Detecting fraudulent user access to online web services via user flow

A method, comprising:

• receiving, at a website, selections of links by a first user of the website;
• storing data indicative of each selected link and a time between each link selection over a plurality of distinct sessions on the website by the first user;
• determining a first model of a flow of the first user through the website based on the stored data indicative of the selected links and the time between each link selection;
• comparing the first model of the flow of the first user through the website to subsequent first user activity on the website including a sequence of link selections;
• and
• determining the subsequent first user activity on the website is unauthorized when comparison of the subsequent first user activity to the first model of the flow of the first user through the website indicates the first user is not responsible for the subsequent first user activity, wherein the subsequent first user activity is determined unauthorized when a first value representing a first likelihood the subsequent first user activity fits a second, different model of a flow of a second, different user of the website is higher than a second value representing a second likelihood the subsequent first user activity fits the first model of the flow of the first user through the website.

At least one non-transitory computer-readable medium comprising a set of instructions that, in response to being executed on a computing device, cause the computing device to:

• monitor a flow of a first user through a website over a plurality of distinct sessions on the website by the first user;
• determine a first model of the flow of the first user through the website based on the monitored flow of the first user through the website;
• compare the first model of the flow of the first user through the website to subsequent first user activity on the website;
• and
• determine the subsequent first user activity on the website is unauthorized when the subsequent first user activity deviates from the first model of the flow of the first user through the website, wherein the subsequent first user activity is determined unauthorized when a first value representing a first likelihood the subsequent first user activity fits a second, different model of a flow of a second, different user of the website is higher than a second value representing a second likelihood the subsequent first user activity fits the first model of the flow of the first user through the website.