Fraud detection engine and method of using the same

Abstract

A fraud detection system and method uses unique indicators for detecting fraud that extend beyond traditional transaction-based indicators. These unique indicators may include environmental information about a customer or a transaction. Such indicators may be used to identify fraud events based on computer-executable instructions that evaluate fraud risk. Further, an improved fraud detection system may include a learning component with a feedback loop. Also, authenticating and other information may be directed to the system for updating indicating data, fraud models, and risk assessments.

What is claimed is: 
     
         1 . A non-transitory computer-readable medium including computer-executable instructions to perform the following method steps:
 storing indicators for identifying fraudulent events related to a customer account, the indicators indicative of environmental information associated with fraudulent events when a fraudulent user accesses or interacts with an automated customer care system configured to allow access to or modification of the customer account;   associating a risk probability with each of the indicators;   defining a fraud model based on the indicators, the fraud model including a defined threshold for a fraudulent event; and   determining that an event associated with the automated customer care system is indicative of the fraudulent event, wherein the event is associated with input indicative of environmental information when a user is accessing or interacting with the automated customer care system to access or modify the customer account wherein the step of determining comprises:
 comparing the inputs associated with the event to the indicators indicative of environmental information of the fraud model; and 
 determining the event exceeds the defined threshold for the fraudulent event based on the comparison of the inputs associated with the event to the fraud model, wherein determining the event exceed the defined threshold comprises:
 determining at least two inputs correspond to at least two of the indicators, and 
 determining the defined threshold is exceeded based on the associated risk probabilities of the at least two indicators; 
 
 wherein the at least two indicators comprise two or more of an access channel used when accessing the automated customer care system, a time when accessing the automated customer care system, a frequency of failed attempts when accessing the automated customer care system, a context of failed attempts when accessing the automated customer care system, a contact number used to reach a customer care agent associated with the automated customer care system, an email address used to reach the customer care agent, or a number of transfers used to reach the customer care agent. 
   
     
     
         2 . The non-transitory computer-readable medium of  claim 1 , wherein the computer-executable instructions further comprise the method steps of:
 creating an assertion for the determined event exceeding the defined threshold for the fraudulent event;   communicating the assertion to an authorized user of the customer account;   authenticating the authorized user of the customer account;   receiving a response from the authorized user that includes information associated with the event; and   updating the one or more fraud models with the information of the received response.   
     
     
         3 . The non-transitory computer-readable medium of  claim 2 , wherein the act of communicating the assertion to an authorized user of the customer account comprises:
 determining the authorized user's preferred mode of contact; and   initiating a communication to the authorized user in accordance with the preferred mode of contact.   
     
     
         4 . The non-transitory computer-readable medium of  claim 1 , wherein the at least two indicators comprise the type of access channel used when accessing customer care operations. 
     
     
         5 . The non-transitory computer-readable medium of  claim 4 , wherein the at least two indicators further comprise biometric information. 
     
     
         6 . The non-transitory computer-readable medium of  claim 5 , wherein the biometric information comprises navigation characteristics for the type of access channel used to access customer care operations. 
     
     
         7 . The non-transitory computer-readable medium of  claim 1 , wherein an input associated with the event comprises a value of a graphical user interface having a field configured to capture the value indicating a level of suspicion associated with the event. 
     
     
         8 . The non-transitory computer-readable medium of  claim 7 , wherein the value indicating the level of suspicion is based, at least in part, on a direct interaction between an agent and a user attempting access to the customer account. 
     
     
         9 . The non-transitory computer-readable medium of  claim 1 , wherein the at least two indicators comprise the contact number used to reach the customer care agent. 
     
     
         10 . The non-transitory computer-readable medium of  claim 1 , wherein the at least two indicators comprise the email address used to reach the customer care agent. 
     
     
         11 . The non-transitory computer-readable medium of  claim 1 , wherein the at least two indicators comprise the number of transfers used to reach the customer care agent. 
     
     
         12 . A fraud detection system comprising:
 a processor; and   a computer-readable data storage including a set of computer-executable instructions that, when executed by the processor, cause the processor to perform operations comprising:
 storing indicators associated with a customer account, wherein the stored indicators comprise environmental information for identifying fraudulent events related to the customer account; 
 defining a fraud model based on the stored indicators, the fraud model including a defined threshold for a fraudulent event; 
 receiving inputs indicative of environmental information for an event when a user is accessing or interacting with a automated customer care system; 
 determining the event is indicative of the fraudulent event based on comparing the received inputs to the defined fraud model and determining a total risk threshold exceeds the defined threshold for the fraudulent event; 
 establishing a communication link with an authorized user of the customer account; 
 authenticating the authorized user; 
 receiving information from the authorized user; and 
 updating the fraud model with the received information. 
   
     
     
         13 . The fraud detection system of  claim 12 , where the stored indicators comprise environmental information indicative of a type of access channel for customer care operations. 
     
     
         14 . The fraud detection system of  claim 12 , wherein the communication link is established according to the authorized user's contact preferences. 
     
     
         15 . The fraud detection system of  claim 12 , wherein at least one received input is set by an agent based on the agent's suspicion that the event is fraudulent. 
     
     
         16 . The non-transitory computer-readable medium of  claim 1 , wherein the automated customer care system comprises an interactive voice response system. 
     
     
         17 . The non-transitory computer-readable medium of  claim 1 , wherein determining the defined threshold is exceeded comprises aggregating the associated risk probabilities of the at least two indicators and comparing the aggregated associated risk probabilities to the defined threshold.