Abstract: A computing system for detecting patterns in data transmitted over a network is provided. The computing system includes a model engine configured to receive an initial dataset including historical data for a first time period, and segment the initial dataset into a plurality of subsets, each subset associated with a second time period smaller than the first time period. The model engine is further configured to train a machine learning model on each subset separately, receive a candidate dataset, analyze the candidate dataset using the trained machine learning model, and assign a score to the candidate dataset based on the analysis. The computing system further includes a rules engine configured to receive the candidate dataset and the corresponding score from the model engine, and generate and output, based at least in part on the score, a decision regarding the candidate dataset.

Abstract: A computing system for detecting patterns in data is provided. The computing system includes a model engine configured to receive an initial dataset, and segment the initial dataset into a plurality of subsets. The model engine is further configured to assign a weight to each subset based at least in part on an age of the subset, train a machine learning model on each subset separately in accordance with the assigned weighting for that subset. The model engine is further configured to receive a candidate dataset, analyze the candidate dataset using the trained machine learning model, and assign a score to the candidate dataset based on the analysis. The computing system further includes a rules engine configured to receive the candidate dataset and the corresponding score from the model engine, and generate and output, based at least in part on the score, a decision regarding the candidate dataset.

Abstract: A method and system for detecting fraudulent network events in a payment card network are provided. A plurality of scored payment card transaction authorization requests is received, originating from a plurality of merchants, and data structures for each of a plurality of merchant groups are generated. Each data structure sorts the scored authorization requests into fraud score range stripes. The data structures are parsed over a plurality of time periods, and at least one cumulative metric is calculated for each merchant group for each of the time periods in each fraud score range stripe. A plurality of ratio striping values is determined for each merchant group, and a set of feature inputs is generated using the ratio striping values. A second fraud detection model is applied to the scored authorization requests. Parameters of the second fraud detection model are configured to change based on the generated set of feature inputs.

Abstract: A system for identifying complete account identifiers from partial account identifiers is provided. The system includes an account identification computing device including at least one processor and a memory device in communication with the at least one processor. The processor is configured to receive transaction data including unique merchant identifiers, build a merchant table using the transaction data, and receive a list including partial account identifiers. The processor is further configured to determine, for each unique merchant identifier, a number of candidate account identifiers and calculate at least one metric based on the number of candidate account identifiers. The processor is further configured to identify a source unique merchant identifier and match at least one candidate account identifier to a complete account identifier by matching one of the partial account identifiers to the at least one candidate account identifier.

Abstract: An inverse recommender system for detecting out-of-pattern payment transactions includes a memory device and a processor programmed to receive transaction data. The transaction data corresponds to historical payment transactions between account holders and merchants. The processor is programmed to generate a merchant correspondence matrix including the merchants and counters indicating the number of historical payment transactions between merchant pairs of the merchants and the account holders. The processor is programmed to store the merchant correspondence matrix in a memory device linking the merchant pairs to each account holder. The processor receives additional transaction data associated with a new payment transaction between an account holder and a merchant, and to generate an inverse recommender score for the new payment transaction based on the account holder's historical payment transaction data.

Abstract: A common point of purchase (CPP) system for identifying a common point of purchases involved in fraudulent or unauthorized payment transactions is provided. The CPP system includes a common point of purchase (CPP) computing device that is configured to receive transaction data and build a table in a database, the table including recording pairing merchant and account identifiers. The CPP computing device is also configured to receive a list of flagged account identifiers and compare the list to the table. The CPP computing device is further configured to compute a metric and build a merchant profile for each merchant, for display at a client system.

Abstract: A system for identifying complete account identifiers from partial account identifiers is provided. The system includes an account identification computing device including at least one processor and a memory device in communication with the at least one processor. The processor is configured to receive transaction data including unique merchant identifiers, build a merchant table using the transaction data, and receive a list including partial account identifiers. The processor is further configured to determine, for each unique merchant identifier, a number of candidate account identifiers and calculate at least one metric based on the number of candidate account identifiers. The processor is further configured to identify a source unique merchant identifier and match at least one candidate account identifier to a complete account identifier by matching one of the partial account identifiers to the at least one candidate account identifier.

