Systems, methods, and computer program products for real-time automated teller machine fraud detection and prevention

Abstract

Systems, methods, and computer program products for real-time automated teller machine (ATM) fraud detection and prevention are described. The method includes receiving transaction data for a plurality of transactions in real-time during processing at a transaction service provider system. The method further includes storing the transaction data in a distributed cache and receiving a transaction request for a user transaction using a payment device at an ATM. The method further includes modifying a profile of ATM activity stored in the distributed cache and comparing at least one metric of the profile to at least one predetermined ATM activity threshold. The method further includes activating a fraud prevention operation comprising rejecting the user transaction, disabling a transaction account, communicating an alert to an issuer, or any combination thereof prior to completion of the user transaction at the ATM.

Description

Technical Field

[0001] The disclosed embodiments or aspects generally relate to fraud detection and prevention, and in a particular embodiment or aspect, to systems, methods, and computer program products that use a distributed cache to detect ATM transaction fraud in real time and activate a fraud prevention system in response. Background Technology

[0002] Participating in fraudulent ATM transactions, especially withdrawals, can be termed "cash-out fraud." Cash-out fraud has resulted in millions of dollars in losses, shared by payment device users and financial institutions. Fraudulent transactions using ATMs are difficult to detect, and even when fraud is detected, the transactions may be completed before traditional security systems trigger security measures. Further complicating matters, payment devices (e.g., debit cards) can be cloned, so multiple fraudsters may attempt to conduct fraudulent transactions at multiple ATMs simultaneously or substantially simultaneously, trying to use as many compromised payment devices as possible before security measures are implemented. Additionally, while it may be common for bank-wide data breaches to trigger proactive fraud prevention systems, such cases do not explain fraud occurring on a specific payment device.

[0003] Furthermore, fixed fraud prevention rules, especially those that strictly apply to all users, cannot fully account for the transaction behavior of individual payment devices, regional transaction behavior, or trends and changes in transaction behavior. Fixed fraud prevention rules often lead to false positives or false negatives, resulting in user frustration or failure to detect fraudulent transactions.

[0004] There is a need in the art for technical solutions to detect fraudulent ATM transactions during ATM transaction processing, particularly before cash withdrawal may occur. Such technical solutions require the use of computer networks configured to aggregate, invoke, and analyze data. There is also a need in the art for technical solutions employing dynamic fraud prevention thresholds to allow for more accurate fraud detection. Summary of the Invention

[0005] Therefore, and generally speaking, we provide improved systems, methods, and computer program products for computer-implemented methods of real-time automated teller machine (ATM) fraud detection and prevention. Preferably, we provide systems, methods, and computer program products for receiving transaction data of multiple transactions in real time during transaction processing in a transaction service provider system. Preferably, we provide systems, methods, and computer program products for storing the transaction data in a distributed cache for aggregating and retrieving the transaction data. Preferably, we provide systems, methods, and computer program products for receiving transaction requests at the ATM, modifying a profile of ATM activity, and comparing at least one metric of the profile with at least one predetermined ATM activity threshold. Preferably, we provide systems, methods, and computer program products for activating fraud prevention operations before a user transaction is completed at the ATM.

[0006] According to a non-limiting embodiment or aspect, a computer-implemented method for real-time ATM fraud detection and prevention is provided. The method includes receiving, with at least one processor, transaction data of multiple transactions completed by at least one ATM, the transaction data being received in real-time during transaction processing in a transaction service provider system. The method includes storing the transaction data in a distributed cache with at least one processor for aggregating and retrieving the transaction data. The method includes receiving, with at least one processor, a transaction request for a user transaction at an ATM using a payment device, the transaction request including a payment device identifier. The method includes modifying, with at least one processor, a profile of ATM activity stored in the distributed cache and associated with the payment device identifier and / or the identifier of the ATM. The profile includes metrics including at least ATM transaction value data and ATM transaction count data. The method includes comparing at least one metric of the profile of the ATM activity with at least one predetermined ATM activity threshold using at least one processor. The method includes activating or causing activation of fraud prevention operations with at least one processor before the user transaction is completed at the ATM in response to determining that the at least one metric meets the at least one predetermined ATM activity threshold. The fraud prevention actions include at least one of the following: rejecting the user's transaction, disabling the transaction account associated with the payment device identifier, sending an alert to the issuer, or any combination thereof.

[0007] In some non-limiting embodiments or aspects, the ATM may be communicatively connected to the distributed cache and may be programmed and / or configured to aggregate the transaction data with data from the user transaction during the processing of the user transaction.

[0008] In some non-limiting embodiments or aspects, the fraud prevention operation may be performed by the ATM in real time in conjunction with processing the user transaction (i) comparing the at least one metric with the at least one predetermined ATM activity threshold, and (ii) activating or causing the fraud prevention operation to be activated.

[0009] In some non-limiting embodiments or aspects, the at least one predetermined ATM activity threshold may be generated at least in part by a machine learning model trained on historical transaction data from multiple payment devices. The machine learning model may be periodically updated based on transaction data received in real time during the processing of the transaction data. The at least one predetermined ATM activity threshold may be regenerated at regular intervals by the machine learning model, at least in part.

[0010] In some non-limiting embodiments or aspects, the at least one metric may further include ATM transaction time data. The fraud prevention operation may be activated in response to determining that the ATM transaction count associated with the payment device identifier within a certain time period meets the at least one predetermined ATM activity threshold, including a transaction upper limit threshold count.

[0011] In some non-limiting embodiments or aspects, the at least one metric may further include ATM transaction location data. The fraud prevention operation may be activated in response to determining that the number of ATM transactions associated with the payment device identifier in a geographic area meets the at least one predetermined ATM activity threshold, including a transaction cap threshold count in the geographic area.

[0012] In some non-limiting embodiments or aspects, the at least one metric may further include ATM transaction time data and ATM transaction location data. The fraud prevention operation may be activated in response to determining that the time interval between a first ATM transaction and a second ATM transaction of the payment device satisfies at least one predetermined ATM activity threshold, including a lower limit threshold time interval. The lower limit threshold may represent the unlikely or improbable travel time between the location of the first ATM transaction and the location of the second ATM transaction.

[0013] According to a non-limiting embodiment or aspect, a system for real-time automatic teller machine (ATM) fraud detection and prevention is provided. The system includes a distributed cache and a server, the server including at least one processor for executing program instructions. The server is programmed and / or configured to receive transaction data of multiple transactions completed by at least one ATM, the transaction data being received in real-time during transaction processing by a transaction service provider system. The server is programmed and / or configured to store the transaction data in the distributed cache for aggregating and retrieving the transaction data. The server is programmed and / or configured to receive transaction requests for user transactions using a payment device at the ATM, the transaction requests including a payment device identifier. The server is programmed and / or configured to modify a profile of ATM activity stored in the distributed cache and associated with the payment device identifier and / or the identifier of the ATM. The profile includes metrics including at least ATM transaction value data and ATM transaction count data. The server is programmed and / or configured to compare at least one metric of the profile of the ATM activity with at least one predetermined ATM activity threshold. The server is programmed and / or configured to activate or cause fraud prevention operations to be activated before the user transaction is completed at the ATM in response to determining that the at least one metric meets the at least one predetermined ATM activity threshold. The fraud prevention operations include at least one of the following: rejecting the user transaction, disabling the transaction account associated with the payment device identifier, sending an alert to the issuer, or any combination thereof.

[0014] In some non-limiting embodiments or aspects, the at least one predetermined ATM activity threshold may be generated at least in part by a machine learning model trained on historical transaction data from multiple payment devices. The machine learning model may be periodically updated based on transaction data received in real time during the processing of the transaction data. The at least one predetermined ATM activity threshold may be regenerated at regular intervals by the machine learning model, at least in part.

[0015] In some non-limiting embodiments or aspects, the at least one metric may further include ATM transaction time data. The fraud prevention operation may be activated in response to determining that the ATM transaction count associated with the payment device identifier within a certain time period meets the at least one predetermined ATM activity threshold, including a transaction upper limit threshold count.

[0016] In some non-limiting embodiments or aspects, the at least one metric may further include ATM transaction location data. The fraud prevention operation may be activated in response to determining that the number of ATM transactions associated with the payment device identifier in a geographic area meets the at least one predetermined ATM activity threshold, including a transaction cap threshold count in the geographic area.

[0017] In some non-limiting embodiments or aspects, the at least one metric may further include ATM transaction time data and ATM transaction location data. The fraud prevention operation may be activated in response to determining that the time interval between a first ATM transaction and a second ATM transaction of the payment device satisfies at least one predetermined ATM activity threshold, including a lower limit threshold time interval. The lower limit threshold may represent the unlikely or improbable travel time between the location of the first ATM transaction and the location of the second ATM transaction.

