# US 2021/0279731 A1 · System, method, and computer program product for early detection of a merchant data breach through machine-learning analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0279731 A1 - Document ID: US20210279731A1 - Status: Published application - Kind: A1 - Application number: 17/261,208 - Filed: 2018-07-23 - Published: 2021-09-09 - Earliest claimed: 2018-07-23 - Assignees: Visa International Service Association - Applicants: Visa International Service Association - Inventors: Shubham Agrawal; Claudia Carolina Barcenas Cardenas; Chiranjeet Chetia; Hangqi Zhao - Web page: https://patentgrep.com/patent/US20210279731A1 ## CPC - G06Q 20/4016: {involving fraud or risk level assessment in transaction processing} - G06F 21/554: {involving event detection and direct action} - G06N 5/02: Knowledge representation; Symbolic representation - G06N 20/00: Machine learning - G06Q 20/322: {Aspects of commerce using mobile devices [M-devices]} - G06Q 20/407: {Cancellation of a transaction} - G06Q 30/0185: {Product, service or business identity fraud} - G06Q 30/02: Marketing; Price estimation or determination; Fundraising - G06Q 40/12: Accounting - G06F 2221/034: Test or assess a computer or a system - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Described are a system, method, and computer program product for early detection of and response to a merchant data breach through machine-learning analysis. The method includes receiving transaction data associated with a plurality of transactions and receiving fraudulent transaction data representative of at least one previously identified data-breach incident. The method also includes generating a first model input dataset associated with the at least one merchant and a second model input dataset associated with the at least one previously identified data-breach incident. The method also includes training at least one machine-learning prediction model to associate merchants with a likelihood of data breach and determining at least one breached merchant of the at least one merchant. The method further includes generating a communication configured to cause at least one action to be taken in response to the determination of the at least one breached merchant. ## Claims ### Claim 1 A computer-implemented method for early detection of and response to a merchant data breach through machine-learning analysis, comprising: receiving, with at least one processor, transaction data associated with a plurality of transactions between at least one financial device holder and at least one merchant in an electronic payment processing network, the transaction data comprising, for each transaction of the plurality of transactions, an authorization request, a portable financial device identifier, and at least one of the following: transaction amount, transaction time, transaction type, merchant identifier, merchant type, or any combination thereof; receiving, with at least one processor, fraudulent transaction data representative of at least one previously identified data-breach incident; generating, with at least one processor and based at least partly on the transaction data and the fraudulent transaction data, a first model input dataset associated with the at least one merchant and a second model input dataset associated with at least one merchant of the at least one previously identified data-breach incident; training, with at least one processor and based at least partly on a comparison of the first model input dataset to the second model input dataset, at least one machine-learning prediction model to associate merchants with a likelihood of data breach; determining, with at least one processor and based at least partly on the authorization requests of the transaction data and at least partly on an output of the at least one machine-learning prediction model, at least one breached merchant of the at least one merchant; and generating, with at least one processor, a communication configured to cause at least one action to be taken in response to the determination of the at least one breached merchant, the at least one action comprising at least one of the following: communicating a message to at least one user to alert the at least one user of the at least one breached merchant; deactivating at least one portable financial device used for at least one prior transaction with the at least one breached merchant; or any combination thereof. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising determining, with at least one processor and based at least partly on the portable financial device identifiers of the transaction data, the at least one portable financial device associated with the at least one prior transaction with the at least one breached merchant, wherein the at least one action comprises deactivating the at least one portable financial device associated with the at least one prior transaction. ### Claim 3 (depends on 2) The computer-implemented method of claim 2, wherein the at least one portable financial device comprises a plurality of portable financial devices, and the at least one financial device holder comprises a plurality of financial device holders. ### Claim 4 (depends on 3) The computer-implemented method of claim 3, further comprising communicating, with at least one processor, a message to each financial device holder of the at least one financial device holder, the message being automatically generated and comprising at least part of the transaction data for a respective transaction of the financial device holder, and the message further comprising a prompt for the financial device holder to authorize a chargeback request for at least one transaction with the at least one portable financial device used for at least one prior transaction with the at least one breached merchant. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the at least one machine-learning prediction model comprises a first machine-learning prediction model and a second machine-learning prediction model that is a different type from the first machine-learning prediction model. ### Claim 6 (depends on 5) The computer-implemented method of claim 5, wherein a merchant of the at least one breached merchant is determined to be breached if either the first machine-learning prediction model or the second machine-learning prediction model identify the merchant as more likely than not to have been breached. ### Claim 7 (depends on 5) The computer-implemented method of claim 5, wherein a merchant of the at least one breached merchant is determined to be breached if both the first machine-learning prediction model and the second machine-learning prediction model identify the merchant as more likely than not to have been breached. ### Claim 8 (depends on 5) The computer-implemented method of claim 5, wherein the first machine-learning prediction model is a fully connected neural network, and the second machine-learning prediction model is a gradient boosted decision tree. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein the at least one action comprises communicating a message to the at least one user to alert the at least one user of the at least one breached merchant, the message comprising a warning notification configured to be visually represented on a display device for the at least one user to take further preventative action. