# US 2021/0279732 A1 · Systems and methods for identifying fraudulent common point of purchases

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0279732 A1
- Document ID: US20210279732A1
- Status: Published application
- Kind: A1
- Application number: 17/328,832
- Filed: 2021-05-24
- Published: 2021-09-09
- Earliest claimed: 2017-12-15
- Assignees: Mastercard International Incorporated
- Applicants: Mastercard International Incorporated
- Inventors: Joshua A. Allbright; Christopher John Merz
- Web page: https://patentgrep.com/patent/US20210279732A1

## CPC

- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- G06F 16/2282: {Tablespace storage structures; Management thereof}
- G06F 16/90335: {Query processing}
- G06F 16/951: Indexing; Web crawling techniques
- G06F 16/955: using information identifiers, e.g. uniform resource locators [URL]
- G06Q 20/34: using cards, e.g. integrated circuit [IC] cards or magnetic cards
- G06Q 20/36: using electronic wallets or electronic money safes
- G06Q 20/409: {Device specific authentication in transaction processing}
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A common point of purchase (CPP) system for identifying a common point of purchases involved in fraudulent or unauthorized payment transactions is provided. The CPP system includes a common point of purchase (CPP) computing device that is configured to receive transaction data, store the transaction data in a database, and perform a look up within the database. The CPP computing device is also configured to build a merchant table, receive a card list, and compare a plurality of flagged account identifiers in the card list to account identifiers in the merchant table. The CPP computing device is further configured to retrieve a unique merchant identifier and/or a merchant name identifier associated with the merchant table account identifiers matched with the flagged account identifiers, aggregate the unique merchant identifier using the merchant name identifier, and determine a first number of the flagged account identifiers associated with the merchant name identifier.

## Claims

### Claim at position 1

1-24. (canceled)

### Claim 25

A common point of purchase (CPP) computing device comprising a processor communicatively coupled to a memory, the CPP computing device configured to:
receive transaction data stored by a payment processor from a first plurality of transactions processed by the payment processor, the first plurality of transactions initiated by a first plurality of users at a plurality of merchants, the transaction data including, for each of the transactions, a unique merchant ID, a time stamp, and an account ID, wherein the time stamps for each of the first plurality of transactions fall within a first time period;
build, in a database, a merchant table including a plurality of records, each record pairing one of the unique merchant IDs and a corresponding one of the account IDs, the corresponding one of the account IDs associated with the unique merchant ID in at least one of the transactions over the first time period, comprising including each pairing in no more than one of the records;
receive a list of flagged account IDs from a third party;
retrieve, from the merchant table, the unique merchant ID from every record that includes one of the flagged account IDs;
parse the merchant table to determine (i) a respective total number of account IDs associated with each retrieved unique merchant ID and (ii) a respective total number of flagged account IDs associated with each retrieved unique merchant ID;
compute a metric for each retrieved unique merchant ID based on a number of flagged account IDs in the list, the total number of account IDs associated with the retrieved unique merchant identifier, the total number of flagged account IDs associated with the retrieved unique merchant identifier, and a total number of unique account IDs in the merchant table; and
cause a client system to display a report identifying a subset of the unique merchant IDs as compromised merchant locations based on the metric.

### Claim 26 (depends on 25)

The CPP device according to claim 25, further configured to compute the metric by steps including:
forming a first ratio of the number of flagged account IDs in the list multiplied by the total number of account IDs associated with the retrieved unique merchant identifier, divided by the total number of unique account IDs in the merchant table;
squaring a quantity formed by multiplying the total number of flagged account IDs associated with the retrieved unique merchant identifier by the first ratio; and
determining the metric includes dividing the squared quantity by the first ratio.

### Claim 27 (depends on 26)

The CPP device according to claim 26, further configured to identify the subset by ranking the retrieved unique merchant IDs according to the metric.

### Claim 28 (depends on 27)

The CPP device according to claim 27, further configured to categorize, in the report, a risk of the retrieved unique merchant IDs being compromised as low, medium, or high.

### Claim 29 (depends on 25)

The CPP device according to claim 25, further configured to report unique account IDs that are (i) not on the list and (ii) in a record with one of the subset of unique merchant IDs, to a respective issuer bank of the unique account ID as potentially compromised, prior to any known fraudulent use of the unique account ID.

### Claim 30 (depends on 25)

The CPP device according to claim 25, wherein the total number of unique account IDs in the merchant table exceeds 100,000,000.

### Claim 31 (depends on 25)

The CPP device according to claim 25, further configured to:
receive subsequent transaction data stored by the payment processor from a second plurality of transactions processed by the payment processor, wherein the time stamps for each of the second plurality of transactions fall within a second time period subsequent to the first time period;
update the merchant table in the database by adding new records for pairings of the unique merchant IDs and the corresponding account IDs in the second plurality of transactions for which no records were generated based on the first plurality of transaction data; and
re-compute the metric based on the updated merchant table.

### Claim 32

A computer-implemented method for identifying a common point of purchases involved in fraudulent or unauthorized payment transactions, said method implemented using a common point of purchase (CPP) computing device in communication with a memory, said method comprising steps executed by the processor of:
receiving transaction data stored by a payment processor from a first plurality of transactions processed by the payment processor, the first plurality of transactions initiated by a first plurality of users at a plurality of merchants, the transaction data including, for each of the transactions, a unique merchant ID, a time stamp, and an account ID, wherein the time stamps for each of the first plurality of transactions fall within a first time period;
building, in a database, a merchant table including a plurality of records, each record pairing one of the unique merchant IDs and a corresponding one of the account IDs, the corresponding one of the account IDs associated with the unique merchant ID in at least one of the transactions over the first time period, comprising including each pairing in no more than one of the records;
receiving a list of flagged account IDs from a third party;
retrieving, from the merchant table, the unique merchant ID from every record that includes one of the flagged account IDs;
parsing the merchant table to determine (i) a respective total number of account IDs associated with each retrieved unique merchant ID and (ii) a respective total number of flagged account IDs associated with each retrieved unique merchant ID;
computing a metric for each retrieved unique merchant ID based on a number of flagged account IDs in the list, the total number of account IDs associated with the retrieved unique merchant identifier, the total number of flagged account IDs associated with the retrieved unique merchant identifier, and a total number of unique account IDs in the merchant table; and
causing a client system to display a report identifying a subset of the unique merchant IDs as compromised merchant locations based on the metric.

