Detecting possible fraudulent communication usage

Claim 3

A method as claimed in claim 1, wherein a second of the fields of the call event record is designated a key field and contains a key relating to an entity as herein defined, and the method comprises the further steps of: reading the second key field of the call event record and obtaining its key; addressing the database by the combination of the second key field and the obtained key (referred to as the "second combination") to access a respective second combination-associated profile set comprising, (i) at least one profile identifying (g) a respective call event data processing algorithm defining a process to be performed upon call event data of a call event record to obtain a process result, (h) at least one second combination-associated first store to be incremented by the process result, and at least one respective threshold for the or each said second combination-associated first store, (j) a respective predetermined outcome to be generated when the contents of a said second combination-associated first store reaches a threshold, at least one said predetermined outcome comprising a fraud risk indicator, (ii) a yet further profile identifying (k) the respective first combination-associated second store for the call event record being currently processed to be incremented by a fraud risk indicator generated by a profile of its own profile set; processing the call event data of the call event record in accordance with said respective second combination-associated profile set, thereby obtaining one or more respective process results, incrementing the corresponding identified second combination-associated first store or stores by the respective process result, and, if a threshold is reached, generating the corresponding respective predetermined outcome, and, if a fraud risk indicator is generated, incrementing said first combination-associated second store by that fraud risk indicator, and, if a threshold of said first combination-associated second store is reached, generating a further respective predetermined outcome in accordance with the further profile of said first combination-associated profile set.

Claim 6

A method as claimed in claim 3, wherein a second of the fields of the call event record is designated a key field and contains a key relating to an entity as herein defined, and the method comprises the further steps of: reading the second key field of the call event record and obtaining its key; addressing the database by the combination of the second key field and the obtained key (referred to as the "second combination") to access a respective second combination-associated profile set comprising, (i) at least one profile identifying (h) a respective call event data processing algorithm defining a process to be performed upon call event data of a call event record to obtain a process result, (j) a respective function to be applied to the process result to generate a fraud risk indicator, (k) at least one second combination-associated first store to be incremented by the process result, and at least one respective threshold for the or each said second combination-associated first store, (l) a respective predetermined outcome to be generated when the contents of a said second combination-associated first store reaches a threshold, (ii) a yet further profile identifying (m) the respective first combination-associated second store for the call event record being currently processed to be incremented by a fraud risk indicator generated by a profile of its own profile set; processing the call event data of the call event record in accordance with said respective second combination-associated profile set, thereby obtaining at least one respective process result and associated fraud risk indicator, incrementing the corresponding identified second combination-associated first store or stores by the respective process result, and, if a threshold is reached, generating the corresponding respective predetermined outcome, incrementing said first combination-associated second store by the associated fraud risk indicator, and, if a threshold of said first combination-associated second store is reached, generating a further respective predetermined outcome in accordance with the further profile of said first combination-associated profile set.

Claim 7

A method as claimed in any one of claim 1, and including a step of presetting a said combination-associated profile set for a user to a default profile set, and a further step of modifying said preset combination-associated profile set in dependence upon network provided data relating to the user.

Claim 8

A method as claimed in claim 5, wherein said network provided data is account-related data.

Claim 9

A method as claimed in claim 6, wherein said modifying step is performed automatically in response to provision of said account-related data.

Claim 10

A method as claimed in any one of claim 5, wherein said modifying step comprises replacing a profile which identifies a first respective threshold for a said first combination-associated first store by a profile which identifies a second respective threshold for the same said first combination-associated first store, said second respective threshold having a higher value than said first respective threshold.

Claim 11

A method as claimed in any one of claim 1, wherein a said generated outcome is or includes entries in a log of the next n call event records occurring which have the same value of key in the first field as that of the call event record which resulted in that response.

Claim 12

A fraud detection system for detecting possible fraudulent use of a communications network, which network is arranged to provide call event records having fields containing call event data, at least a first of the fields being designated a key field and containing a key relating to an entity as herein defined, the system comprising: means for reading a key field of a call event record and obtaining its key and for addressing a database by the combination of said key field and the obtained key (referred to as a "combination"); a database addressable by a said combination and storing a plurality of respective profile sets associated with a first key field and a plurality of keys (referred to as "first combination-associated profile sets"), each first combination-associated profile set comprising (i) at least one profile identifying (a) a respective call event data processing algorithm defining a process to be performed upon call event data of a call event record to obtain a process result, (b) at least one first combination-associated first store to be incremented by the process result, and at least one respective threshold for the or each store, (c) a respective predetermined outcome to be generated when the contents of a said first combination-associated first store reaches a threshold, at least one said predetermined outcome comprising a fraud risk indicator, (ii) a further profile identifying (d) a first combination-associated second store to be incremented by a fraud risk indicator, (e) at least one respective threshold for said first combination-associated second store (f) a further respective predetermined outcome to be generated when the contents of said first combination-associated second store reaches a threshold; means for processing the call event data of the call event record in accordance with said first combination-associated profile set, thereby obtaining one or more respective process results, incrementing the corresponding identified first combination-associated first store or stores by the respective process result, and, if a threshold is reached, generating a said respective predetermined outcome, and, if a fraud risk indicator is generated, incrementing said first combination-associated second store by the fraud risk indicator, and, if a threshold is reached, generating the corresponding further respective predetermined outcome.

