# US 2025/0159080 A1 · Caller verification via carrier metadata

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2025/0159080 A1
- Document ID: US20250159080A1
- Status: Published application
- Kind: A1
- Application number: 19/023,199
- Filed: 2025-01-15
- Published: 2025-05-15
- Earliest claimed: 2019-08-19
- Assignees: Pindrop Security, Inc.
- Applicants: Pindrop Security, Inc.
- Inventors: John Cornwell; Terry Nelms, II
- Web page: https://patentgrep.com/patent/US20250159080A1

## CPC

- H04M 3/5175: {Call or contact centers supervision arrangements}
- G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting
- G06F 18/241: relating to the classification model, e.g. parametric or non-parametric approaches
- H04M 3/2218: {Call detail recording}
- H04M 3/2281: {Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls}
- H04M 3/42059: {Making use of the calling party identifier}
- G06V 2201/10: Recognition assisted with metadata
- H04M 3/436: Arrangements for screening incoming calls {, i.e. evaluating the characteristics of a call before deciding whether to answer it (based on the calling party profile H04M3/42059; based on location H04M3/42348; based on presence H04M3/42365; diversion H04M3/54)}
- H04M 2203/6027: Fraud preventions
- H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06V: IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING

## Abstract

Embodiments described herein provide for passive caller verification and/or passive fraud risk assessments for calls to customer call centers. Systems and methods may be used in real time as a call is coming into a call center. An analytics server of an analytics service looks at the purported Caller ID of the call, as well as the unaltered carrier metadata, which the analytics server then uses to generate or retrieve one or more probability scores using one or more lookup tables and/or a machine-learning model. A probability score indicates the likelihood that information derived using the Caller ID information has occurred or should occur given the carrier metadata received with the inbound call. The one or more probability scores be used to generate a risk score for the current call that indicates the probability of the call being valid (e.g., originated from a verified caller or calling device, non-fraudulent).

## Claims

### Claim 1

A computer-implemented method comprising:
receiving, by a computer, a plurality of labels entered at a graphical user interface corresponding to a plurality of prior calls stored in one or more databases, each label of the plurality of labels indicating call data of each prior call as fraudulent or non-fraudulent;
obtaining, by the computer, the call data for a current call originated at a calling device, the call data includes one or more carrier metadata values of one or more types of carrier metadata values, each carrier metadata value of the one or more types of carrier metadata values mapped to a fraudulent probability according to a probability table;
generating, by the computer, a first score for the current call based upon comparing the call data for the current call against the call data of one or more prior calls stored in the one or more databases;
identifying, by the computer, a first label of the plurality of labels that corresponds with a portion of the call data of the current call;
updating, by the computer, the first score for the current call and the fraudulent probability of the probability table for the current call based upon the first label and the one or more carrier metadata values; and
identifying, by the computer, the current call as fraudulent according to the first score as updated and the fraudulent probability.

### Claim 2 (depends on 1)

The method according to claim 1, wherein the call data of the one or more prior calls includes a stored fraud likelihood score for the carrier metadata value in the call data, and wherein the computer generates the first score according to the stored fraud likelihood score for the carrier metadata value.

### Claim 3 (depends on 1)

The method according to claim 1, wherein the call data of the one or more prior calls includes prior carrier metadata value in the call data, and wherein the computer generates the first score based upon comparing the prior carrier metadata value against the carrier metadata value of the call data of the current call.

### Claim 4 (depends on 1)

The method according to claim 1, wherein updating the first score for the current call and the fraudulent probability includes adjusting, by the computer, the first score in accordance with at least one label and the one or more carrier metadata values.

### Claim 5 (depends on 1)

The method according to claim 1, wherein the first label indicates that a first call of the plurality of prior calls is fraudulent, and wherein the computer updates the first score to indicate the current call as fraudulent.

### Claim 6 (depends on 1)

The method of claim 1, further comprising training, by the computer, a machine learning model to predict a second score according to the plurality of labels indicating fraudulence for each call in the one or more prior calls.

### Claim 7 (depends on 1)

The method according to claim 1, further comprising verifying, by the computer, the calling device in response to determining that the first score satisfies a verification threshold that the carrier metadata value for the current call is associated with a verified calling device.

### Claim 8 (depends on 1)

The method according to claim 1, further comprising detecting, by the computer, the current call as fraudulent in response to determining that the first score satisfies a fraud risk threshold.

### Claim 9 (depends on 1)

The method according to claim 1, further comprising generating, by the computer, a notification for display on the graphical user interface in response to the first score satisfying a fraud risk threshold, the notification indicating one or more remedial actions to address the current call as identified as fraudulent.

### Claim 10 (depends on 1)

The method according to claim 1, wherein at least one carrier metadata value indicates at least one of: Jurisdiction Information Parameter (JIP), Originating Line Information (OLI), P-Asserted-Identity, an originating switch, an originating trunk, or Caller ID.

### Claim 11 (depends on 1)

The method according to claim 1, wherein at least one carrier metadata value indicates at least one of: a carrier, a geographic location, or a line type.

### Claim 12

A system comprising:
a computer comprising a processor configured to:
receive a plurality of labels entered at a graphical user interface corresponding to a plurality of prior calls stored in one or more databases, each label of the plurality of labels indicating call data of each prior call as fraudulent or non-fraudulent;
obtain the call data for a current call originated at a calling device, the call data including one or more carrier metadata values of one or more types of carrier metadata values, each carrier metadata value of the one or more types of carrier metadata values mapped to a fraudulent probability according to a probability table;
generate a first score for the current call based upon comparing the call data for the current call against the call data of one or more prior calls stored in the one or more databases;
identify a first label of the plurality of labels that corresponds with a portion of the call data of the current call;
update the first score for the current call and the fraudulent probability of the probability table for the current call based upon the first label and the one or more carrier metadata values; and
identify the current call as fraudulent according to the first score as updated and the fraudulent probability.

### Claim 13 (depends on 12)

The system according to claim 12, wherein the call data of the one or more prior calls includes a stored fraud likelihood score for the carrier metadata value in the call data, and wherein the computer generates the first score according to the stored fraud likelihood score for the carrier metadata value.

### Claim 14 (depends on 12)

The system according to claim 12, wherein the call data of the one or more prior calls includes prior carrier metadata value in the call data, and wherein the computer generates the first score based upon comparing the prior carrier metadata value against the carrier metadata value of the call data of the current call.

### Claim 15 (depends on 12)

The system according to claim 12, wherein, when updating the first score for the current call and the fraudulent probability, the computer is configured to adjust the first score in accordance with at least one label and the one or more carrier metadata values.

### Claim 16 (depends on 12)

The system according to claim 12, wherein the first label indicates that a first call of the plurality of prior calls is fraudulent, and wherein the computer updates the first score to indicate the current call as fraudulent.

### Claim 17 (depends on 12)

The system according to claim 12, wherein the computer is configured to train a machine learning model to predict a second score according to the plurality of labels indicating fraudulence for each call in the one or more prior calls.

### Claim 18 (depends on 12)

The system according to claim 12, wherein the computer is configured to verify the calling device in response to determining that the first score satisfies a verification threshold that the carrier metadata value for the current call is associated with a verified calling device.

### Claim 19 (depends on 12)

The system according to claim 12, wherein the computer is configured to detect the current call as fraudulent in response to determining that the first score satisfies a fraud risk threshold.

### Claim 20 (depends on 12)

The system according to claim 12, wherein the computer is configured to generate a notification for display on the graphical user interface in response to the first score satisfying a fraud risk threshold, the notification indicating one or more remedial actions to address the current call as identified as fraudulent.