Systems and methods of identity protection and management

[0001] This application is a continuation of U.S. application Ser. No. 13/234,637, filed Sep. 16, 2011, titled “SYSTEMS AND METHODS OF IDENTITY PROTECTION AND MANAGEMENT”. The above-identified application is hereby incorporated by reference herein in their entireties.

[0002] This disclosure relates to personal information management, and particularly, systems and methods for management of identity and personal information on external services.

[0003] Communication systems and network systems such as the Internet enable users to access a multitude of services such as e-commerce services, banking services, credit services, social networking services, and the like. Users often maintain relationships with many of these services. They may have accounts with these services accessed by credentials such as user names and passwords. Furthermore, these services may store personal information of users, such as personal names, relationships with others, home and residence addresses, telephone numbers, credit card numbers, financial information, and so on. Such users often rely on these services to maintain this information, and any compromise to the security or accuracy of this information may impose substantial costs on those users. For example, if an unauthorized person manages to gain access to the user's account and change that user's password, login information, or personal information, then that user may become unable to access his or her account and may be forced to deal with the fallout of identity theft, which can be costly and time-consuming for the user.

[0004] In order to prevent such identity theft and unauthorized access, online services often send out notifications of changes to personal information on users' accounts. For example, where a user changes his or her password, online services often send out an email confirmation to notify the user of the password change. Unfortunately, such notifications may become too numerous and burdensome for the user to carefully review to detect fraud and/or identity theft. Additionally, such notifications may be hidden among other communications, such as other emails, and thus not be noticed by the user in a timely manner. For example, notifications may be misclassified as junk mail or spam, possibly resulting in them going unnoticed by the user. Thus, such notifications may be ignored by users and thus become ineffective.

[0005] Accordingly, disclosed herein are systems and methods of management of identity and personal information, such as account information stored by service providers. The systems and methods disclosed herein enable a user to effectively detect relevant events indicative of changes to identity and/or personal information, such as changes to passwords, login information, address information, and other personal information associated with the user's various accounts with service providers. Additionally, the systems and methods disclosed herein may enable the user to specify automatic actions to be taken in response to such events. Thus, the user may be relieved of the need to manually monitor and/or respond to such events and may be enabled to rapidly respond to those events.

[0006] In one embodiment, a method of monitoring and handling potential identity theft threats is performed by a monitoring computer having one or more computer processors. The monitoring computer receives a request from a user to monitor an account of the user with an online service provider. The request includes personal information associated with the user and user preferences for one or more protective actions to be taken in response to detection, by the monitoring computer, of a change or attempted change to personal information associated with the account. The monitoring computer periodically monitors one or more external data sources for indications of changes to personal information associated with the account. The monitoring computer detects a change or attempted change to personal information associated with the account. The monitoring computer determines a risk level associated with the detected change or attempted change to personal information associated with the account. The monitoring computer transmits a notification to the user via a communication channel selected based on the determined risk level and/or the user preferences. The monitoring computer initiates one or more protective actions selected based on one or more of the determined risk level or the user preferences. Further unauthorized access to the account may be prevented by the one or more actions.

[0007] In an embodiment, periodically monitoring one or more external data sources for indications of changes to personal information comprises periodically connecting to an external service, providing the external service with login credentials associated with the user, and determining whether the external service accepts the provided login credentials.

[0008] In an embodiment, periodically monitoring one or more external data sources for indications of changes to personal information comprises periodically retrieving electronic messages associated with the user and analyzing the content of the retrieved messages to determine whether any of the messages indicates a change to personal information.

[0009] In an embodiment, the risk level may be determined at least in part based on whether a preauthorization for the change or attempted change to personal information was received.

[0010] In an embodiment, the one or more protective actions are initiated subsequent to receiving user approval for initiating the one or more protective actions.

[0011] In an embodiment, the one or more protective actions are initiated without requiring user approval for initiating the one or more protective actions.

[0012] In one embodiment, a computing system is configured to monitor and handle potential identity theft threats. The computing system includes a computer-readable storage medium having stored thereon a plurality of executable software modules. The computing system includes one or more computer processors configured to execute the plurality of software modules stored on the computer-readable storage medium. The computing system includes a network interface. The computing system includes a message monitoring module configured to retrieve an electronic message and determine whether the electronic message indicates a change or a possible change to personal information. The computing system includes an event notification module configured to determine a risk level associated with the electronic message in response to the message monitoring module determining that the electronic message indicates a change or a possible change to personal information. The event notification module may be further configured to execute one or more user-customizable responsive actions based upon the risk level associated with the electronic message as determined by the event notification module.

[0013] In an embodiment, the message monitoring module may be configured to retrieve the electronic message by automatically logging into one or more email accounts and gathering messages from the one or more email accounts.

[0014] In an embodiment, the message monitoring module may be configured to retrieve the electronic message by receiving messages sent to the computing system.

[0015] In an embodiment, at least one of the user-customizable responsive actions may be sending an electronic notification identifying the possible change to personal information.

[0016] In an embodiment, the event notification module may be configured to execute at least a portion of the user-customizable responsive actions only in response to receiving a user confirmation message.

[0017] In an embodiment, the user-customizable responsive actions are selected based upon stored user preferences and the risk level associated with the electronic message.

