# US 12,223,516 B2 · Multi-page online application origination (OAO) service for fraud prevention systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,223,516 B2 - Document ID: US12223516B2 - Status: Granted - Kind: B2 - Application number: 16/804,725 - Filed: 2020-02-28 - Published: 2020-09-03 - Granted: 2025-02-11 - Earliest claimed: 2019-03-01 - Assignees: Mastercard Technologies Canada Ulc - Applicants: Mastercard Technologies Canada ULC - Inventors: John Hearty; Anton Laptiev; Hanhan Wu; Carrie Ka Lai Cheung; Igor Opushnyev; Sik Suen Chan; Parin Prashant Shah - Web page: https://patentgrep.com/patent/US12223516B2 ## CPC - G06Q 30/0185: {Product, service or business identity fraud} - G06F 11/302: {where the computing system component is a software system} - G06F 11/3438: {monitoring of user actions (tracking the activity of the user H04L67/535)} - G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour} - G06F 21/554: {involving event detection and direct action} - G06Q 10/10: Office automation; Time management - G06Q 20/027: {involving a payment switch or gateway} - G06Q 20/40145: {Biometric identity checks} - G06Q 20/4016: {involving fraud or risk level assessment in transaction processing} - G06Q 20/4093: {Monitoring of device authentication} - G06Q 20/4097: {using mutual authentication between devices and transaction partners} - G06Q 40/03: Credit; Loans; Processing thereof - G06Q 50/265: {Personal security, identity or safety} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L 67/306: User profiles - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A fraud prevention system that includes a fraud prevention server including an electronic processor and a memory. The memory includes an online application origination (OAO) service. When executing the OAO service, the electronic processor is configured to determine whether the OAO service is enabled and whether a website configuration includes a list of multi-page placements for an online application, determine that input data needs to be stored in the memory and combined into multi-page input data, determine a fraud risk score of the online application based on the multi-page input data and an online application origination (OAO) model that differentiates between a behavior of a normal user and a behavior of a nefarious actor during a submission of the online application on a device, and control a client server to approve, hold, or deny the online application based on the fraud risk score that is determined. ## Claims ### Claim 1 A fraud prevention system for determining a fraudulent actor, the system comprising: a fraud prevention server including an electronic processor and a memory, the memory including an online application origination (OAO) service, wherein the OAO service is instructions that, when executed by the electronic processor, causes the electronic processor to perform a set of operations including determining whether a first website configuration of a first online application has a multi-webpage flow; responsive to determining that the first website configuration of the first online application does not have the multi-webpage flow, the set of operations further includes calculating first input data on a single webpage of the first online application; storing the first input data in the memory; determining a first fraud risk score of the first online application based on the first input data and a first online application origination (OAO) model differentiating between a behavior of a first normal user and a behavior of a first actor during a submission of the first online application on a first device; determining whether a second website configuration of a second online application has the multi-webpage flow; responsive to determining that the second website configuration of the second online application has the multi-webpage flow, the set of operations further includes calculating second input data on each webpage of a plurality of webpages of the second online application; storing the second input data in the memory; combining all of the second input data associated with a single session of the multi-webpage flow into multi-webpage input data; storing the multi-webpage input data in the memory; determining a second fraud risk score of the second online application based on the multi-webpage input data and a second online application origination (OAO) model differentiating between a behavior of a second normal user and a behavior of a second actor during a submission of the second online application on a second device; and generating an approval signal, a hold signal, or a denial signal for the first online application or the second online application, based on the first fraud risk score or the second fraud risk score, respectively; and transmitting the approval signal, the hold signal, or the denial signal for the first online application or the second online application to a client server. ### Claim 2 (depends on 1) The fraud prevention system of claim 1, wherein the second OAO model includes a feature set with mouse movement behavioral features, and wherein the mouse movement behavioral features include a standard deviation of a mouse click in an X direction feature. ### Claim 3 (depends on 1) The fraud prevention system of claim 1, wherein the second OAO model includes a feature set with navigation behavioral features, and wherein the navigation behavioral features further include a time from last key to submission feature. ### Claim 4 (depends on 1) The fraud prevention system of claim 1, wherein the second OAO model includes a feature set with navigation behavioral features, and wherein the navigation behavioral features further include a coefficient of variation