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, wherein the at least one merchant comprises a plurality of merchants, and the method further comprises storing, with at least one processor and in a merchant profile database, correspondence information for a point-of-contact for each of the plurality of merchants, wherein the at least one user comprises at least one point-of-contact of the plurality of merchants. ### Claim 11 A system for early detection of and response to a merchant data breach through machine-learning analysis, the system comprising at least one server computer including at least one processor, the at least one server computer programmed and/or configured to: receive transaction data associated with a plurality of transactions between at least one financial device holder and at least one merchant in an electronic payment processing network, the transaction data comprising, for each transaction of the plurality of transactions, an authorization request, a portable financial device identifier, and at least one of the following: transaction amount, transaction time, transaction type, merchant identifier, merchant type, or any combination thereof; receive fraudulent transaction data representative of at least one previously identified data-breach incident; generate, based at least partly on the transaction data and the fraudulent transaction data, a first model input dataset associated with the at least one merchant and a second model input dataset associated with at least one merchant of the at least one previously identified data-breach incident; train, based at least partly on a comparison of the first model input dataset to the second model input dataset, at least one machine-learning prediction model to associate merchants with a likelihood of data breach; determine, based at least partly on the authorization requests of the transaction data and at least partly on an output of the at least one machine-learning prediction model, at least one breached merchant of the at least one merchant; and generate a communication configured to cause at least one action to be taken in response to the determination of the at least one breached merchant, the at least one action comprising at least one of the following: communicating a message to at least one user to alert the at least one user of the at least one breached merchant; deactivating at least one portable financial device used for at least one prior transaction with the at least one breached merchant; or any combination thereof. ### Claim 12 (depends on 11) The system of claim 11, wherein the at least one server computer is further programmed and/or configured to determine, based at least partly on the portable financial device identifiers of the transaction data, the at least one portable financial device associated with the at least one prior transaction with the at least one breached merchant, wherein the at least one action comprises deactivating the at least one portable financial device associated with the at least one prior transaction. ### Claim 13 (depends on 12) The system of claim 12, wherein the at least one portable financial device comprises a plurality of portable financial devices, and the at least one financial device holder comprises a plurality of financial device holders. ### Claim 14 (depends on 13) The system of claim 13, wherein the at least one server computer is further programmed and/or configured to communicate a message to each financial device holder of the at least one financial device holder, the message being automatically generated and comprising at least part of the transaction data for a respective transaction of the financial device holder, and the message further comprising a prompt for the financial device holder to authorize a chargeback request for at least one transaction with the at least one portable financial device used for at least one prior transaction with the at least one breached merchant. ### Claim 15 (depends on 11) The system of claim 11, wherein the at least one machine-learning prediction model comprises a first machine-learning prediction model and a second machine-learning prediction model that is a different type from the first machine-learning prediction model. ### Claim 16 (depends on 15) The system of claim 15, wherein a merchant of the at least one breached merchant is determined to be breached if either the first machine-learning prediction model or the second machine-learning prediction model identify the merchant as more likely than not to have been breached. ### Claim 17 (depends on 15) The system of claim 15, wherein a merchant of the at least one breached merchant is determined to be breached if both the first machine-learning prediction model and the second machine-learning prediction model identify the merchant as more likely than not to have been breached. ### Claim 18 (depends on 15) The system of claim 15, wherein the first machine-learning prediction model is a fully connected neural network, and the second machine-learning prediction model is a gradient boosted decision tree. ### Claim 19 (depends on 11) The system of claim 11, wherein the at least one action comprises communicating a message to the at least one user to alert the at least one user of the at least one breached merchant, the message comprising a warning notification configured to be visually represented on a display device for the at least one user to take further preventative action. ### Claim 20 (canceled) ### Claim 21 A computer program product for early detection of and response to a merchant data breach through machine-learning analysis, the computer program product comprising at least one non-transitory computer-readable medium including program instructions that, when executed by at least one processor, cause the at least one processor to: receive transaction data associated with a plurality of transactions between at least one financial device holder and at least one merchant in an electronic payment processing network, the transaction data comprising, for each transaction of the plurality of transactions, an authorization request, a portable financial device identifier, and at least one of the following: transaction amount, transaction time, transaction type, merchant identifier, merchant type, or any combination thereof; receive fraudulent transaction data representative of at least one previously identified data-breach incident; generate, based at least partly on the transaction data and the fraudulent transaction data, a first model input dataset associated with the at least one merchant and a second model input dataset associated with at least one merchant of the at least one previously identified data-breach incident; train, based at least partly on a comparison of the first model input dataset to the second model input dataset, at least one machine-learning prediction model to associate merchants with a likelihood of data breach; determine, based at least partly on the authorization requests of the transaction data and at least partly on an output of the at least one machine-learning prediction model, at least one breached merchant of the at least one merchant; and generate a communication configured to cause at least one action to be taken in response to the determination of the at least one breached merchant, the at least one action comprising at least one of the following: communicating a message to at least one user to alert the at least one user of the at least one breached merchant; deactivating at least one portable financial device used for at least one prior transaction with the at least one breached merchant; or any combination thereof. ### Claim at position 22 -30. (canceled)