### Claim 33 (depends on 32)

The method according to claim 32, further comprising computing the metric by steps including:
forming a first ratio of the number of flagged account IDs in the list multiplied by the total number of account IDs associated with the retrieved unique merchant identifier, divided by the total number of unique account IDs in the merchant table;
squaring a quantity formed by multiplying the total number of flagged account IDs associated with the retrieved unique merchant identifier by the first ratio; and
determining the metric includes dividing the squared quantity by the first ratio.

### Claim 34 (depends on 33)

The method according to claim 33, further comprising identifying the subset by ranking the retrieved unique merchant IDs according to the metric.

### Claim 35 (depends on 34)

The method according to claim 34, further comprising categorizing, in the report, a risk of the retrieved unique merchant IDs being compromised as low, medium, or high.

### Claim 36 (depends on 32)

The method according to claim 32, further comprising reporting unique account IDs that are (i) not on the list and (ii) in a record with one of the subset of unique merchant IDs, to a respective issuer bank of the unique account ID as potentially compromised, prior to any known fraudulent use of the unique account ID.

### Claim 37 (depends on 32)

The method according to claim 32, wherein building the merchant table includes adding records associated for a total number of unique account IDs exceeding 100,000,000.

### Claim 38 (depends on 32)

The method according to claim 32, further comprising:
receiving subsequent transaction data stored by the payment processor from a second plurality of transactions processed by the payment processor, wherein the time stamps for each of the second plurality of transactions fall within a second time period subsequent to the first time period;
updating the merchant table in the database by adding new records for pairings of the unique merchant IDs and the corresponding account IDs in the second plurality of transactions for which no records were generated based on the first plurality of transaction data; and
re-computing the metric based on the updated merchant table.

### Claim 39

A non-transitory computer-readable storage media having computer-executable instructions embodied thereon, wherein when executed by a common point of purchase (CPP) computing device having at least one processor coupled to at least one memory device, the computer-executable instructions cause the at least one processor to:
receive transaction data stored by a payment processor from a first plurality of transactions processed by the payment processor, the first plurality of transactions initiated by a first plurality of users at a plurality of merchants, the transaction data including, for each of the transactions, a unique merchant ID, a time stamp, and an account ID, wherein the time stamps for each of the first plurality of transactions fall within a first time period;
build, in a database, a merchant table including a plurality of records, each record pairing one of the unique merchant IDs and a corresponding one of the account IDs, the corresponding one of the account IDs associated with the unique merchant ID in at least one of the transactions over the first time period, comprising including each pairing in no more than one of the records;
receive a list of flagged account IDs from a third party;
retrieve, from the merchant table, the unique merchant ID from every record that includes one of the flagged account IDs;
parse the merchant table to determine (i) a respective total number of account IDs associated with each retrieved unique merchant ID and (ii) a respective total number of flagged account IDs associated with each retrieved unique merchant ID;
compute a metric for each retrieved unique merchant ID based on a number of flagged account IDs in the list, the total number of account IDs associated with the retrieved unique merchant identifier, the total number of flagged account IDs associated with the retrieved unique merchant identifier, and a total number of unique account IDs in the merchant table; and
cause a client system to display a report identifying a subset of the unique merchant IDs as compromised merchant locations based on the metric.

### Claim 40 (depends on 39)

The non-transitory computer-readable storage media according to claim 39, wherein the computer-executable instructions further cause the at least one processor to perform steps including:
forming a first ratio of the number of flagged account IDs in the list multiplied by the total number of account IDs associated with the retrieved unique merchant identifier, divided by the total number of unique account IDs in the merchant table;
squaring a quantity formed by multiplying the total number of flagged account IDs associated with the retrieved unique merchant identifier by the first ratio; and
determining the metric includes dividing the squared quantity by the first ratio.

### Claim 41 (depends on 40)

The non-transitory computer-readable storage media according to claim 40, wherein the computer-executable instructions further cause the at least one processor to identify the subset by ranking the retrieved unique merchant IDs according to the metric.

### Claim 42 (depends on 41)

The non-transitory computer-readable storage media according to claim 41, wherein the computer-executable instructions further cause the at least one processor to categorize, in the report, a risk of the retrieved unique merchant IDs being compromised as low, medium, or high.

### Claim 43 (depends on 39)

The CPP device according to claim 39, wherein the computer-executable instructions further cause the at least one processor to report unique account IDs that are (i) not on the list and (ii) in a record with one of the subset of unique merchant IDs, to a respective issuer bank of the unique account ID as potentially compromised, prior to any known fraudulent use of the unique account ID.

### Claim 44 (depends on 39)

The non-transitory computer-readable storage media according to claim 39, wherein the computer-executable instructions further cause the at least one processor to:
receive subsequent transaction data stored by the payment processor from a second plurality of transactions processed by the payment processor, wherein the time stamps for each of the second plurality of transactions fall within a second time period subsequent to the first time period;
update the merchant table in the database by adding new records for pairings of the unique merchant IDs and the corresponding account IDs in the second plurality of transactions for which no records were generated based on the first plurality of transaction data; and
re-compute the metric based on the updated merchant table.