Detailed Action
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Acknowledgments
The RCE filed on 09/10/26 is acknowledged.
Status of Claims
Claims 1, 3-11, 13-24, 27-29 and 31-35 are pending.
In the Amendment filed on 08/25/2026 (entered via the RCE), claims 1, 11 and 21 were amended, claims 2, 12, 25, 26 and 30 were cancelled, and no claims were added.
Claims 1, 3-11, 13-24, 27-29 and 31-35 are rejected.
Response to Arguments
Regarding the lack of priority
In view of the cancellation of claims 25 and 26, claims 25 and 26 no longer provide grounds for asserting a lack of priority, i.e., lack of entitlement to the benefit of Provisional Application No. 63/404,868, to which the instant application claims priority.
As noted in the previous Office Action, the subject matter of claims 25 and 26 was cited as exemplary grounds for this lack of priority; it was not to be deemed to constitute an exhaustive listing of subject matter/claims lacking support in the Provisional Application.
In Applicant's remarks, Applicant states:
Applicant respectfully submits that the rejection concerning entitlement to priority for claims 25 and 26 has been overcome and should be withdrawn. (Response, p. 12)
For clarification of the record, it is noted that the Office's indication of lack of priority, i.e., lack of entitlement to the benefit of the provisional application, did not constitute a "rejection."
Regarding the rejections under 35 U.S.C. 112
In view of the amendments to, and cancellations of, the claims in question, the previous rejections are withdrawn. However, the instant amendments give rise to new rejections.
Regarding the rejection under 35 U.S.C. 101
Applicant's arguments have been fully considered but are not persuasive.
Below, the Office responds to Applicant's arguments, organized as per Applicant's headings.1 In the discussion below, page numbers refer to Applicant's Response unless otherwise indicated.
A. Step 1 (p. 13)
The Office agrees that the claims fall within one of the four statutory categories.
B. Step 2A (pp. 13-14)
This section does not provide argument.
1. Prong One (pp. 14-16)
Applicant sets forth the body of claim 1, except for the first four steps. Pp. 14-15.
Applicant highlights the steps of generating and transmitting an alert, queuing, retrieving, and assigning, cites corresponding portions of the specification, and asserts:
These limitations are not directed merely to evaluating risk or making a business decision. Rather, they are directed to a particular computerized transaction-processing architecture that controls processing of transaction events through a severity-based alert queue and category-based disposition workflow.
The claimed ordered-queue processing cannot practically be performed in the human mind. (p. 15)
…
Accordingly, the claims are directed to a specific technological workflow for controlling computerized transaction processing and are not directed to a fundamental economic practice, commercial interaction, or method of organizing human activity. (p. 16)
The Office respectfully disagrees.
The steps of generating and transmitting an alert, queuing, retrieving, and assigning are (for the most part) part of the abstract idea of detecting and preventing fraud. In fact, with the exception of the step of determining a model fit, all the steps of claim 1 are part of this abstract idea, except for the additional elements recited in those steps, such as the processor, machine learning model, or device used to carry out the steps, the database for storing data or from which data is retrieved, the device from/to which data is received/transmitted, the network via which data is received or processed, and the automatic manner in which operations are carried out. Thus the "transaction processing" and "severity-based alert queue and category-based disposition workflow" are all part of the abstract idea, except for the noted additional elements. Inasmuch as the additional elements are recited at a high level of generality, are not described, and are used as tools off-the-shelf, the relationship between the additional elements and the abstract idea is 'apply it' and/or generally linking the use of a judicial exception to a particular technological environment or field of use (as set forth in the rejection hereinbelow), and accordingly claim 1 is directed to the abstract idea.
It is also noted that the claims were not rejected based on being a mental process.
2. Prong Two (pp. 16-18)
Applicant sets forth the steps of enriching, generating and transmitting an alert, queuing, retrieving, and assigning, cites corresponding portions of the specification, and asserts:
Thus, the claims are not directed merely to evaluating information. (p. 17)
…
Consistent with the specification, generated information is used within the claimed system to control subsequent processing of transactions, including prioritized review and differentiated transaction handling. Spec. ¶¶ [0054]-[0056]; Fig. 10. Accordingly, any alleged judicial exception is integrated into a practical application. (pp. 17-18)
The Office respectfully disagrees.
As discussed above, the steps of enriching, generating and transmitting an alert, queuing, retrieving, and assigning are all part of the abstract idea, except for the additional elements recited in those steps, such as the processor, machine learning model, or device used to carry out the steps, the database for storing data or from which data is retrieved, the device from/to which data is received/transmitted, the network via which data is received or processed, and the automatic manner in which operations are carried out. Thus, the "control [of] subsequent processing of transactions, including prioritized review and differentiated transaction handling" constitutes part of the abstract idea, except for the additional elements.
Applicant also argues analogy with Example 42 of the USPTO Subject Matter Eligibility Guidance. P. 18. Applicant asserts:
In Example 42, the USPTO concluded that the claims integrated any alleged abstract idea into a practical application because updated patient information was not merely collected or displayed, but was used by the claimed system to generate notifications and control subsequent operation of the patient-management process. Similarly, in the present disclosure, the generated risk indicator is subsequently used for "queuing an ordered list of generated alerts," "retrieving ... the processed action ... based on an order in which the alert is placed in the ordered list," and assigning the processed action to a particular risk category that triggers a corresponding system action. Accordingly, the generated information is used by the claimed system to govern subsequent computerized processing rather than merely serving as information for presentation or evaluation. (p. 18; emphasis added)
Applicant's alleged analogy is not persuasive. The claimed subject matter of Example 42 is different from that of Applicant's claims. The alleged rationale asserted by Applicant for the USPTO's concluding that the claim of Example 42 integrated the abstract idea into a practical application does not match the actual content of Example 42. According to Example 42, the grounds for finding integration into a practical application are as follows:
The claim recites a combination of additional elements including storing information, providing remote access over a network, converting updated information that was input by a user in a non-standardized form to a standardized format, automatically generating a message whenever updated information is stored, and transmitting the message to all of the users. The claim as a whole integrates the method of organizing human activity into a practical application. Specifically, the additional elements recite a specific improvement over prior art systems by allowing remote users to share information in real time in a standardized format regardless of the format in which the information was input by the user.2 (emphasis added)
As seen from the actual content/reasoning of Example 42 above, the finding of integration into a practical application included a combination of additional elements that reflected a specific improvement over the prior art, including, e.g., standardization of non-standardized format of information, automatic real-time notification to all users, etc. This specific explanation of the rationale for finding integration into a practical application is not analogous to applicant's claims, whether in terms of the content of the claims, the content of the additional elements, the nature of the prior art problem, or the nature of the solution. Accordingly, the alleged analogy with Example 42 is not persuasive.
C. Step 1B (pp. 18-20)
Applicant argues the same claimed subject matter as was argued for Step 2A, Prong Two, namely, the steps of enriching, generating and transmitting an alert, queuing, retrieving, and assigning. As discussed above, these steps are all part of the abstract idea, except for the additional elements recited in those steps, such as the processor, machine learning model, or device used to carry out the steps, the database for storing data or from which data is retrieved, the device from/to which data is received/transmitted, the network via which data is received or processed, and the automatic manner in which operations are carried out.
Applicant writes:
Accordingly, the claims recite significantly more than mere evaluation of transaction information. The claims define a particular technological implementation in which generated risk information is used to control subsequent operation of a computerized transaction-processing workflow, including prioritized processing and differentiated automated transaction handling. Therefore, the amended claims amount to significantly more than any alleged judicial exception.
At a minimum, the combination of severity-based alert generation, ordered queue management, prioritized transaction retrieval, category assignment, and automated transaction disposition constitutes significantly more than any alleged abstract idea. (pp. 19-20; emphasis added)
The Office acknowledges Applicant's assertion that "the claims recite significantly more than mere evaluation of transaction information." However, the content of the claims that goes beyond mere evaluation of transaction information constitutes merely a specifying/narrowing of the abstract idea, together with the noted additional elements, which apply the abstract idea and/or generally link its use to a particular technological environment or field of use. This content does not amount to 'significantly more' under step 2B, such as would render the claims eligible under 35 U.S.C. 101. As already discussed above, the "control subsequent [of] operation of a computerized transaction-processing workflow, including prioritized processing and differentiated automated transaction" and the "severity-based alert generation, ordered queue management, prioritized transaction retrieval, category assignment, and automated transaction disposition" all amount to the abstract idea, except for the additional elements as noted above (including those underlined here in this quotation), which apply the abstract idea and/or generally link its use to a particular technological environment or field of use. Mere instructions to apply an exception using generic computer elements or generally linking the use of a judicial exception to a particular technological environment or field of use cannot provide an inventive concept ("significantly more"). MPEP 2605.I.
Regarding the rejections under 35 U.S.C. 103
Applicant's arguments have been fully considered but are not persuasive.
The Office responds to Applicant's arguments below. In the discussion below, page numbers refer to Applicant's Response unless otherwise indicated.
(1) Initially, Applicant argues that Comeaux does not teach the retrieving step of claim 1 (pp. 20-21). Relatedly, Applicant argues that Shevyrev, Petersen and Faibish do not remedy this alleged deficiency of Comeaux (pp. 21-22). In the arguments against Shevyrev, Petersen and Faibish, Applicant also argues that they do not teach the queuing step of claim 1.
In response, Shevyrev, Petersen and Faibish are not cited as teaching this subject matter. Comeaux does indeed teach this subject matter, contrary to Applicant's argument. Explanation follows.