[0018] In an embodiment, the event notification module may be further configured to determine whether the possible change to personal information was preauthorized, and further configured to execute different user-customizable responsive actions if the possible change to personal information was preauthorized.

[0019] In an embodiment, a non-transitory computer-readable medium comprises executable instructions configured to cause one or more computer processors to perform operations such as the following. The system periodically determines whether a network service is accessible based on a set of user credentials, by performing operations on a periodic basis. The system transmits a login request to the network service. The login request comprises the user credentials formatted in accordance with a protocol used by the network service. The system receives a login response from the network service. The system determines whether the login response indicates that the network service did not accept the user credentials. The system, in response to a determination that the login response indicates that the network service did not accept the user credentials, performs one or more event responses, selected based at least upon user preferences relating to the network service.

[0020] In an embodiment, transmitting a login request to the network service comprises transmitting an HTTP request to the network service.

[0021] In an embodiment, determining whether the login response indicates that the network service did not accept the user credentials comprises comparing the login response to one or more predefined parsing rules associated with the network service.

[0022] In an embodiment, at least one of the event responses may be sending an electronic notification identifying the possible change to personal information.

[0023] In an embodiment, at least a portion of the event responses may be performed only in subsequent to receiving a user confirmation message.

[0024] In an embodiment, the event responses may be selected based upon a risk level determined based on the login response.

[0025] In an embodiment, the operations may also include determining whether the possible change to personal information was preauthorized. The event responses are selected based at least in part on whether the possible change to personal information was preauthorized.

[0034] FIG. 1 is a block diagram of a system of identity protection and management, as used in an embodiment. The system may comprise one or more computing devices, and various elements depicted in FIG. 1 may be included in a single computing device, in separate individual computing devices, or in any combination thereof. The computing device or devices implementing the system of FIG. 1 may be connected to one or more networks such as the Internet by which they may communicate with external entities and data sources.

[0035] In an embodiment, the system comprises a management system 101 which performs methods of identity protection and management, as described throughout this specification. Management system 101 may provide various interfaces by which users 102 may access data on the management system. For example, the management system may provide one or more user interfaces via module 103 that may be accessed by users 102. Such user interfaces may include, for example, HTML interfaces, mobile device or tablet computer application interfaces, RSS feeds, audiovisual interfaces, textual interfaces, application programming interfaces, and the like. Additionally, management system 101 may enable users 102 to access data via event notifications module 104. Such event notifications may be sent by any number of means, including, for example, email, text message, instant message, telephone communications, physical mail, and other forms of communication known to those of skill in the art. Management system 101 may provide further interfaces to users 102, other than those provided by modules 103 and 104, as may be known to those of skill in the art.

[0036] Management system 101 may have access to various data repositories, in an embodiment. The data repositories may be any of various forms of data storage that may be accessed by a computing system, such as hard drives, tape drives, flash memory, random-access memory, read-only memory, EEPROM storage, and so on, as well as any combination thereof. The data may be formatted within the repositories in one or more formats, referred to herein as “data structures,” such as flat text file storage, relational databases, non-relational databases, XML, comma-separated values, Microsoft Excel files, and so on, as well as any combination thereof. The data repositories may provide various forms of access to the stored data, such as by filesystem access, network access, a SQL protocol (e.g. ODBC), HTTP, FTP, NFS, CIFS, and so on, as well as any combination thereof. As used throughout this specification, the terms “data store,” “repository,” “storage device,” and the like may refer to any such data repository as described herein or otherwise known to those of skill in the art.

[0037] In an embodiment, management system 101 may be connected to online service data repository 105 which may include information on various online services such as website services, social networking services, online banking services, e-commerce services and the like. The data included in repository 105 may include data such as a URL and/or location for an online service, types of login credentials for the online service, methods of accessing and providing credentials for the online service, forms of communication used by the online service such as email notifications, data provided by the online service and so on.

[0038] In an embodiment, repository 105 receives information on an online service by manual entry performed by an operator or administrator of management system 101. In an embodiment, management system 101 includes automated software routines that gather appropriate information from online services, so that repository 105 may be populated and/or updated automatically. In an embodiment, management system 101 receives information descriptive of online services directly from those online services, and may use that descriptive information to populate repository 105.

[0039] Additionally, management system 101 may be in communication with credentials and user information repository 106. The repository may be physically stored on the same storage medium as repository 105 or on different storage media, and the two repositories may be implemented in a single repository in an embodiment. The credentials and user information repository 106 may include information about individual users and user accounts. Such information may include login credentials to access the management system so that users may establish accounts and utilize the services provided by the management system. Additionally, repository 106 may include information about users' online identities. Such information may include, for example, login credentials for various online services, types of identities of services to be monitored, types of services to be monitored, preferences for monitoring of online services, preferences for notifications, preferences for levels of urgency for notifications, and the like.

[0040] Management system 101 may include or be connected to identity monitoring service 107. The identity monitoring service may provide periodic or on-demand monitoring of online identity and personal information. For example, identity monitoring service 107 may execute an email monitoring module 108 configured to monitor user emails. Such monitoring may be performed either immediately upon receipt of emails for individual users or on a periodic basis by retrieving relevant emails from a user's account. Identity monitoring service 107 may also execute a credentials monitoring module 109 which may be configured to periodically attempt to access various online services on behalf of users and retrieve personal information associated with those users in order to detect changes or updates to identity and personal information associated with those users. Identity monitoring service 107 may further execute a direct notification module 110 which may be configured to directly receive information about identity and personal information changes from one or more online services. Such direct notifications may be received through standard network protocols such as HTTP or specialized communication protocols including secure communication protocols established with online services.

