# US 2021/0279720 A1 · Anomaly detection in a recurring transaction set

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0279720 A1
- Document ID: US20210279720A1
- Status: Published application
- Kind: A1
- Application number: 15/394,615
- Filed: 2016-12-29
- Published: 2021-09-09
- Earliest claimed: 2015-12-30
- Assignees: Wells Fargo Bank, N.A.
- Applicants: Wells Fargo Bank, N.A.
- Inventors: Joon Maeng
- Web page: https://patentgrep.com/patent/US20210279720A1

## CPC

- G06Q 20/36: using electronic wallets or electronic money safes
- G06Q 20/102: {Bill distribution or payments}
- G06Q 20/3224: {Transactions dependent on location of M-devices}
- G06Q 20/4015: {using location information}
- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- G06Q 20/405: {Establishing or using transaction specific rules}
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

A method may include receiving, at a computing device, a plurality of past transactions associated with a user account of a user; extracting transaction characteristics of a transaction of the plurality of transactions, the transaction characteristics including a location characteristic and a time characteristic; retrieving, based on the transaction characteristics, characteristics of the computing device at a time according to the time characteristic; comparing the transaction characteristics with the retrieved computing device characteristics based on a set of rules to determine a likelihood that the transaction is anomalous; and based on the likelihood indicating that the transaction is anomalous, presenting a notification to the user.

## Claims

### Claim 1

A method comprising:
(A) determining past locations of a computing device using a global positioning system sensor of the computing device;
(B) determining times associated with the past locations of the computing device;
(C) storing the past locations and the times associated with the past locations of the computing device at a storage device of the computing device;
(D) extracting, by a mobile wallet executing at the computing device, a plurality of past transactions that have been completed over a period of time associated with a biller account, the biller account associated with a user account of a user, and wherein the biller account is configured to be paid using a mobile element of the mobile wallet stored on the computing device and the mobile wallet extracts the plurality of past transactions using optical character recognition;
(E) extracting using optical character recognition, by the mobile wallet, transaction characteristics of a first transaction of the plurality of past transactions, the transaction characteristics including a location characteristic and a time characteristic for the first transaction, the location characteristic indicating a past location where the first transaction was made and the time characteristic indicating when the first transaction was made;
(F) retrieving, by the mobile wallet, based on the transaction characteristics, corresponding characteristics of the computing device at a previous tune according to the time characteristic, wherein retrieving includes:
(G) retrieving the past location of the computing device at the previous time according to the time characteristic; and
(H) comparing, by the mobile wallet, the transaction characteristics with the retrieved computing device characteristics based on a set of rules to determine a likelihood that the first transaction is anomalous, wherein comparing includes:
(I) comparing the past location of the computing device with the past location where the first transaction was made;
(J) based on the likelihood indicating that the first transaction is anomalous, presenting, by the mobile wallet, a first notification to the user, wherein presenting the first notification to the user includes presenting a first user interface that includes:
identifying information that the first transaction is anomalous;
a user interface element to indicate the first transaction as anomalous;
(K) repeating operations (E)-(I) for a second transaction having characteristics similar to the first transaction and, based on the likelihood indicating that the second transaction is anomalous, presenting, by the mobile wallet, a second notification to the user, wherein presenting the second notification to the user includes presenting a second user interface that includes:
identifying information that the second transaction is anomalous;
a user interface element to indicate the second transaction as anomalous;
(L) receiving, from the user, an indication that the second transaction is anomalous at the user interface; and
(M) updating the set of rules based on indicating that the first transaction and the second transaction as anomalous and the similarity between the first transaction and the second transaction such that indicating the first transaction and the second transaction at the user interface as anomalous clears future transactions similar to the first transaction and the second transaction when the user indicates that the second transaction is anomalous at the user interface.

### Claim at position 2

2-5. (canceled)

### Claim 6 (depends on 1)

The method of claim 1, wherein retrieving, based on the transaction characteristics, characteristics of the computing device at the previous tune according to the time characteristic includes:
retrieving calendar information of the computing device at the previous time according to the time characteristic.

### Claim 7 (depends on 6)

The method of claim 6, wherein comparing the transaction characteristics with the retrieved computing device characteristics based on the set of rules to determine the likelihood that the transaction is anomalous includes:
comparing the calendar information of the computing device to the time characteristic.

