US 11,941,633 B2
System for identifying points of compromise
Christopher Kallas, Minneapolis, MN (US); and Xiaoqiao Wei, Minneapolis, MN (US)
Assigned to U.S. Bancorp, National Association, Minneapolis, MN (US)
Filed by U.S. Bancorp, National Association, Minneapolis, MN (US)
Filed on Oct. 28, 2020, as Appl. No. 17/082,664.
Application 17/082,664 is a continuation in part of application No. 16/562,724, filed on Sep. 6, 2019, granted, now 11,468,447.
Prior Publication US 2021/0073820 A1, Mar. 11, 2021
Int. Cl. G06Q 20/40 (2012.01); G11C 11/41 (2006.01)
CPC G06Q 20/4016 (2013.01) [G06Q 20/4015 (2020.05); G11C 11/41 (2013.01)] 20 Claims
OG exemplary drawing
 
1. An apparatus comprising:
a processor having programmed instructions stored in memory that when executed cause the processor to:
receive, via a communication network, information regarding suspicious fraud activity at a first location involving a plurality of transaction cards;
monitor changes over a first time interval to received information regarding suspicious fraud activity at the first location, wherein to monitor includes to increment a different counter stored in memory for each of the plurality of transaction cards that performed a fraudulent transaction at a second location subsequent to performing a non-fraudulent transaction at the first location during the first time interval;
identify a point-of-compromise (POC) location based on monitored changes surpassing a threshold indicating suspicious fraud activity at the first location over the first time interval;
responsive to identifying the POC location, determine a number of transaction cards having suspicious fraud activity at the POC location for each of a plurality of time slices of the first time interval;
identify an initial POC time slice that has a highest number of transaction cards having suspicious fraud activity of the plurality of time slices;
determine an end POC time slice after the initial POC time slice based on the end POC time slice being the first time slice after the initial POC time slice having a number of transaction cards having suspicious fraud activity below a value determined from a number of transaction cards having suspicious fraud activity of the plurality of time slices, wherein a time period beginning at the initial POC time slice and ending at the end POC time slice is a window of compromise;
determine one or more transaction cards of the plurality of transaction cards that performed non-fraudulent transactions at the POC location during the first time interval but outside and not within the window of compromise between the initial POC time slice and the end POC time slice; and
responsive to the determination of the one or more transaction cards that performed non-fraudulent transactions at the POC location during the first time interval but outside and not within the window of compromise between the initial POC time slice and the end POC time slice, remove the incremented counter for each of the one or more transaction cards from the memory.