[0041] In an embodiment, monitoring service 107 performs various monitoring tasks, as described previously or as may be contemplated otherwise, to detect events. Events may be related to changes in identity and/or personal information maintained by a service. For example, if a user's login name, password, or other authentication credentials are changed on an online service, the change may be detected by monitoring service 107, thus triggering an event. Monitoring service 107 may also be configured to detect changes to personal information stored online, such as address information, as a type of event. An event indicating an address change could inform a user, for example, of an unauthorized attempt to cause goods or services to be delivered to a different location, which would be a form of identity theft. Other activities may also be considered events by the system, such as online orders or service requests. If the monitoring service 107 is able to trigger events in response to unauthorized online orders or service requests, then the system may be able to stop the orders from being shipped or the services being performed, thus again minimizing the impact of identity theft.

[0042] FIG. 2 is a flow chart of a process of handling and/or responding to a detected event as used in an embodiment. Such a process may be used by the event notification module 104 of management system 101 as shown in FIG. 1. In various embodiments, additional blocks may be included, some blocks may be removed, and/or blocks may be connected or arranged differently from what is shown.

[0043] At block 201, an event is identified. Such an event may be triggered by one of any number of modules such as the user email module 108, credentials monitoring module 109, or direct monitoring module 110 of the identity monitoring service 107 as shown in FIG. 1. The event identified at block 201 may, in various embodiments, include information about an associated user, an associated online service, personal information associated with the event, other relevant information, or any combination thereof.

[0044] At block 202, the system determines whether or not the event identified at block 201 was anticipated. An event may be anticipated, for example, because a user has intentionally caused a change to that user's personal information. For example, where a user decides to change a password or an online account, the password change may be anticipated because it was intended by the user.

[0045] The determination of whether an event is anticipated may be based on preauthorization data which includes information provided by users about which events to anticipate. Users may provide preauthorization for events by contacting the system and indicating that a particular event is to be anticipated, via a web interface, mobile application, or other means. Additionally or alternatively, algorithms including artificial intelligence algorithms may be used to determine whether an event is anticipated or how likely an event is to be non-anomalous, known, and/or authorized by the user. Such algorithms may be similar to, for example, algorithms used to detect credit card fraud, as will be known to those of skill in the art.

[0046] If the event is anticipated, then at block 203, the system ignores the event or alternatively generates a low-priority notification and/or response. This provides the advantage that the user will only be notified of unexpected and/or important events, so that the user will not be inundated with unnecessary notifications.

[0047] If the event is not anticipated then at block 204 the system determines the nature, urgency, and/or other characteristics of the event. This determination may be based on any number of factors including, for example, the nature of the event identified, user preferences stored by the system, frequency of events identified with respect to this user or other users on the system, general information maintained by the system regarding trends in identity fraud, and other information that may be available to the system.

[0048] At block 205, the system retrieves user preferences for notifications. These user preferences may be retrieved from one or more data repositories such as repository 106 shown in FIG. 1. Then, based on the nature and urgency of the event determined at block 204, the user preferences retrieved at block 205, and/or other information available to the system, the system may determine at block 206 an appropriate event response, such as a method of notifying the user of the identified event. The system may then generate a notification 207 to be provided to the user by any number of forms of communication known to those of skill in the art, including, telephone notifications, text messages, instant messages, email messages, physical mail messages and/or other forms of communication, as well as any combination thereof. In an embodiment, the system may determine that no notification is required and thus send no notification to the user. In an embodiment, the system may use default preferences provided by an administrator of the system or built into the system in addition to, or rather than, user preferences.

[0049] At block 208, the system determines whether further event responses, such as protective actions, are to be taken in response to the event that has been identified, and what actions to take, if any. The determination of further protective actions at block 208 may occur immediately after the determination of the method to notify the user at block 206, or it may occur at a later time. In an embodiment, the system first sends out a notification 207 and then waits to receive a response from the user, at block 209. Such a system enables the user to choose not to perform the protective actions, for example because the triggering event was actually caused by the user, but possibly not preauthorized. In an embodiment, the system may determine whether to wait for a user response at block 209 based on user preferences determined at block 205 or based on other information available to the system. In an embodiment, the system may perform some actions automatically and other actions only after user response.

[0050] The protective actions determined at block 208 may include any number of protective actions 210. Such actions may include notifying a third party such as a credit bureau or the police, notifying the online service, temporarily locking the user's account on the service, temporarily or permanently disabling the user's account on the service, changing the user's password on the service, or other actions that may be described throughout this specification or known to those of skill in the art.

[0051] FIG. 3 shows a flow chart of a process of reviewing emails for identity or personal information changes, as used in an embodiment. In various embodiments, additional blocks may be included, some blocks may be removed, and/or blocks may be connected or arranged differently from what is shown.

