# US 2021/0241280 A1 · System and method for modifying payment processing times upon suspicion of fraud

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0241280 A1
- Document ID: US20210241280A1
- Status: Published application
- Kind: A1
- Application number: 17/075,873
- Filed: 2020-10-21
- Published: 2021-08-05
- Earliest claimed: 2020-02-05
- Assignees: Capital One Services, LLC
- Applicants: Capital One Services, LLC
- Inventors: Reza FARIVAR; Vincent PHAM; Anh TRUONG
- Web page: https://patentgrep.com/patent/US20210241280A1

## CPC

- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- G06N 3/09: Supervised learning
- G06N 5/02: Knowledge representation; Symbolic representation
- G06Q 20/34: using cards, e.g. integrated circuit [IC] cards or magnetic cards
- G06Q 20/405: {Establishing or using transaction specific rules}
- G06Q 50/26: Government or public services (business processes related to the transportation industry G06Q50/40)
- G06N 3/08: Learning methods
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Systems, methods, and computer-readable storage media for monitoring risk levels in continuing to allow a potentially compromised payment card to continue to be used. An exemplary system can include a processor which receives a notification of unauthorized use of a card, retrieves a transaction history of authorized use of the card, and performs predictive modeling based on the transaction history based to determine a predicted transaction amount for future transactions. The system can then determine a risk level of continued use of the card and modify processing of the ongoing transaction based on the risk level. The system can then issue a risk level notification to proper authorities.

## Claims

### Claim 1

A method, comprising:
retrieving from a database, via a processor, a transaction history of authorized use of a payment card;
training, via the processor, a model using the transaction history, resulting in a trained model;
identifying, by the processor, a suspicious transaction of the payment card;
initiating, via the processor, increased monitoring of transactions of the payment card upon identifying the suspicious transaction;
while performing the increased monitoring of the transactions of the payment card:
performing, via the processor, predictive modeling using the trained model to determine a predicted transaction amount for future transactions;
determining, via the processor based on stored suspicious transactions, a likelihood of thief apprehension; and
generating, via the processor based on the predicted transaction amount and the likelihood of thief apprehension, a risk potential of not immediately cancelling the payment card,
until the likelihood of thief apprehension meets or exceeds a predetermined apprehension level; and
issuing a notification to law enforcement upon the likelihood of thief apprehension meeting or exceeding the predetermined apprehension level.

### Claim 2 (depends on 1)

The method of claim 1, wherein the risk potential is further based on non-suspicious transactions associated with the payment card.

### Claim 3 (depends on 2)

The method of claim 2, wherein the non-suspicious transactions associated with the payment card comprise transaction amounts, locations of transactions, and a deviation from a transaction amount by the suspicious transaction.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
delaying, via the processor, processing of an ongoing transaction of the payment card at a location.

### Claim 5 (depends on 1)

The method of claim 1, wherein the payment card is one of a credit card, a debit card, and a gift card.

### Claim 6 (depends on 1)

The method of claim 1, wherein the risk potential is further based on one or more of:
a frequency of transactions occurring at a location;
a time pattern of transactions occurring at the location; and
amount trends of suspicious transactions and non-suspicious transactions.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
retrieving, from a database, a transaction history of authorized use of the payment card; and
retrieving, from the database, a plurality of previously identified fraudulent transactions.

### Claim 8 (depends on 7)

The method of claim 7, further comprising analyzing the transaction history to determine a bell curve of authorized amounts based on the transaction history.

### Claim 9 (depends on 8)

The method of claim 8, further comprising analyzing the previously identified fraudulent transactions to determine a bell curve of fraudulent amounts.

### Claim 10 (depends on 9)

The method of claim 9, wherein the risk potential is further based on the bell curve of authorized amounts and the bell curve of fraudulent amounts.

### Claim 11

A system comprising:
a processor; and
a non-transitory computer-readable storage medium having instructions stored which, when executed by the processor, cause the processor to perform operations comprising:
retrieving authorized transactions associated with a payment card;
training a model using the authorized transactions, resulting in a trained model;
identifying a suspicious transaction of the payment card;
after identifying the suspicious transaction, increasing monitoring of transactions of the payment card;
while performing the increased monitoring of the transactions of the payment card:
predicting, using the trained model, a predicted transaction amount for future authorized transactions;
determining, based on other suspicious transactions, a likelihood of thief apprehension; and
generating, based on the predicted transaction amount and the likelihood of thief apprehension, a risk of not immediately cancelling the payment card,
until the likelihood of thief apprehension meets or exceeds a predetermined apprehension level; and
notifying law enforcement upon the likelihood of thief apprehension meeting or exceeding the predetermined apprehension level.

### Claim 12 (depends on 11)

The system of claim 11, wherein the risk is further based on the authorized transactions associated with the payment card.

### Claim 13 (depends on 12)

The system of claim 12, wherein the authorized transactions associated with the payment card comprise transaction amounts and locations of transactions.

### Claim 14 (depends on 11)

The system of claim 11, the non-transitory computer-readable storage medium having additional instructions stored which, when executed by the processor, cause the processor to perform operations comprising:
delaying processing of an ongoing transaction of the payment card at a location.

### Claim 15 (depends on 11)

The system of claim 11, wherein the payment card is one of a credit card and a debit card.

### Claim 16 (depends on 11)

The system of claim 11, wherein the risk is further based on one or more of:
a frequency of transactions occurring at a location where the suspicious transaction occurred;
a time pattern of transactions occurring at the location; and
amount trends of suspicious transactions at the location.

### Claim 17 (depends on 11)

The system of claim 11, wherein the likelihood of thief apprehension is further based on a location where the suspicious transaction occurred.

### Claim 18 (depends on 17)

The system of claim 17, the non-transitory computer-readable storage medium having additional instructions stored which, when executed by the processor, cause the processor to perform operations comprising:
analyzing the authorized transactions to determine a bell curve of authorized amounts.

### Claim 19 (depends on 18)

The system of claim 18, wherein the risk is further based on the bell curve of authorized amounts.

### Claim 20

A non-transitory computer-readable storage medium having instructions stored which, when executed by a computing device, cause the computing device to perform operations comprising:
retrieving authorized transactions associated with a payment card;
training a model using the authorized transactions, resulting in a trained model;
identifying a suspicious transaction of the payment card;
after identifying the suspicious transaction, increasing monitoring of transactions of the payment card;
while performing the increased monitoring of the transactions of the payment card:
predicting, using the trained model, a predicted transaction amount for future authorized transactions;
determining, based on other suspicious transactions, a likelihood of thief apprehension; and
generating, based on the predicted transaction amount and the likelihood of thief apprehension, a risk of not immediately cancelling the payment card,
until the likelihood of thief apprehension meets or exceeds a predetermined apprehension level; and
notifying law enforcement upon the likelihood of thief apprehension meeting or exceeding the predetermined apprehension level.