# US 2014/0195368 A1 · Detecting a suspicious transaction within a network-based facility > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0195368 A1 - Document ID: US20140195368A1 - Status: Published application - Kind: A1 - Application number: 14/153,959 - Filed: 2014-01-13 - Published: 2014-07-10 - Earliest claimed: 2000-11-15 - Assignees: eBay Inc. - Applicants: eBay Inc. - Inventors: Christine Cheng; Brenda Won; Dheeraj Singh Mohnia; Ha Nguyen; Reed Maltzman; Isaac Strack; Noel Morin - Web page: https://patentgrep.com/patent/US20140195368A1 ## CPC - G06Q 20/382: {insuring higher security of transaction} - G06Q 30/08: Auctions - G06Q 40/04: Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract Methods and associated computer-readable media to detect fraudulent activities made over a network-based facility using a machine are disclosed. Responsive to a first event with respect to the network-based facility and initiated either under a first user identity or a first set of user transaction preferences from the machine which is coupled to the network-based facility via a network, the method causes a first identifier associated with either the first user identity or the first set of user transaction preferences to be stored on the machine. Responsive to a second event initiated under either a second user identity or a second set of user transaction preferences, detecting a potentially fraudulent activity occurs by detecting a lack of correspondence between the first identifier stored on the machine and a second identifier associated with either the second user identity or the second set of user transaction preferences. ## Claims ### Claim 1 A method of detecting fraudulent activity, the method comprising: causing a first identifier associated with a first user identity to be stored on a machine responsive to a first event with respect to a network-based facility and initiated under the first user identity from the machine that is coupled to the network-based facility via a network; and detecting, one or more processors, a potentially fraudulent activity by detecting a lack of correspondence between the first identifier stored on the machine and a second identifier associated with a second user identity responsive to a second event with respect to the network-based facility and initiated under the second user identity from the machine. ### Claim 2 (depends on 1) The method of claim 1, further comprising storing the first identifier in a shill cookie on the machine. ### Claim 3 (depends on 2) The method of claim 2, further comprising generating the second identifier associated with the second user identity and storing the second user identifier in the shill cookie on the machine. ### Claim 4 (depends on 2) The method of claim 2, further comprising encoding the shill cookie. ### Claim 5 (depends on 2) The method of claim 2, further comprising encrypting the shill cookie. ### Claim 6 (depends on 1) The method of claim 1, further comprising generating and storing a new shill cookie on the machine or adding to an existing shill cookie stored on the machine each time one of a plurality of triggering events occurs. ### Claim 7 (depends on 3) The method of claim 3, wherein the plurality of triggering events includes at least one type of event selected from a group of events including registering with the network-based facility, communicating with the network-based facility to offer a good or service for sale, communicating with the network-based facility to purchase a good or service, communicating with the network-based facility to present feedback regarding a transaction, and updating a profile maintained by the network-based facility. ### Claim 8 (depends on 1) The method of claim 1, wherein the network-based facility is a network-based transaction facility. ### Claim 9 (depends on 1) The method of claim 1, wherein the network-based facility is a network-based auction facility. ### Claim 10 (depends on 1) The method of claim 1, further comprising recording a set of transaction preferences for the first user identity. ### Claim 11 (depends on 10) The method of claim 10, wherein the set of transaction preferences include a plurality of items selected from items including credit card numbers, bidding histories, payment methods, and shipping addresses. ### Claim 12 (depends on 1) The method of claim 1, further comprising recording the potentially fraudulent activity at the network-based facility responsive to the detection of the lack of correspondence between the first identifier and the second identifier. ### Claim 13 (depends on 1) The method of claim 1, further comprising: generating a potential fraudulent activities table having a fraudulent activity field, a cookie identifier field, a user identifier field, and a frequency field; recording each of a plurality of potentially fraudulent activities and corresponding information into the potential fraudulent activities table; updating the potential fraudulent activities table on at least a periodic basis; and providing an updated report of the potential fraudulent activities table to an investigation team. ### Claim 14 (depends on 1) The method of claim 1, further comprising providing a priority ranking system having a low priority for a low potential fraudulent activity frequency, a medium priority for a medium potential fraudulent activity frequency, and a high priority for a high potential fraudulent activity frequency. ### Claim 15 A method of detecting fraudulent activity, the method comprising: generating a first identifier associated with a first set of transaction preferences, the first identifier to be stored on a first client machine, the first identifier being generated responsive to at least one of a plurality of triggering events with respect to a network-based facility; generating a second identifier associated with a second set of transaction preferences, the second identifier to be stored with either the first identifier on the first client machine or on a second client machine, the second identifier being generated responsive to at least one of the plurality of triggering events with respect to the network-based facility; receiving information stored in one or both of the first identifier and the second identifier at the network-based facility; and detecting, using one or more hardware processors, potentially fraudulent activity by detecting a lack of correspondence between the first set of transaction preferences and the second set of transaction preferences. ### Claim 16 (depends on 15) The method of claim 15, wherein the plurality of triggering events includes at least one type of event selected from a group of events including registering with the network-based facility, communicating with the network-based facility to offer a good or service for sale, communicating with the network-based facility to purchase a good or service, communicating with the network-based facility to present feedback regarding a transaction, and updating a profile maintained by the network-based facility. ### Claim 17 (depends on 15) The method of claim 15, wherein the potentially fraudulent activity includes at least one of shill bidding and shill feedback. ### Claim 18 (depends on 15) The method of claim 15, wherein the detection of the potentially fraudulent activity is responsive to a matching of a plurality of user transaction preferences from a plurality of different user identifies. ### Claim 19 (depends on 15) The method of claim 15, further comprising: generating a first shill cookie and a second shill cookie for the first user identifier and the second user identifier, respectively; and transmitting information stored on the first shill cookie and the second shill cookie to the network-based facility responsive to one of the plurality of triggering events with respect to a network-based facility and associated with the first identifier and the second identifier, respectively. ### Claim 20 A computer-readable storage medium comprising no transitory signals, the computer-readable storage medium having instructions that, when executed by at least one processor causes the at least one processor to perform operations, the operations comprising: generating a first identifier associated with a first set of transaction preferences, the first identifier to be stored on a first client machine, the first identifier being generated responsive to at least one of a plurality of triggering events with respect to a network-based facility; generating a second identifier associated with a second set of transaction preferences, the second identifier to be stored with either the first identifier on the first client machine or on a second client machine, the second identifier being generated responsive to at least one of the plurality of triggering events with respect to the network-based facility; receiving information stored in one or both of the first identifier and the second identifier at the network-based facility; and detecting potentially fraudulent activity by detecting a lack of correspondence between the first set of transaction preferences and the second set of transaction preferences.