System for identifying points of compromise

A method for identifying point-of-compromise locations in a transaction card network, the method comprising:

• monitoring, by a computing system, transaction data for a plurality of transaction cards across a plurality of time intervals;
• constructing, by the computing system, a multidimensional data structure wherein:
• a first dimension corresponds to the plurality of transaction cards, a second dimension corresponds to a plurality of merchant locations, and a third dimension corresponds to the plurality of time intervals;
• for each transaction card of the plurality of transaction cards that performed a non-fraudulent transaction at a first merchant location and subsequently performed a fraudulent transaction at any location, incrementing, by the computing system, a corresponding counter in the multidimensional data structure;
• calculating, by the computing system, a point-of-compromise (POC) indicator for each merchant location by determining a ratio of a sum of counter values for the merchant location to a total number of transaction cards used at the merchant location;
• calculating, by the computing system, a POC acceleration indicator for each merchant location by determining a rate of change of the POC indicator over at least two consecutive time intervals;
• identifying, by the computing system, a candidate POC location based on at least one of the POC indicator or the POC acceleration indicator exceeding a predetermined threshold;
• generating, by the computing system, a mass count plot showing a number of transaction cards having suspicious fraud activity at the candidate POC location for each of a plurality of time slices;
• determining, by the computing system, a window of compromise at the candidate POC location based on identifying a time slice with a highest count in the mass count plot and at least one adjacent time slice having a count higher than a median count, wherein determining the window of compromise further comprises:
• determining a starting date of the window of compromise as a beginning of a time slice that has no time gap with the time slice having the highest count, and determining an ending date of the window of compromise as an end of a last consecutive time slice having a count greater than the median count;
• determining transaction cards that had non-fraudulent transactions at the candidate POC location outside the window of compromise;
• and
• shrinking the dimension of the multidimensional data structure by removing data associated with those transaction cards from the multidimensional data structure.