Real-Time BIN Velocity Detection for Account Range Fraud
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current fraud detection systems in payment card transaction networks are inadequate in detecting and responding to account range fraud attacks, particularly those involving Bank Identification Number (BIN) fraud, which can lead to undetected fraudulent transactions and increased network load.
Innovation Solution
A computing system and method utilizing an Attack Detection and Response (ADR) device that employs artificial intelligence and machine learning algorithms to monitor transaction streams for anomalously high BIN velocities, identifies compromised PANs, and transmits fraud alerts to issuers to flag and authenticate potentially compromised accounts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If known fraud detection systems monitor payment card transactions one transaction at a time, then individual fraudulent transactions can be detected, but widespread fraud attacks such as BIN attacks cannot be detected
Solution Approach 1:
The system segments the analysis approach by dividing fraud detection into two complementary layers: transaction-level analysis (individual transactions) and aggregate-level analysis (patterns across multiple transactions). This segmentation allows the system to simultaneously detect individual fraudulent transactions and identify widespread fraud attacks like BIN attacks that require analyzing multiple transactions together.
Solution Approach 2:
The system adds a new dimension to fraud detection by introducing aggregate analysis that examines transactions from a macro perspective. Instead of only analyzing single transactions in isolation, the system creates an additional analytical dimension that looks at patterns across groups of transactions, enabling detection of coordinated fraud attacks that span multiple accounts and transactions.
2Adaptability or versatility
If fraud detection systems analyze multiple transactions to detect BIN attacks, then widespread fraud can be detected, but the system complexity and processing requirements increase
Solution Approach 1:
The system introduces intermediary components that facilitate aggregate analysis without requiring complete system redesign. These intermediaries include aggregation modules that collect transaction data, pattern recognition modules that identify fraud patterns, and response modules that coordinate actions across multiple systems. This intermediary layer manages complexity by breaking down the aggregate analysis function into manageable, modular components.
3Speed
If real-time monitoring of transaction streams is implemented, then fraud attacks can be detected immediately, but network traffic and processing burden increase
Solution Approach 1:
The system applies partial action by implementing real-time monitoring selectively rather than uniformly across all transactions. It focuses computational resources on transactions that exhibit suspicious patterns or belong to accounts involved in detected fraud attacks, while using less intensive processing for normal transactions. This approach maintains fast detection capability for fraudulent activity while reducing overall network traffic and processing burden.
Data Source
AI summary
Computing systems and methods for detecting anomalous activity over a computer network are described herein. A computing system receives a real-time stream of electronic messages, each of the electronic messages including a first identifier, wherein a portion of the first identifier includes a second identifier. The computing system applies a detection model to the real-time stream of electronic messages, wherein the detection model is programmed to apply at least one machine learning algorithm trained to detect that a velocity of the electronic messages for a range of first identifiers having a common value second identifier exceeds a threshold. In response to the threshold being exceeded, a time period associated with anomalous activity is identified and an anomalous activity flag is appended to messages initiated during the time period associated with anomalous activity which include a first identifier having the common value in the second identifier.