Abstract: A system for determining a fraud risk score associated with a transaction. The system includes a server including an electronic processor. The electronic processor is configured to determine a plurality of rules based on a plurality of transactions over time and extract one or more features of the transaction. The electronic processor is also configured to select, based on the plurality of rules, a plurality of fraud risk features Each non-categorical fraud risk feature selected is associated with a fraud risk feature value and each categorical fraud risk feature selected is associated with a categorical variable value. The electronic processor is configured to determine, for each categorical fraud risk feature, a fraud risk feature value. The electronic processor is also configured to determine the fraud risk score based on the one or more of the transformed fraud risk feature values.

Abstract: Systems, methods, devices, and computer readable media related to fraud detection. Fraud detection is achieved using a flexible scripting language and syntax that simplifies the generation of fraud detection rules. The rules are structured as conditional IF-THEN statements that include data objects referred to as Anchors and Add-Ons. The Anchors and Add-Ons used to generate the rules also correspond to a distinct data path for the retrieval data from any of a variety of data sources. The retrieval of data from the various data sources is optimized based on data dependencies within the rules. By knowing the data dependencies of each rule and utilizing parallelization of rule execution, the retrievals of data from the data sources is achieved efficiently so the rules can be executed quickly.

Abstract: A universal device identifier (UDID) service with adjusted attribute distances. In one embodiment, a server includes an electronic processor and a memory storing the UDID service. The electronic processor is configured to receive an identification request regarding a currently-observed device having a first set of device attributes, retrieve any previously-observed devices, determine whether one or more devices are found from retrieving the any of the previously-observed devices, determine all changed device attributes for each device of the one or more devices that are found relative to the first set of device attributes, generate an adjusted attribute distance corresponding to the all changed device attributes for the each device, retrieve a universal device identifier (UDID) of a closest device having a lowest adjusted attribute distance among all adjusted attribute distances that are generated, and assign the UDID of the closest device to the currently-observed device.

Abstract: Systems and methods for tracking velocity information. One system includes an application execution server providing an application layer. The application execution server is configured to receive a request including metadata. The application execution server is also configured to generate and transmit a response to the request. The application execution server is also configured to enrich the metadata by structuring the metadata for further processing by a data processing layer, where the further processing includes determining velocity information associated with the metadata, and by supplementing the metadata with available historical velocity information. The application execution server is also configured to transmit the enriched metadata for further processing by the data processing layer.

Abstract: Systems, methods, devices, and computer readable media related to fraud detection. Fraud detection is achieved using a flexible scripting language and syntax that simplifies the generation of fraud detection rules. The rules are structured as conditional IF-THEN statements that include data objects referred to as Anchors and Add-Ons. The Anchors and Add-Ons used to generate the rules also correspond to a distinct data path for the retrieval data from any of a variety of data sources. The generated rules with distinct data paths are then converted using a transpiler from the scripting language into native language source code (e.g., PHP, Java, etc.) for deployment in a particular environment. The rules are then executed in real-time in the environment to detect potential fraudulent activity.

Abstract: Methods and systems for request orchestration. One system includes an electronic processor configured to receive a request including request metadata and identify a data attribute associated with the request. The electronic processor is also configured to determine an execution plan for enriching the request metadata based on the data attribute. The electronic processor is also configured to execute an application function according to the execution plan to enrich the request metadata. The electronic processor is also configured to evaluate the enriched request metadata. The electronic processor is also configured to generate and transmit a response to the request based on the evaluation of the enriched request metadata.

Abstract: Methods and systems for providing distributed GeoIP information updating. One method includes receiving, with a data processing server, an update event associated with an update to an active version of GeoIP information, the active version of the GeoIP information is actively accessible by an application execution server for request enrichment. The method also includes generating, with the data processing server, an updated version of the GeoIP information according to the update. The method also includes replacing, with the data processing server, the active version with the updated version in storage, where, in response to storing the updated version, the updated version is actively accessible by the application server for request enrichment.

Abstract: Methods and systems for providing distributed user agent information updating. One system includes a data processing server configured to receive an update event associated with an update to an active version of user agent information. The active version of the user agent information is actively accessible for request enrichment. The data processing server is also configured to generate an updated version of the user agent information according to the update and replace the active version with the updated version in storage. In response to the storage of the updated version, the updated version is actively accessible for request enrichment.

Abstract: Methods and systems for providing distributed evaluation list updating. One system includes a data processing server. The data processing server receiving a request event associated with an update to an active evaluation list version. The active evaluation list version is actively accessible for request validation. The data processing server also generates an updated evaluation list version according to the update associated with the request event. After generating the updated evaluation list version, the data processing server replaces the active evaluation list version with the updated evaluation list version in storage, where, in response to storing the updated evaluation list version, the updated evaluation list version is actively accessible for request validation.

Abstract: A system, method and computer-readable medium for recommending signals to monitor in a fraud prevention application, including a server including an electronic processor. The electronic processor is configured to calculate a similarity score for one or more clients, and, for one or more signals, determine, for each of the one or more clients, a signal weight associated with the signal. The electronic processor is also configured to multiply the signal weight by the similarity score associated with the client to generate a weighted similarity score and generate a total similarity score and, for each signal, a total weighted similarity score. The electronic processor is configured to, for each signal, generate a recommendation score based on the total weighted similarity score for the signal and the total similarity score for the signal and, based on the recommendation scores, generate one or more recommended signals for a first client.

