# US 12,114,158 B2 · System for determining network membership

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,114,158 B2
- Document ID: US12114158B2
- Status: Granted
- Kind: B2
- Application number: 17/392,748
- Filed: 2021-08-03
- Published: 2023-02-09
- Granted: 2024-10-08
- Earliest claimed: 2021-08-03
- Assignees: Capital One Services, LLC
- Applicants: Capital One Services, LLC
- Inventors: Aditya Pai; Brice Elder; Sarah Olsen
- Web page: https://patentgrep.com/patent/US12114158B2

## CPC

- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- H04W 12/08: Access security
- G06Q 20/322: {Aspects of commerce using mobile devices [M-devices]}
- G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- H04W 12/12: Detection or prevention of fraud
- H04W 12/61: Time-dependent
- H04W 12/63: Location-dependent; Proximity-dependent
- H04W 12/66: {Trust-dependent, e.g. using trust scores or trust relationships}
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Aspects described herein may allow for determining network membership to facilitate detecting fraudulent messages. A computing device may receive, from one or more terminals at a first location, a plurality of interactive messages during a pre-determined time period. Each interactive message may comprise personally identifiable information of a user. The computing device may store a first record and a second record that indicate interactive messages were received from a group of users in temporal proximity to each other at the first location and the second location respectively. The computing device may send a request to confirm users in the subset are members of a network and update a membership list based on a reply received from the user. If further messages are received from devices outside the membership list, an alert may be sent to alert the possibility of a fraudulent message.

## Claims

### Claim 1

A method comprising:
receiving, by a computing device and from one or more terminals at a first location, a plurality of interactive messages during a pre-determined time period, wherein each interactive message comprises personally identifiable information of a user;
determining, by the computing device and based on the plurality of interactive messages, a plurality of users associated with the plurality of interactive messages;
storing, by the computing device, a first record that indicates interactive messages were received from the plurality of users in temporal proximity to each other at the first location;
determining, by the computing device, a second record that indicates interactive messages were received from a subset of the plurality of users in temporal proximity to each other at a second location;
assigning, to each of the first record and the second record, a respective weight;
sending, by the computing device, to at least one user in the subset, and based on the weight assigned to the first record being lower than the weight assigned to the second record, a request to confirm users in the subset are members of a network;
receiving a reply to the request, wherein the reply confirms that the users in the subset are members of the network;
adding, by the computing device and to a membership list, the subset;
receiving a second request to authenticate an interaction between a first user and a second user;
determining, by the computing device and based on the membership list, that both the first user and the second user are members of the network; and
approving, based on the determining that both the first user and the second user are members of the network, the second request.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
storing a location list that comprises a plurality of locations, wherein the location list comprises the first location but not the second location, and
wherein the assigning the respective weight is based on the location list.

### Claim 3 (depends on 2)

The method of claim 2, further comprising:
determining, based on a number of interactive messages, that were received at each location of the plurality of locations during a second predetermined time period, reaching a threshold, the location list.

### Claim 4 (depends on 1)

The method of claim 1, wherein the first location and the second location are the same location.

### Claim 5 (depends on 1)

The method of claim 1, wherein the first record comprises:
a plurality of user groups, wherein each user group comprises two users of the plurality of users; and
an indication, for each of the plurality of user groups, that indicates interactive messages were received from the two users in the user group in close temporal proximity to each other at the first location.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
receiving a second request to authenticate an interaction between a first user and a second user;
determining, by the computing device and based on the list, that the first user is a member of the network and the second user is not one of the members of the network; and
sending, to the first user and based on the determining, an alert.

### Claim 7 (depends on 1)

A method of claim 1, further comprising:
receiving, from a mobile device associated with a member of the network, a second request of a content item; and
sending, to one or more of the other members of the network, the content item.

### Claim 8

A device comprising:
one or more processors; and
memory configured to store computer instructions that, when executed by the one or more processors, cause the device to perform actions comprising:
receiving, from one or more terminals at a first location, a plurality of interactive messages during a predetermined time period, wherein each interactive message comprises personally identifiable information of a user;
determining, based on the plurality of interactive messages, a plurality of users associated with the plurality of interactive messages;
storing a first record that indicates interactive messages were received from the plurality of users in close temporal proximity to each other at the first location;
determining a second record that indicates interactive messages were received from a subset of the plurality of users in close temporal proximity to each other at a second location;
assigning, to each of the first record and the second record, a respective weight;
sending, to at least one user in the subset and based on the weight assigned to the first record being lower than the weight assigned to the second record, a request to confirm users in the subset are members of a network;
receiving a reply to the request, wherein the reply confirms that users in the subset are members of the network;
maintaining a list of members of the network;
adding, based on the reply and to the list, the subset;
receiving a second request to authenticate an interaction between a first user and a second user;
determining, based on the list, that both the first user and the second user are members of the network; and
approving, based on the determining that both the first user and the second user are members of the network, the second request.

