Communications-service fraud detection using special social connection

One or more nontransitory computer-readable media having computer-executable instructions embodied thereon that, when executed, perform a method of detecting fraud, the method comprising:

• receiving data that describes a plurality of communication records that are associated with a destination identifier, wherein the destination identifier is associated with a communication device, and wherein the data is related to activity that took place over a given period of time;
• extracting a plurality of source identifiers from said plurality of communication records, wherein each source identifier identifies a source of a communication received by the communication device;
• for each of said source identifiers, determining whether said source identifier is classified as fraudulent or nonfraudulent;
• based on a number of fraudulent source identifiers and a number of nonfraudulent source identifiers, calculating a fraud metric associated with the destination identifier.

A system for detecting fraud, comprising:

• a device classification component that performs a method comprising:
• (A) receiving a first data set that describes a plurality of communication outgoing records that are associated with a communications device, wherein the data is related to activity that took place over a first period of time;
• (B) extracting a plurality of destination identifiers from said plurality of outgoing communication records;
• (C) initializing a fraud hypothesis variable associated with said communications device;
• (D) for each destination identifier of a portion of said plurality of destination identifiers, obtaining from a destination classification component a fraud metric associated with the destination identifier, wherein the fraud metric is based at least in part on an amount of fraudulent communications associated with the destination identifier;
• (E) for each destination identifier of the portion of said plurality of destination identifiers, modifying said fraud hypothesis variable associated with said communications device based on the fraud metric associated with said destination identifier;
• and
• (F) comparing said fraud hypothesis variable to a first predetermined threshold;
• (G) when said fraud hypothesis variable exceeds said first predetermined threshold, generating a fraud indication that is related to said communications device;
• and
• (H) passing said fraud indication to a confirmation component;
• the destination classification component that performs a method comprising:
• (A) receiving a second data set that describes a plurality of communication records that are associated with a potentially fraudulent destination identifier, wherein the data set is related to activity that took place over a second period of time;
• (B) extracting a plurality of source identifiers from said plurality of communication records;
• (C) for each source identifier of said plurality of source identifiers, determining whether said source identifier has been classified as fraudulent or non-fraudulent by the device classification component and confirmed as fraudulent by the confirmation component;
• (D) based on a number of source identifiers that have been classified as fraudulent and a number of source identifiers that have been classified as non-fraudulent, calculating a fraud metric associated with the destination identifier;
• and
• (E) passing the fraud metric to the device classification component upon request;
• and
• a confirmation component that performs a method comprising:
• (A) receiving fraud indications from the device classification component;
• (B) for each fraud indication so received, determining whether said fraud indication requires corroboration;
• (C) if said fraud indication requires corroboration, performing additional analysis to classify a device associated with the fraud indication as fraudulent or non-fraudulent;
• (D) if said fraud indication does not require corroboration, classifying the device associated with the fraud indication as fraudulent;
• (E) passing a result of said classifying to the destination classification component upon request.