Claim 13

A fraud detection system for detecting possible fraudulent use of a communications network, which network is arranged to provide call event records having fields containing call event data, at least a first of the fields being designated a key field and containing a key relating to an entity as herein defined, the system comprising: means for reading a key field of a call event record and obtaining its key and for addressing a database by the combination of said key field and the obtained key (referred to as a "combination"); a database addressable by a said combination and storing a plurality of respective profile sets associated with a first key field and a plurality of keys (referred to as "first combination-associated profile sets"), each first combination-associated profile set comprising (i) at least one profile identifying (a) a respective call event data processing algorithm defining a process to be performed upon call event data of a call event record to obtain a process result, (b) at least one first combination-associated first store to be incremented by the process result, and at least one respective threshold for the or each store, (c) a respective predetermined outcome to be generated when the contents of a said first combination-associated first store reaches a threshold, at least one said predetermined outcome comprising a fraud risk indicator, (ii) a further profile identifying (d) a first combination-associated second store to be incremented by a fraud risk indicator, (e) at least one respective threshold for said first combination-associated second store (f) a further respective predetermined outcome to be generated when the contents of said first combination-associated second store reaches a threshold; means for processing the call event data of the call event record in accordance with said first combination-associated profile set, thereby obtaining one or more respective process results, incrementing the corresponding identified first combination-associated first store or stores by the respective process result, and, if a threshold is reached, generating a said respective predetermined outcome, and, if a fraud risk indicator is generated, incrementing said first combination-associated second store by the fraud risk indicator, and, if a threshold is reached, generating the corresponding further respective predetermined outcome.

Claim 14

A system as claimed in claim 10, for use when a second of said fields is designated a key field and contains a key relating to an entity as herein defined, and wherein the database stores a plurality of respective second combination-associated profile sets comprising (i) at least one profile identifying (g) a respective call event data processing algorithm defining a process to be performed upon call event data of a call event record to obtain a process result, (h) at least one second combination-associated first store to be incremented by the process result, and at least one respective threshold for the or each store, (j) a respective predetermined outcome to be generated when the contents of a said second combination-associated first store reaches a threshold, at least one said predetermined outcome comprising a fraud risk indicator, (ii) a yet further profile identifying (k) the respective first combination-associated second store for the call event record being currently processed to be incremented by a fraud risk indicator generated by a profile of its own profile set, and wherein said processing means is arranged to process the call event data of the call event record in accordance with said respective second combination-associated profile set, thereby obtaining one or more respective process results, incrementing the corresponding identified second combination-associated first store or stores by the respective process result, and, if a threshold is reached, generating a said respective predetermined outcome, and, if a fraud risk indicator is generated, incrementing said first combination-associated second store by that fraud risk indicator, and, if a threshold is reached, generating the corresponding further respective predetermined outcome.

Claim 15

A fraud detection system for detecting possible fraudulent use of a communications network, which network is arranged to provide call event records having fields containing call event data, at least a first of the fields being designated a key field and containing a key relating to an entity as herein defined, the system comprising: means for reading a key field of a call event record and obtaining its key and for addressing a database by the combination of said key field and the obtained key (referred to as a "combination"); a database addressable by a said combination and storing a plurality of respective profile sets associated with a first key field and a plurality of keys (referred to as "first combination-associated profile sets"), each first combination-associated profile set comprising (i) at least one profile identifying (a) a respective call event data processing algorithm defining a process to be performed upon call event data of a call event record to obtain a process result, (b) a respective function to be applied to the process result to generate a fraud risk indicator, (c) at least one first combination-associated first store to be incremented by the process result, and at least one respective threshold for the or each store, (d) a respective predetermined outcome to be generated when the contents of a said first combination-associated first store reaches a threshold, (ii) a further profile identifying (e) a first combination-associated second store to be incremented by a fraud risk indicator, (f) at least one respective threshold for said first combination-associated second store (g) a further respective predetermined outcome to be generated when the contents of said first combination-associated second store reaches a threshold; means for processing the call event data of the call event record in accordance with said first combination-associated profile set, thereby obtaining at least one respective process result and associated fraud risk indicator, incrementing the corresponding identified first combination-associated first store or stores by the respective process result, and, if a threshold is reached, generating the corresponding respective predetermined outcome, incrementing said first combination-associated second store by the fraud risk indicator, and, if a threshold is reached, generating the corresponding further respective predetermined outcome.