[0018] According to a non-limiting embodiment or aspect, a computer program product is provided for real-time automated teller machine (ATM) fraud detection and prevention. The computer program product includes at least one non-transient computer-readable medium comprising program instructions that, when executed by at least one processor, cause the at least one processor to receive transaction data of multiple transactions completed by at least one ATM. The transaction data is received in real-time during transaction processing in a transaction service provider system. The program instructions further cause the at least one processor to store the transaction data in a distributed cache for aggregating and retrieving the transaction data. The program instructions further cause the at least one processor to receive a transaction request for a user transaction using a payment device at the ATM, the transaction request including a payment device identifier. The program instructions further cause the at least one processor to modify a profile of ATM activity stored in the distributed cache and associated with the payment device identifier and / or the identifier of the ATM. The profile includes metrics including at least ATM transaction value data and ATM transaction count data. The program instructions further cause the at least one processor to compare at least one metric of the profile of the ATM activity with at least one predetermined ATM activity threshold. The program instructions further cause the at least one processor to activate or cause fraud prevention operations to be activated before the user transaction is completed at the ATM in response to determining that the at least one metric meets the at least one predetermined ATM activity threshold. The fraud prevention operations include at least one of the following: rejecting the user transaction, disabling the transaction account associated with the payment device identifier, sending an alert to the issuer, or any combination thereof.

[0019] In some non-limiting embodiments or aspects, the at least one predetermined ATM activity threshold may be generated at least in part by a machine learning model trained on historical transaction data from multiple payment devices. The machine learning model may be periodically updated based on transaction data received in real time during the processing of the transaction data. The at least one predetermined ATM activity threshold may be regenerated at regular intervals by the machine learning model, at least in part.

[0020] In some non-limiting embodiments or aspects, the at least one metric may further include ATM transaction time data. The fraud prevention operation may be activated in response to determining that the ATM transaction count associated with the payment device identifier within a certain time period meets the at least one predetermined ATM activity threshold, including a transaction upper limit threshold count.

[0021] In some non-limiting embodiments or aspects, the at least one metric may further include ATM transaction location data. The fraud prevention operation may be activated in response to determining that the number of ATM transactions associated with the payment device identifier in a geographic area meets the at least one predetermined ATM activity threshold, including a transaction cap threshold count in the geographic area.

[0022] In some non-limiting embodiments or aspects, the at least one metric may further include ATM transaction time data and ATM transaction location data. The fraud prevention operation may be activated in response to determining that the time interval between a first ATM transaction and a second ATM transaction of the payment device satisfies at least one predetermined ATM activity threshold, including a lower limit threshold time interval. The lower limit threshold may represent the unlikely or improbable travel time between the location of the first ATM transaction and the location of the second ATM transaction.

[0023] Other non-limiting embodiments or aspects are set forth in the following numbered clauses:

[0024] Clause 1: A computer-implemented method for real-time automatic teller machine (ATM) fraud detection and prevention, the method comprising: receiving, with at least one processor, transaction data of a plurality of transactions completed by at least one ATM, the transaction data being received in real time during transaction processing in a transaction service provider system; storing, with at least one processor, the transaction data in a distributed cache for aggregating and retrieving the transaction data; receiving, with at least one processor, a transaction request for a user transaction at the ATM using a payment device, the transaction request including a payment device identifier; and modifying, with at least one processor, the data stored in the distributed cache and related to the payment device identifier and / or the ATM... A profile of ATM activity associated with the identifier of M, the profile including at least ATM transaction value data and ATM transaction count data; comparing at least one metric of the profile of the ATM activity with at least one predetermined ATM activity threshold using at least one processor; and activating or causing to activate fraud prevention operations using at least one processor before completing the user transaction at the ATM in response to determining that the at least one metric meets the at least one predetermined ATM activity threshold, the fraud prevention operations including at least one of the following: rejecting the user transaction, disabling the transaction account associated with the payment device identifier, sending an alert to the issuer, or any combination thereof.

[0025] Clause 2: The computer-implemented method according to Clause 1, wherein the ATM communication is connected to the distributed cache and is programmed and / or configured to aggregate the transaction data with data from the user transaction during the processing of the user transaction.

[0026] Clause 3: A computer-implemented method according to Clause 1 or 2, wherein the processing of the user transaction is performed in real time by the ATM by (i) comparing the at least one metric with the at least one predetermined ATM activity threshold, and (ii) activating or causing the fraud prevention operation to be activated.

[0027] Clause 4: A computer-implemented method according to any one of Clauses 1 to 3, wherein the at least one predetermined ATM activity threshold is generated at least in part by a machine learning model trained on historical transaction data of multiple payment devices.

[0028] Clause 5: A computer-implemented method according to any one of Clauses 1 to 4, wherein the machine learning model is periodically updated based on the transaction data received in real time during the processing of the transaction data, and wherein the at least one predetermined ATM activity threshold is at least partially regenerated by the machine learning model at regular intervals.

[0029] Clause 6: A computer-implemented method according to any one of Clauses 1 to 5, wherein the at least one metric further includes ATM transaction time data, and wherein the fraud prevention operation is activated in response to determining that the ATM transaction count associated with the payment device identifier within a certain time period meets the at least one predetermined ATM activity threshold including a transaction upper limit threshold count.

[0030] Clause 7: A computer-implemented method according to any one of Clauses 1 to 6, wherein the at least one metric further includes ATM transaction location data, and wherein the fraud prevention operation is activated in response to determining that the ATM transaction count associated with the payment device identifier in a geographic area satisfies the at least one predetermined ATM activity threshold including a transaction upper limit threshold count in the geographic area.

[0031] Clause 8: A computer-implemented method according to any one of Clauses 1 to 7, wherein the at least one metric further includes ATM transaction time data and ATM transaction location data, and wherein the fraud prevention operation is activated in response to determining that the time interval between a first ATM transaction of the payment device and a second ATM transaction of the payment device satisfies the at least one predetermined ATM activity threshold including a lower limit threshold time interval, the lower limit threshold representing an unlikely or improbable travel time between the location of the first ATM transaction and the location of the second ATM transaction.

[0032] Clause 9: A system for real-time automatic teller machine (ATM) fraud detection and prevention, the system comprising: a distributed cache; and a server including at least one processor for executing program instructions, the server being programmed and / or configured to: receive transaction data of multiple transactions completed by at least one ATM, the transaction data being received in real time during transaction processing in a transaction service provider system; store the transaction data in the distributed cache for aggregating and retrieving the transaction data; receive a transaction request for a user transaction using a payment device at the ATM, the transaction request including a payment device identifier; modify the data stored in the distributed cache and related to the... A profile of ATM activity associated with a payment device identifier and / or the identifier of the ATM, the profile including metrics including at least ATM transaction value data and ATM transaction count data; comparing at least one metric of the profile of the ATM activity with at least one predetermined ATM activity threshold; and activating or causing fraud prevention operations to be activated before the user transaction is completed at the ATM in response to determining that the at least one metric meets the at least one predetermined ATM activity threshold, the fraud prevention operations including at least one of the following: rejecting the user transaction, disabling the transaction account associated with the payment device identifier, sending an alert to the issuer, or any combination thereof.

[0033] Clause 10: In the system described in Clause 9, wherein the at least one predetermined ATM activity threshold is generated at least in part by a machine learning model trained on historical transaction data from multiple payment devices.

[0034] Clause 11: The system according to Clause 9 or 10, wherein the machine learning model is periodically updated based on the transaction data received in real time during the processing of the transaction data, and wherein the at least one predetermined ATM activity threshold is at least partially regenerated by the machine learning model at regular intervals.

[0035] Clause 12: A system according to any one of Clauses 9 to 11, wherein the at least one metric further includes ATM transaction time data, and wherein the fraud prevention operation is activated in response to determining that the ATM transaction count associated with the payment device identifier within a certain time period meets the at least one predetermined ATM activity threshold including a transaction upper limit threshold count.

[0036] Clause 13: A system according to any one of Clauses 9 to 12, wherein the at least one metric further includes ATM transaction location data, and wherein the fraud prevention operation is activated in response to determining that the ATM transaction count associated with the payment device identifier in a geographic area meets the at least one predetermined ATM activity threshold including the transaction upper limit threshold count in the geographic area.

[0037] Clause 14: A system according to any one of Clauses 9 to 13, wherein the at least one metric further includes ATM transaction time data and ATM transaction location data, and wherein the fraud prevention operation is activated in response to determining that the time interval between a first ATM transaction of the payment device and a second ATM transaction of the payment device satisfies the at least one predetermined ATM activity threshold including a lower limit threshold time interval, the lower limit threshold representing an unlikely or improbable travel time between the location of the first ATM transaction and the location of the second ATM transaction.

