Systems and methods for improved detection of network fraud events

A computing system for detecting fraudulent network events in a payment card network, said computing system comprising at least one processor and a memory storing instructions executable by the at least one processor to execute a merchant profiling engine configured to:

• receive a plurality of scored payment card transaction authorization requests originating from a plurality of merchants, wherein each of the scored payment card transaction authorization requests is associated with a respective preliminary fraud score that is proportional to indicia of fraud present in an individual transaction corresponding to the respective scored payment card transaction authorization request;
• generate, for each of a plurality of merchant groups of the plurality of merchants, a respective data structure, wherein the data structure sorts the scored payment card transaction authorization requests associated with the respective merchant group over a plurality of fraud score range stripes, each of the fraud score range stripes defined by an upper fraud score threshold and a lower fraud score threshold and including one or more of the scored payment card transaction authorization requests having a value of the corresponding preliminary fraud score therebetween;
• parse each of the data structures over a plurality of time periods, wherein each of the time periods extends back over a respective predetermined interval from a common starting point;
• calculate, for each merchant group for each of the time periods, at least one cumulative metric from the one or more scored payment card transaction authorization requests associated with each of the fraud score range stripes;
• determine, for each merchant group, a plurality of ratio striping values, each of the ratio striping values being a ratio of a first value of the at least one cumulative metric in a first of the fraud score range stripes from a first time period with respect to a second value of the at least one cumulative metric in the first fraud score range stripe from a second time period, wherein the second time period extends back farther in time than the first time period resulting in each of the plurality of ratio striping values being constrained to have values between zero and one;
• and
• output, in response to a ratio striping value for a first fraud score range stripe for one of the merchant groups approaching a value of 1, a potential fraud attack alert to the one of the merchant groups, wherein the upper fraud score threshold of the first fraud score range stripe corresponds to a low indicia of fraud present in the individual scored payment card transaction authorization requests for the one of the merchant groups in the first fraud score range stripe.

A computer-implemented method for detecting fraudulent events in a payment card network, said method implemented by a computing device having at least one processor, said method comprising steps performed by the at least one processor of:

• receiving a plurality of scored payment card transaction authorization requests originating from a plurality of merchants, wherein each of the scored payment card transaction authorization requests is associated with a respective preliminary fraud score that is proportional to indicia of fraud present in an individual transaction corresponding to the respective scored payment card transaction authorization request;
• generating, for each of a plurality of merchant groups of the plurality of merchants, a respective data structure, wherein the data structure sorts the scored payment card transaction authorization requests associated with the respective merchant group over a plurality of fraud score range stripes, each of the fraud score range stripes defined by an upper fraud score threshold and a lower fraud score threshold and including one or more of the scored payment card transaction authorization requests having a value of the corresponding preliminary fraud score therebetween;
• parsing each of the data structures over a plurality of time periods, wherein each of the time periods extends back over a respective predetermined interval from a common starting point;
• calculating, for each merchant group for each of the time periods, at least one cumulative metric from the one or more scored payment card transaction authorization requests associated with each of the fraud score range stripes;
• determining, for each merchant group, a plurality of ratio striping values, each of the ratio striping values being a ratio of a first value of the at least one cumulative metric in a first of the fraud score range stripes from a first time period with respect to a second value of the at least one cumulative metric in the first fraud score range stripe from a second time period, wherein the second time period extends back farther in time than the first time period resulting in each of the plurality of ratio striping values being constrained to have values between zero and one;
• and
• outputting, in response to a ratio striping value for a first fraud score range stripe for one of the merchant groups approaching a value of 1, a potential fraud attack alert to the one of the merchant groups, wherein the upper fraud score threshold of the first fraud score range stripe corresponds to a low indicia of fraud present in the individual scored payment card transaction authorization requests for the one of the merchant groups in the first fraud score range stripe.

At least one non-transitory computer-readable storage media having computer-executable instructions embodied thereon wherein, when executed by at least one processor, the computer-executable instructions cause the at least one processor to:

• receive a plurality of scored payment card transaction authorization requests originating from a plurality of merchants, wherein each of the scored payment card transaction authorization requests is associated with a respective preliminary fraud score that is proportional to indicia of fraud present in an individual transaction corresponding to the respective scored payment card transaction authorization request;
• generate, for each of a plurality of merchant groups of the plurality of merchants, a respective data structure, wherein the data structure sorts the scored payment card transaction authorization requests associated with the respective merchant group over a plurality of fraud score range stripes, each of the fraud score range stripes defined by an upper fraud score threshold and a lower fraud score threshold and including one or more of the scored payment card transaction authorization requests having a value of the corresponding preliminary fraud score therebetween;
• parse each of the data structures over a plurality of time periods, wherein each of the time periods extends back over a respective predetermined interval from a common starting point;
• calculate, for each merchant group for each of the time periods, at least one cumulative metric from the one or more scored payment card transaction authorization requests associated with each of the fraud score range stripes;
• determine, for each merchant group, a plurality of ratio striping values, each of the ratio striping values being a ratio of a first value of the at least one cumulative metric in a first of the fraud score range stripes from a first time period with respect to a second value of the at least one cumulative metric in the first fraud score range stripe from a second time period, wherein the second time period extends back farther in time than the first time period resulting in each of the plurality of ratio striping values being constrained to have values between zero and one;
• and
• output, in response to a ratio striping value for a first fraud score range stripe for one of the merchant groups approaching a value of 1, a potential fraud attack alert to the one of the merchant groups, wherein the upper fraud score threshold of the first fraud score range stripe corresponds to a low indicia of fraud present in the individual scored payment card transaction authorization requests for the one of the merchant groups in the first fraud score range stripe.