Abstract: An example method is described. The method includes receiving, by a computing system, data indicative of a call into an interactive voice response (IVR) system from a user device and determining, by the computing system and based on the data, a set of actions performed by the user device within the IVR system and a corresponding set of results performed by the IVR system during the call. Additionally, the method includes converting, by the computing system, the set of actions and the corresponding set of results into a sequence of code pairs using a dictionary established based on training data, determining, by the computing system, an activity pattern during the call based on the sequence of code pairs; and calculating, by the computing system, a probability that the call is fraudulent based on the activity pattern during the call.

Abstract: An example method is described. The method includes receiving, by a computing system, data indicative of a call into an interactive voice response (IVR) system from a user device and determining, by the computing system and based on the data, a set of actions performed by the user device within the IVR system and a corresponding set of results performed by the IVR system during the call. Additionally, the method includes converting, by the computing system, the set of actions and the corresponding set of results into a sequence of code pairs using a dictionary established based on training data, determining, by the computing system, an activity pattern during the call based on the sequence of code pairs; and calculating, by the computing system, a probability that the call is fraudulent based on the activity pattern during the call.

Abstract: An example method is described. The method includes receiving, by a computing system, data indicative of a call into an interactive voice response (IVR) system from a user device and determining, by the computing system and based on the data, a set of actions performed by the user device within the IVR system and a corresponding set of results performed by the IVR system during the call. Additionally, the method includes converting, by the computing system, the set of actions and the corresponding set of results into a sequence of code pairs using a dictionary established based on training data, determining, by the computing system, an activity pattern during the call based on the sequence of code pairs; and calculating, by the computing system, a probability that the call is fraudulent based on the activity pattern during the call.

Abstract: Systems, methods, and computer-readable storage media utilized for event-based authentication. One method includes recognizing an event and receiving, from a device, a withdrawal request of a user, wherein the withdrawal request includes a captured feature by the device. The method further includes determining that the user is associated with the recognized event using at least a geographic proximity between the event and the withdrawal request, wherein the geographic proximity is a given radius around a location of the event, and wherein the device is within the given radius and adjusting authentication rules based on the determination that the user is associated with the recognized event, wherein the adjustment of the authentication rules includes adjusting a matching threshold between the captured feature and a reference feature. The method further includes processing the withdrawal request for the user based on the adjusted authentication rules.

Abstract: A financial institution computing system associated with a financial institution includes a network interface configured to communicate data over a network, and a processing circuit comprising a memory and a processor. The memory has instructions stored thereon that cause the processor to receive, by the network interface, a content request from a user computing device associated with a user, the content request requesting content from a network destination, determine if the network destination is associated with a trusted entity, determine that the requested content prompts the user to input sensitive information, and transmit, by the network interface substitution content to the user computing device responsive to determining that the network destination is illegitimate and to determining that the requested content includes at least one field into which the user may input sensitive information, the substitution content including at least one prompt requesting the user to input sensitive information.

Abstract: An example method is described. The method includes receiving, by a computing system, data indicative of a call into an interactive voice response (IVR) system from a user device and determining, by the computing system and based on the data, a set of actions performed by the user device within the IVR system and a corresponding set of results performed by the IVR system during the call. Additionally, the method includes converting, by the computing system, the set of actions and the corresponding set of results into a sequence of code pairs using a dictionary established based on training data, determining, by the computing system, an activity pattern during the call based on the sequence of code pairs; and calculating, by the computing system, a probability that the call is fraudulent based on the activity pattern during the call.

Abstract: Intelligent authentication is disclosed. Data associated with a request for resource access by a user is compared to values of factors related to previous resource access by the user. A score is computed based on a result of the compare. Here, the score represents a degree of likelihood the user is the user associated with the previous resource access. An authentication level can then be determined based on the score, and authentication of the user triggered at the authentication level. In one instance, the authentication can be triggered to re-authenticate a user after a user session times out.

Abstract: A financial institution computing system associated with a financial institution includes a network interface configured to communicate data over a network, and a processing circuit comprising a memory and a processor. The memory has instructions stored thereon that cause the processor to receive, by the network interface, a content request from a user computing device associated with a user, the content request requesting content from a network destination, determine if the network destination is associated with a trusted entity, determine that the requested content prompts the user to input sensitive information, and transmit, by the network interface substitution content to the user computing device responsive to determining that the network destination is illegitimate and to determining that the requested content includes at least one field into which the user may input sensitive information, the substitution content including at least one prompt requesting the user to input sensitive information.

Abstract: Methods and systems of authenticating a user based on an event, such as a natural disaster, a gathering of people, and mass activities of people. The method comprises recognizing, by a financial institution computing system, an event; receiving, by the financial institution computing system, a transaction request of a user; determining, by the financial institution computing system, that the user is associated with the recognized event; adjusting, by the financial institution computing system, authentication rules for the user; and processing, by the financial institution computing system, the transaction request for the user based on the adjusted authentication rules.

