Systems and methods for graduated suspicious activity detection

Abstract

Systems and methods for evaluating electronic value transfers. Various of the methods include graduating a defined affinity between transactions to increasing levels of scrutiny. At an increased level of scrutiny, reports can be generated indicating suspicious activity and/or interdiction procedures can be implemented to reduce the occurrence of the detected suspicious activity. Various of the systems are tailored to implement the aforementioned methods.

What is claimed is: 
     
         1 . A system for evaluating value transfers, the system comprising:
 a fraud processing computer; and   a computer readable medium associated with the fraud processing computer, wherein the computer readable medium comprises computer instructions executable by the fraud processing computer to:
 receive a plurality of transaction packages; 
 form a plurality of root node affinities associated with respective transaction packages; 
 compare the plurality of root node affinities with a tier one affinity; and 
 assimilate at least one of the root node affinities with the tier one affinity based on the comparison. 
   
     
     
         2 . The system of  claim 1 , wherein the tier one affinity is a first tier one affinity, and wherein the computer instructions are further executable by the fraud processing computer to:
 compare one of the plurality of root node affinities with another of the root node affinities; and   based on the comparison, form a second tier one affinity from compared root node affinities.   
     
     
         3 . The system of  claim 1 , wherein the computer instructions are further executable by the fraud processing computer to:
 receive a trigger level.   
     
     
         4 . The system of  claim 3 , wherein the trigger level is selected from a group consisting of: an affinity intensity, an event count, and an event occurrence. 
     
     
         5 . The system of  claim 3 , wherein the trigger level is seven matches to a given tier one affinity. 
     
     
         6 . The system of  claim 3 , wherein the computer instructions are further executable by the fraud processing computer to:
 convert the tier one affinity to a tier two affinity based at least in part on satisfying the trigger level;   locking the tier two affinity; and   generating a report indicating suspicious activity associated with the tier two affinity.   
     
     
         7 . The system of  claim 6 , wherein the tier one affinity is a first tier one affinity, and wherein the computer instructions are further executable by the fraud processing computer to:
 compare a second tier one affinity to the tier two affinity; and   based at least in part on the comparison, initiate interdiction procedures in relation to the tier two affinity.   
     
     
         8 . The system of  claim 7 , wherein the computer instructions are further executable by the fraud processing computer to:
 assimilate the second tier one affinity into the tier two affinity based at least in part on the comparison.   
     
     
         9 . The system of  claim 6 , wherein the computer instructions are further executable by the fraud processing computer to:
 compare one of the plurality of root node affinities to the tier two affinity; and   based at least in part on the comparison, initiate interdiction procedures in relation to the tier two affinity.   
     
     
         10 . The system of  claim 9 , wherein the computer instructions are further executable by the fraud processing computer to:
 assimilate one of the plurality of root node affinities compared with the tier two affinity based at least in part on the comparison.   
     
     
         11 . The system of  claim 1 , wherein the computer instructions are further executable by the fraud processing computer to:
 receive real time transaction information;   request on-demand transaction information;   receive on-demand transaction information; and   assemble the real time transaction information and the on-demand transaction information to create the plurality of transaction packages.   
     
     
         12 . The system of  claim 1 , wherein the plurality of transaction packages are comprised of information selected from a group consisting of: real time transaction information, on-demand transaction information, and a combination of real time transaction information and on-demand transaction information. 
     
     
         13 . The system of  claim 11 , wherein the computer instructions are further executable by the fraud processing computer to:
 perform a gross sort on the plurality of transaction packages, wherein at least one of the plurality of transaction packages is eliminated from consideration.   
     
     
         14 . The system of  claim 6 , wherein the tier one affinity is a first tier one affinity, and wherein the computer instructions are further executable by the fraud processing computer to:
 compare a second tier one affinity to an affinity selected from a group consisting of: a third tier one affinity and a root node affinity; and   generate a report reflecting the comparison at a defined period.   
     
     
         15 . A method for evaluating value transfers, the method comprising:
 receiving, by a computer system, a plurality of transaction packages;   forming, by the computer system, a plurality of root node affinities associated with respective transaction packages;   comparing, by the computer system, the plurality of root node affinities with a tier one affinity; and   assimilating, by the computer system, at least one of the root node affinities with the tier one affinity based on the comparison.   
     
     
         16 . The method for evaluating value transfers of  claim 15 , the method further comprising:
 comparing one of the plurality of root node affinities with another of the root node affinities; and   based on the comparison, forming a second tier one affinity from compared root node affinities.   
     
     
         17 . The method for evaluating value transfers of  claim 15 , further comprising:
 receiving, by the computer system, a trigger level.   
     
     
         18 . The method for evaluating value transfers of  claim 17 , further comprising:
 converting the tier one affinity to a tier two affinity based at least in part on satisfying the trigger level;   locking the tier two affinity; and   generating a report indicating suspicious activity associated with the tier two affinity.   
     
     
         19 . A computer program product residing on a processor-readable storage medium for evaluating value transfers, the computer program product comprising processor-readable instructions configured to cause one or more processors to:
 receive a plurality of transaction packages;   form a plurality of root node affinities associated with respective transaction packages;   compare the plurality of root node affinities with a tier one affinity; and   assimilate at least one of the root node affinities with the tier one affinity based on the comparison.   
     
     
         20 . The computer program product of  claim 19 , wherein the processor-readable instructions are further configured to cause the one or more processors to:
 receive a trigger level;   convert the tier one affinity to a tier two affinity based at least in part on satisfying the trigger level;   lock the tier two affinity; and   generate a report indicating suspicious activity associated with the tier two affinity.