### Claim 8

A non-transitory computer-readable medium, comprising instructions, which when executed by at least one processor, configure the at least one processor to perform operations comprising:
(A) determining past locations of a computing device using a global positioning system sensor of the computing device;
(B) determining times associated with the past locations of the computing device;
(C) storing the past locations and the times associated with the past locations of the computing device at a storage device of the computing device;
(D) extracting, by a mobile wallet executing at the computing device, a plurality of past transactions that have been completed over a period of time associated with a biller account, the biller account associated with a user account of a user, and wherein the biller account is configured to be paid using a mobile element of the mobile wallet stored on the computing device and the mobile wallet extracts the plurality of past transactions using optical character recognition;
(E) extracting using optical character recognition, by the mobile wallet, transaction characteristics of a first transaction of the plurality of past transactions, the transaction characteristics including a location characteristic and a time characteristic for the first transaction, the location characteristic indicating a past location where the first transaction was made and the time characteristic indicating when the first transaction was made;
(F) retrieving, by the mobile wallet, based on the transaction characteristics, corresponding characteristics of the computing device at a previous time according to the time characteristic, wherein retrieving includes:
(G) retrieving the past location of the computing device at the previous time according to the time characteristic; and
(H) comparing, by the mobile wallet, the transaction characteristics with the retrieved computing device characteristics based on a set of rules to determine a likelihood that the first transaction is anomalous, wherein comparing includes:
(I) comparing the past location of the computing device with the past location where the first transaction was made;
(J) based on the likelihood indicating that the first transaction is anomalous, presenting, by the mobile wallet, a first notification to the user, wherein presenting the first notification to the user includes presenting a first user interface that includes:
identifying information that the first transaction is anomalous;
a user interface element to indicate the first transaction as anomalous;
(K) repeating operations (E)-(I) for a second transaction having characteristics similar to the first transaction and, based on the likelihood indicating that the second transaction is anomalous, presenting, by the mobile wallet, a second notification to the user, wherein presenting the second notification to the user includes presenting a second user interface that includes:
identifying information that the second transaction is anomalous;
a user interface element to indicate the second transaction as anomalous;
(L) receiving, from the user, an indication that the second transaction is anomalous at the user interface; and
(M) updating the set of rules based on indicating the first transaction and the second transaction as anomalous and the similarity between the first transaction and the second transaction such that indicating the first transaction and the second transaction at the user interface as anomalous clears future transactions similar to the first transaction and the second transaction when the user indicates that the second transaction is anomalous at the user interface.

### Claim at position 6

9-12. (canceled)

### Claim 13 (depends on 8)

The computer-readable medium of claim 8, wherein retrieving, based on the transaction characteristics, characteristics of the computing device at the previous time according to the time characteristic includes:
retrieving calendar information of the computing device at the previous time according to the time characteristic.

### Claim 14 (depends on 13)

The computer-readable medium of claim 13, wherein comparing the transaction characteristics with the retrieved computing device characteristics based on the set of rules to determine the likelihood that the transaction is anomalous includes:
comparing the calendar information of the computing device to the time characteristic.

### Claim 15

A system comprising:
at least one processor; and
at least one storage device comprising instructions, which when executed by the at least one processor, configure to at least one processor to perform operations comprising:
(A) determining past locations of a computing device using a global positioning system sensor of the computing device;
(B) determining times associated with the past locations of the computing device;
(C) storing the past locations and the times associated with the past locations of the computing device at a storage device of the computing device;
(D) extracting, by a mobile wallet executing at the computing device, a plurality of past transactions that have been completed over a period of time associated with a biller account, the biller account associated with a user account of a user, and wherein the biller account is configured to be paid using a mobile element of the mobile wallet stored on the computing device and the mobile wallet extracts the plurality of past transactions using optical character recognition;
(E) extracting using optical character recognition, by the mobile wallet, transaction characteristics of a first transaction of the plurality of past transactions, the transaction characteristics including a location characteristic and a time characteristic for the first transaction, the location characteristic indicating a past location where the first transaction was made and the time characteristic indicating when the first transaction was made;
(F) retrieving, by the mobile wallet, based on the transaction characteristics, corresponding characteristics of the computing device at a previous time according to the time characteristic, wherein retrieving includes:
(G) retrieving a past location of the computing device at the previous time according to the time characteristic; and
(H) comparing, by the mobile wallet, the transaction characteristics with the retrieved computing device characteristics based on a set of rules to determine a likelihood that the first transaction is anomalous, wherein comparing includes:
(I) comparing the past location of the computing device with the past location where the first transaction was made;
(J) based on the likelihood indicating that the first transaction is anomalous, presenting, by the mobile wallet, a first notification to the user , wherein presenting the first notification to the user includes presenting a first user interface that includes:
identifying information that the first transaction is anomalous;
a user interface element to indicate the first transaction as anomalous;
(K) repeating operations (E)-(I) for a second transaction having characteristics similar to the first transaction and, based on the likelihood indicating that the second transaction is anomalous, presenting, by the mobile wallet, a second notification to the user, wherein presenting the second notification to the user includes presenting a second user interface that includes:
identifying information that the second transaction is anomalous;
a user interface element to indicate the second transaction as anomalous;
(L) receiving, from the user, an indication that the second transaction is anomalous at the user interface; and
(M) updating the set of rules based on indicating the first transaction and the second transaction as anomalous and the similarity between the first transaction and the second transaction such that indicating the first transaction and the second transaction at the user interface as anomalous clears future transactions similar to the first transaction and the second transaction when the user indicates that the second transaction is anomalous at the user interface.

### Claim at position 10

16-19. (canceled)

### Claim 20 (depends on 15)

The system of claim 15, wherein retrieving, based on the transaction characteristics, characteristics of the computing device at the previous time according to the time characteristic includes:
retrieving calendar information of the computing device at the previous time according to the time characteristic.