Identifying fraudulent transactions

A computer configured to access a storage device, the computer comprising:

• a processor;
• and
• a non-transitory, computer-readable storage medium storing computer-readable instructions that when executed by the processor cause the computer to perform:
• determining, within a plurality of feature vectors corresponding to a plurality of transactions, a correlation between values of particular features in the plurality of feature vectors that distinguish at least a subset of the transactions as fraudulent, wherein each feature vector comprises a plurality of features having values that describe the feature vector's corresponding transaction;
• generating a triggering criteria for identifying suspicious transactions based on the values of the particular features;
• in response to receiving a request to approve a new transaction, determining that attributes of the new transaction meet the triggering criteria;
• flagging a device associated with initiating the new transaction as suspicious;
• and
• if the device has been previously flagged as suspicious, denying the request to approve the new transaction;
• and
• if the device has not been previously flagged as suspicious, transmitting a request for authentication of an account holder associated with the new transaction.

A non-transitory computer-readable medium having instructions stored thereon that is executable by a computing system to perform operations comprising:

• determining, within a plurality of feature vectors corresponding to a plurality of transactions, a correlation between values of particular features in the plurality of feature vectors that distinguish at least a subset of the transactions as fraudulent, wherein each feature vector comprises a plurality of features having values that describe the feature vector's corresponding transaction;
• generating a triggering criteria for identifying suspicious transactions based on the values of the particular features;
• in response to receiving a request to approve a new transaction, determining that attributes of the new transaction meet the triggering criteria;
• determining a suspicion score for a device associated with initiating the new transaction, wherein the suspicion score is based on a number of times that the device has been previously flagged as suspicious and other devices that the device is related to that have been previously flagged as suspicious.