Systems and methods for managing fraudulent operations in a plurality of computing devices

A method, comprising:

• continuously receiving in real time, by a processor of an authorizing entity server managed by an authorizing entity communicating with a plurality of computing devices managed by at least one entity server of an entity over a communication network, operation data about each operation of a plurality of operations that are performed by the plurality of computing devices;
• storing, by the processor of the authorizing entity server, the operation data in respective data entries of a log data storage;
• wherein each respective operation of the plurality of operations is performed at a computing device of the plurality of computing devices when a user associated with the authorizing entity uses a unique authorization identifier issued by the authorizing entity to authorize the operation;
• wherein the operation data of each respective operation comprises:
• (i) the unique authorization identifier;
• (ii) a timestamp of the operation;
• (iii) an identifier of the computing device;
• (iv) a location of the computing device;
• and
• (v) an agent identifier of an agent associated with the entity that performed the operation on the computing device using the unique authorization identifier of the user;
• receiving, by the processor of the authorizing entity server, at least one indication that at least one respective particular operation from the plurality of operations was determined to be fraudulent after the timestamp of the at least one particular operation;
• storing, by the processor of the authorizing entity server, the at least one the fraudulent indication in the operation data of the respective at least one particular operation;
• continuously identifying in real time, by the processor of the authorizing entity server, using the agent identifier in entries of the log data storage having positive fraud indications, a set of agents from the entity associated with fraudulent operations;
• continuously determining in real time, by the processor of the authorizing entity server, a number of instances for each identified agent in the set associated with fraudulent operations;
• continuously updating in real time, by the processor of the authorizing entity server, a score assigned to each agent in the set based on the number of instances that each agent was associated with fraudulent operations, and based on entries in the log data storage having positive fraud indications with timestamps within a predefined time interval;
• and
• performing, by the processor of the authorizing entity server;
• at least one of:
• (i) determining that the at least one agent is lax in following security policies of the entity for managing unique authorization identifiers of users when the assigned score of at least one agent is greater than a predefined threshold, and causing over the communication network, at least one computing device from the plurality of computing devices associated with the at least one agent that is lax, to reject operations;
• (ii) determining that agents in a specific location of the entity are lax in following the security policies of the entity for managing unique authorization identifiers of users when a number of the at least one agent in the set of agents at the specific location is greater than a predefined first number, and causing over the communication network, a first subset of computing devices from the plurality of computing devices associated with agents in the specific location of the entity that are lax, to reject operations;
• or
• (iii) determining that the at least one entity server is breached when the number of instances for each identified agent in the set associated with fraudulent operations performed at different computing devices at different locations of the entity is greater than a second predefined number, and causing over the communication network, a second subset of computing devices from the plurality of computing devices associated with the at least one entity server that is breached, to reject operations;
• sending, by the processor of the authorizing entity server over the communication network, an alert to an administering computing device associated with the entity about the rejected operations;
• and
• identifying, by the processor of the authorizing entity server, data of the at least one agent that is lax in following security policies of the entity.