Abstract: A method and system for detecting fraudulent network events in a payment card network by incorporating breach velocities into fraud scoring models are provided. A potential compromise event is detected, and payment cards that transacted at a compromised entity associated with the potential compromise event are identified. Subsequent transaction activity for the payment cards is reviewed, and a data structure for the payment cards are generated. The data structure sorts subsequent transaction activity into fraud score range stripes. The data structure is parsed over a plurality of time periods, and at least one cumulative metric is calculated for each of the time periods in each fraud score range stripe. A plurality of ratio striping values are determined, and a set of feature inputs is generated using the ratio striping values. The feature inputs are applied to a scoring model used to score future real-time transactions initiated using the payment cards.

Abstract: An inverse recommender system for detecting out-of-pattern payment transactions includes a memory device and a processor programmed to receive transaction data. The transaction data corresponds to historical payment transactions between account holders and merchants. The processor is programmed to generate a merchant correspondence matrix including the merchants and counters indicating the number of historical payment transactions between merchant pairs of the merchants and the account holders. The processor is programmed to store the merchant correspondence matrix in a memory device linking the merchant pairs to each account holder. The processor receives additional transaction data associated with a new payment transaction between an account holder and a merchant, and to generate an inverse recommender score for the new payment transaction based on the account holder's historical payment transaction data.

Abstract: A method and system for detecting fraudulent network events in a payment card network by incorporating breach velocities into fraud scoring models are provided. A potential compromise event is detected, and payment cards that transacted at a compromised entity associated with the potential compromise event are identified. Subsequent transaction activity for the payment cards is reviewed, and a data structure for the payment cards are generated. The data structure sorts subsequent transaction activity into fraud score range stripes. The data structure is parsed over a plurality of time periods, and at least one cumulative metric is calculated for each of the time periods in each fraud score range stripe. A plurality of ratio striping values are determined, and a set of feature inputs is generated using the ratio striping values. The feature inputs are applied to a scoring model used to score future real-time transactions initiated using the payment cards.

Abstract: A computing system for detecting a pattern of fraudulent network events in a payment card network is configured to continuously receive a plurality of scored transaction authorization requests each including a respective account number and a respective fraud score. The computing system is also configured to sort the scored transaction authorization requests into account ranges based the account number, and sort the transaction authorization requests within each of the account ranges into a fraud score range stripes based on the corresponding fraud score. The computing system is further configured to calculate, for the scored transaction authorization requests within each fraud score range stripe, a ratio of a cumulative metric for a shorter time period over a longer time period, and detect, in near real-time, a fraud event associated with one of the account ranges based on the ratio for one of the fraud score range stripes within the account range.

Abstract: A computing system for detecting a pattern of fraudulent network events in a payment card network is configured to continuously receive a plurality of scored transaction authorization requests each including a respective account number and a respective fraud score. The computing system is also configured to sort the scored transaction authorization requests into account ranges based the account number, and sort the transaction authorization requests within each of the account ranges into a fraud score range stripes based on the corresponding fraud score. The computing system is further configured to calculate, for the scored transaction authorization requests within each fraud score range stripe, a ratio of a cumulative metric for a shorter time period over a longer time period, and detect, in near real-time, a fraud event associated with one of the account ranges based on the ratio for one of the fraud score range stripes within the account range.

Abstract: An inverse recommender system for detecting out-of-pattern payment transactions includes a memory device and a processor programmed to receive transaction data. The transaction data corresponds to historical payment transactions between account holders and merchants. The processor is programmed to generate a merchant correspondence matrix including the merchants and counters indicating the number of historical payment transactions between merchant pairs of the merchants and the account holders. The processor is programmed to store the merchant correspondence matrix in a memory device linking the merchant pairs to each account holder. The processor receives additional transaction data associated with a new payment transaction between an account holder and a merchant, and to generate an inverse recommender score for the new payment transaction based on the account holder's historical payment transaction data.

