Adaptive Validation and Remediation Systems and Methods for Credential Fraud

A device comprising:

• one or more processors;
• a non-transitory memory;
• and
• one or more programs stored in the non-transitory memory, which, when executed by the one or more processors, cause the device to:
• determine, for a plurality of media service accounts, corresponding fraud suspicion values based on a model;
• identify a plurality of suspected accounts from the plurality of media service accounts based on the corresponding fraud suspicion values, wherein each of the plurality of suspect accounts has a corresponding fraud suspicion value that satisfies an account fraud detection criterion;
• identify one or more devices in each of the plurality of suspected accounts, wherein each of the one or more devices is associated with a device risk value that satisfies a device risk criterion;
• predict a likelihood of account takeover from each of the one or more devices associated with each of the suspected accounts;
• detect a triggering event from a device of the one or more devices associated with an account;
• and
• execute at least one of a validation procedure or a remediation procedure in response to the triggering event and based on a trigger sensitivity value associated with the triggering event, a respective likelihood of account takeover for the device associated with the account, a respective device risk value associated with the device, and a respective fraud suspicion value associated with the account.

A method comprising:

• at a device including a processor and a non-transitory memory:
• obtaining a trigger sensitivity value associated with a triggering event from one or more devices associated with one or more media service accounts;
• requesting from a model fraudulent classifications of the one or more media service accounts and the one or more devices associated with the one or more media service accounts, wherein the fraudulent classifications indicate a respective likelihood of account takeover from a respective device of the one or more devices, a respective device risk value associated with the respective device associated with a respective media service account of the one or more media service accounts, and a respective fraud suspicion value associated with the respective media service account;
• receiving from the model the fraudulent classifications of the one or more media service accounts and the one or more devices;
• and
• causing executing at least one of a validation procedure or a remediation procedure corresponding to the fraudulent classifications and the trigger sensitivity value.

A device comprising:

• one or more processors;
• a non-transitory memory;
• and
• one or more programs stored in the non-transitory memory, which, when executed by the one or more processors, cause the device to:
• obtain a trigger sensitivity value associated with a triggering event from one or more devices associated with one or more media service accounts;
• request from a model fraudulent classifications of the one or more media service accounts and the one or more devices associated with the one or more media service accounts, wherein each of the fraudulent classifications indicates a likelihood of account takeover from a respective device of the one or more devices, a respective device risk value associated with the respective device associated with a respective media service account of the one or more media service accounts, and a respective fraud suspicion value associated with the respective media service account;
• receive the fraudulent classifications of the one or more media service accounts and the one or more devices from the model;
• and
• cause executing at least one of a validation procedure or a remediation procedure corresponding to the fraudulent classifications and the trigger sensitivity value.