Regarding Comeaux, Applicant initially cites 4:31-41 and claim 1 (p. 21). However, the rejection did not cite these portions of Comeaux for the queuing and retrieving steps. Subsequently, Applicant cites 5:8-11 of Comeaux (p. 21). However, Applicant does not cite the entirety of these teachings of Comeaux, and accordingly Applicant mischaracterizes Comeaux.
The rejection cites, inter alia, Comeaux 18:62-19:11 as teaching the queuing step. 18:62-19:11 reads as follows:
The alert-generating server may transmit one or more instructions to an administrator device or any other server of the system to cease execution of a request associated with a fraudulent activity for each alert generated by the alert-generating server based on a fraud probability score corresponding to the alert. For instance, the alert-generating server may sort each alert based on their corresponding fraud probability score. Based on the sorting order of alerts, the alert-generating server may generate instructions corresponding to the alerts, and transmit the instructions to the administrator device to cease execution of the request associated with a fraudulent activity for each alert in the sorted order of the alerts. In other words, the one or more alerts and instructions associated with the one or more alerts are presented on a graphical user interface (GUI) of an administrator device in order of priority as indicated by the relative fraud probability scores. (emphasis added)
As per the underlined content above, Comeaux is deemed to squarely teach the queuing step.3 Applicant's argument does not address or even acknowledge this portion of Comeaux, despite that it is the first listed portion of Comeaux cited in the rejection as teaching the queuing step. Thus, Applicant effectively fails to offer any rebuttal of this prime evidence demonstrating that the prior art (Comeaux) teaches the queuing step.
Further, the rejection cites, inter alia, Comeaux 5:8-11 as teaching the retrieving step. 5:8-11 reads as follows:
Analyst computers may query and fetch these alerts from a database and may present the alerts to be addressed by an analyst, for example, according to a priority level of the respective alerts. (emphasis added)
As per the underlined content above, Comeaux is deemed to squarely teach the retrieving step.4 Applicant argues that this the portion of Comeaux teaches merely "present[ing]" alerts according to a priority level (p. 21). However, this portion also teaches "fetching" the alerts according to the priority level. The "fetching" teaches "retrieving." Thus, Applicant effectively fails to address this prime evidence demonstrating that the prior art (Comeaux) teaches the retrieving step. Applicant's omission of part of Comeaux's teachings serves to mischaracterize those teachings.
(2) Secondly, Applicant argues that Comeaux and Shevyrev do not teach the assigning step and subsequent responsive actions (pp. 22-23).
In response, Comeaux is not cited as teaching the entirety of this subject matter. Shevyrev is cited as teaching the entirety of this subject matter. Explanation is provided in the rejection in the body of the Office Action hereinbelow. Contrary to Applicant's argument, Shevyrev indeed teaches assigning categories of high, medium, and low risk levels based on risk scores and associated thresholds/ranges, as part of the processing of the transactions. See, e.g., Shevyrev 0066-0067.
In addition, claim 1 as drafted does not require that the assigning and subsequent responsive actions occur after retrieval of the processed action (see p. 22-23).
Claim Interpretation
Claims 1, 11 and 21 recite:
tuning, by the at least one processor, a currently generated risk indicator using information associated with one or more previously generated risk indicators retained by the machine learning model;
The above-quoted tuning step is interpreted as encompassing that the tuning of the currently generated risk indicator may be achieved indirectly, via tuning, training or the like of the machine learning model. Specifically, the tuning, training or the like of the machine learning model improves performance of the model, resulting in the model generating improved/changed – i.e., tuned5 – output. As claimed and disclosed, the risk indicator is the output generated by the machine learning model.6
While the art of machine learning generally speaks of tuning a machine learning model, or tuning the parameters/hyperparameters of the model in order to tune the model, it is not such ordinary parlance in the art to speak of "tuning" an output of a machine learning model. However, we believe the claim language "tuning a … risk indicator" may be considered to be merely an infelicitous usage, rather than, say, Applicant's attempt to be its own lexicographer. For we believe that Applicant intends to be in conformity with the general knowledge/understanding of the art (see, e.g., Applicant's teachings in the disclosure in regard to the claimed tuning step, namely, ¶ 0071: "Tuning as used herein may refer to an experimental process of finding optimal values of hyperparameters to maximize model performance. As used herein and generally understood in the art, ….").
Accordingly, we believe the interpretation of the tuning step given above is reasonable, aligns with the knowledge/understanding in the art and with Applicant's intent, and accordingly promotes compact prosecution.
Claims 8 and 18 recite:
wherein the queuing of generated alerts includes ordering the generated alerts according to their respective probabilities of unauthorized activity.
The language "their respective probabilities of unauthorized activity" (underlined above) is interpreted as referring to the "probability of unauthorized action" that is "indicate[d]" by each "alert" that is "generated" in the 'responsive to a determination' step of base claims 1 and 11, wherein Applicant is deemed to intend that each of the "generated alerts" in the queuing step of claims 1 and 11 has been generated by the 'responsive to a determination' step of claims 1 and 11.
Claim 31 recites "transmitting the generated alerts." In view of the claims and the disclosure, "the generated alerts" are interpreted as referring to the "the generated alerts" of the queuing step of base claim 1.
Claim Objections
Claims 1, 3-7, 10, 11, 13-17, 20, 21, 24, 27-29 and 34 are objected to because of the following informalities:
A) Claims 1, 11 and 21 recite:
tuning, by the at least one processor, a currently generated risk indicator using information associated with one or more previously generated risk indicators retained by the machine learning model;
As claims 1, 11 and 21 are drafted, the relationship between "a currently generated risk indicator" and the "risk indicator" generated in the earlier generating step (which is also recited as the "generated risk indicator" in later steps) is not clear. As best understood, based on the claims, the instant amendments, and the disclosure, Applicant's intention was that "a currently generated risk indicator" does indeed refer to the "risk indicator" generated in the earlier generating step (which is also recited as the "generated risk indicator" in later steps).
B) Claims 1, 11 and 21 recite:
responsive to a determination that the generated risk indicator exceeds a predetermined threshold, generating an alert indicating a probability of an unauthorized action and transmitting the alert to the transaction channel device associated with the processed action;
As for antecedent basis for the underlined language, we note that claims 1, 11 and 21 do not explicitly previously recite a "transaction channel device associated with the processed action." Rather, claims 1, 11 and 21 previously recite "receiving, via a network, information corresponding to a processed action of a user from a transaction channel device" (receiving step). Based on the claims, the instant amendments, and the disclosure (see, e.g., 0032-0042), the "transaction channel device associated with the processed action" (underlined above) is understood to refer to the "transaction channel device" from which the "information corresponding to a processed action of a user" is received in the receiving step: it is believed this is Applicant's intention and that the underlined language is merely a matter of loose or imprecise usage.
C) Claims 1, 11 and 21 recite:
queuing an ordered list of generated alerts in the database, wherein the generated alerts are ordered based on severity of the corresponding risk indicator to facilitate prioritized processing;
As for antecedent basis for the underlined language, we note that claims 1, 11 and 21 do not explicitly previously recite a "corresponding risk indicator." Rather, claims 1, 11 and 21 previously recite:
responsive to a determination that the generated risk indicator exceeds a predetermined threshold, generating an alert indicating a probability of an unauthorized action and transmitting the alert to the transaction channel device associated with the processed action;
Based on this step ('responsive to a determination' step), the remainder of the claims, and the disclosure (see, e.g., 0055 "In some embodiments, system 1000 may involve queuing of an ordered list of generated alerts that includes ordering the generated alerts according to their respective risk indicators."), it is believed Applicant intended the "corresponding risk indicator" to refer (for each alert) to the risk indicator that exceeded the threshold and consequently caused generation of the (respective) alert, as per the 'responsive to a determination' step.
Regarding the queuing step more generally, it is believed Applicant intended the "wherein" clause therein to be indicating that that each alert in the "ordered list of generated alerts" has a corresponding risk indicator (as per the 'responsive to a determination' step) and is ordered in the ordered list based on severity of the respective corresponding risk indicator to facilitate prioritized processing.
D) Claims 3 and 13 recite "the alert is generated." As per B), C), above, base claims 1 and 11 recite more than one generated alert. Claims 3 and 13 do not specify which of the generated alerts of claims 1 and 11 the above-underlined language refers to. However, as best understood, based on the content of the claims in question and the disclosure, it is understood that the above-underlined language of claims 3 and 13 is intended to refer to the alert generated in the 'responsive to a determination' step of claims 1 and 11. Claims 3 and 13 are interpreted accordingly.
E) Claims 4-7, 10, 14-17, 20, 24, 27-29 and 34 recite "the risk indicator." As per A), C), above, base claims 1 and 11 recite more than one risk indicator. Claims 4-7, 10, 14-17, 20, 24, 27-29 and 34 do not specify which of the risk indicators of claims 1 and 11 the above-underlined language refers to. However, as best understood, based on the content of the claims in question and the disclosure, it is understood that the above-underlined language of claims 4-7, 10, 14-17, 20, 24, 27-29 and 34 is intended to refer to the risk indicator generated in the step of "generating … a risk indicator" of claims 1 and 11. Claims 4-7, 10, 14-17, 20, 24, 27-29 and 34 are interpreted accordingly.
