Fingerprinting account activity habits in order to discover fraudulent usage

A method performed by a computing system for discovering fraudulent account usage, comprising:

• querying a database to identify a list of accounts and transaction categories, the database comprising a history of transactions associated with each of the accounts;
• generating a first table based on the transaction categories, the first table comprising an account identifier corresponding to each account in the list of accounts;
• generating a second table by populating the first table with a first set of historical transactions associated with each of the account identifiers across each of the transaction categories over a first period of time;
• generating a third table by populating the first table based at least on a response to querying the database for a second set of historical transactions associated with each of the account identifiers across each of the transaction categories over a second period of time;
• for each of the account identifiers, generating a measure of similarity between the first set of historical transactions in the first table associated with the account identifier and the second set of historical transactions associated with the account identifier in the third table;
• and
• for each account identifier with a corresponding measure of similarity below a threshold value, identifying the account identifier as a fraudulent account candidate.

A computer-readable storage medium having program instructions encoded thereon that are executable by one or more processors to perform a computer-implemented method, the method comprising:

• querying a database to identify a list of accounts and transaction categories, the database comprising a history of transactions associated with each of the accounts;
• generating a first table based on the transaction categories, the first table comprising an account identifier corresponding to each account in the list of accounts;
• generating a second table by populating the first table with a first set of historical transactions associated with each of the account identifiers across each of the transaction categories over a first period of time;
• generating a third table by populating the first table based at least on a response to querying the database for a second set of historical transactions associated with each of the account identifiers across each of the transaction categories over a second period of time;
• for each of the account identifiers, generating a measure of similarity between the first set of historical transactions in the first table associated with the account identifier and the second set of historical transactions associated with the account identifier in the third table;
• and
• for each account identifier with a corresponding measure of similarity below a threshold value, identifying the account identifier as a fraudulent account candidate.