Abstract: A common point of purchase (CPP) system for identifying a common point of purchases involved in fraudulent or unauthorized payment transactions is provided. The CPP system includes a common point of purchase (CPP) computing device that is configured to receive transaction data and build a table in a database, the table including recording pairing merchant and account identifiers. The CPP computing device is also configured to receive a list of flagged account identifiers and compare the list to the table. The CPP computing device is further configured to compute a metric and build a merchant profile for each merchant, for display at a client system.

Abstract: A message tracking computing device for identifying anomalous activity in real-time is provided. The message tracking computing device is programmed to receive real-time transaction data including a plurality of transaction records. Each transaction record associated with a payment transaction. The message tracking computing device is also programmed to sort the plurality of transaction records into a plurality of channels. The message tracking computing device is further programmed to compute, for each channel, a normalized velocity score by computing a streaming mean, computing a streaming standard deviation, and computing the normalized velocity score based on the streaming mean, the streaming standard deviation, and a transaction ratio.

Abstract: A system for identifying complete account identifiers from partial account identifiers is provided. The system includes an account identification computing device including at least one processor and a memory device in communication with the at least one processor. The processor is configured to receive transaction data including unique merchant identifiers, build a merchant table using the transaction data, and receive a list including partial account identifiers. The processor is further configured to determine, for each unique merchant identifier, a number of candidate account identifiers and calculate at least one metric based on the number of candidate account identifiers. The processor is further configured to identify a source unique merchant identifier and match at least one candidate account identifier to a complete account identifier by matching one of the partial account identifiers to the at least one candidate account identifier.

Abstract: A common point of purchase (CPP) system for identifying a common point of purchases involved in fraudulent or unauthorized payment transactions is provided. The CPP system includes a common point of purchase (CPP) computing device that is configured to receive transaction data, store the transaction data in a database, and perform a look up within the database. The CPP computing device is also configured to build a merchant table, receive a card list, and compare a plurality of flagged account identifiers in the card list to account identifiers in the merchant table. The CPP computing device is further configured to retrieve a unique merchant identifier and/or a merchant name identifier associated with the merchant table account identifiers matched with the flagged account identifiers, aggregate the unique merchant identifier using the merchant name identifier, and determine a first number of the flagged account identifiers associated with the merchant name identifier.

Abstract: A method and system for detecting fraudulent network events in a payment card network by incorporating breach velocities into fraud scoring models are provided. A potential compromise event is detected, and payment cards that transacted at a compromised entity associated with the potential compromise event are identified. Subsequent transaction activity for the payment cards is reviewed, and a data structure for the payment cards are generated. The data structure sorts subsequent transaction activity into fraud score range stripes. The data structure is parsed over a plurality of time periods, and at least one cumulative metric is calculated for each of the time periods in each fraud score range stripe. A plurality of ratio striping values are determined, and a set of feature inputs is generated using the ratio striping values. The feature inputs are applied to a scoring model used to score future real-time transactions initiated using the payment cards.

Abstract: The methods described herein are configured to obtain a first record pattern associated with the unidentified entity and select a second record pattern associated with an entity identifier of a known entity. Based on the first record pattern matching the second record pattern, the entity identifier of the known entity is associated to the unidentified entity to indicate that the unidentified entity and the known entity are the same. Determining the entity identifier of the unidentified entity enables the linking of separate identifier systems of data structures to facilitate communication and/or interaction between the data structures.

Abstract: A method and system for detecting fraudulent network events in a payment card network by incorporating breach velocities into fraud scoring models are provided. A potential compromise event is detected, and payment cards that transacted at a compromised entity associated with the potential compromise event are identified. Subsequent transaction activity for the payment cards is reviewed, and a data structure for the payment cards are generated. The data structure sorts subsequent transaction activity into fraud score range stripes. The data structure is parsed over a plurality of time periods, and at least one cumulative metric is calculated for each of the time periods in each fraud score range stripe. A plurality of ratio striping values are determined, and a set of feature inputs is generated using the ratio striping values. The feature inputs are applied to a scoring model used to score future real-time transactions initiated using the payment cards.