F) Claim 34 further recites:
wherein the generating includes: …
Note base claim 1 recites two instances of "generating" – two generating steps. Claim 34 does not specify which of the two "generating" steps of claim 1 the above-underlined language refers to. However, as best understood, based on the content of claims 1 and 34 and the disclosure (e.g., 0043-0046), it is understood that the "generating" of claim 34 is intended to refer to the first generating step of claim 1 (namely, "generating … a risk indicator …"). Claim 34 is interpreted accordingly.
Appropriate clarification/correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 9, 19 and 32 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor, or for pre-AIA the applicant regards as the invention.
Unclear Scope/Unclear Antecedent Basis
Claim 9 and 19 recite:
(ones of) the generated risk indicators that are below the predetermined threshold.
As per the Claim Objections, A), C), above, base claims 1 and 11 recite a risk indicator that is generated and determined to exceed a threshold, a currently generated risk indicator, previously generated risk indicators, and the corresponding risk indicator. Base claims 1 and 11 do not recite risk indicators that are below a threshold.
It is possible Applicant intends the "ones of the generated risk indicators that are below the predetermined threshold" of claims 9 and 19 to refer to ones of the "previously generated risk indicators" of base claims 1 and 11. However, this possibility cannot be assumed since, prior to the instant amendments, claims 1 and 11 did not recite the "previously generated risk indicators."
It is possible Applicant intends the "ones of the generated risk indicators that are below the predetermined threshold" of claims 9 and 19 to refer to ones of the generated risk indicators that (as per C), above) are implied by the queuing step of base claims 1 and 11. However, this possibility cannot be assumed since these implied risk indicators correspond to alerts that are generated only if the risk indicator "exceeds a predetermined threshold" (see 'responsive to a determination' step of claims 1 and 11). Thus, since claims 9 and 19 stipulate that the generated risk indicators are below the predetermined threshold, the risk indicators of claims 9 and 19 cannot be these implied risk indicators of claims 1 and 11 -- unless claims 9 and 19 are intended to refer to a different threshold than that of claims 1 and 11 (that is, unless "the predetermined threshold" of claims 9 and 19 is incorrect and should be, e.g., "another predetermined threshold" or the like).
It is possible that Applicant intends that (at least) the step of generating a risk indicator of base claims 1 and 11 is repeated, such that multiple risk indicators are generated, and that the "ones of the generated risk indicators that are below the predetermined threshold" of claims 9 and 19 refer to ones of these unstated, potential risk indicators.
In view of Applicant's claims and disclosure, it is not clear what Applicant intended. It is noted that Applicant's specification, figures (e.g., 10 and 14-16) and original claims admit of a variety of arrangements of Applicant's subject matter.
In view of the wide range of uncertainty as to what the "generated risk indicators that are below the predetermined threshold" of claims 9 and 19 refer to in base claims 1 and 11 (and the uncertainty surrounding "the predetermined threshold" of claims 9 and 19, as discussed above), claims 9 and 19 are indefinite.
Claim 32 recites:
transmitting each generated alert to an associated transaction channel device.
Note base claim 1 recites:
responsive to a determination that the generated risk indicator exceeds a predetermined threshold, generating an alert indicating a probability of an unauthorized action and transmitting the alert to the transaction channel device associated with the processed action;
The antecedent basis of "an associated transaction channel device" of claim 32 is not clear. That is, it is not clear if "an associated transaction channel device" of claim 32 refers to the "the transaction channel device associated with the processed action" of claim 1 or not.7
On the one hand, the language "associated transaction channel device" of claim 32 could be a shortened form of the language "the transaction channel device associated with the processed action" of claim 1.
On the other hand, the word "an" indicates that the "associated transaction channel device" of claim 32 does not refer back to a previously recited element, and hence indicates that "an associated transaction channel device" of claim 32 does not refer to "the transaction channel device associated with the processed action" of claim 1.
Note also that the underlined language of claim 32 predates the underlined language of claim 1, so that prior to the instant amendments the language "an associated transaction channel device" of claim 32 could not have referred to the language "the transaction channel device associated with the processed action" of claim 1.
Also recall that, as per Claim Objections, B) above, "the transaction channel device associated with the processed action" of claim 1 is understood to refer to the "transaction channel device" from which the "information corresponding to a processed action of a user" is received in the receiving step of claim 1 -- this creates a greater discrepancy in meaning between "an associated transaction channel device" of claim 32 and "the transaction channel device associated with the processed action" of claim 1, which would seem to make it less likely that "an associated transaction channel device" of claim 32 refers to "the transaction channel device associated with the processed action" of claim 1.
In addition, if we are to ascribe substantive content to claim 32, it would seem that the "associated transaction channel device" of claim 32 would have to be an element other than "the transaction channel device associated with the processed action" of claim 1. Explanation is provided below.
Traversing through claim 1 from the start, we see that it recites a single "processed action" (receiving step), followed by a single "risk indicator" that is generated corresponding to / based on the single "processed action" (generating step, storing step, 'responsive to a determination' step, assigning step)8, followed by a single "alert" that is generated corresponding to / based on the single "generated risk indicator" satisfying a condition (namely, "a determination that the generated risk indicator exceeds a predetermined threshold"). Thus, at this juncture in claim 1, there is only a single "generated alert," and accordingly the language "each generated alert" in claim 32 would not make sense because the word "each" indicates more than one.
As we continue traversing through claim 1, the queuing step recites multiple "generated alerts" (and "corresponding risk indicators"). Thus, at this juncture in claim 1, the language "each generated alert" in claim 32 makes sense, as claim 1 now recites multiple alerts for the word "each" in claim 23 to refer to.
Thus, the queuing step, with its reference to a plurality of "generated alerts" and "corresponding risk indicators9," implies that the preceding series of steps (outlined above) whereby an alert is generated, has been carried out not just one time as recited by the claim, but rather that it has been repeated multiple times.
However, if this is indeed so, that is, if the preceding series of steps whereby an alert is generated has been carried out multiple times, we must still recall that (as per the 'responsive to a determination' step of claim 1 quoted above) the only way claim 1 provides for an alert to be generated is if the corresponding risk indicator meets the condition (namely, "a determination that the generated risk indicator exceeds a predetermined threshold"). And, importantly, as per the 'responsive to a determination' step of claim 1 quoted above, if the condition is met, not only is the alert generated, but also the alert is transmitted to the transaction channel device associated with the processed action. All of this is to say that, if multiple alerts are generated according to the claim steps for generating a (single) alert, then so too each of these multiple generated alerts is transmitted to the transaction channel device associated with the processed action.
Therefore, if the "associated transaction channel device" of claim 32 is "the transaction channel device associated with the processed action" of claim 1, then claim 32 ("transmitting each generated alert to an associated transaction channel device") adds no content to claim 1 (or in other words, claim 32 does not further limit claim 1), because claim 1 already provides that every alert generated is transmitted to the transaction channel device associated with the processed action.
Therefore, it is only if the "associated transaction channel device" of claim 32 is not "the transaction channel device associated with the processed action" of claim 1, that claim 32 adds content to claim 1, or in other words, that claim 32 further limits claim 1.10
In other words, in order to ascribe substantive content to claim 32, it seems we must interpret the "associated transaction channel device" of claim 32 to be an element other than "the transaction channel device associated with the processed action" of claim 1.
As stated at the outset of this discussion, the language of claim 32 provides mixed signals as to whether "an associated transaction channel device" of claim 32 refers to "the transaction channel device associated with the processed action" of claim 1: on the one hand, the element as described in claim 32 could be short for the element as described in claim 1; on the other hand, the word "an" suggests the element in claim 32 is not the same as the element in claim 1; also, prior to the instant amendments, the element in claim 32 could not have referred to the element in claim 1 because claim 1 did not previously contain that element; finally, the understanding that the element in claim 1 actually refers to the "transaction channel device" from which the "information corresponding to a processed action of a user" is received in the receiving step of claim 1 increases the discrepancy in meaning between the element of claim 32 and the element of claim 1.
In the interest of compact prosecution, it is deemed desirable to ascribe substantive content to claim 32 rather than to ascribe no content to claim 32. We believe it is reasonable to let this factor, namely, the promotion of compact prosecution, (further) tip the balance (i.e., the mixed signals) so as to favor the interpretation according to which the element of claim 32 is not the same as the element of claim 1. Accordingly, for purposes of examination, we adopt such an interpretation of claim 32, and interpret the "associated transaction channel device" of claim 32 as being any associated transaction channel device.
(On this adopted interpretation of claim 32, regarding the word "associated" in claim 32, we interpret it in light of claims 1 and 32 and the disclosure to mean any transaction channel device associated with the processed action.)
Despite the interpretation of claim 32 adopted for purposes of examination, the claim as drafted is on its face not clear as to the antecedent basis of "an associated transaction channel device" – it is not clear if "an associated transaction channel device" refers to "the transaction channel device associated with the processed action" of claim 1 or not (and, if not, it is not clear what the term "associated" refers to – associated with what?).
Accordingly, claim 32 is indefinite.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1, 3-11, 13-24, 27-29 and 31-35 are rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception (i.e., a law of nature, a natural phenomenon, or an abstract idea) without significantly more.
Claims 1, 3-11, 13-24, 27-29 and 31-35 are directed to a method, system, or product, which are/is one of the statutory categories of invention. (Step 1: YES)
Claims 1, 11 and 21 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The claims recite a method, system, and computer-readable medium for detecting and preventing fraud.