Abstract: Methods and systems for developing software products from reusable code files. One system includes an electronic processor configured to receive a first selection defining a desired functionality for a new software product and a second selection for the new software product. The electronic processor is also configured to access, from a first repository, a first executable code file based on the first selection and access, from a second repository, a second executable code file based on the second selection. The electronic processor is also configured to aggregate the first executable code file and the second executable code file as the new software product. The electronic processor is also configured to enable deployment of the new software product.

Abstract: A fraud prevention system that includes a fraud prevention server including an electronic processor and a memory. The memory includes a feature drift hardened online application origination (OAO) service. When executing the feature drift hardened OAO service, the electronic processor is configured to detect, with respect to a first OAO model, feature drift in a dataset of an online application that exceeds a predefined threshold, generate one or more feature drift hardened OAO models that mitigate the feature drift, determine a fraud score of the online application based on the one or more feature drift hardened OAO models that differentiates between a behavior of a normal user and a behavior of a nefarious actor during a submission of the online application on a device and mitigates the feature drift, and control a client server to approve, hold, or deny the online application based on the fraud score.

Abstract: An account recommendation system that includes a server. The server is operable to identify a user account based on a server-side persistent device identification. The server includes a processor and a memory. The server is configured to receive a request including one or more attributes related to a client device, identify the server-side persistent device identification (“PDI”) record for the client device based on the one or more attributes of the client device, identify one or more candidate accounts based on the server-side persistent device identification, determine confidence scores for each of the one or more candidate accounts, generate a recommendation signal for the user account associated with the client device based on the confidence scores, and transmit the recommendation signal to a merchant server.

Abstract: Systems and methods for providing a hardware security module extension having support for custom cryptographic operations. One system includes an application execution server providing an application execution environment. The application execution server is configured to receive a cryptographic request associated with a custom cryptographic operation and access key data from a hardware security module in response to receiving the cryptographic request. The application execution server is also configured to execute, within the application execution environment, the custom cryptographic operation against the key data from the hardware security module and transmit a response to the cryptographic request.

Abstract: An account recommendation system that includes a server. The server is operable to identify a user account based on a server-side persistent device identification. The server includes a processor and a memory. The server is configured to receive a request including one or more attributes related to a client device, identify the server-side persistent device identification (“PDI”) record for the client device based on the one or more attributes of the client device, identify one or more candidate accounts based on the server-side persistent device identification, determine confidence scores for each of the one or more candidate accounts, generate a recommendation signal for the user account associated with the client device based on the confidence scores, and transmit the recommendation signal to a merchant server.

Abstract: A fraud prevention system that includes a server. The server is operable to receive a first attribute of a client device from the client device and associated with a first transaction, receive a second attribute of the client device from the client device and associated with the first transaction, receive a third attribute related to the client device and associated with the first transaction, and generate a persistent device identification (“PDI”) record including the first attribute, the second attribute, and the third attribute, store the PDI record in a memory, receive the third attribute related to the client device and associated with a second transaction, and identify the client device using the PDI record based on the third attribute without receiving, in association with the second transaction, the first attribute of the client device and the second attribute of the client device.

Abstract: Systems and methods are provided for use in extending dialogue between a mobile device and a point-of-interaction. One exemplary computer-implemented method includes receiving, at a point-of-interaction (POI) computing device, an identifier for an interaction with a user where the identifier is specific to a card associated with an account of the user or to the user in general, and submitting, by the POI computing device, a request for the identifier to a registration database to determine whether the account is registered for one or more services. The method then includes, in response to the request, receiving an encrypted action (associated with a service), encoding, by the POI computing device, a receipt for the interaction, and transmitting, by the POI computing device, the encoded receipt and the encrypted action to a host server for initiating the encrypted action between the POI computing device and a mobile device associated with the user.

Abstract: Security-enhancing devices, systems, methods, and non-transitory computer-readable media for performing non-interactive zero knowledge proof (NIZKP) authentication. In one embodiment, a computing device includes a memory and an electronic processor. The memory stores a NIZKP authentication program and a plurality of unique passwords. The electronic processor is configured to receive a first random value from an electronic source, generate a second random value by performing an exclusive disjunction operation on the first random value with a first password of the plurality of unique passwords, perform an extraction operation on the second random value, determine whether the extraction operation performed on the second random value extracted a non-random value from the second random value, and responsive to determining that the extraction operation performed on the second random value extracted the non-random value from the second random value, authenticate communications with the electronic source.

Abstract: Security-enhancing devices, systems, methods, and non-transitory computer-readable media for performing non-interactive zero knowledge proof (NIZKP) authentication. In one embodiment, a computing device includes a memory and an electronic processor. The memory stores a NIZKP authentication program and a plurality of unique passwords. The electronic processor is configured to receive a first random value from an electronic source, generate a second random value by performing an exclusive disjunction operation on the first random value with a first password of the plurality of unique passwords, perform an extraction operation on the second random value, determine whether the extraction operation performed on the second random value extracted a non-random value from the second random value, and responsive to determining that the extraction operation performed on the second random value extracted the non-random value from the second random value, authenticate communications with the electronic source.

Abstract: Systems and methods for providing a development application having a tiered application pattern. One system includes an electronic processor configured to, with a gateway layer, receive and route a request to an application layer. In response to receiving the request from the gateway layer, the electronic processor is also configured to, with the application layer, perform application functionality corresponding to a function associated with the request. The application functionality includes generating an application event. The electronic processor is configured to receive, with an event stream layer, the application event from the application layer. The electronic processor is configured to, with the data processing layer, access the application event and process the application event. The electronic processor is configured to transmit, with the data processing layer, the processed application event to a data storage layer.