[0038] Clause 15: A computer program product for real-time automatic teller machine (ATM) fraud detection and prevention, the computer program product comprising at least one non-transitory computer-readable medium, the at least one non-transitory computer-readable medium comprising program instructions, the program instructions, when executed by at least one processor, causing the at least one processor to: receive transaction data of a plurality of transactions completed by at least one ATM, the transaction data being received in real time during transaction processing in a transaction service provider system; store the transaction data in a distributed cache for aggregating and retrieving the transaction data; receive a transaction request for a user transaction at the ATM using a payment device, the transaction request including a payment device identifier; modify the stored... A configuration file of ATM activity stored in the distributed cache and associated with the payment device identifier and / or the ATM identifier, the configuration file including metrics including at least ATM transaction value data and ATM transaction count data; comparing at least one metric of the configuration file of the ATM activity with at least one predetermined ATM activity threshold; and activating or causing fraud prevention operations to be activated before the user transaction is completed at the ATM in response to determining that the at least one metric meets the at least one predetermined ATM activity threshold, the fraud prevention operations including at least one of the following: rejecting the user transaction, disabling the transaction account associated with the payment device identifier, sending an alert to the issuer, or any combination thereof.

[0039] Clause 16: The computer program product pursuant to Clause 15, wherein the at least one predetermined ATM activity threshold is generated, at least in part, by a machine learning model trained on historical transaction data from multiple payment devices.

[0040] Clause 17: A computer program product pursuant to Clause 15 or 16, wherein the machine learning model is periodically updated based on the transaction data received in real time during the processing of the transaction data, and wherein the at least one predetermined ATM activity threshold is at least partially regenerated by the machine learning model at regular intervals.

[0041] Clause 18: A computer program product according to any one of Clauses 15 to 17, wherein the at least one metric further includes ATM transaction time data, and wherein the fraud prevention operation is activated in response to determining that the ATM transaction count associated with the payment device identifier within a certain time period meets the at least one predetermined ATM activity threshold including a transaction upper limit threshold count.

[0042] Clause 19: A computer program product according to any one of Clauses 15 to 18, wherein the at least one metric further includes ATM transaction location data, and wherein the fraud prevention operation is activated in response to determining that the ATM transaction count associated with the payment device identifier in a geographic area meets the at least one predetermined ATM activity threshold including a transaction upper limit threshold count in the geographic area.

[0043] Clause 20: A computer program product according to any one of Clauses 15 to 19, wherein the at least one metric further includes ATM transaction time data and ATM transaction location data, and wherein the fraud prevention operation is activated in response to determining that the time interval between a first ATM transaction of the payment device and a second ATM transaction of the payment device satisfies the at least one predetermined ATM activity threshold including a lower limit threshold time interval, the lower limit threshold representing an unlikely or improbable travel time between the location of the first ATM transaction and the location of the second ATM transaction.

[0044] The operational methods and manufacturing economics of these and other features and characteristics of this disclosure, as well as the combinations of related structural elements and parts, will become more apparent after considering the following description and appended claims with reference to the accompanying drawings, all of which form part of this specification, wherein similar reference numerals in the drawings indicate corresponding parts. However, it should be clearly understood that the drawings are for illustrative and descriptive purposes only and are not intended to be construed as limiting the scope of this disclosure. Unless the context clearly requires otherwise, the singular forms “a” and “described” as used in this specification and claims include plural indicators. Attached Figure Description

[0045] Additional advantages and details of this disclosure are explained in more detail below with reference to exemplary embodiments illustrated in the accompanying drawings, in which:

[0046] Figure 1 These are schematic diagrams of non-limiting embodiments or aspects of systems and methods for real-time automatic teller machine (ATM) fraud detection and prevention;

[0047] Figure 2 This is a process diagram of a non-limiting embodiment or aspect of a system and method for real-time ATM fraud detection and prevention;

[0048] Figure 3 This is a process diagram of a non-limiting embodiment or aspect of a system and method for real-time ATM fraud detection and prevention;

[0049] Figure 4 This is a process diagram of a non-limiting embodiment or aspect of a system and method for real-time ATM fraud detection and prevention;

[0050] Figure 5 This is a process diagram of a non-limiting embodiment or aspect of a system and method for real-time ATM fraud detection and prevention;

[0051] Figure 6 This refers to a series of process flows of non-limiting embodiments or aspects of systems and methods for real-time ATM fraud detection and prevention; and

[0052] Figure 7 It is a series of process flows of non-limiting embodiments or aspects of systems and methods for real-time ATM fraud detection and prevention. Detailed Implementation

[0053] For the purposes of the following description, the terms “upper,” “lower,” “right,” “left,” “vertical,” “horizontal,” “top,” “bottom,” “horizontal,” “longitudinal,” and their derivatives shall be associated with the non-limiting embodiments as they are oriented in the accompanying drawings. However, it should be understood that various alternative variations and sequences of steps may be employed in the non-limiting embodiments unless explicitly specified otherwise. It should also be understood that the specific apparatus and processes shown in the accompanying drawings and described in the following specification are merely exemplary embodiments. Therefore, the specific dimensions and other physical characteristics relating to the embodiments disclosed herein should not be considered limiting.

[0054] The aspects, components, elements, structures, actions, steps, functions, instructions, etc., used herein should not be construed as critical or essential unless explicitly stated otherwise. Furthermore, as used herein, the article “a” is intended to include one or more items and is interchangeable with “one or more” and “at least one.” Additionally, as used herein, the term “set” is intended to include one or more items (e.g., related items, unrelated items, combinations of related and unrelated items, etc.) and is interchangeable with “one or more” or “at least one.” Where only one item is desired, the term “a” or similar language is used. Furthermore, as used herein, the terms “having” and similar expressions are intended to be open-ended terms. Additionally, unless explicitly stated otherwise, the phrase “based on” is intended to mean “at least partially based on.”

[0055] This document describes some non-limiting embodiments related to thresholds. As used herein, satisfying a threshold can mean a value greater than a threshold, more than a threshold, higher than a threshold, greater than or equal to a threshold, less than a threshold, less than a threshold, lower than a threshold, less than or equal to a threshold, equal to a threshold, etc.

[0056] As used herein, the terms "communication" and "transmission" can refer to the receiving, accepting, sending, transmitting, or providing of information (e.g., data, signals, messages, instructions, commands, etc.). Communication between one unit (e.g., a device, system, component of a device or system, or a combination thereof) and another unit means that the first unit is able to receive information directly or indirectly from and / or send information to the other unit. This can refer to a direct or indirect connection that is inherently wired and / or wireless (e.g., a direct communication connection, an indirect communication connection, etc.). Furthermore, although the transmitted information may be modified, processed, relayed, and / or routed between the first and second units, the two units can also communicate with each other. For example, the first unit can communicate with the second unit even if it passively receives information and does not actively send information to the second unit. As another example, the first unit can communicate with the second unit if at least one intermediate unit (e.g., a third unit located between the first and second units) processes information received from the first unit and transmits the processed information to the second unit. In some non-limiting embodiments, a message can refer to a network packet (e.g., a data packet, etc.) that includes data. Any known electronic communication protocol and / or algorithm may be used, such as TCP / IP (including HTTP and other protocols), WLAN (including 802.11 and other radio frequency-based protocols and methods), analog transmission, cellular networks (e.g., Global System for Mobile Communications (GSM), Code Division Multiple Access (CDMA), Long Term Evolution (LTE), Global Microwave Access Interoperability (WiMAX), etc.). It should be understood that many other arrangements are possible.

[0057] As used herein, the term "mobile device" can refer to one or more portable electronic devices configured to communicate with one or more networks. For example, a mobile device may include a cellular phone (e.g., a smartphone or standard cellular phone), a portable computer (e.g., a tablet computer, laptop computer, etc.), a wearable device (e.g., a watch, glasses, lenses, clothing, etc.), a personal digital assistant (PDA), and / or other similar devices. As used herein, the term "client device" refers to any electronic device configured to communicate with one or more servers or remote devices and / or systems. Client devices may include mobile devices, network-enabled appliances (e.g., network-enabled televisions, refrigerators, thermostats, etc.), computers, POS systems, and / or any other devices or systems capable of communicating with networks.

[0058] As used herein, the term "computing device" can refer to one or more electronic devices configured to communicate directly or indirectly with or on one or more networks. A computing device can be a mobile device. For example, a mobile device may include a cellular phone (e.g., a smartphone or standard cellular phone), a portable computer, a wearable device (e.g., a watch, glasses, lenses, clothing, etc.), a PDA, and / or other similar devices. A computing device may not be a mobile device, such as a desktop computer. Furthermore, the term "computer" can refer to any computing device that includes the necessary components for receiving, processing, and outputting data and typically includes a display, processor, memory, input devices, and network interfaces. "Application program" or "Application Programming Interface" (API) refers to computer code or other data categorized on a computer-readable medium that can be executed by a processor to facilitate interaction between software components, such as interaction between a client-side front-end and / or a server-side back-end for receiving data from a client. "Interface" refers to a generated display, such as one or more graphical user interfaces (GUIs) that a user can interact with directly or indirectly (e.g., via a keyboard, mouse, etc.).

[0059] As used herein, the term "payment device" can refer to portable financial devices, electronic payment devices, payment cards (e.g., credit or debit cards), gift cards, smart cards, smart media, pay cards, healthcare cards, wristbands, machine-readable media containing account information, keychain devices or pendants, RFID transponders, retailer discount or membership cards, cellular phones, e-wallet mobile applications, PDAs, pagers, security cards, computers, access cards, wireless terminals, transponders, etc. In some non-limiting embodiments, a payment device may include volatile or non-volatile memory storing information such as account identifiers, account holder names, etc.

