Quantifying device risk through association

A computer configured to access a storage device, the computer comprising:

• a processor;
• and
• a non-transitory, computer-readable storage medium storing computer-readable instructions that when executed by the processor cause the computer to perform:
• determining, for each device in a first set of devices associated with a fraudulent transaction initiated by a plurality of flagged accounts, a suspicion score based on a number of fraudulent transactions associated with the device, wherein each device in the first set of devices is a mobile payment device using near-field-communication to initiate payment transactions with a merchant terminal;
• determining a relationship between each device in the first set and other devices in a second set that have initiated at least one legitimate transaction using at least one of the plurality of flagged accounts, wherein the determined relationship is based on a common transaction account used between devices in each set;
• for each device in the second set, determining an average suspicion score based on the suspicion score for each device in the first set that is related to the device in the second set;
• and
• in response to determining that the average suspicion score for a particular device in the second set is above a threshold, blocking a pending transaction involving the particular device and enforcing additional authentication measures based on the average suspicion score.

A non-transitory computer-readable medium having instructions stored thereon that is executable by a computing system to perform operations comprising:

• determining, for each device in a first set of devices associated with a fraudulent transaction initiated by a plurality of flagged accounts, a suspicion score based on a number of fraudulent transactions associated with the device, wherein each device in the first set of devices is a mobile payment device used to initiate card-not-present transactions;
• determining a relationship between each device in the first set and other devices in a second set that have initiated at least one legitimate transaction using at least one of the plurality of flagged accounts, wherein the determined relationship is based on a common transaction account used between devices in each set;
• for each device in the second set, determining an average suspicion score based on the suspicion score for each device in the first set that is related to the device in the second set;
• determining a relationship between each device in the second set and other devices in a third set based on common accounts used between devices in each set;
• for each device in the third set, determining an average suspicion score based on the average suspicion score for each device in the second set that is related to the device in the third set;
• applying a distance dampening factor to the average suspicion score for each device in the second and third set, wherein the distance dampening factor is higher for devices in the third set than for devices in the second set;
• and
• in response to determining that the average suspicion score for a particular device in the second or third set is above a threshold, blocking a pending transaction involving the particular device and enforcing additional authentication measures based on the average suspicion score.