# US 12,762,278 B2 · Systems, methods, and apparatuses for identifying unauthorized use of a user's authentication credentials to an electronic network based on non-public data access > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,762,278 B2 - Document ID: US12762278B2 - Status: Granted - Kind: B2 - Application number: 18/987,293 - Filed: 2024-12-19 - Published: 2025-04-10 - Granted: 2026-10-13 - Earliest claimed: 2022-09-14 - Assignees: Bank of America Corporation - Applicants: Bank of America Corporation - Inventors: Marci Anne Landy; Daniel Joseph Serna; Tina Berumen Pachorek; Jessica Hope Thompson; Joseph Henry Pindell, Jr.; Mrunal Mody - Web page: https://patentgrep.com/patent/US12762278B2 ## CPC - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 2221/2101: Auditing as a secondary aspect - G06F 2221/2115: Third party - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems, computer program products, and methods are described herein for identifying unauthorized use of a user's authentication credentials to an electronic network based on non-public data access. The present invention is configured to receive a verified access attempt at a first time for a user account; receive an unverified access attempt at a second time for the user account; determine the unverified access attempt is a credential sharing event for the user account; receive unverified account access logs associated with the unverified access attempt, the unverified account access logs comprising access to non-public data; and generate an unverified data access interface component to configure a graphical user interface of a device associated with a manager of the system. ## Claims ### Claim 1 A system for identifying unauthorized use of a user's authentication credentials, the system comprising: a memory device with non-transitory computer-readable program code stored thereon; at least one processing device operatively coupled to the at least one memory device and at least one communication device, wherein when executed, the computer-readable code is configured to cause the at least one processing device to: receive a verified access attempt at a first time for a user account; receive an unverified access attempt at a second time for the user account; determine the unverified access attempt is a credential sharing event for the user account, wherein the credential sharing event comprises a sharing of user credentials associated with the user account to an unverified user; receive unverified account access logs associated with the unverified access attempt, the unverified account access logs comprising access to non-public data; and generate an unverified data access interface component to configure a graphical user interface of a device associated with a manager of the system. ### Claim 2 (depends on 1) The system of claim 1, wherein when executed, the computer-readable code is configured to cause the at least one processing device to: apply a threat level machine learning model to a user account identifier associated with the user account; and determine, by the threat level machine learning model, a threat level indication of the user account, wherein the threat level indication comprises a high threat level where the user account has access to non-public data. ### Claim 3 (depends on 2) The system of claim 2, wherein when executed, the computer-readable code is configured to cause the at least one processing device to: automatically deny, in response to determining the high threat level indication of the user account, the unverified access attempt to the account. ### Claim 4 (depends on 2) The system of claim 2, wherein when executed, the computer-readable code is configured to cause the at least one processing device to: generate, in response to determining the high threat level indication of the user account, a high threat level interface component to configure a graphical user interface of a device associated with the manager of the system. ### Claim 5 (depends on 2) The system of claim 2, wherein when executed, the computer-readable code is configured to cause the at least one processing device to: collect a set of application logs associated with the user account identifier, the set of application logs comprising a plurality of previous applications accessed by the user account associated with the user account identifier; create a first training set comprising the collected set of application logs; and train the threat level machine learning model in a first stage using the first training set. ### Claim 6 (depends on 5) The system of claim 5, wherein the collected set of application logs comprises non-public data. ### Claim 7 (depends on 1) The system of claim 1, wherein when executed, the computer-readable code is configured to cause the at least one processing device to determine the user account is an internal account, wherein the internal account is an account associated with an internal user associated with the manager of the system. ### Claim 8 (depends on 7) The system of claim 7, wherein when executed, the computer-readable code is configured to cause the at least one processing device to: determine that the unverified user associated with the unverified access attempt is an external user; and generate, wherein the external user is a user associated with the manager of the system and the internal account is an account associated with the internal user associated with the manager of the system, a credential sharing indication interface component to configure the graphical user interface of the device associated with the manager of the system. ### Claim 9 (depends on 1) The system of claim 1, wherein when executed, the computer-readable code is configured to cause the at least one processing device to: determine that the unverified user associated with the unverified access attempt is an external user, wherein the external user