Abstract: A fraud analysis computing system is provided. The system includes a network interface configured to communicate data over a network and a processing circuit including one or more processors coupled to non-transitory memory. The processing circuit is configured to monitor incoming call data generated during an incoming call between a user and an incoming caller, detect a fraud trigger within the incoming call data, and complete a fraud interception activity in response to detection of the fraud trigger.

Abstract: An example method is described. The method includes receiving, by a computing system, data indicative of a call into an interactive voice response (IVR) system from a user device and determining, by the computing system and based on the data, a set of actions performed by the user device within the IVR system and a corresponding set of results performed by the IVR system during the call. Additionally, the method includes converting, by the computing system, the set of actions and the corresponding set of results into a sequence of code pairs using a dictionary established based on training data, determining, by the computing system, an activity pattern during the call based on the sequence of code pairs; and calculating, by the computing system, a probability that the call is fraudulent based on the activity pattern during the call.

Abstract: Systems and methods using a processor coupled to a non-transitory storage medium. The processor is structured to receive an indication of a mobile device connected to a secure network provided by a financial institution, where the mobile device is associated with a user account at the financial institution, identify the mobile device based on a unique identifier of the mobile device, automatically authenticate the mobile device for a first level transaction, receive a transaction request from a user via the mobile device, determine that the transaction request is for the first level transaction, and complete the transaction request.

Abstract: A mail analysis system includes a mail receiving device structured to receive a piece of mail associated with a user and direct the piece of mail to an imaging area, a scanning device structured to capture a scanned image of the piece of mail in the imaging area, a mail sorting structured to contact the piece of user mail to send the mail in one of a predetermined number of directions, and a processing circuit. The processing circuit is caused to receive the scanned image captured by the scanning device, determine if the piece of mail proposes a transaction to the user, transmit information pertaining to the transaction to a financial institution computing system, receive, an indication of the legitimacy of the proposed transaction from the financial institution computing system, and transmit a control signal to the mail sorting device based on the legitimacy of the proposed transaction.

Abstract: An example method is described. The method includes receiving, by a computing system, data indicative of a call into an interactive voice response (IVR) system from a user device and determining, by the computing system and based on the data, a set of actions performed by the user device within the IVR system and a corresponding set of results performed by the IVR system during the call. Additionally, the method includes converting, by the computing system, the set of actions and the corresponding set of results into a sequence of code pairs using a dictionary established based on training data, determining, by the computing system, an activity pattern during the call based on the sequence of code pairs; and calculating, by the computing system, a probability that the call is fraudulent based on the activity pattern during the call.

Abstract: Intelligent authentication is disclosed. According to one embodiment, a system includes a transaction logic configured to receive transaction metadata associated with an attempted transaction. The transaction logic is also configured to identify a user attempting the attempted transaction. The system further includes an activity logic configured to access an activity log associated with the user. The activity log includes values corresponding to previous transactions made by the user and any additional information provided by 3rd party feeds. The activity logic is also configured to compare transaction metadata to the values. The system also includes an authentication logic configured to select an authentication level for the transaction based, at least in part, on the comparison.

Abstract: A fraud analysis computing system is provided. The system includes a network interface configured to communicate data over a network and a processing circuit including one or more processors coupled to non-transitory memory. The processing circuit is configured to monitor incoming call data generated during an incoming call between a user and an incoming caller, detect a fraud trigger within the incoming call data, and complete a fraud interception activity in response to detection of the fraud trigger.

Abstract: A financial institution computing system associated with a financial institution includes a network interface configured to communicate data over a network, and a processing circuit comprising a memory and a processor. The memory has instructions stored thereon that cause the processor to receive, by the network interface, a content request from a user computing device associated with a user, the content request requesting content from a network destination, determine if the network destination is associated with a trusted entity, determine that the requested content prompts the user to input sensitive information, and transmit, by the network interface substitution content to the user computing device responsive to determining that the network destination is illegitimate and to determining that the requested content includes at least one field into which the user may input sensitive information, the substitution content including at least one prompt requesting the user to input sensitive information.

Abstract: Systems, methods, and other embodiments associated with intelligent authentication. According to one embodiment, a system includes a transaction logic configured to receive transaction metadata associated with an attempted transaction. The transaction logic is also configured to identify a user attempting the attempted transaction. The system further includes an activity logic configured to access an activity log associated with the user. The activity log includes values corresponding to previous transactions made by the user and any additional information provided by 3rd party feeds. The activity logic is also configured to compare transaction metadata to the values. The system also includes an authentication logic configured to select an authentication level for the transaction based, at least in part, on the comparison.

Abstract: Systems, methods, and other embodiments associated with intelligent authentication. According to one embodiment, a system includes a transaction logic configured to receive transaction metadata associated with an attempted transaction. The transaction logic is also configured to identify a user attempting the attempted transaction. The system further includes an activity logic configured to access an activity log associated with the user. The activity log includes values corresponding to previous transactions made by the user and any additional information provided by 3rd party feeds. The activity logic is also configured to compare transaction metadata to the values. The system also includes an authentication logic configured to select an authentication level for the transaction based, at least in part, on the comparison.