[0060] As used herein, the term "transaction service provider" can refer to an entity that receives transaction authorization requests from merchants or other entities and, in some cases, provides payment guarantees through an agreement between the transaction service provider and the issuing entity. For example, a transaction service provider may include, for instance... Payment networks, or any other entity that processes transactions. The term "transaction processing system" can refer to one or more computer systems operated by or on behalf of a transaction service provider, such as a transaction processing server executing one or more software applications, a token service executing one or more software applications, etc. A transaction processing server may include one or more processors, and in some non-limiting embodiments, may be operated by or on behalf of a transaction service provider.

[0061] As used herein, the term "issuing institution" may refer to one or more entities, such as a bank, that provide customers with accounts for transactions (e.g., payment transactions), such as initiating credit and / or debit payments. For example, an issuing institution may provide customers with an account identifier, such as a primary account number (PAN), that uniquely identifies one or more accounts associated with said customer. The account identifier may be implemented on a payment device, such as a physical payment instrument (e.g., a payment card), and / or may be electronic and used for electronic payments. The term "issuing system" refers to one or more computer systems operated by or on behalf of an issuing institution, such as a server computer executing one or more software applications. For example, an issuing system may include one or more authorization servers for authorizing transactions.

[0062] As used herein, the term "acquiring institution" can refer to an entity authorized and / or approved by a transaction service provider to initiate transactions (e.g., payment transactions) using payment devices associated with the transaction service provider. Transactions that an acquiring institution can initiate can include payment transactions (e.g., purchases, original letter of credit transactions (OCT), account treasury transactions (AFT), etc.). In some non-limiting embodiments, the acquiring institution can be a bank. As used herein, the term "acquiring system" can refer to one or more computer systems, computer devices, software applications, etc., operated by or on behalf of the acquiring institution.

[0063] As used herein, the term "authentication system" may refer to one or more computing devices that authenticate users and / or accounts, such as, but not limited to, transaction processing systems, merchant systems, issuer systems, payment gateways, third-party authentication services, etc.

[0064] As used herein, the term "account identifier" can include one or more PANs, tokens, or other identifiers associated with a customer account. The term "token" can refer to an identifier used as a substitute or replacement for an original account identifier such as a PAN. Account identifiers can be alphanumeric or any combination of characters and / or symbols. Tokens can be associated with PANs or other original account identifiers in one or more data structures (such as one or more databases) such that the token can be used to conduct transactions without directly using the original account identifier. In some instances, an original account identifier such as a PAN can be associated with multiple tokens for different individuals or purposes.

[0065] As used herein, the term "merchant" can refer to an individual or entity that provides goods and / or services to or provides access to goods and / or services to a customer based on a transaction such as a payment transaction. The terms "merchant" or "merchant system" can also refer to one or more computer systems operated by or on behalf of a merchant, such as a server computer executing one or more software applications. As used herein, "point-of-sale (POS) system" can refer to one or more computers and / or peripherals used by a merchant to conduct payment transactions with a customer, including one or more card readers, near-field communication (NFC) receivers, RFID receivers and / or other contactless transceivers or receivers, contact-based receivers, payment terminals, computers, servers, input devices and / or other similar devices that can be used to initiate payment transactions.

[0066] As used herein, the term "server" or "server computer" may refer to or include one or more processors or computers, storage devices, or similar computer arrangements operated by multiple parties or facilitating communication and processing in a network environment such as the Internet. However, it should be understood that communication may be facilitated through one or more public or private network environments, and various other arrangements are possible. Furthermore, multiple computers, such as servers, communicating directly or indirectly in a network environment, or other computerized devices, such as POS devices, may constitute a "system," such as a merchant's POS system. As used herein, references to "server" or "processor" may refer to the previously stated server and / or processor, different servers and / or processors, and / or combinations of servers and / or processors, stated as performing a prior step or function. For example, as used in the specification and claims, a first server and / or first processor stated as performing a first step or function may refer to the same or different server and / or processor stated as performing a second step or function.

[0067] Non-limiting embodiments or aspects of this disclosure relate to systems, methods, and computer program products for real-time automatic teller machine (ATM) fraud detection and prevention. The described network architecture and component arrangement are configured to allow detection of fraudulent ATM transactions while they are still being processed. Real-time detection and response surpasses prior art fraud flagging and review, and the described system is particularly capable of preventing fraudulent transactions from proceeding or recurring before they are completed, thereby preventing losses. Furthermore, by utilizing a fraud analysis process directly connected to the ATM transaction flow, fraud can be detected and countermeasures taken before cash withdrawal occurs. The described computer network further includes a distributed cache, which allows for faster data aggregation, data retrieval, and data analysis.

[0068] The described system and method further include maintaining a profile of the payment device's ATM activity for comparison with dynamically generated fraud detection thresholds. Dynamic thresholds, especially those trained on historical transaction data, reduce false alarms, thereby reducing wasted computing time, memory, and resources due to misclassified transactions. Furthermore, the described metrics for payment device ATM activity are specifically chosen to improve fraud detection by identifying surges in transaction counts and amounts at individual ATMs and locations. Additionally, by comparing ATM transaction locations, fraudulent transactions can be identified as those where a payment device is unlikely or improbable to complete transactions at more than one location.

[0069] For details, please refer to the following: Figure 1 In some non-limiting embodiments or aspects, a system 100 for real-time ATM fraud detection and prevention is provided. System 100 includes an ATM 102 programmed and / or configured to connect to one or more payment devices 104 of one or more users 106 to complete one or more ATM transactions. In a fraudulent ATM transaction scenario, the payment device 104 can be a genuine payment device 104 of user 106, or it can be a counterfeit payment device 104, such as a copied credit card. When user 106 wants to complete an ATM transaction, user 106 can present their payment device 104 for authentication at ATM 102. The payment device 104 can be identified by ATM 102 using a payment device 104 identifier, which can be stored in various media and transmitted to ATM 102 in various ways. The payment device 104 can be a credit card, in which case the payment device 104 identifier can be stored on a chip or magnetic stripe on the card, and ATM 102 can include a chip reader or magnetic stripe reader that receives the payment device identifier from the payment device 104. Payment device 104 may also be an electronic payment device, and the payment identifier may be transmitted from the electronic payment device to ATM 102, for example, via encrypted wireless communication. ATM 102 may request user 106 to present or enter additional data to verify the identity of payment device 104 and / or user 106. For example, user 106 may be prompted to enter a personal identification number (PIN) of payment device 104. User 106 may also be prompted to enter a password, biometric scan, or other similar identifier.

[0070] ATM 102 can communicate with transaction service provider system 108 to authenticate payment device 104 and / or user 106. After identifying payment device 104, user 106 can connect to ATM 102 to initiate an ATM transaction. For cash withdrawal ATM transactions, user 106 can enter the requested amount to be withdrawn from the transaction account associated with payment device 104 and allocated from ATM 102. ATM 102 can generate a transaction authorization request for the ATM transaction and transmit the transaction authorization request to transaction service provider system 108. The transaction authorization request may include a payment device identifier, which may be encrypted. ATM 102, transaction service provider system 108, or another computing device can communicate with distributed cache 114 to generate and / or modify a stored profile of ATM activity, which may be associated with the payment device identifier, ATM identifier, etc. Distributed cache 114 may include multiple servers that allow for rapid data aggregation, efficient data retrieval, and modularity for future growth of distributed cache 114, thereby allowing for increased communication capacity. Distributed cache 114 may be included in and / or associated with transaction service provider system 108. ATM activity profiles may include one or more metrics of ATM activity associated with payment device 104 or ATM 102, including but not limited to: ATM transaction value data; ATM transaction count data; ATM transaction time data; ATM transaction location data; ATM identifier data; issuer identifier data, etc.

[0071] ATM 102, transaction service provider system 108, or another computing device can compare one or more metrics from the ATM activity profile with at least one predetermined ATM activity threshold. For example, ATM transaction value data can be compared with a predetermined upper limit threshold for transaction values. Additionally, ATM transaction count data can be compared with a predetermined upper limit threshold for transaction counts. (Reference) Figure 6 and 7 And the corresponding discussion, to understand further non-limiting embodiments or aspects of evaluating metrics related to predetermined ATM activity thresholds. It should be understood that multiple configurations may be possible.

