System and method for detecting malicious payment transaction activity using aggregate views of payment transaction data in a distributed network environment

A method, comprising

• at a server computer coupled to a plurality of user devices and a plurality of payment gateways through a computer network, the server computer including a data store including aggregated data for a plurality of payment transactions conducted with the plurality of payment gateways through the computer network:
• receiving a form request from a first user device over the computer network in association with a web page of a merchant organization including a widget;
• providing a form definition to the first user device over the computer network in response to the form request, wherein a form having one or more fields for entering payment information is presented to a user in the web page at the first user device when the form definition is rendered by the widget;
• storing form definition data as part of the aggregated data;
• receiving a first form response over the computer network, the first form response sent using the form and including first payment information for a requested first payment transaction;
• storing first form response data associated with the first form response in association with the form definition data as part of the aggregated data;
• submitting a gateway request for the requested first payment transaction to a payment gateway over the computer network;
• receiving a gateway response from the payment gateway over the computer network, wherein the gateway response includes a transaction response code indicating a result of the requested first payment transaction;
• storing gateway response data associated with the gateway response in association with the form response data and form definition data as part of the aggregated data;
• at a time interval:
• accessing a fraud prevention rule, the fraud prevention rule including a pattern for identifying one more sets of data that matches the pattern, and
• evaluating the fraud prevention rule against the aggregated data, including generating an identifier for each matching set of data based on that set of data and storing the identifiers for each of the matching sets of data as a fraud prevention list corresponding to that fraud prevention rule;
• accessing the fraud prevention list;
• generating a current identifier for a second payment transaction based on a second form response received from a second user device;
• determining that the current identifier matches any identifier of the fraud prevention list and identifying the second payment transaction as fraudulent based on the determination that the current identifier matches any identifier of the fraud prevention list;
• and
• generating a fraud prevention response without submitting the second payment transaction to the payment gateway based on the identification of the second payment transaction as fraudulent.

A non-transitory computer readable media, comprising instructions for:

• receiving a form request from a first user device over the computer network in association with a web page of a merchant organization including a widget, wherein the form request is received at a server computer coupled to a plurality of user devices and a plurality of payment gateways through the computer network, the server computer including a data store including aggregated data for a plurality of payment transactions conducted with the plurality of payment gateways through the computer network;
• providing a form definition to the first user device over the computer network in response to the form request, wherein a form having one or more fields for entering payment information is presented to a user in the web page at the first user device when the form definition is rendered by the widget;
• storing form definition data as part of the aggregated data;
• receiving a first form response over the computer network, the first form response sent using the form and including first payment information for a requested first payment transaction;
• storing first form response data associated with the first form response in association with the form definition data as part of the aggregated data;
• submitting a gateway request for the requested first payment transaction to a payment gateway over the computer network;
• receiving a gateway response from the payment gateway over the computer network, wherein the gateway response includes a transaction code indicating a result of the requested first payment transaction;
• storing gateway response data associated with the gateway response in association with the form response data and form definition data as part of the aggregated data;
• at a time interval:
• accessing a fraud prevention rule, the fraud prevention rule including a pattern for identifying one more sets of data that matches the pattern, and
• evaluating the fraud prevention rule against the aggregated, including generating an identifier for each matching set of data based on that set of data and storing the identifiers for each of the matching sets of data as a fraud prevention list corresponding to that fraud prevention rule;
• accessing the fraud prevention list;
• generating a current identifier for a second payment transaction based on a second form response received from a second user device;
• determining that the current identifier matches any identifier of the fraud prevention list and identifying the second payment transaction as fraudulent based on the determination that the current identifier matches any identifier of the fraud prevention list;
• and
• generating a fraud prevention response without submitting the second payment transaction to the payment gateway based on the identification of the second payment transaction as fraudulent.