System and method for detecting purchasing card fraud

[0001] This application claims the benefit of U.S. Provisional Application No. 60/105,611, filed on Oct. 26, 1998 and entitled “System and Method For Detecting Credit Card Fraud”.

[0002] This invention relates to a system and method for detecting and preventing purchasing card fraud during all phases of a purchasing card life cycle.

[0003] Roughly half a billion transactions with significant, but preventable, fraud potential occur in the United States each year. Purchasing card contact events that can lead to fraudulent occurrences include application processing, card activation, usage, such as mail and phone ordering, and maintenance events, such as address or other information changes. It is estimated that the total cost of fraud is $1.3 million for every one million gross active accounts, or $1.34 in fraud loss per gross active account (Sources: VISA/MC, Credit Card Prevention Sourcebook).

[0004] A large portion of this fraud could effectively be addressed though improved identification of known fraudulent names, fraudulent addresses, fraudulent phone numbers, fraudulent social security numbers, and other fraudulent personal information. In fact, a large number of fraud cases are typically perpetrated by repeat offenders or organized rings.

[0005] Current tools to combat repeat and organized fraud are still underdeveloped. While there are a myriad of sources for fraud-related information, the various sources focus on differing pieces of personal data and return fraudulent alerts in non-standard formats. In addition to the lack of uniformity of the alert information, current systems lack real time, “near” real time, or via batch functionality. Furthermore, no single comprehensive source exists that is capable of addressing fraud during the many stages of a purchasing card account.

[0006] Therefore, it is an object of the present invention to provide a system and method for facilitating fraud prevention and detection at all stages of a purchasing card life cycle, wherein purchasing cards are defined as credit cards, debit cards, “Smart” cards (having IC chips), retail cards (such as gas cards), and the like.

[0007] It is another object of the present invention to provide a single comprehensive database of standardized fraud data from various contributory sources.

[0008] It is still another object of the present invention to allow clients to reduce manual processes for fraud detection.

[0009] In accordance with these and other objects, the present invention provides a method and system for detecting purchasing card fraud during every aspect of a purchasing card life cycle. A central fraud database is created for receiving known fraudulent or “high risk” personal information. The personal information may include, the fraudulent name, fraudulent addresses, fraudulent phone numbers, fraudulent places of employment, criminal history, and other personal information for example. The central fraud database receives information from a variety of sources including but not limited to proprietary databases, client fraud files, law enforcement, and USPS databases. After a contact event has a occurred the fraud database is scanned for a match between the contact event information and the contents of the fraud database. If a possible fraud match occurs the system sends a fraud alert to the client or user of the database. The present invention has many advantages over the prior art for example the present invention has the capability to send fraud alerts in real time, “near” real time, or via batch to clients thus reducing or eliminating the damage caused by potential purchasing card fraud.

[0010] Thus in accordance with one aspect of the present invention, a method is provided for detecting purchasing card fraud during all phases of a purchasing card life cycle. The method includes obtaining contact event information from a client during a contact event, comparing the contact event information with information stored in a database, and sending a fraud alert to a client in real time, “near” real time, or via batch for communicating to the client that a potential fraud match has occurred. Thus the method allows for special handling of the contact event by the client or user of the database.

[0011] In accordance with another aspect of the present invention, a system for detecting purchasing card fraud during all phases of a purchasing card life cycle is provided. The system has a computer database for receiving contact event information from a client, computer software in communication with the computer database for comparing the contact event information with information stored in the database, and a communication network for sending a fraud alert to a client in real time, “near” real time, or via batch for informing the client that a potential fraud match has occurred.

[0012] The above objects and other objects, features, and advantages of the present invention are readily apparent from the following detailed description of the best mode for carrying out the invention when taken in connection with the accompanying drawings.

[0017] The present invention provides a system and method for facilitating fraud prevention and detection for all contact events during a purchasing card life cycle. Such contact events include 1) application processing; 2) card activation; 3) cardholder usage, including mail and telephone orders; and 4) maintenance events, such as name and address changes, PIN changes, plastic requests, and credit line increases.

[0018] With reference to FIG. 1, the system of the present invention preferably includes a single, comprehensive risk database 10 for the detection of purchasing card fraud. The risk database 10 may include information from various sources 12, as will be described below. The risk database is preferably server-based and has connectivity, via a local area network 14 (LAN) or other network, to a mainframe 16. The mainframe 16 is provided for on-line transactions involving the various contact events 18 described above. Clients 20 are provided with connectivity to the risk database 10 for file transfer and general access, and are also provided connectivity to mainframe 16 (Graphical User Interface, dummy terminal or the like) for receipt of fraud alerts and queue information. An optional, more limited database (not shown) could be provided for non-contributors to the risk database. Preferably, a backup server is provided.

