# US 2025/0148469 A1 · Deposit fraud detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0148469 A1 - Document ID: US20250148469A1 - Status: Published application - Kind: A1 - Application number: 18/386,848 - Filed: 2023-11-03 - Published: 2025-05-08 - Earliest claimed: 2023-11-03 - Assignees: Fmr LLC - Applicants: Fmr LLC - Inventors: ANDREW WIRTHLIN; JOHN ECONOMIDIS; PRAFUL IYER; BRADLEY CARRIER - Web page: https://patentgrep.com/patent/US20250148469A1 ## CPC - G06Q 20/4016: {involving fraud or risk level assessment in transaction processing} - G06Q 20/10: specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems - G06Q 40/024: {Anti-fraud, anti-money laundering or know-your-customer} - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract A computerized method is provided for automatic monitoring and detection of deposit fraud. Methods can include receiving, by a computing device, user account information, assessing the user account information to determine a fraud risk score and, if sufficient, adding the account to a watchlist for additional monitoring. ## Claims ### Claim 1 A computerized method for identifying a fraudulent electronic funds transfer (EFT), the method comprising: receiving, at a computing device, user account information for an account depositing funds using EFT; evaluating the user account information to assign a risk score to the user account; determining that the risk score for the user account is greater than a threshold risk score; adding the user account to a watchlist database for fraud detection; calculating a number of infractions for the added user account and, when the number of infractions is greater than a selected infraction threshold, marking the deposit for further review, wherein calculating the number of infractions includes one or more of analyzing the user account information for a number of authentication infractions, analyzing user deposit records for suspicious activity, analyzing disbursement records for suspicious activity, analyzing user account for suspicious activity, analyzing user deposit records for deposits in bad order, and importing one or more third-party fraud risk scores. ### Claim 2 (depends on 1) The computerized method of claim 1, wherein calculating the number of infractions comprises assigning a weight to each of the infractions. ### Claim 3 (depends on 1) The computerized method of claim 1, wherein assigning a risk score to the user account comprises validating user-provided information submitted in an account application against independently obtained user information. ### Claim 4 (depends on 1) The computerized method of claim 1, wherein the authentication infractions comprise mismatches between user-provided information and corresponding independently obtained user information. ### Claim 5 (depends on 1) The computerized method of claim 1, wherein analyzing the user deposit records for suspicious activity comprises one or more of identifying past returned checks and identifying failed deposits. ### Claim 6 (depends on 1) The computerized method of claim 1, wherein analyzing disbursement records for suspicious activity comprises one or more of identifying recent changes in outgoing payment instructions for the user and identifying disbursements occurring in close proximity to deposits. ### Claim 7 (depends on 1) The computerized method of claim 1, wherein analyzing the user account for suspicious activity, comprises identifying one or more of recent changes in user account information, recent changes in user contact information, invalid contact information, failed login attempts, changes to login methods, recent high-risk logins by user, geographic location of user contact information in a high risk area, geographic location of a user login in a high risk area, differences between geographical location of user contact information, and geographical location of user login. ### Claim 8 (depends on 1) The computerized method of claim 1, further comprising altering a number of processing threads used for evaluating the user account information or calculating the number of infractions based on one or more of a number of new use accounts to evaluate and a total number of user accounts in the watchlist database. ### Claim 9 (depends on 1) The computerized method of claim 1, further comprising setting parameters for the evaluating and calculating steps comprising one or more of entering the threshold risk score, entering a time-out period for removing a user account from the watchlist database, entering a threshold deposit amount required before marking the deposit for further review, entering a path to direct deposits for further review, and entering the selected infraction threshold. ### Claim 10 (depends on 1) The computerized method of claim 1, wherein the calculating step is automatically repeated periodically for each user account in the watchlist database. ### Claim 11 (depends on 10) The computerized method of claim 10, wherein the calculating step is automatically repeated at least once per hour for each user account in the watchlist database. ### Claim 12 (depends on 10) The computerized method of claim 10, further comprising removing the user account from the watchlist database where the number of infractions for the added user account is below a monitoring threshold. ### Claim 13 (depends on 1) The computerized method of claim 1, further comprising removing the user account from the watchlist database after a selected period of user inactivity. ### Claim 14 (depends on 1) The computerized method of claim 1, wherein marking for further review comprises sending one or more of the user account information, the assigned risk score, and the calculated number of infractions to an analyst for manual review. ### Claim 15 (depends on 1) The computerized method of claim 1, wherein marking for further review comprises prompting the user for additional information. ### Claim 16 A system for identifying a fraudulent electronic funds transfer (EFT), the system comprising a server computing device comprising a processor and a memory storing instructions that, when executed by the processor, cause the processor to perform the steps of: receiving, at a computing device, user account information for an account depositing funds using EFT; evaluating the user account information to assign a risk score to the user account; determining that the risk score is greater than a threshold risk score; adding the user account to a watchlist database for fraud detection; calculating a number of infractions for the added user account and, where the number of infractions is greater than a selected infraction threshold, marking the deposit for further review, wherein calculating the number of infractions includes one or more of analyzing the user account information for a number of authentication infractions, analyzing user deposit records for suspicious activity, analyzing disbursement records for suspicious activity, analyzing user account for suspicious activity, analyzing user deposit records for deposits in bad order, and importing one or more third-party fraud risk scores. ### Claim 17 (depends on 16) The system of claim 16, wherein the server computing device is further operable to alter a number of processing threads used for evaluating the user account information or calculating the number of infractions based on one or more of a number of new use accounts to evaluate and a total number of user accounts in the watchlist database. ### Claim 18 (depends on 16) The system of claim 16, wherein the calculating step is automatically repeated periodically for each user account in the watchlist database. ### Claim 19 (depends on 18) The system of claim 18, further comprising removing the user account from the watchlist database where the number of infractions for the added user account is below a monitoring threshold. ### Claim 20 (depends on 16) The system of claim 16, wherein the server computing device is further operable to remove the user account from the watchlist database after a selected period of user inactivity.