[0052] Although the process of FIG. 3 is described with respect to email messages, the process may be applied to other forms of communication as will be known to those of skill in the art. For example, the system may be configured to receive and analyze text messages received on the user's cell phone. In another embodiment, the system may be configured to automatically review physical mail that may have been, for example, scanned in by the user.

[0053] The system may access emails in any number of ways. For example, at block 301, the system may directly access the user's email. This may be done, for example, by the system maintaining the user's email account, login and password and periodically accessing the user's email account to retrieve messages. Such retrieval may be performed via an online interface such as a web interface, an IMAP interface, a POP interface, or the like. Alternatively or additionally, the system may receive emails for the user directly at block 302. For example, the user may configure one or more email accounts to automatically forward and/or copy all messages to a specialized email address operated by the system so that the system may receive messages immediately. In an embodiment, the user may maintain one or more email accounts on the system, in which case all messages may be delivered to the system or otherwise accessed so that they may be reviewed.

[0054] Upon accessing one or more messages from block 301, from block 302, and/or by other means, the system analyzes the content and/or headers of the email messages at block 303. The data analyzed by the system at block 303 may include any data associated with an email message such as the sender of the message, the recipient of the message, the time and date of the message, the subject line of the message, any Internet headers included in the message, digital signatures attached to the message, attachments to the message, images included in the message, the content of the message, MIME parts of the message, Internet addresses such as IP addresses associated with the message, and so on. For example, the system may identify messages containing the terms “password change,” “address change,” “email address change,” “account created,” “account modified,” “account removed,” and so on. In various embodiments, the parameters such as keywords to be identified may be manually configured, or they may be automatically determined by an automated process such as a machine learning process, Bayesian analysis, neural network processing, and so on.

[0055] In an embodiment, the system may be configured to recognize one or more specialized headers in the message. Such a specialized header may be used, for example, by an online service to enable the automatic detection of messages relating to personal information changes. For example, when a user changes a login name or password on an online service account, the online service may be configured to send an email to that user with a specialized header indicating that the message relates to a login name or password change. In an embodiment, such a specialized header may include one or more digital signatures to provide verification that the message originated from the online service.

[0056] At block 304, the system determines whether the email indicates a change in identity information based on the analysis performed at block 303. Such identity information changes may include changes to the user's login name, password, personal name, account number, associated accounts, home address, mailing address, telephone number, email address, or the like. In an embodiment, the system detects attempted changes as well as or alternatively to successful changes, in which case the system may provide notifications as to attempted changes.

[0057] If at block 304 the system determines that the email indicates a change (or attempted change) in identity information, then at block 305 the system triggers an event for processing. This triggering of an event may invoke an event notification process, such as that shown in FIG. 2, which determines whether a notification should be transmitted, and attributes of the notification. In an embodiment, at block 305, the event is processed (e.g. by the process outlined in FIG. 2) immediately upon the determination that the email indicates a change in identity information. In an alternate embodiment, the system may initiate event processing at block 305 on a regular or periodic basis such as once every hour, once every day, or once every week. Whether the event is processed immediately or at a later time may depend on user preferences and/or the nature of the event, including the urgency of the event.

[0058] If the email is determined not to indicate a change in identity information at block 304 or after the event is processed at block 305, the system waits for the next monitoring cycle at block 306. The system may be configured to perform the monitoring shown in blocks 301 or 302 on a periodic basis such as a daily, weekly, or monthly basis. In such a case, the system would, at block 306, wait for the appropriate period of time to elapse prior to again reviewing messages. In an additional embodiment, the system may wait at block 306 for further messages to be received prior to again performing either of block 301 or 302.

[0059] FIG. 4 is a flowchart of a process of verifying credentials with an online service, as used in an embodiment. Although this process is described with respect to an online service connected via a network such as the Internet, this process may equally be applied to services accessible by other forms of communication. For example, this process may be applied to telephone services by automatically dialing and providing information to such services. In various embodiments, additional blocks may be included, some blocks may be removed, and/or blocks may be connected or arranged differently from what is shown.

[0060] At block 401, the system maintains online credentials for a user. These online credentials may include a login name and a password. Other information that may be used to authenticate users to online services may also be stored at block 401.

[0061] At block 402, the system connects with an online service associated with the credentials maintained at block 401. The system may connect with the online service by any number of means. For example, it may attempt to access the main web page of the online service or it may attempt to access a login page of the online service. In another embodiment, the system may access a special application programming interface (API) provided by the online service. Such an API may be an HTML based API such as a SOAP API or a REST API. In an embodiment, the communications performed at block 402 are performed over a secure channel. In an embodiment, the system maintains instructions for how to connect with the online service at block 402 in one or more repositories such as the online service repository 105 of FIG. 1.

[0062] At block 403, the system provides the credentials maintained at block 401 to the online service to which the system has connected at block 402. The system may be configured to provide those credentials to the online service in a manner expected by the online service. The appropriate manner of providing those online credentials may be stored in a repository such as online service repository 105 in FIG. 1.

[0063] In an embodiment, the credentials are provided over a secure communications channel. In an embodiment, the credentials may be provided by an HTTP protocol such as an HTTP POST form submission. In an embodiment, the credentials may be transmitted using an HTTP Basic or Digest authentication protocol. In other embodiments, the credentials may be transmitted using a challenge/response protocol, a digital signature, or by other means. Additionally and/or alternatively, the credentials, or any part of the credentials such as a password, may be encrypted or may be obfuscated using a hash function, such as a cryptographic or one-way hash function.

