Event manager for use in fraud detection

A system for detecting telecommunications fraud comprising:

• means for receiving one or more events relating to a subscriber;
• means for combining the one or more events to provide a score;
• and
• means for storing the subscriber and the score in an investigation queue if the score exceeds a predetermined threshold.

A computer program for detecting telecommunications fraud embodied in machine executable code comprising:

• machine executable code to receive one or more events relating to a subscriber;
• machine executable code to combine the one or more events to provide a score;
• and
• machine executable code to store the subscriber and the score in an investigation queue if the score exceeds a predetermined threshold.

A method for identifying possibly fraudulent activity in a telecommunications system comprising:

• providing a fraud record, the fraud record including a first plurality of fields;
• providing an account change record, the account change record including a second plurality of fields;
• providing a search key, the search key indicating one or more search key fields corresponding to fields of the account change record and the fraud record;
• applying the search key and a first set of rules to the account change record and the fraud record, thereby determining whether there is a possible match;
• calculating a match quality for the one or more search key fields if there is a possible match;
• and
• generating an event if there is a possible match, the event having a weight indicative of the quality of a match between the account change record and the fraud record.

A method for identifying possibly fraudulent activity in a telecommunications system comprising:

• defining one or more events, each event corresponding to a category of account activity,
• assigning to each of the one or more events an event weight and an event half-life;
• receiving a provisioning record, the provisioning record corresponding to an activity in an account;
• determining which category of account activity corresponds to the provisioning record;
• and
• generating an event for the account activity, the event having the event weight and the event half-life of the category to which the account activity corresponds.