[0019] The system of the present invention possesses the technical functionality to pool data from multiple sources in multiple formats and to standardize reporting structure guidelines, enabling the risk database to function for many types of transactions or contact events 18. In addition, the system provides the ability to query in real time, “near” real time, or via batch with on-line interfaces to the mainframe transactions. Preferably, limited client 20 resources are required for access.

[0020] In a preferred embodiment, at the mainframe 16 level, a daily queue statistics report is developed at the client 20 level to identify all accounts that match the risk database 10, including the source of the data match. Furthermore, at the server level, reports are generated which track contributor statistics. In addition, reporting is developed to track client statistics on a query basis, such as by the number of record transactions queried against the risk database 10, or by the number of records with a data match.

[0021] Possible sources for the consortium fraud database 10 include client databases, credit card issuer databases, credit bureau databases, research and investigation fraud files, ANI risk databases, the U.S. Postal Service NRI database, Account Takeover modeling/scoring, the Social Security Administration, the Department of Motor Vehicles, Western Union, Telecheck, the American Business List, law enforcement, court and public information records, phone directories, and direct mail surveys.

[0022] From such sources, the available data includes, but is not limited to, 1) personal information, such as addresses, phone numbers, and social security numbers used in known frauds; 2) valid US addresses and their nature, i.e. residential, commercial, or vacant; 3) valid address/name combinations; 4) high risk zip codes; 5) public information, such as bankruptcy filings, tax liens, and civil judgments; and 6) consumer and purchase data.

[0023] The proposed data element structure within the risk database preferably includes at least the following:

[0024] 1. Names of fraudulent or potentially fraudulent (“high risk”) primary, secondary, and additional cardholders in the form of first name, last name, and middle initial.

[0025] 2. Fraudulent or potentially fraudulent (“high risk”) home and business addresses, including P.O. Box, city, state, and zip code.

[0026] 3. Fraudulent or potentially fraudulent (“high risk”) home and business telephone numbers.

[0027] 4. Fraudulent or potentially fraudulent (“high risk”) social security numbers of primary, secondary, and additional cardholders.

[0028] The risk database would act as a central repository for fraud data to be queried against by lenders and adjacent market users. Potential primary users or clients include bank card issuers, non-bank card issuers, potential card issuers, oil card issuers, merchants, and retailers. Possible secondary users include phone companies, DDA Account banks, and utility companies, among others.

[0029] The method of detecting potential purchasing card fraud of the present invention is outlined in the flow diagram of FIG. 2. The method includes obtaining contact event information at the mainframe 16, as represented by block 50. Comparing the contact event 18 information to fraud information stored in the risk database 10, as represented by block 52. If a match is found between the contact event information and the fraud information, the method further includes issuing an on-line alert to the client and queuing the information for manual review by the particular client, as represented by block 54. If a match does not occur client 20 is notified as such and communication with risk database 10 is concluded, as represented by block 56. Optionally, a fraud match may be scored, as represented by block 58 and as will be explained below. If a client 20 does not wish to receive a score then communication with the database is concluded, as represented by block 60. However, if a client has elected to receive a match score, a scorecard is generated and sent to the client 20, as represented by block 62 and then communication with risk database is terminated at block 64.

[0030] Within the system of the present invention, contact event 18 transactions are preferably structured to create automatic queries which compare account record data elements against the fraud information stored in the risk database. If a match is found between the account data and the fraud data, then an alert message is generated by the system in real time, “near” real time, or via batch to the queue. In addition, the account record is sent to an on-line queue to be monitored and/or manually worked by the client. Upon entry to the queue, the contact event transaction is suspended or placed on hold until manual follow-up is completed. The contact event information may for example be purged from the database.

[0031] An additional feature of the present invention is to offer clients 18 the option of having matched fraud data records “scored” to assist in the decisioning/actioning processes when a record is queued. Preferably, a generic suite of scorecards is provided, while also allowing client-defined scorecards to be developed and implemented. In a preferred embodiment, a scorecard is provided which predicts the likelihood of a fraudulent takeover of an existing, active, or inactive cardholder account.

[0032] The following attributes of the invention are thus possibly provided to facilitate fraud detection at all stages of a purchasing card life cycle:

• • [0033] Application Processing
  • [0034] Card Activation
  • [0035] Cardholder Usage/Maintenance
  • [0036] Other Transaction or Contact Events: Priority Non-Mons: PIN changes, plastic requests, credit line increases and changes to the account record.