For claims 1, 11 and 21 (claim 1 being deemed representative), the limitations (indicated below in bold) of:
receiving, via a network, information corresponding to a processed action of a user from a transaction channel device;
enriching, using the network, the information in real time by appending to the information at least one of transactional data, customer characteristic data, or historical data associated with a user account associated with the user to form enriched information;
encrypting, using the network, the enriched information corresponding to the processed action of the user;
generating, by a machine learning model executed by the at least one processor, a risk indicator that is expressed as a severity associated with unauthorized activity for the processed action of the user, the machine learning model being trained to predict a likelihood of unauthorized activity for the processed action based on a plurality of inputs, the plurality of inputs including at least one past return;
determining, by the at least one processor, a model fit representing how accurately the machine learning model adapts to the plurality of inputs;
tuning, by the at least one processor, a currently generated risk indicator using information associated with one or more previously generated risk indicators retained by the machine learning model;
storing, the generated risk indicator in a database;
responsive to a determination that the generated risk indicator exceeds a predetermined threshold, generating an alert indicating a probability of an unauthorized action and transmitting the alert to the transaction channel device associated with the processed action;
queuing an ordered list of generated alerts in the database, wherein the generated alerts are ordered based on severity of the corresponding risk indicator to facilitate prioritized processing;
retrieving, by the at least one processor via the network, the processed action from the database based on an order in which the alert is placed in the ordered list;
assigning, based on the generated risk indicator, the processed action to one of the following:
a low-risk category,
a medium-risk category, or
a high-risk category; and
generating a risk result from the machine learning model to determine whether the processed action is determined to be unauthorized, wherein the generated risk result includes the at least one processor:
responsive to assignment to the high-risk category, automatically stopping, at the transaction channel device, the processed action;
responsive to assignment to the medium-risk category, flagging, at the transaction channel device, the processed action for review; or
responsive to assignment to the low-risk category, automatically allowing, at the transaction channel device, the processed action.
as drafted, constitute a process that, under the broadest reasonable interpretation, covers "certain methods of organizing human activity," specifically, "fundamental economic practices or principles" and/or "commercial or legal interactions,” but for recitation of generic computer components and generally linking the use of a judicial exception to a particular technological environment or field of use. The Examiner notes that "fundamental economic practices" or "fundamental economic principles" describe concepts relating to the economy and commerce, including hedging, insurance, and mitigating risks, and "commercial interactions" or "legal interactions" include agreements in the form of contracts, legal obligations, advertising, marketing or sales activities or behaviors, and business relations. MPEP 2106.04(a)(2)II.A.,B. If a claim limitation, under its broadest reasonable interpretation, covers “mathematical relationships, mathematical formulas or equations, mathematical calculations” or "fundamental economic practices or principles" and/or "commercial or legal interactions," but for recitation of generic computer components and generally linking the use of a judicial exception to a particular technological environment or field of use, then it falls within the "certain methods of organizing human activity" grouping of abstract ideas. Accordingly, claims 1, 11 and 21 recite an abstract idea. (Step 2A - Prong 1: YES. Claims 1, 11 and 21 recite an abstract idea.)
This judicial exception is not integrated into a practical application. Claims 1, 11 and 21 recite the additional elements of a network; a transaction channel device (associated with the processed action); a machine learning model executed by the at least one processor; the machine learning model being trained; determining, by the at least one processor, a model fit representing how accurately the machine learning model adapts to the plurality of inputs; the at least one processor; retained by the machine learning model; a database; automatically (all the foregoing elements recited in claims 1, 11 and 21); a computing system including at least one processor (claim 1); one or more processors (claim 11); and a non-transitory computer-readable medium storing a set of instructions for identifying unauthorized actions in a computing system including at least one processor (claim 21), that implement the abstract idea. These additional elements are not described by the applicant and they are recited at a high level of generality (i.e., one or more generic computer elements performing generic computer functions, or generally linking the use of a judicial exception to a particular technological environment or field of use), such that they amount to no more than mere instructions to apply the exception using generic computer elements (namely, all of the additional elements), or such that they amount to no more than generally linking the use of a judicial exception to a particular technological environment or field of use (namely, a machine learning model executed by the at least one processor; the machine learning model being trained; determining, by the at least one processor, a model fit representing how accurately the machine learning model adapts to the plurality of inputs; retained by the machine learning model). Accordingly, even in combination these additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea. (Step 2A - prong 2: NO. The additional elements do not integrate the abstract idea into a practical application.)
The claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception itself. As discussed above with respect to integration of the abstract idea into a practical application, the additional elements of a network; a transaction channel device (associated with the processed action); a machine learning model executed by the at least one processor; the machine learning model being trained; determining, by the at least one processor, a model fit representing how accurately the machine learning model adapts to the plurality of inputs; the at least one processor; retained by the machine learning model; a database; automatically (all the foregoing elements recited in claims 1, 11 and 21); a computing system including at least one processor (claim 1); one or more processors (claim 11); and a non-transitory computer-readable medium storing a set of instructions for identifying unauthorized actions in a computing system including at least one processor (claim 21), to perform the noted steps amount to no more than mere instructions to apply the exception using generic computer elements or generally linking the use of a judicial exception to a particular technological environment or field of use. Mere instructions to apply an exception using generic computer elements or generally linking the use of a judicial exception to a particular technological environment or field of use cannot provide an inventive concept ("significantly more"). Accordingly, even in combination, these additional elements do not provide significantly more. As such, claims 1, 11 and 21 are not patent eligible. (Step 2B: NO. The claims do not provide significantly more.)
Dependent claims 3-10, 13-20, 22-24, 27-29 and 31-35 are similarly rejected because they further define/narrow the abstract idea of independent claims 1, 11 and 21 as discussed above, and/or do not integrate the abstract idea into a practical application or provide an inventive concept such as would render the claims eligible, whether each is considered individually or as an ordered combination.
As for further defining/narrowing the abstract idea:
Claims 3 and 13 merely describe merely describes wherein the alert is generated at a set interval to periodically monitor and detect for unauthorized activity.
Claims 4 and 14 merely describe wherein the risk indicator is a two-digit number that indicates a probability of unauthorized activity.
Claims 5 and 15 merely describe wherein the risk indicator is assigned based on proprietary knowledge.
Claims 6 and 16 merely describe wherein the risk indicator is further generated based in part on a log-norm scaling of a user's profile against the user's profile.
Claims 7 and 17 merely describe wherein stopping the processed action comprises … holding the processed action if the risk indicator exceeds the predetermined threshold.
Claims 8 and 18 merely describe wherein the queuing of generated alerts includes ordering the generated alerts according to their respective probabilities of unauthorized activity.
Claims 9 and 19 merely describe wherein allowing the processed action comprises … allowing one or more processed actions associated with ones of the generated risk indicators that are below the predetermined threshold.
Claims 10 and 20 merely describe wherein flagging the processed action, comprises flagging for review by an analyst, if the risk indicator is between a first predetermined threshold and a second predetermined threshold.
Claim 22 merely describes wherein … based on at least one charge-off.
Claim 23 merely describes wherein … based on an aggregated sum of previous returns.
Claim 24 merely describes wherein the risk indicator is assigned based on a Virtual Private Network (VPN) indicator.
Claim 27 merely describes wherein the risk indicator is assigned based on at least one signature verification on a check deposit.
Claim 28 merely describes wherein the risk indicator is derived based on a … probability.
Claim 29 merely describes wherein the risk indicator is further generated based in part on a log-norm scaling of a processed action against a plurality of previous processed actions.
Claim 31 merely describes transmitting the generated alerts … associated with a financial institution based on the severity of the corresponding risk indicator to facilitate prioritized processing.
Claim 32 merely describes transmitting each generated alert ….
Claim 33 merely describes … is selected from one of an ATM channel, a mobile channel, or a teller channel.
Claim 34 merely describes wherein the generating includes: computing a … probability that the processed action belongs to a class indicating a likelihood of fraudulent activity; computing a log-normal probability density score based on a deposit amount associated with the processed action, wherein computing the log-normal probability density score includes using a first parameter and a second parameter; and computing a probability value indicative of whether the processed action is an unauthorized action, wherein the probability value is used to generate the risk indicator.
Claim 35 merely describes wherein the plurality of inputs include: processed action data, unauthorized device propensity, past statistics, the at least one past return, a user relationship, and unauthorized instrument data.
As for additional elements:
Claims 7, 9, 17 and 19 recite "automatically." These additional elements are recited at a high level of generality such that they amount to no more than mere instructions to apply the exception using a generic computer element. Even in combination these additional elements do not integrate the abstract idea into a practical application and do not amount to significantly more than the abstract idea itself. Therefore, the claim(s) is/are ineligible.
Claims 22 and 23 recite "… the machine learning model is trained …." These additional elements are recited at a high level of generality such that they amount to no more than mere instructions to apply the exception using a generic computer element or generally linking the use of a judicial exception to a particular technological environment or field of use. Even in combination these additional elements do not integrate the abstract idea into a practical application and do not amount to significantly more than the abstract idea itself. Therefore, the claim(s) is/are ineligible.
Claim 28 recites "model." These additional elements are recited at a high level of generality such that they amount to no more than mere instructions to apply the exception using a generic computer element or generally linking the use of a judicial exception to a particular technological environment or field of use. Even in combination these additional elements do not integrate the abstract idea into a practical application and do not amount to significantly more than the abstract idea itself. Therefore, the claim(s) is/are ineligible.