[0072] One or more predetermined ATM activity thresholds may be generated, at least in part, by a machine learning model trained on historical transaction data of one or more payment devices 104. Transaction service provider system 108 may include, or be communicatively connected to, a machine learning model engine 116 that accepts historical transaction data as model input and generates suggested ATM activity thresholds that indicate fraud associated with payment device 104. Transaction data of one or more payment devices 104 may be stored in real time relative to transaction processing by transaction service provider system 108. Thresholds may be generated specifically for payment device 104, a group of payment devices 104, or generally for all payment devices 104. For a threshold specific to a particular payment device 104, the machine learning model of machine learning model engine 116 may be trained on historical transaction data of that particular payment device 104, may be trained on similar payment devices 104 (e.g., transactions of multiple payment devices 104 at an ATM), and / or may be trained on a broader or entire sample of payment devices 104. Transaction service provider system 108 may include, or be communicatively connected to a transaction database 110 to store historical transaction data. In addition to or in place of the transaction database 110, historical transaction data may be stored in a distributed cache 114. The machine learning model may be periodically updated (e.g., retrained, iterated in additional generations, etc.) based on transaction data received in real time during transaction data processing. Relatedly, the predetermined ATM activity thresholds generated may be at least partially regenerated by the machine learning model at regular intervals (e.g., hourly, daily, weekly, monthly, etc.).

[0073] Transaction service provider system 108 may include or be communicatively connected to fraud prevention system 120, which is programmed and / or configured to perform one or more anti-fraud prevention measures in response to reported or detected fraudulent transactions. In response to ATM 102 and / or transaction service provider system 108 determining that one or more metrics meet one or more predetermined ATM activity thresholds, ATM 102 and / or transaction service provider system 108 may communicate with fraud prevention system 120 to activate or cause activation of one or more fraud prevention actions. Fraud prevention actions may include, but are not limited to: rejecting user transactions (e.g., rejecting triggering ATM transactions, rejecting future payment device transactions, etc.); disabling transaction accounts associated with payment device identifiers (e.g., complete disabling, conditional disabling, allowing only transactions of specific types or sources, such as pre-arranged payments, etc.); (e.g., conveying alerts to the communication device 118 of user 106 of payment device 104, to issuer system 112 associated with the issuer of payment device 104, etc.); etc. If user 106 maintains its informational contact only with the issuer of payment device 104, an alarm transmitted to the issuer system 112 can be automatically forwarded to user 106's communication device 118 or trigger a new alarm to said device.

[0074] Further reference Figure 1 Furthermore, in other non-limiting embodiments or aspects, ATM 102 may be communicatively connected to distributed cache 114 to accelerate the evaluation of the associated profile of ATM activity during ATM transactions. During the interaction between user 106 and ATM 102, ATM 102 may communicate with distributed cache 114 to aggregate transaction data for the current ATM transaction, thereby allowing the comparison of profile metrics with predetermined thresholds in real time with ATM transaction processing. If ATM 102 performs the step of comparing ATM activity profiles with predetermined thresholds, ATM 102 may communicate with distributed cache 114 to retrieve the metrics of the ATM activity profile and complete the comparison with transaction processing in real time. ATM 102 may activate or cause one or more fraud prevention operations to be activated by communicating with fraud prevention system 120, which may be relayed by transaction service provider system 108. Activation of one or more fraud prevention operations may be performed in real time with the processing of the current ATM transaction.

[0075] For details, please refer to the following: Figure 2Furthermore, in a non-limiting embodiment or aspect, process 200 is provided for a system and method for real-time automated teller machine (ATM) fraud detection and prevention. Each step of process 200 may be performed by one or more ATMs, a transaction service provider system, a fraud prevention system, a machine learning model engine, and / or other computing devices. In step 202, an original transaction is received at one or more ATMs. In step 204, the transaction service provider system may aggregate ATM transaction data of the original transaction by modifying one or more profiles of ATM activity stored in a transaction database and / or a distributed cache. Aggregation may be based on ATM transaction value data, ATM transaction account data, or other similar variables. Aggregation may be performed at a hierarchy of payment device, ATM, issuer of payment device, institution associated with ATM, or region of ATM. Aggregation may be used to detect anomalous transaction behavior based on unsupervised model learning. Techniques such as multivariate Gaussian distributions can be used to supplement unsupervised machine learning to help identify anomalies between groups of payment devices or ATMs based on aggregated transaction patterns (e.g., provided that 99.7% of the data is within three standard deviations of the mean, 95% is within two standard deviations of the mean, and 68% is within one standard deviation of the mean). To aid in the aggregation and anomaly detection process, ATM transaction data can be aggregated to store attributes such as time data, amount data, count data, ATM identifier data, issuer identifier data, and location data.

[0076] During transaction processing by a transaction service provider system, a distributed cache can be provided to quickly aggregate real-time transaction data. For example, backend servers such as the transaction service provider system's servers can aggregate totals at the ATM device level and / or payment device level, such as the total transaction amount at ATMs and / or using payment devices, the number of transactions at ATMs and / or using payment devices, and the frequency of ATM and / or payment device activity (e.g., card authentication, withdrawals, etc.). The backend servers can further aggregate totals including ATMs or geographical areas near ATMs (e.g., within a 1-mile radius of the ATM, postal codes, city areas, country areas, etc.). Aggregation can take into account and record payment device identifiers to detect simultaneous coordinated withdrawal attacks at multiple locations. Because the time frame for detecting fraud and denying ATM transactions, especially those involving simultaneous coordinated withdrawal attacks, is short, the fast distributed cache connected to the transaction service provider system allows for aggregation, comparison, and detection during transaction processing. If a predetermined threshold is met (e.g., meets and / or exceeds) during aggregation calculation, downstream systems can be automatically triggered to close, modify, and / or report one or more transaction accounts.

[0077] ATM network transaction data, as input for aggregation using a distributed cache, can include PIN authentication communications, balance statement communications, withdrawal transaction communications, etc. Such communications can be fed into a real-time aggregation computing engine, which can operate at a transaction service provider system. The output of such a system may include, but is not limited to: real-time notification to stop transactions (e.g., based on time-related and heuristic constraints set by a model to detect anomalous transactions); real-time reporting to the issuer and / or payment network of single or coordinated cash-out fraud occurring; and real-time blocking rules, triggered to prevent further transactions if the payment device's issuer is registered in an integrated rules system with the transaction service provider system.

[0078] Further reference Figure 2 Furthermore, in another non-limiting embodiment or aspect, process 200 includes step 206, in which the transaction service provider system can perform statistical analysis on the aggregation. Step 206 may include post-aggregation data conditioning and auditing, which may involve adding multiple data feeds (e.g., aggregating location data using location services) or pre-computed attributes. In step 208, the transaction service provider system may execute a model trained on historical transaction data and existing fraudulent transaction patterns that match the current transaction pattern. The transaction processing server system, particularly the machine learning model engine communicatively connected to it, may have multiple thresholds, and the model may be adjusted between these thresholds to achieve a balance between stopping cash withdrawals and allowing regular customer usage patterns. The thresholds may be enforced by the transaction service provider system and may be opted in or out by the issuer.

[0079] The first preferred unrestricted machine learning model could be a decision tree algorithm. Decision tree algorithms match input data with expected or well-known outputs. The second preferred unrestricted machine learning model could be a clustering algorithm. Clustering algorithms are largely unsupervised, can predict thresholds that may not have been previously known, and can dynamically change over time. The third preferred unrestricted machine learning model could be a linear regression model, as supervised learning about existing fraud patterns can be performed using linear regression. Machine learning models for detecting fraudulent transaction patterns and / or setting predetermined thresholds can be trained on historical transaction data, and known fraudulent and valid transactions can be labeled as inputs to the machine learning model. The machine learning model can be trained periodically (e.g., hourly, daily, weekly, etc.) so that thresholds can be adjusted based on new transaction patterns.

[0080] Further reference Figure 2In another non-limiting embodiment or aspect, process 200 includes step 210, in which the transaction service provider system completes connection and reporting. In step 210, the fraud prevention system may recommend certain actions to be performed, or may automatically operate according to predetermined rules. Fraud response rules may determine which other types of transactions should be blocked or restricted based on amount, type, time, location, etc. The fraud prevention system may also recommend or trigger further tracking of users of payment devices that initiate ATM transactions that meet thresholds. The fraud prevention system may generate a preliminary report in which a sudden surge in cash-out fraud activity is detected, and may notify the transaction service provider system to take additional fraud prevention measures. In step 212, the transaction service provider system may create and publish rules on behalf of the issuer. The issuer may set limits on the aggregated value or count of transactions for certain payment devices or a particular region. For example, the issuer may predefine a rule that a transaction can be designated as fraudulent if the same PIN is used simultaneously or substantially simultaneously at multiple ATMs. The issuer may also predefine a rule that the corresponding transaction account can be disabled if the withdrawal count meets or exceeds a predetermined threshold (e.g., a probe derivation or model derivation threshold).