[0064] At block 404, the system retrieves a response from the online service, subsequent to the system providing the credentials at block 403. The system may interpret and/or parse the response based on information about the online service, such as information stored in repository 105 of FIG. 1. At block 405, the system analyzes the response retrieved at block 404 to determine whether the response indicates that the credentials were accepted. Such a determination may be specific to particular online services, may depend on the nature of the content received, and/or may be based on parsing of the response data for inclusion of content indicative of whether the credentials were accepted. For example, where the content is a webpage indicating that the password was not correct, then the system may determine that the credentials were not accepted.

[0065] If the credentials are not accepted at block 405, then at block 406 the system triggers an event for processing. Such triggering of an event may invoke the performance of a process such as that shown in FIG. 2. As explained previously with respect to FIG. 3, the triggering of the event at block 406 may be performed immediately in response to the determination that the credentials were not accepted or it may be performed at a later time.

[0066] If the response indicates that the credentials were accepted at block 405 or after the event is processed at block 406, the system waits for the next monitoring cycle at block 407. The particular intervals at which the system performs the monitoring of online credentials may be specified by the user as a preference. Alternately, the system may include a default period for monitoring. In an embodiment, the system waits for a predefined action that indicates that the credentials should be tested, such as a user-initiated request or a notification from the online service being monitored.

[0067] FIGS. 5A and 5B depict sample user interfaces for specifying monitoring services, as used in an embodiment. A user may use such interfaces to manage the performance of monitoring services such as those shown in FIGS. 3 and 4. Additionally, the user may use such interfaces to manage the handling of event notifications and other protective actions such as those shown in FIG. 2. In an embodiment, the system may provide these interfaces to a user computing device or other device by means of a website, a mobile phone application, a tablet device application, a telephone call system, an application programming interface or by other means of communication. In an embodiment, multiple interfaces may be provided.

[0068] FIG. 5A illustrates an embodiment of an interface for establishing email monitoring preferences. In this embodiment, the user is able to select an online service using interface element 501. The user may select an online service by typing in a name and/or URL of the online service. In an embodiment, the user may alternatively select the online service using a predefined list. In other embodiments, the user may select the online service by other means. In an embodiment, the user may be able to specify the methods of monitoring a service, thus possibly enabling the user to monitor services not already known to the system.

[0069] The user may provide options for online credentials verification using the interface elements shown in block 502. Such information may be used to control a process such as that shown in FIG. 4. The user may provide login credentials such as a user name and password using interface elements 503. Additionally, the user may provide information such as the frequency of monitoring using interface elements 504. The system may request additional information or less information depending on the particular requirements of the monitoring service provided by the system.

[0070] The user may configure email monitoring services using the interface elements included in block 505. The information provided in block 505 may be used to configure the performance of a method such as that shown in FIG. 3. For example, the user may provide an email address to be monitored using interface element 506. In an embodiment where the user wishes to have the system retrieve emails from the specified account, the user may provide login and password information or other login information to the system. In another embodiment, the system may be configured to have access to certain email services so that login credentials are not required for the email monitoring service to function.

[0071] Additionally, the user may choose to forward emails to the system and may indicate a desire to do so at using interface element 507. Upon selecting this interface the system may provide instructions to the user as to how to forward email to the system. Additionally, the system may configure itself to receive emails and perform monitoring on those emails.

[0072] The user may configure direct monitoring of the selected online service using the interface elements shown in block 508. To enable direct monitoring, the user may select interface element 509. Selection of this interface element may cause the system to periodically query the online service for identity or personal information changes. The user may be provided with options for how frequently the monitoring is to be provided. Alternatively, selecting interface element 509 may cause the system to notify the online service of the user's interest in identity and personal information monitoring. Such a request may cause the online service, based on a prior agreement between the system and the online service, to send notifications to the system in response to the online service detecting changes (and/or attempted changes) to the user's identity or personal information. Such monitoring has the advantage that the system may only receive notifications about verified and actual information changes rather than likely information changes detected either through online monitoring, email monitoring or by other means.

[0073] In the embodiment shown in FIG. 5, the various forms of monitoring are associated with a particular site provided using interface element 501. In other embodiments, some or all of the forms of monitoring need not be associated with a particular site. For example, a user may be able to use email monitoring, in which case the system may, upon detecting a message of interest, determine a site or online service associated with the message and perform actions based on that message. Similarly, the user may sign up for direct monitoring without specifying a particular site, and the system would process events based on any notifications relating to the user and received from online services. Such embodiments may thus relieve the user of having to manually specify every site or service to be monitored.

[0074] Where the system provides other monitoring means, the interface shown in FIG. 5A may include further sections and interface elements to receive configuration settings for those monitoring means. In embodiments that do not implement all the monitoring means shown in FIG. 5A, the interface may be adjusted accordingly.

[0075] Turning to FIG. 5B, the system may present a user interface for specifying responses to detected events. The information provided by the user in such an interface may be used to configure the performance of a method such as that shown in FIG. 2.