Claim 31 recites "a mobile banking application." These additional elements are recited at a high level of generality such that they amount to no more than mere instructions to apply the exception using a generic computer element. Even in combination these additional elements do not integrate the abstract idea into a practical application and do not amount to significantly more than the abstract idea itself. Therefore, the claim(s) is/are ineligible.
Claim 32 recites "an associated transaction channel device." These additional elements are recited at a high level of generality such that they amount to no more than mere instructions to apply the exception using a generic computer element. Even in combination these additional elements do not integrate the abstract idea into a practical application and do not amount to significantly more than the abstract idea itself. Therefore, the claim(s) is/are ineligible.
Claim 33 recites "the transaction channel device." These additional elements are recited at a high level of generality such that they amount to no more than mere instructions to apply the exception using a generic computer element. Even in combination these additional elements do not integrate the abstract idea into a practical application and do not amount to significantly more than the abstract idea itself. Therefore, the claim(s) is/are ineligible.
Claim 34 recites "model." These additional elements are recited at a high level of generality such that they amount to no more than mere instructions to apply the exception using a generic computer element or generally linking the use of a judicial exception to a particular technological environment or field of use. Even in combination these additional elements do not integrate the abstract idea into a practical application and do not amount to significantly more than the abstract idea itself. Therefore, the claim(s) is/are ineligible.
Claims 3-6, 8, 10, 13-16, 18, 20, 24, 27, 29 and 35 do not recite any additional elements, and accordingly, for the reasons provided above with respect to the independent claims, are not patent eligible.
Therefore, dependent claims 3-10, 13-20, 22-24, 27-29 and 31-35 are not patent eligible.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1, 3, 5, 7-11, 13, 15, 17-21, 23, 27, 28, 31-33 and 35 are rejected under 35 U.S.C. 103 as being unpatentable over Comeaux et al. (U.S. Patent No. 11,669,844), hereafter Comeaux, in view of Petersen et al. (U.S. Patent Application Publication No. 2020/0125725 A1), hereafter Petersen, further in view of Shevyrev et al. (U.S. Patent Application Publication No. 2023/0281629 A1), hereafter Shevyrev, and further in view of Laptiev et al. (U.S. Patent Application Publication No. 2023/0385844 A1), hereafter Laptiev.
Regarding Claims 1, 11 and 21
Comeaux teaches:
receiving, via a network (Fig. 1, 112), information corresponding to a processed action of a user from a transaction channel device; (Fig. 2, 204, 16:40-17:19 "In a next step 204, the alert-generating server receives one or more fraud events from one or more fraud detection devices. … In some instances, the fraud detection devices may be a webserver, a payment server, a network security device …"; 2:31-35 "receiving, by a server, one or more fraud events from one or more fraud detection devices"; 10:21-23; 11:14-20 "the alert-generating server 102 may receive a record of a fraudulent transaction event associated with a user from a system server 106", 12:21-27 "the alert-generating server 102 may monitor or otherwise subscribe to fraudulent and/or authentication events generated and published by the payment server."; claim 1, receiving step; 7:26-28 in conjunction with 14:59-62; (also 5:65-6:30 alert-generating server 102 receives authentication failure event from system server 106); note as per 12:43-13:30 (e.g., 13:15-30), 13:31-14:45 although the fraudulent event may be received from a system server 106, the server 106 may have received it from (interacting with) a user device 110, so that the fraudulent event may also be deemed to be received from user device 110; thus, transaction channel device may be any of 106, 110a or 110b in Fig. 1)
…
encrypting, using the network, the enriched information corresponding to the processed action of the user; (14:46-50; regarding using the network: since the database can be in communication with the alert-generating server 102 and hence the information can be transmitted to the database via the network, therefore under the broadest reasonable interpretation the network is used in the encrypting; alternatively, the "encrypted version [of the events being stored] contain[s] data fields that are associated with a communication channel," thus under the broadest reasonable interpretation the communication channel and hence the network that instantiates the communication channel is used in encrypting the data.; note although 14:46-50 pertains to the fraudulent events and not to the enriched version thereof, it would be obvious to combine embodiments so as to apply the encryption to the enriched version thereof because it would provide for more comprehensive data security)
generating, by a machine learning model executed by the at least one processor (processor of alert-generating server 102, Fig. 1), a risk indicator (alert probability score) that is expressed as a severity associated with unauthorized activity for the processed action of the user, the machine learning model being trained to predict a likelihood of unauthorized activity for the processed action based on a plurality of inputs, the plurality of inputs including at least one past …; (2:26-49, 4:31-5:11, 17:60-18:14, Fig. 2, 210, claim 1 generates alert probability score (risk indicator) based on past actions/events of/associated with user (based on a plurality of inputs including at least one past …); regarding machine learning limitations, note especially 4:42-64 and see also 7:34-50, 8:4-28, 9:7-28)
…;
storing, the generated risk indicator in a database (Fig. 1, 104); (4:40-41, 7:28-30; 14:46-49)
responsive to a determination that the generated risk indicator exceeds a predetermined threshold, generating an alert indicating a probability of an unauthorized action and (2:49-53, 18:21-33, 18:43-50, Fig. 2, 212, claim 1; for context see prior art cited for "generating" step above)
transmitting the alert to the transaction channel device associated with the processed action; (18:44-19:11 generate alert and transmit corresponding instructions, e.g., "For example, the alert-generating server may transmit the one or more instructions to an administrator device or any other server of the system to cease the execution of a request associated with the fraudulent activity. Subsequently, the alert-generating server may transmit one or more notifications to a user device alerting the user about the fraudulent activity on their account."; claim 4 "transmitting …[alert] notifications to a user device"; note, as per the prior art cited for the receiving step above, the information corresponding to the processed action may be received from server 106 and/or from user device 110; note "the transaction channel device associated with the processed action" is interpreted as being the transaction channel device from which the information corresponding to the processed action is received in the receiving step above11 )
queuing an ordered list of generated alerts in the database, (18:62-19:11, 5:8-11; regarding "in the database": 5:8-9, 14:46-50, 14:59-63, 15:27-29)
wherein the generated alerts are ordered based on severity of the corresponding risk indicator to facilitate prioritized processing; (4:65-67, 18:62-19:11, 5:8-11)
retrieving, by the at least one processor via the network, the processed action from the database based on an order in which the alert is placed in the ordered list; and (5:8-11, 14:59-15:3)
…
generating a risk result (instructions) from the machine learning model to determine whether the processed action is determined to be unauthorized, wherein the generated risk result includes the at least one processor: (2:53-58, 18:51-19:11, Fig. 2, 214, claim 1)
… automatically stopping, at the transaction channel device, the processed action; (2:53-58, 5:5-8, 18:43-19:11, Fig. 2, 214, claims 1, 3)
…;
or … automatically allowing, at the transaction channel device, the processed action. (18:33-42)
Comeaux does not explicitly disclose but Petersen teaches:
enriching, using the network, the information in real time by appending to the information at least one of transactional data, customer characteristic data, or historical data associated with a user account associated with the user to form enriched information; (0004, 0006, 0010, 0029, 0032, 0060, 0067, 0086, and 0090 teach enriching log message data (e.g., re financial transaction) by appending thereto an identity profile key or identity profile information during processing; note the identity profile key (or per 0032 identity profile information) appended is customer characteristic data; note although Petersen 0007 initially presents transmission of an email as an exemplary occurrence (event) triggering generation of a log message, per 0041 the event/ occurrence can also be a financial transaction (see 0036 for clarification of the term "baseline behavior"); regarding in real time: the appending of the key occurs during the processing of the transaction, hence in real time)
It would have been obvious to one of ordinary skill in the art not later than the effective filing date of the claimed invention to have modified Comeaux's systems and methods for detecting and preventing fraudulent events, by incorporating therein these teachings of Petersen regarding enriching log message data (e.g., re financial transaction) by appending thereto an identity profile key or identity profile information during processing, because Petersen's teachings represent a known way of accessing user profile information that is to be used in conjunction with information about an event (e.g., a triggering event) in order to determine whether the event information represents fraudulent activity, and this (Petersen's) way of accessing user profile information either (i) can be substituted for Comeaux's way of doing the same, MPEP 2143.I.B., or (ii) is just another way of describing Comeaux's way of doing the same. Comeaux's way of doing the same is presented, e.g., as Fig. 2, 206, as described at 17:20-35: "In a next step 206, the alert-generating server determine a user identifier associated with a fraud event of the one or more fraud events based on the data associated with the fraudulent activity. The data associated the fraudulent activity may include details such as money transfers or transaction requests, account identifiers, user identifiers, a timestamp, an amount of money at issue, location of event, and source device identifier. Based on the data, the alert-generating server generate a query using the data as inputs, and transmit the query to a database to determine identification details of a user whose account is undergoing a fraudulent activity. Upon obtaining the identification details of the user, in a next step 208, the alert-generating server may determine an alert-generation model applicable to the fraud event based on the identification information of the user associated with the fraud event." Note Petersen 0010, 0029, 0060, 0067 suggests there are other equivalents or substitutions that can be performed instead of his appending of information, for example, associating the information, e.g., via a table. These equivalents/substitutions are the same as or similar to Comeaux's teachings on this point, e.g., 17:20-35 (set forth above), 10:21-50, 11:26-32, 16:11-24 and 16:53-17:6. Thus, Petersen's teachings may be combined with Comeaux as a substitution, MPEP 2143.I.B., or Petersen is merely making explicit what Comeaux already teaches.
