A non-transitory computer-readable medium, comprising instructions, which when executed by at least one processor, configure the at least one processor to perform operations comprising:
- (A) determining past locations of a computing device using a global positioning system sensor of the computing device;
- (B) determining times associated with the past locations of the computing device;
- (C) storing the past locations and the times associated with the past locations of the computing device at a storage device of the computing device;
- (D) extracting, by a mobile wallet executing at the computing device, a plurality of past transactions that have been completed over a period of time associated with a biller account, the biller account associated with a user account of a user, and wherein the biller account is configured to be paid using a mobile element of the mobile wallet stored on the computing device and the mobile wallet extracts the plurality of past transactions using optical character recognition;
- (E) extracting using optical character recognition, by the mobile wallet, transaction characteristics of a first transaction of the plurality of past transactions, the transaction characteristics including a location characteristic and a time characteristic for the first transaction, the location characteristic indicating a past location where the first transaction was made and the time characteristic indicating when the first transaction was made;
- (F) retrieving, by the mobile wallet, based on the transaction characteristics, corresponding characteristics of the computing device at a previous time according to the time characteristic, wherein retrieving includes:
- (G) retrieving the past location of the computing device at the previous time according to the time characteristic;
- and
- (H) comparing, by the mobile wallet, the transaction characteristics with the retrieved computing device characteristics based on a set of rules to determine a likelihood that the first transaction is anomalous, wherein comparing includes:
- (I) comparing the past location of the computing device with the past location where the first transaction was made;
- (J) based on the likelihood indicating that the first transaction is anomalous, presenting, by the mobile wallet, a first notification to the user, wherein presenting the first notification to the user includes presenting a first user interface that includes:
- identifying information that the first transaction is anomalous;
- a user interface element to indicate the first transaction as anomalous;
- (K) repeating operations (E)-(I) for a second transaction having characteristics similar to the first transaction and, based on the likelihood indicating that the second transaction is anomalous, presenting, by the mobile wallet, a second notification to the user, wherein presenting the second notification to the user includes presenting a second user interface that includes:
- identifying information that the second transaction is anomalous;
- a user interface element to indicate the second transaction as anomalous;
- (L) receiving, from the user, an indication that the second transaction is anomalous at the user interface;
- and
- (M) updating the set of rules based on indicating the first transaction and the second transaction as anomalous and the similarity between the first transaction and the second transaction such that indicating the first transaction and the second transaction at the user interface as anomalous clears future transactions similar to the first transaction and the second transaction when the user indicates that the second transaction is anomalous at the user interface.