associated with the unverified access attempt is a user that is not associated with the manager of the system. ### Claim 10 (depends on 1) The system of claim 1, wherein when executed, the computer-readable code is configured to cause the at least one processing device to: determine that the unverified user associated with the unverified access attempt is an external user, wherein the external user associated with the unverified access attempt is a user associated with the manager of the system. ### Claim 11 (depends on 1) The system of claim 1, wherein the second time associated with the unverified access attempt is at a later time than the first access attempt associated with the verified access attempt. ### Claim 12 A computer program product for identifying unauthorized use of a user's authentication credentials, wherein the computer program product comprises at least one non-transitory computer-readable medium having computer-readable program code portions embodied therein, the computer-readable program code portions which when executed by a processing device are configured to cause the processing device—to: receive a verified access attempt at a first time for a user account; receive an unverified access attempt at a second time for the user account; determine the unverified access attempt is a credential sharing event for the user account, wherein the credential sharing event comprises a sharing of user credentials associated with the user account to an unverified user; receive unverified account access logs associated with the unverified access attempt, the unverified account access logs comprising access to non-public data; and generate a unverified data access interface component to configure a graphical user interface of a device associated with a manager of a system. ### Claim 13 (depends on 12) The computer program product of claim 12, wherein the computer-readable program code portions which when executed by a processing device are further configured to cause the processing device to: apply a threat level machine learning model to a user account identifier associated with the user account; and determine, by the threat level machine learning model, a threat level indication of the user account, wherein the threat level indication comprises a high threat level where the user account has access to a non-public data. ### Claim 14 (depends on 13) The computer program product of claim 13, wherein the computer-readable program code portions which when executed by a processing device are further configured to cause the processing device: automatically deny, in response to determining the high threat level indication of the user account, the unverified access attempt to the account. ### Claim 15 (depends on 13) The computer program product of claim 13, wherein the computer-readable program code portions which when executed by a processing device are further configured to cause the processing device to: generate, in response to determining the high threat level indication of the user account, a high threat level interface component to configure a graphical user interface of a device associated with the manager of the system. ### Claim 16 (depends on 12) The computer program product of claim 12, wherein the computer-readable program code portions which when executed by a processing device are further configured to cause the processing device to determine the user account is an internal account, wherein the internal account is an account associated with an internal user associated with the manager of the system. ### Claim 17 (depends on 12) The computer program product of claim 12, wherein the computer-readable program code portions which when executed by a processing device are further configured to: determine that the unverified user associated with the unverified access attempt is an external user, wherein the external user associated with the unverified access attempt is a user that is not associated with the manager of the system. ### Claim 18 (depends on 12) The computer program product of claim 12, wherein the computer-readable program code portions which when executed by a processing device are further configured to: determine that the unverified user associated with the unverified access attempt is an external user, wherein the external user associated with the unverified access attempt is a user associated with the manager of the system. ### Claim 19 (depends on 16) The computer program product of claim 16, wherein the computer-readable program code portions which when executed by a processing device are further configured to: determine that the unverified user associated with the unverified access attempt is an external user; and generate, wherein the external user is a user associated with the manager of the system and the internal account is an account associated with the internal user associated with the manager of the system, a credential sharing indication interface component to configure the graphical user interface of the device associated with the manager of the system. ### Claim 20 A computer-implemented method for identifying unauthorized use of a user's authentication credentials, the computer-implemented method comprising: receiving a verified access attempt at a first time for a user account; receiving an unverified access attempt at a second time for the user account; determining the unverified access attempt is a credential sharing event for the user account, wherein the credential sharing event comprises a sharing of user credentials associated with the user account to an unverified user; receiving unverified account access logs associated with the unverified access attempt, the unverified account access logs comprising access to non-public data; and generating a unverified data access interface component to configure a graphical user interface of a device associated with a manager of a system.