[0081] For details, please refer to the following: Figure 3 Furthermore, in a non-limiting embodiment or aspect, process 300 is provided for a system and method for real-time automated teller machine (ATM) fraud detection and prevention. Each step of process 300 may be performed by one or more ATMs, a transaction service provider system, a fraud prevention system, a machine learning model engine, and / or other computing devices. In step 302, the transaction service provider system may receive transaction data for multiple transactions completed by at least one ATM. The transaction data may be received in real time during transaction processing at the transaction service provider system. In step 304, the transaction service provider system may store the transaction data in a distributed cache for aggregation and retrieval of the transaction data. In step 306, the transaction service provider system may receive a transaction request for a user transaction using a payment device at the ATM. The transaction request may include a payment device identifier. In step 308, the transaction service provider system may modify a configuration file of ATM activity stored in the distributed cache. The configuration file of ATM activity may be associated with a payment device identifier or an ATM identifier. ATM activity profiles may include metrics, including but not limited to: ATM transaction value data 309; ATM transaction count data 311; ATM transaction time data; ATM transaction location data; ATM identifier; issuer identifier; payment device identifier, etc. Modifications to the ATM activity profile may require aggregating one or more metrics based on the current transaction (e.g., increasing the transaction count, increasing the transaction value, etc.). Aggregates may also be periodically reset to zero, for example, at the start of a new time period observed by the transaction service provider system.

[0082] In step 310, the transaction service provider system may compare at least one metric of the ATM activity profile with at least one predetermined ATM activity threshold. Step 312, which may be included in step 310, may involve the transaction service provider system determining whether the metric meets the predetermined ATM activity threshold. If the threshold is not met, the transaction service provider system may continue monitoring ongoing transactions without initiating any fraud prevention action. However, in response to determining that at least one metric of the ATM activity profile meets at least one predetermined ATM activity threshold, step 314 may be performed. In step 314, the transaction service provider system may activate or cause one or more fraud prevention actions to be activated. Fraud prevention actions may include, but are not limited to: rejecting user transactions; disabling transaction accounts associated with payment device identifiers; and sending alerts to users and / or issuers.

[0083] For details, please refer to the following: Figure 4 Furthermore, in non-limiting embodiments or aspects, an extension of process 300 for a system and method for real-time automated teller machine (ATM) fraud detection and prevention is provided. Each step of process 300 can be performed by one or more ATMs, a transaction service provider system, a fraud prevention system, a machine learning model engine, and / or other computing devices. A recursive set of operations for continuously refreshing and automatically correcting the underlying machine learning model is described. In step 302, the transaction service provider system can receive transaction data for multiple transactions completed by at least one ATM. The transaction data can be received in real time during transaction processing at the transaction service provider system. In step 304, the transaction service provider system can store the transaction data in a distributed cache for aggregation and retrieval of the transaction data.

[0084] In step 322, the transaction service provider system (e.g., a machine learning model engine) may update the machine learning model based on transaction data received in real time during transaction data processing. The machine learning model may be retrained, iterated, enhanced, modified, etc., to take new transaction data into account. At least a portion of previous transaction data that may have been used to train the machine learning model may be phased out and not used for subsequent training, thereby allowing the machine learning model to remain dynamic and accurate with current transaction patterns and trends. In step 324, the transaction service provider system (e.g., the machine learning model engine) may generate or regenerate one or more predetermined ATM activity thresholds based on the updated machine learning model. Subsequently, in step 310, the transaction service provider system may compare at least one metric of the ATM activity profile with at least one predetermined ATM activity threshold. The transaction service provider system may periodically repeat steps 302, 304, 322, and 324 to update the machine learning model based on the latest transaction data and process ongoing transactions substantially in real time due to the transaction service provider system's advantageous position on the network.

[0085] For details, please refer to the following: Figure 5 Furthermore, in non-limiting embodiments or aspects, an extension of process 300 for a system and method for real-time automated teller machine (ATM) fraud detection and prevention is provided. Each step of process 300 may be performed by one or more ATMs, a transaction service provider system, a fraud prevention system, a machine learning model engine, and / or other computing devices. Details of actions following threshold satisfaction for preventing current and / or future fraudulent transactions are described. In step 310, the transaction service provider system may compare at least one metric of a profile of ATM activity with at least one predetermined ATM activity threshold. Step 312, which may be included in step 310, may involve the transaction service provider system determining whether the metric satisfies the predetermined ATM activity threshold. If the threshold is not met, the transaction service provider system may continue monitoring ongoing transactions without initiating any fraud prevention action. However, in response to determining that at least one metric of a profile of ATM activity satisfies at least one predetermined ATM activity threshold, step 314 may be performed. In step 314, the transaction service provider system may activate or cause one or more fraud prevention actions to be activated.

[0086] In step 332, as a fraud prevention operation, the transaction service provider system may reject the user transaction. Step 332 may result in the rejection of a current ATM transaction that may have already met a predetermined ATM activity threshold. Because aggregation, detection, and fraud prevention operations can be performed in real time during the processing of the original ATM transaction, the transaction can be aborted before the original ATM transaction is completed. In this way, fraudulent ATM transactions, such as fraudulent withdrawal requests using counterfeit or unauthorized payment devices, can be rejected before fraud ultimately succeeds, for example, before cash is dispensed from the ATM. Step 332 may also include rejecting one or more future user transactions using payment devices associated with fraudulent ATM activity.

[0087] In step 334, as a fraud prevention operation, the transaction service provider system can communicate with the issuing system to disable the transaction account associated with the payment device currently being transacted by the user. The transaction service provider system can also effectively disable the payment device by rejecting all future transactions originating from the payment device, regardless of whether the issuing system takes action. Because the transaction service provider system acts as a conduit for receiving transaction authorization requests and responses, it can be specifically positioned to disable payment device transaction activity before the issuing system can investigate and respond on its own.

[0088] In step 336, as a fraud prevention operation, the transaction service provider system may communicate or cause an alert to be communicated to the issuing system and / or the user associated with the payment device used in the current ATM transaction. If the user communication information is stored in the issuing system rather than the transaction service provider system, the issuing system itself may communicate the alert to the user. The alert may include information about the current transaction, including its time, location, amount, etc. The alert may also notify the issuing system and / or the user of other fraud prevention operations that have been activated, including rejected transactions, disabled transaction accounts, etc. The user may receive the alert on a communication device (e.g., a mobile device) during the processing of an ATM transaction, which may have triggered an ATM activity threshold. The reduced latency of alert notifications provided by the system described herein allows for faster fraud resolution and reduces information asymmetry between the user and the payment device issuer. It should also be understood that the fraud prevention operations described above may be performed alone or in combination with other fraud prevention operations.

[0089] For details, please refer to the following: Figure 6Furthermore, in non-limiting embodiments or aspects, a series of process flows 400a-400d are provided for systems and methods for real-time automated teller machine (ATM) fraud detection and prevention. Each process flow may be performed by one or more ATMs, transaction service provider systems, fraud prevention systems, machine learning model engines, and / or other computing devices. The depicted process flows 400a-400d provide non-limiting examples of metrics of ATM activity profiles to be compared with predetermined ATM activity thresholds used to trigger fraud prevention operations. In process flow 400a, the ATM activity profile may include metrics of ATM transaction value data 309. ATM transaction value data 309 may be aggregated for ATMs, payment devices, a series of ATMs (e.g., belonging to a specific issuer), or combinations thereof. The predetermined threshold may be generated at least in part by a machine learning model. In step 410a, the transaction service provider system may determine whether the aggregated ATM transaction value data 309 meets (e.g., equals, exceeds, etc.) the predetermined threshold. If the threshold is met, fraud prevention operations may be activated by the transaction service provider system in step 314. For example, a current ATM transaction withdrawing $100 may be received. The aggregated transaction value of the ATM, plus the current ATM transaction, is determined to be $5085. The machine learning model may have already generated a predetermined threshold of $5000 for the ATM. The current ATM transaction may meet this threshold, thus triggering fraud prevention actions such as rejecting immediate ATM withdrawal requests, preventing future transactions between the payment device and the ATM, etc.

[0090] Further reference Figure 6 Furthermore, in another non-limiting embodiment or aspect, in process flow 400b, the profile of ATM activity may include a metric for ATM transaction count data 311. ATM transaction count data 311 may be aggregated for ATMs, payment devices, a series of ATMs (e.g., belonging to a specific issuer), or combinations thereof. A predetermined threshold count may be generated at least in part by a machine learning model. In step 410b, the transaction service provider system may determine whether the aggregated ATM transaction count data 311 meets (e.g., equals, exceeds, etc.) the predetermined threshold count. If the threshold count is met, fraud prevention operations may be activated by the transaction service provider system in step 314. For example, a current ATM transaction may be received. It may be determined that the aggregated transaction count of the payment device plus the current ATM transaction is 3. The machine learning model may have already generated a predetermined threshold count of 3 for the payment device. The current ATM transaction may meet the threshold, thus triggering the activation of fraud prevention operations, such as rejecting an immediate ATM withdrawal request, disabling the payment device or associated transaction account, etc.

[0091] Further reference Figure 6Furthermore, in another non-limiting embodiment or aspect, in process flow 400c, the profile of ATM activity may include metrics of ATM transaction time data 402 and ATM transaction value data 309. ATM transaction value data 309 may be aggregated for ATMs, payment devices, a series of ATMs (e.g., belonging to a specific issuer), or combinations thereof. A predetermined threshold may be generated at least in part by a machine learning model. In step 410c, the transaction service provider system may determine whether the aggregated ATM transaction value data 309 over a period of time meets (e.g., equals, exceeds, etc.) a predetermined threshold. If the threshold is met, fraud prevention operations may be activated by the transaction service provider system in step 314. For example, a current ATM transaction may be received. It may be determined that the aggregated transaction value of the payment device plus the current ATM transaction within a given time period (e.g., hour, day, week, etc.) is $550. The machine learning model may have already generated a predetermined threshold of $300 for the payment device within a given time period. The current ATM transaction may meet the threshold, thus triggering the activation of fraud prevention operations, such as rejecting an immediate ATM withdrawal request, disabling the payment device or associated transaction account, etc.

