Systems and methods for identifying suspect illicit merchants

An illicit website identifying (IWI) computing device in communication with a payment processing network, the IWI computing device including a processor in communication with a memory, said processor programmed to:

• provide keywords associated with an illicit product to a web-crawler;
• receive suspect website data from the web-crawler;
• store, at the memory, a log of suspect illicit websites identified from the suspect website data, the log including respective website content associated with each suspect illicit website, wherein each suspect illicit website is associated with a respective merchant;
• receive, from the payment processing network, payment transaction data for payment transactions initiated at a plurality of candidate merchants;
• match at least one payment transaction of a first candidate merchant from the received payment transaction data to a first suspect illicit website by identifying at least a portion of the website content associated with the first suspect illicit website in at least one data field of the at least one payment transaction;
• store, at the memory, one or more rules for confirming the first suspect illicit website as illicit based on the payment transaction data of the first candidate merchant, the one or more rules including at least one of a match of a merchant country code in the payment transaction data with a high-risk country code and a threshold deviation of a payment amount in the payment transaction data from an expected price;
• confirm, by applying the one or more rules to the payment transaction data of the first candidate merchant, the first suspect illicit website as illicit;
• identify the first candidate merchant as illicit for further investigation;
• and
• generate an identification report including the identified illicit website and the first candidate merchant.

A computer-implemented method for identifying illicit websites and merchants using an illicit website identifying (IWI) computing device in communication with a payment processing network, the IWI computing device including a processor in communication with a memory, said method comprising:

• providing, by the processor, keywords associated with an illicit product to a web-crawler;
• receiving, by the processor, suspect website data from the web-crawler;
• storing, at the memory by the processor, a log of suspect illicit websites identified from the suspect website data, the log including respective website content associated with each suspect illicit website, wherein each suspect illicit website is associated with a respective merchant;
• receiving, by the processor, from the payment processing network, payment transaction data for payment transactions initiated at a plurality of candidate merchants;
• matching, by the processor, at least one payment transaction of a first candidate merchant from the received payment transaction data to a first suspect illicit website by identifying at least a portion of the website content associated with the first suspect illicit website in at least one data field of the at least one payment transaction;
• storing, at the memory by the processor, one or more rules for confirming the first suspect illicit website as illicit based on the payment transaction data of the first candidate merchant, the one or more rules including at least one of a match of a merchant country code in the payment transaction data with a high-risk country code and a threshold deviation of a payment amount in the payment transaction data from an expected price;
• confirming, by the processor applying the one or more rules to the payment transaction data of the first candidate merchant, the first suspect illicit website as illicit;
• identifying, by the processor, the first candidate merchant as illicit for further investigation;
• and
• generating, by the processor, an identification report including the identified illicit website and the first candidate merchant.

At least one non-transitory computer-readable storage media having computer-executable instructions embodied thereon for execution by an illicit website identifying (IWI) computing device, the IWI computing device in communication with a payment processing network, the IWI computing device including at least one processor in communication with a memory, wherein the computer-executable instructions cause the processor to:

• provide keywords associated with an illicit product to a web-crawler;
• receive suspect website data from the web-crawler;
• store, at the memory, a log of suspect illicit websites identified from the suspect website data, the log including respective website content associated with each suspect illicit website, wherein each suspect illicit website is associated with a respective merchant;
• receive, from the payment processing network, payment transaction data for payment transactions initiated at a plurality of candidate merchants;
• match at least one payment transaction of a first candidate merchant from the received payment transaction data to a first suspect illicit website by identifying at least a portion of the website content associated with the first suspect illicit website in at least one data field of the at least one payment transaction;
• store, at the memory, one or more rules for confirming the first suspect illicit website as illicit based on the payment transaction data of the first candidate merchant, the one or more rules including at least one of a match of a merchant country code in the payment transaction data with a high-risk country code and a threshold deviation of a payment amount in the payment transaction data from an expected price;
• confirm, by applying the one or more rules to the payment transaction data of the first candidate merchant, the first suspect illicit website as illicit;
• identify the first candidate merchant as illicit for further investigation;
• and
• generate an identification report including the identified illicit website and the first candidate merchant.