Abstract: A payment processing system continuously processes transactions. A group of transactions satisfying criteria within a recent measurement window are extracted from transaction data. A second group of transactions satisfying the criteria within a past baseline window are also extracted. An attribute of transactions is selected for analysis and a risk metric value is calculated for transactions in the measurement window having a particular attribute value. The same risk metric is used to calculate a baseline value for transactions in the baseline window having the same attribute value. The baseline value may be normalized and adjusted. The risk metric value is compared to the baseline value and an alert is generated if the risk metric value is greater. Any of a variety of risk metrics are used. Total dollar amount and total order count from the measurement window compared to similar from the baseline window are also used to inform the alert.

Abstract: A payment processing system continuously processes transactions. Upon arrival, in real-time, a transaction is parsed and each entity is used to retrieve other previous transactions associated with that entity in order to build a link analysis web. Iteratively, each entity in the retrieved transactions is used to retrieve other associated transactions, etc. Before retrieval of associated transactions, each entity is checked whether it appears in a bypass table. If so, that entity is not used to retrieve transactions. Once built, transactions and entities within the link analysis web are analyzed to determine whether the current transaction is fraudulent. Off-line or online, risk metrics such as address mismatch rate, bank decline rate, ticket decline rate and new payment device rate, along with the proportion of a linked entity is used to determine whether that linked entity is erroneous and should be placed into the bypass table and excluded from the web.

Abstract: A payment processing system continuously processes transactions. Upon arrival, in real-time, a transaction is parsed and each entity is used to retrieve other previous transactions associated with that entity in order to build a link analysis web. Iteratively, each entity in the retrieved transactions is used to retrieve other associated transactions, etc. Before retrieval of associated transactions, each entity is checked whether it appears in a bypass table. If so, that entity is not used to retrieve transactions. Once built, transactions and entities within the link analysis web are analyzed to determine whether the current transaction is fraudulent. Off-line or online, risk metrics such as address mismatch rate, bank decline rate, ticket decline rate and new payment device rate, along with the proportion of a linked entity is used to determine whether that linked entity is erroneous and should be placed into the bypass table and excluded from the web.

Abstract: A payment processing system continuously processes transactions. A group of transactions satisfying criteria within a recent measurement window are extracted from transaction data. A second group of transactions satisfying the criteria within a past baseline window are also extracted. An attribute of transactions is selected for analysis and a risk metric value is calculated for transactions in the measurement window having a particular attribute value. The same risk metric is used to calculate a baseline value for transactions in the baseline window having the same attribute value. The baseline value may be normalized and adjusted. The risk metric value is compared to the baseline value and an alert is generated if the risk metric value is greater. Any of a variety of risk metrics are used. Total dollar amount and total order count from the measurement window compared to similar from the baseline window are also used to inform the alert.