[0092] Further reference Figure 6 Furthermore, in another non-limiting embodiment or aspect, in process flow 400d, the profile of ATM activity may include metrics of ATM transaction time data 402 and ATM transaction count data 311. ATM transaction count data 311 may be aggregated for ATMs, payment devices, a series of ATMs (e.g., belonging to a specific issuer), or combinations thereof. A predetermined threshold count may be generated at least in part by a machine learning model. In step 410d, the transaction service provider system may determine whether the aggregated ATM transaction count data 311 within a certain time period meets (e.g., equals, exceeds, etc.) a predetermined threshold count. If the threshold count is met, fraud prevention operations may be activated by the transaction service provider system in step 314. For example, a current ATM transaction may be received. It may be determined that the aggregated transaction count of the ATM within a given time period (e.g., hour, day, week, etc.) plus the current ATM transaction is 27. The machine learning model may have already generated a predetermined threshold count of 27 for the ATM within a given time period. The current ATM transaction may meet the threshold, thus triggering the activation of fraud prevention operations, such as rejecting immediate ATM withdrawal requests, preventing future transactions between the payment device and the ATM, etc.

[0093] For details, please refer to the following: Figure 7Furthermore, in non-limiting embodiments or aspects, a series of process flows 400e-400h are provided for systems and methods for real-time automated teller machine (ATM) fraud detection and prevention. Each process flow may be performed by one or more ATMs, transaction service provider systems, fraud prevention systems, machine learning model engines, and / or other computing devices. The depicted process flows 400e-400h provide non-limiting instances of metrics for ATM activity profiles to be compared with predetermined ATM activity thresholds used to trigger fraud prevention operations. In process flow 400e, the ATM activity profile may include metrics for ATM transaction location data 404 and ATM transaction value data 309. Within a given area based on ATM transaction location data 404, ATM transaction value data 309 may be aggregated for ATMs, payment devices, a series of ATMs (e.g., belonging to a specific issuer), or combinations thereof. The predetermined threshold may be generated at least partially by a machine learning model. In step 410e, the transaction service provider system may determine whether the aggregated ATM transaction value data 309 satisfies (e.g., equals, exceeds, etc.) a predetermined threshold for a certain area. If the threshold is met, fraud prevention actions can be activated by the transaction service provider system in step 314. For example, the current ATM transaction can be received. It can be determined that for a given area (e.g., postal code, radial distance, county, city, etc.), the aggregated transaction value of the payment device plus the current ATM transaction is $650. A machine learning model may have already generated a predetermined threshold of $500 for payment devices in a given area. The current ATM transaction may meet the threshold, thus triggering the activation of fraud prevention actions, such as rejecting immediate ATM withdrawal requests, disabling the payment device or associated transaction account, etc. The aforementioned comparison can be further based on ATM transaction time data 402 to limit the aggregation / comparison to a given time period.

[0094] Further reference Figure 7Furthermore, in another non-limiting embodiment or aspect, in process flow 400f, the profile of ATM activity may include metrics of ATM transaction location data 404 and ATM transaction count data 311. Within a given area based on ATM transaction location data 404, ATM transaction count data 311 may be aggregated for ATMs, payment devices, a series of ATMs (e.g., belonging to a specific issuer), or combinations thereof. A predetermined threshold count may be generated at least in part by a machine learning model. In step 410f, the transaction service provider system may determine whether the aggregated ATM transaction count data 311 meets (e.g., equals, exceeds, etc.) a predetermined threshold count for a certain area. If the threshold count is met, fraud prevention operations may be activated by the transaction service provider system in step 314. For example, a current ATM transaction may be received. It may be determined that within a given area (e.g., postal code, radial distance, county, city, etc.), the aggregated transaction count of a series of ATMs plus the current ATM transaction equals 70. The machine learning model may have already generated a predetermined threshold count of 70 for ATMs in the given area. The current ATM transaction may meet a threshold, thus triggering fraud prevention actions such as rejecting immediate ATM withdrawal requests, preventing future transactions between the payment device and one or more ATMs in the area, etc. The aforementioned comparison can be further based on ATM transaction time data 402 to limit aggregation / comparison to a given time period.

[0095] Further reference Figure 7 Furthermore, in another non-limiting embodiment or aspect, in process flow 400g, the ATM activity profile may include measurements of ATM time data 402 and ATM transaction location data 404. ATM transaction data may be aggregated to determine the time interval between a first ATM transaction and a second ATM transaction at a first ATM location and a second ATM location (determined by location services, ATM identifier lookup, etc.). A predetermined threshold interval may be generated, at least in part, by a machine learning model as a lower limit. In step 410g, the transaction service provider system may determine that the time interval between the first ATM transaction and the second ATM transaction meets (e.g., equals, exceeds, etc.) the predetermined threshold interval. If the threshold interval is met, fraud prevention operations may be activated by the transaction service provider system in step 314. For example, a current ATM transaction may be received. The time interval between a current ATM transaction at the current location and a previous ATM transaction at a previous location may be 5 minutes. The machine learning model may have generated a predetermined threshold interval of 15 minutes. The current ATM transaction may meet the threshold, thus triggering the activation of fraud prevention operations, such as rejecting an immediate ATM withdrawal request, disabling the payment device or associated transaction account, etc.

[0096] Further reference Figure 7Furthermore, in another non-limiting embodiment or aspect, during process flow 400h, the ATM activity profile may include measurements of ATM time data 402 and ATM transaction location data 404. ATM transaction data may be aggregated to determine the time interval between a first ATM transaction and a second ATM transaction at a payment device with a first ATM location and a second ATM location (determined by location services, ATM identifier lookup, etc.). A predetermined threshold travel time may be generated as a lower limit, at least in part, by a machine learning model (e.g., in conjunction with a mapping procedure that may include current traffic data for various transportation modes). In step 410h, the transaction service provider system may determine that the time interval between the first ATM transaction and the second ATM transaction satisfies (e.g., equals, exceeds, etc.) the predetermined threshold travel time. If the threshold travel time is met, fraud prevention operations may be activated by the transaction service provider system in step 314. For example, a current ATM transaction may be received. The time interval between a current ATM transaction at the current location and a previous ATM transaction at a previous location may be 5 minutes. The machine learning model may have generated a predetermined threshold travel time of 5 minutes between the current position and the previous position, representing a lower bound (e.g., a travel time threshold that is unlikely or improbable). The current ATM transaction may meet the threshold, thus triggering fraud prevention actions such as rejecting an immediate ATM withdrawal request, disabling the payment device, or the associated transaction account.

[0097] Further reference Figure 6 and 7 Furthermore, in other non-limiting embodiments or aspects, the predetermined ATM activity threshold can be set for payment devices, a group of payment devices belonging to the issuer, ATMs, ATM zones, a series of ATMs belonging to the acquirer, etc.

[0098] Although this disclosure has been described in detail for illustrative purposes based on embodiments currently considered to be most practical and non-limiting, it should be understood that such details are for the purposes described only, and that this disclosure is not limited to the disclosed embodiments, but rather is intended to cover modifications and equivalent arrangements within the scope and scheme of the appended claims. For example, it should be understood that this disclosure contemplates, where possible, that one or more features of any embodiment may be combined with one or more features of any other embodiment.

Claims

1. A computer-implemented method for real-time automatic teller machine (ATM) fraud detection and prevention, the method comprising: At least one predetermined ATM activity threshold is generated using at least one processor and at least in part by a machine learning model trained on historical transaction data from multiple payment devices. The system uses at least one processor to receive transaction data for multiple transactions completed by at least one ATM, the transaction data being received in real time during transaction processing within the transaction service provider system. The transaction data is stored in a distributed cache using at least one processor for aggregation and retrieval. The at least one processor receives a transaction request for a user transaction using a payment device at a first ATM of the at least one ATM, the transaction request including a payment device identifier; In response to receiving the transaction request and before completing the user transaction at the first ATM: Modify the configuration file of ATM activity stored in the distributed cache and associated with the payment device identifier using at least one processor. The configuration file includes metrics including at least ATM transaction value data and ATM transaction count data. Modifying the configuration file of the ATM activity includes aggregating at least one metric of the configuration file based on the user transactions. At least one processor compares at least one metric of the ATM activity profile with at least one predetermined ATM activity threshold; and In response to determining that the at least one metric satisfies the at least one predetermined ATM activity threshold, a fraud prevention operation is activated or caused to be activated by at least one processor before the user transaction is completed at the first ATM, the fraud prevention operation including at least one of the following: rejecting the user transaction, disabling the transaction account associated with the payment device identifier, communicating an alert to the issuer, or any combination thereof; The machine learning model is retrained using at least one processor, based at least in part on the transaction data received in real time during the processing of transaction data, to produce an updated machine learning model. Using at least one processor, at least one predetermined ATM activity threshold is regenerated, at least partially, through the updated machine learning model, to produce at least one updated predetermined ATM activity threshold; Using at least one processor, a new transaction request for a new user transaction is received at a second ATM of the at least one ATM; At least one processor compares at least one metric of the ATM activity profile with the at least one updated predetermined ATM activity threshold; and In response to determining that the at least one metric satisfies the at least one updated predetermined ATM activity threshold, a second fraud prevention operation is activated or caused to be activated for the new user's transaction by at least one processor.

