| CPC G06F 21/554 (2013.01) [H04W 4/022 (2013.01); G06F 16/955 (2019.01); G06F 2221/034 (2013.01); G06Q 30/018 (2013.01); H04L 67/02 (2013.01); H04L 67/52 (2022.05); H04W 4/027 (2013.01); H04W 84/18 (2013.01)] | 17 Claims |
|
1. A system comprising:
a first server system configured to conduct a set of transactions, over one or more data networks and via a first online service, with user devices associated with a first set of individuals;
a second server system configured to conduct a transaction, over the one or more data networks and via a second online service, with a particular user device associated with a particular online identity;
a synthetic identity detection server communicatively coupled, via the one or more data networks, to external servers associated with online services, the external servers comprising the first server system and the second server system, wherein the synthetic identity detection server is communicatively coupled to the second server system in a manner that is external to a communication connection, via the second online service, between the second server system and the particular user device; and
a non-transitory computer-readable medium storing a graph data structure comprising nodes representing individuals having identities usable for accessing online services comprising the first online service and the second online service and links between the nodes, the links corresponding to common characteristics between connected nodes, wherein the common characteristics are determined based on transaction data associated with transactions via the online services with the user devices;
wherein the synthetic identity detection server is configured for:
obtaining the transaction data from the external servers via the one or more data networks, the transaction data describing the set of transactions with the user devices via the first online service,
updating the graph data structure, based on the obtained transaction data, to include the links between the nodes,
determining, from the links between the nodes, that a degree of connectivity among a subset of the nodes exceeds a threshold connectivity, the degree of connectivity indicating electronic communications involving a subset of identities represented by the subset of the nodes, the subset of identities including the particular online identity, wherein the degree of connectivity is determined by:
determining node edge densities for the nodes, wherein a node edge density indicates a node-to-link ratio among a subset of nodes;
identifying weights for at least some of the links, wherein a value of a weight for a link is associated with a type of link between the nodes where links representing characteristics that have a higher likelihood of corresponding to a specific individual have a higher value weight than links representing characteristics that correspond to multiple individuals; and
computing, based on the node edge densities and the weights, the degree of connectivity for the subset of the nodes,
determining that a subset of the links among the subset of the nodes represents activity having a likelihood of connectivity lower than a threshold likelihood of connectivity, and
transmitting, based on (a) the degree of connectivity exceeding the threshold connectivity and (b) the likelihood of connectivity being lower than the threshold likelihood of connectivity, an alert to the second server system indicating that the particular online identity is a potential synthetic identity, wherein:
(a) the potential synthetic identity is usable for gaining access to the second online service, and
(b) the alert is usable for preventing or delaying completion of the transaction between the second online service and the potential synthetic identity and for updating a graphical interface displayed by a display device to include a visual indicator of the degree of connectivity exceeding the threshold connectivity.
|