[0076] In an embodiment the interface includes options for various threat or urgency levels. For example, options for severe threats are shown in box 510. Options for moderate threats are shown in box 511. Other levels of threats may also be included on this interface and/or other interfaces. Additionally, in other embodiments the system may categorize threats using different terminology or different categorizations. For example, the system may categorize events as password change events, address change events, login name change events, and so on. In such a case, the interface of FIG. 5B may display boxes for types of event categories. In an embodiment, the categorizations may be account-dependent and/or user-defined.

[0077] In an embodiment, the system provides options for notification and/or actions to be taken in response to particular events. For example, interface elements 512 provide options for notification delivery options in response to a severe threat. Interface elements 513 provide options for actions to be taken in response to a severe threat. In an embodiment the system indicates that certain notifications and/or actions are recommended. In an embodiment the recommended notification and/or actions are selected by default.

[0078] Additionally, the interface provides options for when the action should be taken. For example using element 514 the user may request to take an action automatically upon detection of the events. Using element 515, the user may request that the system ask the user before taking any further actions. In an embodiment, the recommended actions and/or notifications may change based on whether the user wishes to be asked before taking the action or taking the action automatically. In an embodiment, the interface may provide further controls for specifying that some actions are to be taken without user confirmation, and other actions are to be taken only after user confirmation.

[0079] The recommended actions may be dependent as well upon the threat level of the events. As shown in interface elements 514 and 515, the recommended notifications and actions may differ for moderate threats as opposed to severe threats. Thus, the system may recommend levels of notification and/or actions that are appropriate to particular threats, so that users need not select forms of notification and/or actions without prior suggestion.

[0080] FIG. 6 shows a sample notification email sent in response to an event, as used in an embodiment. The notification may be sent by any number of means such as by email, by text message, by voicemail, by telephone call, via a mobile phone application, via a portable computer application, or by other means.

[0081] The notification message includes pertinent information relating to the detected events. For example, the notification shows in subject line 601 that the event is a password change and that it is a severe threat. The notification message may also indicate the online service at which the event was detected 602 and it may provide information about responding to the event 603. Additionally, in an embodiment, the notification message may include a link to the content that triggered the event and/or a copy, snippet, summary, or other representation of the content that triggered the event, such as the email from the online service or the page returned by the attempted login.

[0082] In an embodiment, the notification message may provide options for the user to respond to the event. By providing these options in the notification message itself, the system provides users with the benefit of being able to respond quickly and informedly to the detected events. In an alternate embodiment, the notification message may provide a link or other mechanism by which the user may access a website, mobile phone application, or other interface for responding to the event. Such an interface may appear much like the interface described below with respect to FIG. 6.

[0083] In the embodiment shown in FIG. 6, the user may indicate using interface element 604 that the event was initiated by the user so that it may be ignored. If the user did not initiate the change, however, then the user may select interface element 605 and further select actions to be taken using interface elements 606. In an embodiment, interface elements 606 are only displayed if interface element 605 is selected to indicate that the event was not initiated by the user. In an embodiment, the elements 606 that are selected by default are based on preferences provided by the user, for example, using an interface such as that shown in FIG. 5B.

[0084] Notification email may also include an interface control 607 to enable the user to submit the information provided using element 604, 605, and 606. Upon submitting this information to the system, the system may then undertake the appropriate actions by for example applying block 208 as shown in FIG. 2.

[0085] Other embodiments of the notification message shown in FIG. 6 may be used, and may include different information from that shown. In an embodiment, the contents of the notification message are customized to the particular type of event detected. In an embodiment, where some actions have already been taken, the notification message may include information indicating the results of the actions taken. In an embodiment, upon the user requesting certain actions to be taken using the notification message, a further message confirming the results of those actions is sent to the user.

[0086] FIG. 7 is a sample user interface with a notification message as displayed on a mobile device, as used in an embodiment. The information provided by the interface may be similar to that shown in the notification email of FIG. 6, and in various embodiments the mobile interface may include less or additional information, or information organized in a different form, as is suitable for the particular mobile device. In other embodiments, notifications may be transmitted to a mobile device via other delivery mechanisms, such as SMS messages, browser-renderable content, standalone applications, etc., which may also allow the user to select protective actions through any of these mechanisms.

[0087] The sample interface of FIG. 7 includes information about the detected event 701, as well as options for displaying further information 702. The sample interface further includes options for actions to be taken 703, an interface element to initiate the performance of the actions 704, and an interface element to ignore the event 705. Additional controls and/or information may be included on the mobile interface. In an embodiment, the mobile interface is displayed as a series of screens, in order to reduce the amount of information shown on each screen to accommodate for the smaller available display size on many mobile devices.

[0088] FIG. 8 is a block diagram illustrating one embodiment of a computing system that implements the systems and methods described herein. In the embodiment of FIG. 8, a computing device 801 is in communication with a user 802, as well as an optional third-party data source 803, via a network 804. In an embodiment, the computing device 801 receives data, such as credit data, from one or more data sources 803 and accesses the data to identify information regarding one or more entities. The computing device 801 may then perform analysis and prepare information for presentation to the user 802. The management system 101 may include the same or similar components as the computing device 801. Similarly, the computing devices 801 may be used to implement any of the methods discussed herein.

