web-crawler;
• store, at the memory, a log of suspect illicit websites identified from the suspect website data, the log including respective website content associated with each suspect illicit website, wherein each suspect illicit website is associated with a respective merchant;
• store, at the memory, one or more rules for confirming the suspect illicit websites as illicit based on the payment transaction data, the one or more rules including at least one of a match of a merchant country code in the payment transaction data with a high-risk country code and a threshold deviation of a payment amount in the payment transaction data from an expected price;
• match at least one payment transaction from the transaction history database to a first suspect illicit website of the log of suspect illicit websites by identifying at least a portion of the website content associated with the first suspect illicit website in at least one data field of the at least one payment transaction;
• confirm, by applying the one or more rules to the matched at least one payment transaction, the first suspect illicit website as illicit;
• identify the merchant associated with the matched at least one payment transaction by matching the merchant code in the matched at least one payment transaction against the plurality of merchant codes stored by the payment processing network;
• and
• generate an identification report including the identified illicit website and the identified merchant.