# US 10,769,290 B2 · Systems and methods for fraud detection via interactive link analysis

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,769,290 B2
- Document ID: US10769290B2
- Status: Granted
- Kind: B2
- Application number: 12/175,858
- Filed: 2008-07-18
- Published: 2009-02-12
- Granted: 2020-09-08
- Earliest claimed: 2007-05-11
- Assignees: Fair Isaac Corporation
- Applicants: Stuart L. Crawford; Chris Erickson; Victor Miagkikh; Michael Steele; Megan Thorsen; Sergei Tolmanov
- Inventors: Stuart L. Crawford; Chris Erickson; Victor Miagkikh; Michael Steele; Megan Thorsen; Sergei Tolmanov
- Web page: https://patentgrep.com/patent/US10769290B2

## CPC

- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06Q 10/10: Office automation; Time management
- G06Q 30/06: Buying, selling or leasing transactions
- G06Q 30/0643: {graphically representing goods, e.g. 3D product representation}
- G06Q 40/02: Banking, e.g. interest calculation or account maintenance (credit or loans G06Q40/03)
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06Q 30/0601: Electronic shopping [e-shopping]
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Fraud detection is facilitated by developing account cluster membership rules and converting them to database queries via an examination of clusters of linked accounts abstracted from the customer database. The cluster membership rules are based upon certain observed data patterns associated with potentially fraudulent activity. In one embodiment, account clusters are grouped around behavior patterns exhibited by imposters. The system then identifies those clusters exhibiting a high probability of fraud and builds cluster membership rules for identifying subsequent accounts that match those rules. The rules are designed to define the parameters of the identified clusters. When the rules are deployed in a transaction blocking system, when a rule pertaining to an identified fraudulent cluster is triggered, the transaction blocking system blocks the transaction with respect to new users who enter the website.

## Claims

### Claim 1

A system for detecting fraud by displaying visual representations of data relating to entities-of-interest that are indicative of fraud, the system comprising:
a first database that stores at least one attribute of a plurality of the entities-of-interest;
a second database, remote from the first database, that stores at least one attribute of the plurality of the entities-of-interest;
a pattern match generator that generates pattern matching rules;
a pattern matcher that receives the pattern matching rules and applies the pattern matching rules to recognize links between at least one attribute of two or more of the entities-of-interest according to one or more of the pattern matching rules, where the pattern matching rules are generated using the pattern match generator;
a layer builder that, based on the links recognized by the pattern matcher, creates an internal data structure that represents relationships between the two or more of the entities-of-interest in terms of types of links between the two or more of the entities-of-interest, number of links between the two or more of the entities-of-interest, and numerical strength of links between the two or more of the entities-of-interest;
a cluster explainer that derives rules that define requirements for the two or more of the entities-of-interest to be included in a cluster and categorize the two or more of the entities-of-interest that satisfy the defined requirements as potentially fraudulent entities, wherein the derived rules are applied to one or more first database-related transactions in real time and to one or more second database-related transactions in real-time to detect credit history transactions categorized as potentially fraudulent; and
an interface for displaying a visual representation of the relationships between the two or more of the entities-of-interest, as expressed by the layer builder, to a user, and
an editor for receiving an input from the user that indicates a user-generated requirement to modify the defined requirements to be included in the cluster and categorized as potentially fraudulent entities;
where displaying the visual representation comprises:
displaying in one of a plurality of locations of the interface different types of links between the two or more of the entities-of-interest as different colors, and displaying in another of the plurality of locations of the interface the numerical strength of links between the two or more of the entities-of-interest as lines of different thickness between the two or more of the entities-of-interest.

### Claim 2 (depends on 1)

The system of claim 1, wherein the editor is configured to query the first database to determine if additional entities-of-interest satisfy modified requirements to be included in the cluster and categorized as a potentially fraudulent entity.

### Claim 3 (depends on 2)

The system of claim 2, wherein the pattern matcher creates a dataset comprising a list of the two or more of the entities-of-interest and the links by which they are connected; and
the dataset is loaded into the layer builder.

### Claim 4 (depends on 3)

The system of claim 3, further comprising:
a pattern editor that creates new pattern matching rules based on additional requirements input by the user.

### Claim 5 (depends on 1)

The system of claim 1, wherein the at least one attribute includes a credit history of an individual.

### Claim 6 (depends on 1)

The system of claim 1, wherein the at least one attribute includes insurance claims.

### Claim 7 (depends on 1)

The system of claim 1, wherein the at least one attribute includes debit card transactions.

### Claim 8

A fraud detection method, the method comprising:
searching a first database that stores at least one attribute of a plurality of entities-of-interest;
searching a second database that stores at least one attribute of the plurality of entities-of-interest;
generating pattern matching rules;
applying the generated pattern matching rules to recognize links between at least one attribute of two or more of the entities-of-interest according to one or more of the pattern matching rules;
expressing relationships in terms of types of links between the two or more of the entities-of-interest, number of links between the two or more of the entities-of-interest, and numerical strength of links between by the two or more of the entities-of-interest;
electronically displaying the relationship between the two or more of the entities-of-interest, to a user;
deriving rules that define requirements for the two or more of the entities-of-interest to be included in a cluster and categorize the two or more of the entities-of-interest that satisfy the defined requirements as potentially fraudulent entities, wherein the derived rules are applied to one or more first database-related transactions in real time and to one or more second database-related transactions in real-time to detect credit history transactions categorized as potentially fraudulent; and
receiving input from the user to modify the defined requirements to be included in the cluster and categorized as potentially fraudulent entities; and
electronically displaying different types of links between the two or more of the entities-of-interest as different colors, and displaying the numerical strength of links between the two or more of the entities of interest as lines of different thickness between the two or more of the entities-of-interest.

### Claim 9 (depends on 8)

The method of claim 8, further comprising:
querying the first database to determine if additional entities satisfy the modified requirements to be included in the cluster and categorized as a potentially fraudulent entity.

### Claim 10 (depends on 9)

The method of claim 9, further comprising:
creating a dataset comprising a list of the two or more of the entities-of-interest and the links by which they are connected; and
loading the dataset.

### Claim 11 (depends on 10)

The method of claim 10, further comprising:
creating new pattern matching rules based on additional requirements input by the user.

### Claim 12 (depends on 8)

The method of claim 8, wherein the at least one attribute includes a credit history of an individual comprising an entity of interest.

### Claim 13 (depends on 8)

The method of claim 8, wherein the at least one attribute includes insurance claims.

### Claim 14 (depends on 8)

The method of claim 8, wherein the at least one attribute includes debit card transactions.