of keystroke rate across all fields in a form of the second online application. ### Claim 5 (depends on 1) The fraud prevention system of claim 1, wherein the second OAO model includes a feature set with mouse movement behavioral features, and wherein the mouse movement behavioral features further include a standard deviation of a mouse click in a Y direction feature. ### Claim 6 (depends on 1) The fraud prevention system of claim 1, wherein the second OAO model includes a feature set with navigation behavioral features, and wherein the navigation behavioral features further include an average number of mouse clicks per field of a form feature. ### Claim 7 (depends on 1) The fraud prevention system of claim 1, wherein the second OAO model includes a feature set with navigation behavioral features, and wherein the navigation behavioral features further include an amount of time on page feature. ### Claim 8 (depends on 1) The fraud prevention system of claim 1, wherein the second OAO model includes a feature set with mouse movement behavioral features, and wherein the mouse movement behavioral features further include a total mouse distance feature. ### Claim 9 (depends on 1) The fraud prevention system of claim 1, wherein the second OAO model includes a feature set with navigation behavioral features, and wherein the navigation behavioral features further include a ratio of time spent in fields of a form to an overall time on page feature. ### Claim 10 (depends on 1) The fraud prevention system of claim 1, wherein the second OAO model includes a feature set with navigation behavioral features, and wherein the navigation behavioral features further include an average keystroke rate standard deviation feature. ### Claim 11 (depends on 1) The fraud prevention system of claim 1, wherein the second OAO model includes a feature set with navigation behavioral features, and wherein the navigation behavioral features further include an average of time between focus and first keystroke feature. ### Claim 12 (depends on 1) The fraud prevention system of claim 1, wherein the second OAO model includes a feature set with navigation behavioral features, and wherein the navigation behavioral features further include a total mouse click count feature. ### Claim 13 (depends on 1) The fraud prevention system of claim 1, wherein the second OAO model includes a feature set with non-behavioral features. ### Claim 14 (depends on 13) The fraud prevention system of claim 13, wherein the non-behavioral features further include a proxy concealed detection feature. ### Claim 15 (depends on 1) The fraud prevention system of claim 1, wherein transmitting the approval signal, the hold signal, or the denial signal for the first online application or the second online application to the client server further includes transmitting a control message to the client server, the control message controlling the client server. ### Claim 16 (depends on 1) The fraud prevention system of claim 1, wherein the set of operations further includes generating an approval signal, a hold signal, or a denial signal for the first online application based on the first fraud risk score; generating a second approval signal, a second hold signal, or a second denial signal for the second online application based on the second fraud risk score; and transmitting the second approval signal, the second hold signal, or the second denial signal for the second online application to a second client server. ### Claim 17 A non-transitory computer-readable medium storing an online application origination (OAO) service for determining a fraudulent actor that, when executed by a processor in a fraud prevention server comprising a memory, causes the processor to perform a set of operations comprising: determining whether a first website configuration of a first online application has a multi-webpage flow; responsive to determining that the first website configuration of the first online application does not have the multi-webpage flow, the set of operations further includes calculating first input data on a single webpage of the first online application; storing the first input data in a memory; determining a first fraud risk score of the first online application based on the first input data and a first OAO model differentiating between a behavior of a first normal user and a behavior of a first actor during a submission of the first online application on a first device; determining whether a second website configuration of a second online application has the multi-webpage flow; responsive to determining that the second website configuration of the second online application has the multi-webpage flow, the set of operations further includes calculating second input data on each webpage of a plurality of webpages of the second online application; storing the second input data in the memory; combining all of the second input data associated with a single session of the multi-webpage flow into multi-webpage input data; storing the multi-webpage input data in the memory; determining a second fraud risk score of the second online application based on the multi-webpage input data and a second OAO model differentiating between a behavior of a second normal user and a behavior of a second actor during a submission of the second online application on a second device; and generating an approval signal, a hold signal, or a denial signal for the first online application or the second online application, based on the first fraud risk score or the second fraud risk score, respectively; and transmitting the approval signal, the hold signal, or the denial signal for the first online application or the second online application to a client server.