Comeaux in view of Petersen does not explicitly disclose but Shevyrev teaches:
… return; (Abstract, 0017, 0024 (“historical returned … checks”), Fig. 4 (described at 0076-0082) system trains machine learning model (Fig. 4, 308) to predict fraudulent check deposit based on training features (Fig. 4, 402) including historical returned checks (Fig. 4, 404f))
It would have been obvious to one of ordinary skill in the art not later than the effective filing date of the claimed invention to have modified the combination of Comeaux's systems and methods for detecting and preventing fraudulent events,
as modified by Petersen's teachings regarding enriching log message data (e.g., re financial transaction) by appending thereto an identity profile key or identity profile information during processing, by incorporating therein these teachings of Shevyrev, specifically, identifying returns as a risk factor (the machine learning (ML) model being trained to predict a likelihood of unauthorized activity for the processed action based on inter alia a past return), because Comeaux teaches training the ML model based on a “behavior profile of the user based on … financial data of the user that may include … credit score [and] any known flag for activity [sic] or known fraud” (9:58-63), and Shevyrev teaches that returns is a known flag for fraud (see citations given above). Therefore, although Comeaux does not explicitly/specifically mention returns, Comeaux effectively includes returns as a risk factor for predicting likelihood of fraud. Therefore, Shevyrev’s teachings are effectively within the scope of Comeaux, and Shevyrev is merely making explicit what Comeaux teaches. Likewise, for this reason Shevyrev is aligned with Comeaux in approach and may be understood as complementing Comeaux / making Comeaux more comprehensive/complete. As such, by explicitly including/naming this additional risk factor of returns, Shevyrev serves to make Comeaux more comprehensive, robust, and accurate, see Comeaux, 1:23-56 (“organizations that are especially vulnerable to fraudulent activity, such as the banking and insurance industries, need tools to detect, investigate, analyze, and prevent fraud as accurately and efficiently as possible … Based on the afore-mentioned reasons, it is clear that the current fraud analytics techniques are neither efficient nor accurate enough.”), see Shevyrev, 0001-0003 (“Without more granular identification capabilities, conventional network-transaction-security systems perpetuate inaccuracies of check-return identification” (0003)), MPEP 2143.I.B.,G.
As set forth above, Comeaux teaches if the probability alert score exceeds a certain threshold then stopping the action (a first risk result/outcome), and if the probability alert score does not exceed a certain threshold then allowing the action (a second risk result/outcome), but Comeaux (in view of Petersen) does not explicitly disclose a third, intermediate risk result/outcome of flagging the action for review (if the probability alert score falls between a first threshold and a second threshold, or represents an intermediate level of risk), and Comeaux (in view of Petersen) does not explicitly disclose an intermediate step of assigning the fraudulent event, based on its score, to a category (high, medium or low risk), and then executing the risk result/outcome responsive to the category assignment. However, Shevyrev teaches:
assigning, based on the generated risk indicator, the processed action to one of the following: a low-risk category, a medium-risk category, or a high-risk category; and generating a risk result from the machine learning model to determine whether the processed action is determined to be unauthorized, wherein the generated risk result includes the at least one processor: responsive to assignment to the high-risk category, automatically stopping (Fig. 3, 316), at the transaction channel device, the processed action; responsive to assignment to the medium-risk category, flagging (Fig. 3, 312), at the transaction channel device, the processed action for review; or responsive to assignment to the low-risk category, automatically allowing (Fig. 3, 314), at the transaction channel device, the processed action. (0019-0020, 0024, Fig. 3, 312, 314, 316, 0064, 0066-0069, 0072-0075; e.g., 0064 check-return machine-learning model 308 generates a check-return prediction score 310; 0067 check-return prediction score is compared to thresholds or ranges of thresholds; if score satisfies first threshold (range), the transaction is approved 314 (allowed); if score satisfies second threshold (range), the transaction is suspended 312 (flagged for review); if score satisfies third threshold (range), the transaction is denied 316 (stopped); 0069 suspending the transaction may constitute invoking and performing a verification process, such as human review (flagging the processed action for review); the foregoing actions of approval 314, suspension 312 and denial 316 constitute the recited risk results; 0066 regarding the triggering/performance of one of acts 312, 314 and 316 based on comparing the score to the threshold as described in 0067, the three threshold ranges (first, second, and third), which trigger/dictate performing the three acts 314, 312, 316, respectively, are described in 0066 as: "the mobile check deposit system 102 performs the act 314 based on a low check-return prediction score indicating a low-risk or low probability of a check-return. In contrast, the mobile check deposit system 102 can perform the act 316 based on a high check-return prediction score indicating a high-risk or high probability of a check-return. Alternatively, the mobile check deposit system 102 can perform the act 312 based on a medium check-return prediction score indicating a medium-risk or medium probability of a check-return." – that is, each score range indicates a degree/category of risk: a low score range indicates a low risk, a high score range indicates a high risk, a medium score range indicates a medium risk; this is just to say that, based on the score, the transaction is assigned to a risk category (high, medium, or low); therefore, the acts 312, 314, 316 are performed both responsive to the score and responsive to the risk category (risk level) assignment)
It would have been obvious to one of ordinary skill in the art not later than the effective filing date of the claimed invention to have modified the combination of Comeaux's systems and methods for detecting and preventing fraudulent events, as modified by Petersen's teachings regarding enriching log message data (e.g., re financial transaction) by appending thereto an identity profile key or identity profile information during processing, by incorporating therein these teachings of Shevyrev (specifically, substituting Shevyrev’s tripartite decision/outcome structure including a risk level categorization step for Comeaux's bipartite decision/outcome structure without a risk level categorization step) because it provides for more nuanced/fine-tuned decision-making/outcomes, thereby increasing accuracy, e.g., providing for more thorough review/analysis where the probability of fraud lies in an intermediate range, and thus preventing more fraud. See Shevyrev, 0001-0003 (“Without more granular identification capabilities, conventional network-transaction-security systems perpetuate inaccuracies of check-return identification” (0003)), 0069 (“By suspending [flagging] the transfer of funds to the recipient account, the mobile check deposit system 102 can avoid a risk of loss to a financial institution and/or a check maker account.”), see Comeaux, 1:23-56 (“organizations that are especially vulnerable to fraudulent activity, such as the banking and insurance industries, need tools to detect, investigate, analyze, and prevent fraud as accurately and efficiently as possible … Based on the afore-mentioned reasons, it is clear that the current fraud analytics techniques are neither efficient nor accurate enough.”), MPEP 2143.I.A.,B.,C.,D.,G.
Comeaux in view of Petersen and Shevyrev does not explicitly disclose the entirety of the limitations set forth below. However, Laptiev teaches:
determining, by the at least one processor, a model fit representing how accurately the machine learning model adapts to the plurality of inputs; (0123-0134, with reference to Fig. 9; e.g., 0123, 0128-0134, Fig. 9, 910 model fitting)
tuning, by the at least one processor, a currently generated risk indicator using information associated with one or more previously generated risk indicators (0125, Fig. 9, 912) retained by the machine learning model; (0123-0134, with reference to Fig. 9; e.g., 0126-0127 loss function 918 compares likelihood of approval score 912 with approval/denial label 916 (0124 ground truth) to yield the "difference between" 912 and 916 (0127), which is also referred to as the "error or measure of loss" (0126); inasmuch as 918 uses 912 and 916, 912 and 916 are retained by the machine learning model; as per the model fitting operations described in 0128-0134, the score 912 generated/outputted in a subsequent iteration (currently generated risk indicator) is improved/adjusted (tuned) relative to prior iterations, and this generation/outputting of the score 912 in the subsequent iteration uses scores 912 and labels 916 generated in prior iterations (using information associated with one or more previously generated risk indicators): this improving/adjusting of 912 (tuning of the risk indicator) brought about through the model fitting operations is expressed/ taught in particular at 0128 ("For instance, the provisional credit determination system 102 performs modifications or adjustments to the dispute-evaluator machine-learning model 904 to reduce the measure of loss from the loss function 918 for a subsequent training iteration." – note the reduction of the measure of loss, i.e., the reduction of the difference between 912 and 916, indicates that 912 has been adjusted/improved (tuned)); 0132 ("Thus, over multiple iterations, the provisional credit determination system 102 improves the accuracy of the dispute-evaluator machine-learning model 904" – improving the accuracy of the model means that the accuracy of the output, namely, 912, has been improved, thus 912 has been adjusted/improved (tuned)); 0133 ("The provisional credit determination system 102 repeats this process until the dispute-evaluator machine-learning model 904 generates training likelihood of approval scores [912] that result in likelihood of approval scores [912] that satisfy a threshold measure of loss." – i.e., the scores 912 have been adjusted/improved (tuned) to the point that they satisfy the threshold measure of loss, that is, presumably, a magnitude of loss that is desirably small, reflecting improved accuracy of the outputted scores).)
It would have been obvious to one of ordinary skill in the art not later than the effective filing date of the claimed invention to have modified the combination of Comeaux's systems and methods for detecting and preventing fraudulent events,
as modified by Petersen's teachings regarding enriching log message data (e.g., re financial transaction) by appending thereto an identity profile key or identity profile information during processing, and as further modified by Shevyrev's teachings regarding (i) identifying returns as a risk factor and (ii) a tripartite decision/outcome structure including explicit high/medium/low risk level categorization (both as explained above), by incorporating therein these teachings of Laptiev regarding a model fit and tuning risk scores (model outputs) based on previous risk scores, because Laptiev's teachings are consistent with Comeaux's approach of improving performance by retraining/tuning but provide a more comprehensive account of such retraining/tuning and as such would further improve model performance/results (Laptiev's more comprehensive teachings may be substituted for Comeaux's teachings in this regard, so as to effectively fill any gaps in Comeaux's teachings), MPEP 2143.I.A.,B.,C.,D.