[0089] The network 804 may include any communication network or combination of communication networks, such as one or more of the Internet, LANs, WANs, MANs, etc., for example. In the embodiment of FIG. 801, the computing device 801 includes a computing system having one or more computing devices (e.g., computers). The computing device 801 may include, for example, a single computing device, a computer server, a smart storage unit, or a combination of one or more computing devices and/or computer servers. Depending on the embodiment, the components illustrated in the computing device 801 may be distributed amongst multiple devices, such as via a local area or other network connection. In other embodiments the computing device 801 may include fewer and/or additional components that are illustrated in FIG. 8.

[0090] The exemplary computing device 801 may be a general purpose computer using one or more microprocessors, such as, for example, an Intel® Pentium® processor, an Intel® Pentium® II processor, an Intel® Pentium® Pro processor, an Intel® Pentium® IV processor, an Intel® Pentium® D processor, an Intel® Core™ processor, an xx86 processor, an 8051 processor, a MIPS processor, a Power PC processor, a SPARC processor, an Alpha processor, and so forth. The computer may run a variety of operating systems that perform standard operating system functions such as, for example, opening, reading, writing, and closing a file. It is recognized that other operating systems may be used, such as, for example, Microsoft® Windows® 3.X, Microsoft® Windows 98, Microsoft® Windows® 2000, Microsoft® Windows® NT, Microsoft® Windows® CE, Microsoft® Windows® ME, Microsoft® Windows® XP, Windows® 7, Palm Pilot OS, Apple® MacOS®, Disk Operating System (DOS), UNIX, IRIX, Solaris, SunOS, FreeBSD, Linux®, or IBM® OS/2® operating systems. In other embodiments, the computing device 801 may be controlled by a proprietary operating system. Conventional operating systems control and schedule computer processes for execution, perform memory management, provide file system, networking, I/O services, and provide a user interface, such as a graphical user interface (“GUI”), among other things.

[0091] The computing device 801 includes one or more central processing units (“CPU”) 805, which may each include one or more conventional or proprietary microprocessor(s). The computing device 801 may further include one or more memories 806, such as random access memory (“RAM”), for temporary storage of information, read only memory (“ROM”) for permanent storage of information, and/or a mass storage device 807, such as a hard drive, diskette, or optical media storage device. The memory 806 may store software code, or instructions, for execution by the processor 805 in order to cause the computing device to perform certain operations, such as gathering sensor-related data, processing the data with statistical and/or predictive models, formatting data for user devices or other presentation, transmitting data, or other operations described or used herein.

[0092] The methods described and claimed herein may be performed by any suitable computing device, such as the computing device 801. The methods may be executed on such suitable computing devices in response to execution of software instructions or other executable code read from a non-transitory tangible computer readable medium or computer storage device. A computer readable medium is a data storage device that can store data that is readable by a computer system. Examples of computer readable mediums include read-only memory, random-access memory, other volatile or non-volatile memory devices, CD-ROMs, magnetic tape, flash drives, and optical data storage devices.

[0093] The exemplary computing device 801 may include one or more input/output (I/O) devices and interfaces 808, such as a keyboard, trackball, mouse, drawing tablet, joystick, game controller, touchscreen (e.g., capacitive or resistive touchscreen), touchpad, accelerometer, and/or printer, for example. The computing device 801 may also include one or more multimedia devices 809, such as a display device (also referred to herein as a display screen), which may also be one of the I/O devices 808 in the case of a touchscreen, for example. Display devices may include LCD, OLED, or other thin screen display surfaces, a monitor, television, projector, or any other device that visually depicts user interfaces and data to viewers. The computing device 801 may also include one or more multimedia devices, such as speakers, video cards, graphics accelerators, and microphones, for example.

[0094] In the embodiment of FIG. 8, the I/O devices and interfaces 808 provides a communication interface to various external devices via the network 804. For example, the computing device 801 may be electronically coupled to the network 804 via a wired, wireless, or combination of wired and wireless, communication link(s). The network 804 may allow communication with various other computing devices and/or other electronic devices via wired or wireless communication links.

[0095] In the embodiment of FIG. 8, the computing device 801 may include an identity monitoring service module 107, an event notification module 104, and a user interface module 103, as well as other modules or fewer modules. The computing device 801 may include fewer or additional modules, such as the email monitoring module 108, the credentials monitoring module 109, and/or the direct notification module 110, which are discussed above with reference to FIG. 1. Each of these modules is discussed in further detail below. In general, the word “module,” as used herein, refers to logic embodied in hardware or firmware, or to a collection of software instructions, possibly having entry and exit points, written in any programming language, such as, for example, Java, Python, Perl, Lua, C, C++, C#, Objective C, etc. A software module may be compiled and linked into an executable program, installed in a dynamic link library, or may be written in an interpreted programming language such as, for example, BASIC, Perl, or Python. Software modules may be callable from other modules or from themselves, and/or may be invoked in response to detected events or interrupts. Software modules configured for execution on computing devices may be provided on a computer readable medium, such as a compact disc, digital video disc, flash drive, or any other tangible medium. Such software code may be stored, partially or fully, on a memory device of the executing computing device, such as the computing device 801, for execution by the computing device. Hardware modules may be comprised of connected logic units, such as gates and flip-flops, and/or may be comprised of programmable units, such as programmable gate arrays or processors. The modules described herein are typically implemented as software modules, but may be implemented in hardware, firmware and/or software. Generally, the modules described herein refer to logical modules that may be combined with other modules or divided into sub-modules despite their physical organization or storage.