### Claim 9 (depends on 8)

The device of claim 8, wherein the computer instructions are further configured to cause the device to perform actions comprising:
storing a location list that comprises a plurality of locations, wherein the location list comprises the first location but not the second location, and
wherein the assigning the respective weight is based on the location list.

### Claim 10 (depends on 9)

The device of claim 9, wherein the computer instructions are configured to cause the device to determine, based on a number of interactive messages, that were received at each location of the plurality of locations during a second predetermined time period, reaching a threshold, the location list.

### Claim 11 (depends on 8)

The device of claim 8, wherein the computer instructions are further configured to cause the device to perform actions comprising:
receiving, from a mobile device associated with a member of the network, a second request of a content item; and
sending, to one or more of the other members of the network, the content item.

### Claim 12

A non-transitory computer readable medium storing computer instruction that, when executed by one or more processors, cause performance of actions comprising:
receiving, from one or more terminals at a first location, a plurality of interactive messages during a predetermined time period, wherein each interactive message comprises personally identifiable information of a user;
determining, based on the plurality of interactive messages, a plurality of users associated with the plurality of interactive messages;
storing a first record that indicates interactive messages were received from the plurality of users in close temporal proximity to each other at the first location;
determining a second record that indicates interactive messages were received from a subset of the plurality of users in close temporal proximity to each other at a second location;
assigning, to each of the first record and the second record, a respective weight;
sending, to at least one user in the subset and based on the weight assigned to the first record being lower than the weight assigned to the second record, a first message to confirm users in the subset are members of a network;
receiving a reply to the first message, wherein the reply confirms that users in the subset are members of the network;
receiving, from a mobile device associated with a member of the network, a request of a content item;
sending, to one or more of the other members of the network, the content item;
adding, to a membership list, the subset;
receiving a second request to authenticate an interaction between a first user and a second user;
determining, based on the membership list, that both the first user and the second user are members of the network; and
approving, based on the determining that both the first user and the second user are members of the network, the second request.

### Claim 13 (depends on 12)

The non-transitory computer readable medium of claim 12, wherein the computer instructions are further configured to cause performance of actions comprising:
storing a location list that comprises a plurality of locations, wherein the location list comprises the first location but not the second location, and
wherein the assigning the respective weight is based on the location list.

### Claim 14 (depends on 13)

The non-transitory computer readable medium of claim 13, wherein the computer instructions are configured to determine, based on a number of interactive messages, that were received at each location of the plurality of locations during a second predetermined time period, reaching a threshold, the location list.

### Claim 15 (depends on 8)

The device of claim 8, wherein the first record comprises:
a plurality of user groups, wherein each user group comprises two users of the plurality of users; and
an indication, for each of the plurality of user groups, that indicates interactive messages were received from the two users in the user group in close temporal proximity to each other at the first location.

### Claim 16 (depends on 8)

The device of claim 8, wherein the computer instructions, when executed by the one or more processors, further configured to cause the device to perform actions comprising:
receiving a second request to authenticate an interaction between a first user and a second user;
determining, by the device and based on the list, that the first user is a member of the network and the second user is not one of the members of the network; and
sending, to the first user and based on the determining, an alert.

### Claim 17 (depends on 12)

The non-transitory computer readable medium of claim 12, wherein the first record comprises:
a plurality of user groups, wherein each user group comprises two users of the plurality of users; and
an indication, for each of the plurality of user groups, that indicates interactive messages were received from the two users in the user group in close temporal proximity to each other at the first location.

### Claim 18 (depends on 12)

The non-transitory computer readable medium of claim 12, wherein the computer instructions are further configured to cause performance of actions comprising:
receiving a second request to authenticate an interaction between a first user and a second user;
determining, by the device and based on the list, that the first user is a member of the network and the second user is not one of the members of the network; and
sending, to the first user and based on the determining, an alert.

### Claim 19 (depends on 1)

The method of claim 1, wherein the sending the request to confirm users in the subset are the members of the network is further based on the first record and the second record each associated with a respective time within a predetermined time range.

### Claim 20 (depends on 8)

The device of claim 8, wherein the computer instructions, when executed by the one or more processors, configured to cause the device to send the request to confirm users in the subset are the members of the network by causing the device to send the request further based on the first record and the second record each associated with a respective time within a predetermined time range.