Note, alternatively to Laptiev's teachings set forth above, the step of "tuning, by the at least one processor, a currently generated risk indicator using information associated with one or more previously generated risk indicators retained by the machine learning model" is also taught by Shevyrev (0072-0073 (retaining previously generated risk indicators) and 0080-0081, Fig. 4; these teachings of Shevyrev are combinable with the heretofore combination based on the same rationale as given above for combining Laptiev).
Regarding Claims 3 and 13
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claims 1 and 11 as set forth above. Comeaux further teaches:
wherein the alert is generated at a set interval to periodically monitor and detect for unauthorized activity. (4:67-5:4; 7:26-50)
Regarding Claims 5 and 15
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claims 1 and 11 as set forth above. Comeaux further teaches:
wherein the risk indicator is assigned based on proprietary knowledge. (As per Fig. 2 (or, e.g., 2:26-62), score (indicator) is determined (210) based on model (208), which in turn is based on user profile (202), where user profile (9:29-10:20) includes personal data, financial data and social network data, at least some of which data is proprietary knowledge, e.g., social security number, mother's maiden name and place of birth, GUID, account balance, credit score)
Regarding Claim 7 and 17
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claims 1 and 11 as set forth above. Comeaux further teaches:
wherein stopping the processed action comprises automatically holding the processed action if the risk indicator exceeds the predetermined threshold. (2:53-58, 5:5-8,18:43-19:11, Fig. 2, 214, claims 1, 3)
Note: Shevyrev (0066-0067, 0074-0075) also teaches claims 7 and 17.
Regarding Claims 8 and 18
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claims 1 and 11 as set forth above. Comeaux further teaches:
wherein the queuing of generated alerts includes ordering the generated alerts according to their respective probabilities of unauthorized activity. (4:65-67, 18:62-19:11, 5:8-11)
Regarding Claims 9 and 19
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claims 1 and 11 as set forth above. Comeaux further teaches:
wherein allowing the processed action comprises automatically allowing one or more processed actions associated with ones of the generated risk indicators that are below the predetermined threshold. (2:53-58, 18:33-42)
Note: Shevyrev (0066-0067, 0074-0075) also teaches claims 9 and 19.
Note regarding the use of the plural "ones of the generated indicators," if the plurality is deemed not taught by Comeaux or Shevyrev, then it is obvious based on MPEP 2144.04.VI.B. (Duplication of Parts).
Regarding Claims 10 and 20
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claims 1 and 11 as set forth above. Shevyrev further teaches:
wherein flagging the processed action, comprises flagging for review by an analyst, if the risk indicator is between a first predetermined threshold and a second predetermined threshold. (0066-0067, 0074-0075)
It would have been obvious to one of ordinary skill in the art not later than the effective filing date of the claimed invention to have modified the combination of Comeaux's systems and methods for detecting and preventing fraudulent events, as modified by Petersen's teachings regarding enriching log message data (e.g., re financial transaction) by appending thereto an identity profile key or identity profile information during processing, as further modified by Shevyrev's teachings regarding (i) identifying returns as a risk factor and (ii) a tripartite decision/outcome structure including explicit high/medium/low risk level categorization, and as further modified by Laptiev's teachings regarding a model fit and tuning risk scores (model outputs) based on previous risk scores, by incorporating therein these further teachings of Shevyrev regarding holding a transaction based on a threshold, because it provides for more nuanced/fine-tuned decision-making/outcomes, thereby increasing accuracy, e.g., providing for more thorough review/analysis where the probability of fraud lies in an intermediate range, and thus preventing more fraud. See Shevyrev, 0001-0003 (“Without more granular identification capabilities, conventional network-transaction-security systems perpetuate inaccuracies of check-return identification” (0003)), 0069 (“By suspending [flagging] the transfer of funds to the recipient account, the mobile check deposit system 102 can avoid a risk of loss to a financial institution and/or a check maker account.”), see Comeaux, 1:23-56 (“organizations that are especially vulnerable to fraudulent activity, such as the banking and insurance industries, need tools to detect, investigate, analyze, and prevent fraud as accurately and efficiently as possible … Based on the afore-mentioned reasons, it is clear that the current fraud analytics techniques are neither efficient nor accurate enough.”), MPEP 2143.I.A.,B.,C.,D.,G.
Regarding Claim 23
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claim 1 as set forth above. Shevyrev further teaches:
wherein the machine learning model is trained based on an aggregated sum of previous returns. (0024 "combinations of … historical returned … checks"; 0077, Table 1 "(returned_checks_total_amount) Total amount … of returned checks")
It would have been obvious to one of ordinary skill in the art not later than the effective filing date of the claimed invention to have modified the combination of Comeaux's systems and methods for detecting and preventing fraudulent events, as modified by Petersen's teachings regarding enriching log message data (e.g., re financial transaction) by appending thereto an identity profile key or identity profile information during processing, as further modified by Shevyrev's teachings regarding (i) identifying returns as a risk factor and (ii) a tripartite decision/outcome structure including explicit high/medium/low risk level categorization, and as further modified by Laptiev's teachings regarding a model fit and tuning risk scores (model outputs) based on previous risk scores, by incorporating therein these further teachings of Shevyrev regarding an aggregated sum of previous returns as a fraud risk factor, because this is a known fraud risk factor, and accordingly the incorporation of these further teachings of Shevyrev would cause the heretofore combination to take into account a greater range of known fraud risk factors, and thus would render the heretofore combination more comprehensive, robust and accurate, see Comeaux, 1:23-56 (“organizations that are especially vulnerable to fraudulent activity, such as the banking and insurance industries, need tools to detect, investigate, analyze, and prevent fraud as accurately and efficiently as possible … Based on the afore-mentioned reasons, it is clear that the current fraud analytics techniques are neither efficient nor accurate enough.”), see Shevyrev, 0001-0003 (“Without more granular identification capabilities, conventional network-transaction-security systems perpetuate inaccuracies of check-return identification” (0003)), MPEP 2143.I.A.,G.
Regarding Claim 27
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claim 1 as set forth above. Shevyrev further teaches:
wherein the risk indicator is assigned based on at least one signature verification on a check deposit. (per Abstract, 0006, 0017, features are used to predict fraudulent check deposit, hence features constitute risk indicators; per Fig. 3, 304a, 0055-0056, features include check features 304a, which include signature/signature analysis)
It would have been obvious to one of ordinary skill in the art not later than the effective filing date of the claimed invention to have modified the combination of Comeaux's systems and methods for detecting and preventing fraudulent events, as modified by Petersen's teachings regarding enriching log message data (e.g., re financial transaction) by appending thereto an identity profile key or identity profile information during processing, as further modified by Shevyrev's teachings regarding (i) identifying returns as a risk factor and (ii) a tripartite decision/outcome structure including explicit high/medium/low risk level categorization, and as further modified by Laptiev's teachings regarding a model fit and tuning risk scores (model outputs) based on previous risk scores, by incorporating therein these further teachings of Shevyrev regarding signature verification in light of forgery being a risk factor, because forgery is a known risk factor and signature verification is a known fraud detection/preventive measure to address forgery, and accordingly these further teachings of Shevyrev would cause the heretofore combination to take into account a greater range of known fraud risk factors, and thus would render the heretofore combination more comprehensive, robust and accurate, see Comeaux, 1:23-56 (“organizations that are especially vulnerable to fraudulent activity, such as the banking and insurance industries, need tools to detect, investigate, analyze, and prevent fraud as accurately and efficiently as possible … Based on the afore-mentioned reasons, it is clear that the current fraud analytics techniques are neither efficient nor accurate enough.”), see Shevyrev, 0001-0003 (“Without more granular identification capabilities, conventional network-transaction-security systems perpetuate inaccuracies of check-return identification” (0003)), 0006, MPEP 2143.I.A.,G.