[0096] In the embodiment of FIG. 8, the computing device 801 includes three modules, namely, an identity monitoring service module 107, an event notification module 104, and a user interface module 103, as well as other modules or fewer modules. In this embodiment, each of the modules is shown as part of the computing device 801. However, in other embodiments, the modules may be distributed across multiple devices, and may be controlled and/or operated by multiple different entities. These modules are configured to perform methods as described throughout this specification. In various embodiments, fewer or additional modules may be included within a computing system.

[0097] The computing device 801 may be configured to acquire user data and other external data such as third-party data. The various modules and/or other modules may comprise software alone, hardware alone, or a combination of software and hardware. The device may be especially adapted to communicate using a variety of network or communications protocols in order to communicate with external data sources such as data repositories, network servers, online services, telecommunication services, distributed computing systems, and so on. Some of these protocols may include standard network protocols, such as HTTP, FTP, SNMP, or the like. The device may further include hardware drivers, such as USB, FireWire, Thunderbolt (Light Peak), or serial communications drivers, for example to communicate with devices in direct communication with the system.

[0098] The computing device 801 may be configured to transmit, or initiate transmission of, data such as user interfaces, data reports, application programming interface data, or the like, to requesting entities, such as external user 802, that have registered interest with the system. In one embodiment, the device provides the data in an unformatted data structure, such as in an XML, CSV, TXT, or other spreadsheet, text, or web accessible data structure. In other embodiments, the device provides information in user interfaces, such as user interfaces that are configured for rendering by a web browser, mobile device, tablet device, or other device or application, for display to users. A variety of different presentations may be provided. In some embodiments, the requesting entities may indicate presentation preferences or configurations (e.g., data formats and/or types of information), and the device may transmit data based on the indicated preferences or configurations. The presentation format may also be determined based on the type of device being used by the user.

[0099] In an embodiment, any or all of the modules 103, 104, and 107-110 are configured to act in real time. Thus, when data is received by the modules, the modules process that data as soon as practicable or necessary to provide users with timely information. In order to achieve this, specialized hardware may be used to gain efficiency, and executable code may be designed to minimize latency or computation time. In an embodiment, the modules, possibly with other modules of the system, are executed within a real-time operating system, to enhance the responsiveness of the system.

[0100] Depending on the embodiment, the methods described with reference to the flowcharts and block diagrams such as FIGS. 1-4 and 8, as well as any other methods discussed herein, may include fewer or additional blocks and/or the blocks may be performed in a different order than is illustrated. Software code configured for execution on a computing device in order to perform the methods may be provided on a computer readable medium, such as a compact disc, digital video disc, flash drive, hard drive, memory device or any other tangible medium. Such software code may be stored, partially or fully, on a memory of a computing device, such as the computing system 101 of FIG. 1 and/or other computing devices illustrated in the Figures, in order to perform the respective methods. For ease of explanation, the method will be described herein as performed by the various modules, such as may be executed on the computing system 101, which should be interpreted to include any one or more of the computing devices noted above and/or any other suitable computing device.

[0101] Conditional language, such as, among others, “can,” “could,” “might,” or “may,” unless specifically stated otherwise, or otherwise understood within the context as used, is generally intended to convey that certain embodiments include, while other embodiments do not include, certain features, elements and/or steps. Thus, such conditional language is not generally intended to imply that features, elements and/or steps are in any way required for one or more embodiments or that one or more embodiments necessarily include logic for deciding, with or without user input or prompting, whether these features, elements and/or steps are included or are to be performed in any particular embodiment.

[0102] Any process descriptions, elements, or blocks in the flow diagrams described herein and/or depicted in the attached figures should be understood as potentially representing modules, segments, or portions of code which include one or more executable instructions for implementing specific logical functions or steps in the process. Alternate implementations are included within the scope of the embodiments described herein in which elements or functions may be deleted, executed out of order from that shown or discussed, including substantially concurrently or in reverse order, depending on the functionality involved, as would be understood by those skilled in the art.

[0103] All of the methods and processes described above may be embodied in, and partially or fully automated via, software code modules executed by one or more general purpose computers. For example, the methods described herein may be performed by the computing devices described herein and/or any other suitable computing device. The methods may be executed on the computing devices in response to execution of software instructions or other executable code read from a tangible computer readable medium. A tangible computer readable medium is a data storage device that can store data that is readable by a computer system. Examples of computer readable mediums include read-only memory, random-access memory, other volatile or non-volatile memory devices, CD-ROMs, magnetic tape, flash drives, and optical data storage devices.

[0104] It should be emphasized that many variations and modifications may be made to the above-described embodiments, the elements of which are to be understood as being among other acceptable examples. All such modifications and variations are intended to be included herein within the scope of this disclosure. The foregoing description details certain embodiments of the invention. It will be appreciated, however, that no matter how detailed the foregoing appears in text, the invention can be practiced in many ways. As is also stated above, it should be noted that the use of particular terminology when describing certain features or aspects of the invention should not be taken to imply that the terminology is being re-defined herein to be restricted to including any specific characteristics of the features or aspects of the invention with which that terminology is associated. The scope of the invention should therefore be construed in accordance with the appended claims and any equivalents thereof.