[0037] The components of the invention are:

• • [0038] Consortium Data Warehouse
  • [0039] Fraud Scoring
  • [0040] Actioning (Alerts to On-Line Screens)
  • [0041] Queuing for Manual Review
    The Matching Process

[0042] As shown in FIG. 3, selected non-monetary transactions may be structured to create queries which compare account record data elements against the Consortium Risk Database 10 of the invention. For example, during an account entry transaction 80 (application processing, card activation, mail/phone order, address change, and the like) could automatically compare key application data elements against the Data Warehouse or Risk Database 10. If a match is found, as represented by block 82, between the account and the Data Warehouse, then an alert message 84 would be generated by the system real time, “near” real time, or via batch. In addition, the account record may be sent to an on-line queue 86 to be monitored and/or manually worked by the client. Upon entry to the queue, the non-monetary transactions would be suspended or placed on hold until manual follow up is completed. In the case of new account entries and batch-entered new accounts, the accounts may be built on the system, however, plastic generation would be suspended.

[0043] Information residing within the queue would include the account record information, the reason for the alert (i.e., potential fraudulent name, address, SSN, or phone number), and the contributing source of the matched data. This process will help to reduce responsibility/liability for data integrity.

Scoring of Matched Data

[0044] In further keeping with the invention, clients will be provided the option of having matched fraud data records “scored” to assist in the decisioning/actioning processes when a record is queued, as represented by block 88. This should provide business opportunities to build the appropriate scorecard logic. Accordingly, a generic suite of scorecards 90 may be implemented as well as client-defined scorecards 92.

Consortium Contributors

[0045] All consortium contributors will be allowed access to the entire data warehouse. Usage incentives may also be provided for “global” contributors. An example of a usage incentive may be reduced fees for accessing the fraud database. Other incentives may include partial to full access to information contained in the fraud database.

Non-Consortium User

[0046] A non-contributor to the consortium may be offered access to information that the database manager may have purchased or provided in a non-consortium database 100. Otherwise non-contributors may be restricted from information provided by “global” contributors to the Risk Consortium Database.

Summary of Benefits and Critical Needs Met

• • [0047] Provides a single source of uniform data from various contributor business sources;
  • [0048] Increases the effectiveness of fraud detection efforts;
  • [0049] Allows clients to reduce current manual processes for fraud identification and actioning;
  • [0050] Pools data across the client base to improve identification of repeat offenders.
    Consortium Risk Data Warehouse

[0051] A consortium data warehouse contains data contributed from various business sources 110 including, but not limited to:

• • [0052] Clients;
  • [0053] Research and Investigation Fraud Files (Fraud App's and Account takeovers (type lost 3,5,8));
  • [0054] Customer Service Fraud File Database;
  • [0055] Card Activation ANI Risk Database;
  • [0056] Postal NRI Database (high risk Zip Codes);
  • [0057] Social Security Administration compromised SSN's;
  • [0058] International Association of Financial Crimes Investigators;
  • [0059] Cellular or Pay Phone Numbers/Numbers used fraudulently;
  • [0060] Western Union Fraud Data;
  • [0061] American Business List (prison addresses, hospitals, etc.);
  • [0062] Account takeover modeling/scoring;
  • [0063] Potential model for Skimmin;
  • [0064] American Correctional Association;
  • [0065] Lexis/Nexis.
    Proposed Data Element Structure

[0066] As depicted in FIG. 4, the data element structure 200 may include:

• • [0067] Name (Primary and Secondary and additional): First, Last, Middle Initial;
  • [0068] Address: Home, Business (including PO Box);
  • [0069] City;
  • [0070] State;
  • [0071] Zip Code;
  • [0072] Phone: Home, Business;
  • [0073] Social Security Number: Primary, Secondary;
  • [0074] High Risk Zip Codes (NRI data); and
  • [0075] Known fraudulent accounts determined by type lost.

[0076] Therefore, the system and method of the present invention provide a single source of uniform data from various contributor business sources 210, increase the effectiveness of fraud detection efforts, allow clients 212 to reduce current manual processes for fraud identification and actioning, and allow pooling of data across the client base to improve the identification of repeat offenders.

[0077] While embodiments of the invention have been illustrated and described, it is not intended that these embodiments illustrate and describe all possible forms of the invention. Rather, the words used in the specification are words of description rather than limitation, and it is understood that various changes may be made without departing from the spirit and scope of the invention.