Claim 16

A fraud detection system for detecting possible fraudulent use of a communications network, which network is arranged to provide call event records having fields containing call event data, at least a first of the fields being designated a key field and containing a key relating to an entity as herein defined, the system comprising: means for reading a key field of a call event record and obtaining its key and for addressing a database by the combination of said key field and the obtained key (referred to as a "combination"); a database addressable by a said combination and storing a plurality of respective profile sets associated with a first key field and a plurality of keys (referred to as "first combination-associated profile sets"), each first combination-associated profile set comprising (i) at least one profile identifying (a) a respective call event data processing algorithm defining a process to be performed upon call event data of a call event record to obtain a process result, (b) a respective function to be applied to the process result to generate a fraud risk indicator, (c) at least one first combination-associated first store to be incremented by the process result, and at least one respective threshold for the or each store, (d) a respective predetermined outcome to be generated when the contents of a said first combination-associated first store reaches a threshold, (ii) a further profile identifying (e) a first combination-associated second store to be incremented by a fraud risk indicator, (f) at least one respective threshold for said first combination-associated second store (g) a further respective predetermined outcome to be generated when the contents of said first combination-associated second store reaches a threshold; means for processing the call event data of the call event record in accordance with said first combination-associated profile set, thereby obtaining at least one respective process result and associated fraud risk indicator, incrementing the corresponding identified first combination-associated first store or stores by the respective process result, and, if a threshold is reached, generating the corresponding respective predetermined outcome, incrementing said first combination-associated second store by the fraud risk indicator, and, if a threshold is reached, generating the corresponding further respective predetermined outcome.

Claim 17

A system as claimed in claim 12, for use when a second of said fields is designated a key field and contains a key relating to an entity as herein defined, and wherein the database stores a plurality of respective second combination-associated profile sets comprising (i) at least one profile identifying (h) a respective call event data processing algorithm defining a process to be performed upon call event data of a call event record to obtain a process result, (j) a respective function to be applied to the process result to generate a fraud risk indicator, (k) at least one second combination-associated first store to be incremented by the process result, and at least one respective threshold for the or each store, (l) a respective predetermined outcome to be generated when the contents of a said second combination-associated first store reaches a threshold, (ii) a yet further profile identifying (m) the respective first combination-associated second store for the call event record being currently processed to be incremented by a fraud risk indicator generated by a profile of its own profile set, and wherein said processing means is arranged to process the call event data of the call event record in accordance with said respective second combination-associated profile set, thereby obtaining at least one respective process result and associated fraud risk indicator, incrementing the corresponding identified second combination-associated first store or stores by the respective process result, and, if a threshold is reached, generating the corresponding respective predetermined outcome, and, if a fraud risk indicator is generated, incrementing said first combination-associated second store by that fraud risk indicator, and, if a threshold is reached, generating the corresponding further respective predetermined outcome.

Claim 18

A system as claimed in any one of claim 10, and including means responsive to receipt of network provided data relating to a particular user for modifying a profile set associated with that particular user.

Claim 19

A system as claimed in claim 14, wherein said modifying means is responsive to account-related data for modifying said profile set.

Claim 20

A system as claimed in any one of claim 10, and including means for accessing an accounts function of a communications network and retrieving account-related data associated with a particular user, and modifying means responsive to account-related data retrieved by said accessing and retrieving means to modify a profile set associated with that particular user in dependence upon the retrieved account-related data.

Claim 21

A system as claimed in any one of claim 10, wherein said modifying means is arranged to replace a profile which identifies a first respective threshold for a said first combination-associated first store by a profile which identifies a second respective threshold for the same said first combination-associated first store, said second respective threshold having a higher value than said first respective threshold.

Claim 22

A system as claimed in any one of claim 10, wherein the outcome generating means is arranged to generate as an outcome, or part of an outcome, entries in a log of the next n call event records occurring which have the same value of key in the first key field as that of the call event record which resulted in that outcome.

Claim 23

A communications network incorporating a fraud detection system as claimed in any one of claim 10.

Claim 24

A communications network as claimed in claim 19, wherein the network is an intelligent network.

Claim 25

A communications network as claimed in claim 20, wherein the fraud detection system forms part of the network intelligence of the intelligent network.