2. The computer-implemented method of claim 1, wherein the first ATM communication is connected to the distributed cache and is programmed and / or configured to aggregate the transaction data with data from the user transaction during processing of the user transaction.

3. The computer-implemented method of claim 2, wherein the processing of the user transaction is performed in real time by the first ATM by (i) comparing the at least one metric with the at least one predetermined ATM activity threshold, and (ii) activating or causing the fraud prevention operation to be activated.

4. The computer-implemented method of claim 1, wherein the machine learning model is periodically updated based on the transaction data received in real time during the processing of the transaction data, and wherein the at least one predetermined ATM activity threshold is at least partially regenerated by the machine learning model at regular intervals.

5. The computer-implemented method of claim 1, wherein the at least one metric further includes ATM transaction time data, and wherein the fraud prevention operation is activated in response to determining that the ATM transaction count associated with the payment device identifier within a certain time period meets the at least one predetermined ATM activity threshold including a transaction upper limit threshold count.

6. The computer-implemented method of claim 1, wherein the at least one metric further includes ATM transaction location data, and wherein the fraud prevention operation is activated in response to determining that the ATM transaction count associated with the payment device identifier in a geographic area satisfies the at least one predetermined ATM activity threshold including a transaction upper limit threshold count in the geographic area.

7. The computer-implemented method of claim 1, wherein the at least one metric further comprises ATM transaction time data and ATM transaction location data, and wherein the fraud prevention operation is activated in response to determining that the time interval between a first ATM transaction of the payment device and a second ATM transaction of the payment device satisfies the at least one predetermined ATM activity threshold including a lower limit threshold time interval, the lower limit threshold representing an impossible travel time between the location of the first ATM transaction and the location of the second ATM transaction.

8. A system for real-time automatic teller machine (ATM) fraud detection and prevention, the system comprising: Distributed cache; as well as A server, comprising at least one processor for executing program instructions, said server being programmed and / or configured to: At least one predetermined ATM activity threshold is generated, at least in part, through a machine learning model trained on historical transaction data from multiple payment devices. Receive transaction data for multiple transactions completed by at least one ATM, wherein the transaction data is received in real time during transaction processing in the transaction service provider system; The transaction data is stored in the distributed cache for aggregation and retrieval. Receive a transaction request for a user transaction using a payment device at a first ATM of the at least one ATM, the transaction request including a payment device identifier; In response to receiving the transaction request and before completing the user transaction at the first ATM: Modify the configuration file of ATM activity stored in the distributed cache and associated with the payment device identifier, the configuration file including at least ATM transaction value data and ATM transaction count data, wherein, when the configuration file of the ATM activity is modified, the server is programmed and / or configured to aggregate at least one metric of the configuration file based on the user transactions; Compare at least one metric of the ATM activity profile with at least one predetermined ATM activity threshold; and In response to determining that the at least one metric satisfies the at least one predetermined ATM activity threshold, a fraud prevention operation is activated or caused to be activated before the user transaction is completed at the first ATM, the fraud prevention operation including at least one of the following: rejecting the user transaction, disabling the transaction account associated with the payment device identifier, sending an alert to the issuer, or any combination thereof; The machine learning model is retrained, at least in part, based on the transaction data received in real time during the processing of transaction data, in order to produce an updated machine learning model. At least one predetermined ATM activity threshold is regenerated, at least in part, through the updated machine learning model, to produce at least one updated predetermined ATM activity threshold; Receive a new transaction request for a new user transaction at a second ATM of the at least one ATM; Compare at least one metric of the ATM activity profile with the at least one updated predetermined ATM activity threshold; and In response to determining that the at least one metric satisfies the at least one updated predetermined ATM activity threshold, a second fraud prevention operation is activated or caused to be activated for the new user's transaction.

9. The system of claim 8, wherein the machine learning model is periodically updated based on the transaction data received in real time during the processing of the transaction data, and wherein the at least one predetermined ATM activity threshold is at least partially regenerated by the machine learning model at regular intervals.

10. The system of claim 8, wherein the at least one metric further includes ATM transaction time data, and wherein the fraud prevention operation is activated in response to determining that the ATM transaction count associated with the payment device identifier within a certain time period meets the at least one predetermined ATM activity threshold including a transaction upper limit threshold count.

11. The system of claim 8, wherein the at least one metric further includes ATM transaction location data, and wherein the fraud prevention operation is activated in response to determining that the ATM transaction count associated with the payment device identifier in a geographic area satisfies the at least one predetermined ATM activity threshold including a transaction upper limit threshold count in the geographic area.

12. The system of claim 8, wherein the at least one metric further comprises ATM transaction time data and ATM transaction location data, and wherein the fraud prevention operation is activated in response to determining that the time interval between a first ATM transaction of the payment device and a second ATM transaction of the payment device satisfies the at least one predetermined ATM activity threshold including a lower limit threshold time interval, the lower limit threshold representing an impossible travel time between the location of the first ATM transaction and the location of the second ATM transaction.

13. A computer program product for real-time automatic teller machine (ATM) fraud detection and prevention, the computer program product comprising at least one non-transient computer-readable medium, the at least one non-transient computer-readable medium comprising program instructions that, when executed by at least one processor, cause the at least one processor to perform the following operations: At least one predetermined ATM activity threshold is generated, at least in part, through a machine learning model trained on historical transaction data from multiple payment devices. Receive transaction data for multiple transactions completed by at least one ATM, wherein the transaction data is received in real time during transaction processing in the transaction service provider system; The transaction data is stored in a distributed cache for aggregation and retrieval. Receive a transaction request for a user transaction using a payment device at a first ATM of the at least one ATM, the transaction request including a payment device identifier; In response to receiving the transaction request and before completing the user transaction at the first ATM: Modify the configuration file of ATM activity stored in the distributed cache and associated with the payment device identifier, the configuration file including at least ATM transaction value data and ATM transaction count data, wherein the program instructions that cause the at least one processor to modify the configuration file of the ATM activity cause the at least one processor to aggregate at least one metric of the configuration file based on the user transactions; Compare at least one metric of the ATM activity profile with at least one predetermined ATM activity threshold; and In response to determining that the at least one metric satisfies the at least one predetermined ATM activity threshold, a fraud prevention operation is activated or caused to be activated before the user transaction is completed at the ATM, the fraud prevention operation including at least one of the following: rejecting the user transaction, disabling the transaction account associated with the payment device identifier, sending an alert to the issuer, or any combination thereof; The machine learning model is retrained, at least in part, based on the transaction data received in real time during the processing of transaction data, in order to produce an updated machine learning model. At least one predetermined ATM activity threshold is regenerated, at least in part, through the updated machine learning model, to produce at least one updated predetermined ATM activity threshold; Receive a new transaction request for a new user transaction at a second ATM of the at least one ATM; Compare at least one metric of the ATM activity profile with the at least one updated predetermined ATM activity threshold; and In response to determining that the at least one metric satisfies the at least one updated predetermined ATM activity threshold, a second fraud prevention operation is activated or caused to be activated for the new user's transaction.

14. The computer program product of claim 13, wherein the machine learning model is periodically updated based on the transaction data received in real time during the processing of the transaction data, and wherein the at least one predetermined ATM activity threshold is at least partially regenerated by the machine learning model at regular intervals.

15. The computer program product of claim 13, wherein the at least one metric further includes ATM transaction time data, and wherein the fraud prevention operation is activated in response to determining that the ATM transaction count associated with the payment device identifier within a certain time period meets the at least one predetermined ATM activity threshold including a transaction upper limit threshold count.

16. The computer program product of claim 13, wherein the at least one metric further includes ATM transaction location data, and wherein the fraud prevention operation is activated in response to determining that the ATM transaction count associated with the payment device identifier in a geographic area meets the at least one predetermined ATM activity threshold including a transaction upper limit threshold count in the geographic area.

17. The computer program product of claim 13, wherein the at least one metric further comprises ATM transaction time data and ATM transaction location data, and wherein the fraud prevention operation is activated in response to determining that the time interval between a first ATM transaction of the payment device and a second ATM transaction of the payment device satisfies the at least one predetermined ATM activity threshold including a lower limit threshold time interval, the lower limit threshold representing an impossible travel time between the location of the first ATM transaction and the location of the second ATM transaction.

Images