Regarding Claim 28
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claim 1 as set forth above. Comeaux further teaches:
wherein the risk indicator is derived based on a model probability. (7:34-50, Fig. 2, 210, 2:43-49, 4:46-52 alert probability score determined by/based on model)
Regarding Claim 31
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claim 1 as set forth above. Comeaux further teaches:
transmitting the generated alerts to a mobile banking application associated with a financial institution based on the severity of the corresponding risk indicator to facilitate prioritized processing. (18:44-19:11 generate alert and transmit corresponding instructions, e.g., "For example, the alert-generating server may transmit the one or more instructions to an administrator device or any other server of the system to cease the execution of a request associated with the fraudulent activity. Subsequently, the alert-generating server may transmit one or more notifications to a user device alerting the user about the fraudulent activity on their account."; claim 4 "transmitting …[alert] notifications to a user device"; 15:30 "The administrator device 108 GUI may receive alerts"; 15:18-44 "administrator device 108 may be … smartphones," which have software and receive the alerts (one of ordinary skill in the art understands that a smartphone performs operations via mobile application(s)); as per, e.g., 2:19-20 ("In a fraud detection context within a financial institution enterprise network"), 1:26 ("banking"), 11:64-12:3 ("A system server 106 such as a payment server may be a server computer associated with a payment or transaction system that conducts payment or transactions operated by payment services systems, such as the Society for Worldwide Interbank Financial Telecommunication (SWIFT), Fedwire, and the Automated Clearing House (ACH), among others"), and 7:6-10 (ATM scenario), the administrator device and its applications are associated with financial institution, e.g., a bank, and hence, under broadest reasonable interpretation, teach a banking application; 4:65-5:11, 18:51-19:11 sorting alerts based on fraud probability score (priority) and presenting alerts to administrator device in order of this priority (based on the severity of the corresponding risk indicator to facilitate prioritized processing) (under broadest reasonable interpretation, the value of the score teaches severity of the corresponding risk indicator))
Regarding Claim 32
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claim 1 as set forth above. Comeaux further teaches:
transmitting each generated alert to an associated transaction channel device. (18:44-19:11 generate alert and transmit corresponding instructions, e.g., "For example, the alert-generating server may transmit the one or more instructions to an administrator device or any other server of the system to cease the execution of a request associated with the fraudulent activity. Subsequently, the alert-generating server may transmit one or more notifications to a user device alerting the user about the fraudulent activity on their account."; claim 4 "transmitting …[alert] notifications to a user device"; 15:30 "The administrator device 108 GUI may receive alerts")
Regarding Claim 33
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claim 1 as set forth above. Comeaux further teaches:
wherein the transaction channel device is selected from one of an ATM channel, a mobile channel, or a teller channel. (15:23-25 administrator/analyst device 108, which receives alert (see claim 32 above), may be smartphone (mobile channel); 14:20-22 user device 110, which receives alert (see claim 32 above), may be cellular telephone/smartphone (mobile channel); regarding ATM channel and teller channel: 7:1-25 indicates fraudulent transaction event (e.g., suspicious ATM money withdrawal) may come from ATM; per 7:26-28 alert-generating server 102 receives such events ("data associated with the scenario model") from database, which per 14:46-62 receives such fraudulent events; in this scenario, one of ordinary skill in the art understands that the fraudulent transaction event comes ultimately from the ATM, thus teaching an ATM channel and, under broadest reasonable interpretation -- since an ATM is an automated teller machine -- a teller channel)
Regarding Claim 35
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claim 1 as set forth above. Comeaux further teaches:
wherein the plurality of inputs include: processed action data, unauthorized device propensity, past statistics, …, a user relationship, and unauthorized instrument data. (Regarding processed action data: e.g., per 8:4-20 training data (plurality of inputs) includes attributes including "number of transactions per month, time and date associated with transactions, amount of transactions" (8:18-19); regarding unauthorized device propensity: e.g., per 8:4-20 training data (plurality of inputs) includes attributes including "number of login attempts" (8:17-18); per 10:32-33 input data, hence also training data (plurality of inputs), of fraudulent events includes "remote network logon logs of a user for suspicious access attempts"; per 10:54-11:13 input data, hence also training data (plurality of inputs), of fraudulent events includes multiple failed authentication attempts; the number of log-in attempts/failed authentication events indicates the likelihood that the login/authentication attempt is by an unauthorized device (unauthorized device propensity); regarding past statistics: e.g., per 8:4-20 training data (plurality of inputs) includes attributes including "number of login attempts, number of transactions per month, time and date associated with transactions, amount of transactions" (8:18-19); 10:62-11:35 "historical data" is input to alert-generation model, hence also used as training data (plurality of inputs); 13:23-26; regarding a user relationship: per 19:19-35 the behavior profile is used as training data (plurality of inputs); per 9:29-37 the behavior profile includes "user social network data" (9:37) which, in turn, per 9:64-10:3 includes "number and types of relationships of the user"; regarding unauthorized instrument data: per 11:14-15 "the alert-generating server 102 may receive a record of a fraudulent transaction event associated with a user from a system server 106"; this fraudulent event data may include "account identifiers" (11:62), data indicating that "a user [opened] multiple new accounts" (which data would include account numbers) (13:17-18), data indicating "account takeover fraud," including stolen "account access credentials such as username, password, PIN, etc. … account identifiers"; under broadest reasonable interpretation, account identifiers/numbers teaches instrument data; finally, note also that behavior profile may include "any known flag for activity or known fraud" (9:62-63))
Shevyrev further teaches:
wherein the plurality of inputs include: … the at least one past return …. (Abstract, 0017, 0024 (“historical returned … checks”), Fig. 4 (described at 0076-0082) system trains machine learning model (Fig. 4, 308) to predict fraudulent check deposit based on training features (Fig. 4, 402) including historical returned checks (Fig. 4, 404f))
Note: this limitation taught by Shevyrev is the same as the corresponding limitation in base claim 1 taught by Shevyrev. Accordingly, the motivation/rationale for combining this teaching of Shevyrev with the combination of other references is the same as the motivation/rationale given for this limitation in claim 1 above.
Claims 4 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Comeaux et al. (U.S. Patent No. 11,669,844), hereafter Comeaux, in view of Petersen et al. (U.S. Patent Application Publication No. 2020/0125725 A1), hereafter Petersen, further in view of Shevyrev et al. (U.S. Patent Application Publication No. 2023/0281629 A1), hereafter Shevyrev, further in view of Laptiev et al. (U.S. Patent Application Publication No. 2023/0385844 A1), hereafter Laptiev, and further in view of Abifaker et al. (U.S. Patent Application Publication No. 2015/0278817 A1), hereafter Abifaker.
Regarding Claims 4 and 14
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claims 1 and 11 as set forth above. Comeaux in view of Petersen, Shevyrev, and Laptiev does not explicitly disclose but Abifaker teaches:
wherein the risk indicator is a two-digit number that indicates a probability of unauthorized activity. (Fig. 3, 0067-0070)
It would have been obvious to one of ordinary skill in the art not later than the effective filing date of the claimed invention to have modified the combination of Comeaux's systems and methods for detecting and preventing fraudulent events, as modified by Petersen's teachings regarding enriching log message data (e.g., re financial transaction) by appending thereto an identity profile key or identity profile information during processing, as further modified by Shevyrev's teachings regarding (i) identifying returns as a risk factor and (ii) a tripartite decision/outcome structure including explicit high/medium/low risk level categorization, and as further modified by Laptiev's teachings regarding a model fit and tuning risk scores (model outputs) based on previous risk scores, by incorporating therein these teachings of Abifaker because, even though Comeaux does not specify the format of the alert probability score (indicator), inasmuch as Comeaux requires that this score be compared to a threshold, this score necessarily has numeric content (e.g., this score is a number or some other quantifier/metric), and thus Abifaker's teachings merely flesh out (an example of) implementation detail necessary for Comeaux's invention to be operable. Note that the particular format of the score/indicator, as a two-digit number or as another quantifier/metric, is obvious based on MPEP 2144.07 (selection of format, viz., two-digit number, known in the prior art (e.g., Abifaker) to be suitable for performing the same function in the same/similar context (Comeaux)), 2144.06 (use of format, viz., two-digit number, known in prior art to be useful for same purpose; substitution of equivalents), 2144.04.I (design choice).
Claims 6, 16, 29 and 34 are rejected under 35 U.S.C. 103 as being unpatentable over Comeaux et al. (U.S. Patent No. 11,669,844), hereafter Comeaux, in view of Petersen et al. (U.S. Patent Application Publication No. 2020/0125725 A1), hereafter Petersen, further in view of Shevyrev et al. (U.S. Patent Application Publication No. 2023/0281629 A1), hereafter Shevyrev, further in view of Laptiev et al. (U.S. Patent Application Publication No. 2023/0385844 A1), hereafter Laptiev, and further in view of Pavlovic ("Log-normal Distribution - A simple explanation”).
Regarding Claims 6 and 16
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claims 1 and 11 as set forth above. Comeaux further teaches
wherein the risk indicator (alert probability score) is further generated based in part on … a user's profile (behavior profile of a user) … the user's profile. (2:26-62 generates alert probability score (2:44) based on alert generation model (2:46) which is based on a behavior profile of a user (2:26-31); 9:29-1020 describes the behavior profile)
Comeaux in view of Petersen, Shevyrev, and Laptiev does not explicitly disclose but Pavlovic teaches:
… a log-norm scaling of … against …. (Note Applicant’s specification (0045) defines “log-norm scaling” thus: “Log-norm scaling may refer to applying a logarithmic transformation to values, which transforms the values onto a scale that approximates the normality”; Pavlovic, p. 3, teaches the same thing: “Let’s say your data [values] fits a log-normal distribution. If you then take the logarithm of [applying a logarithmic transformation to] all your data points [values], the newly transformed [logarithmically transformed] points [values] will now fit a normal distribution [a scale that approximates the normality].”)
It would have been obvious to one of ordinary skill in the art not later than the effective filing date of the claimed invention to have modified the combination of Comeaux's systems and methods for detecting and preventing fraudulent events, as modified by Petersen's teachings regarding enriching log message data (e.g., re financial transaction) by appending thereto an identity profile key or identity profile information during processing, as further modified by Shevyrev's teachings regarding (i) identifying returns as a risk factor and (ii) a tripartite decision/outcome structure including explicit high/medium/low risk level categorization, and as further modified by Laptiev's teachings regarding a model fit and tuning risk scores (model outputs) based on previous risk scores, by incorporating therein these teachings of Pavlovic regarding log-norm scaling, because this is a known way to model various natural phenomena, see Pavlovic, p. 1, and has particular advantages under certain circumstances applicable to the combination, e.g., where the data cannot be negative, (e.g., data such as a probability of fraud / a risk value), where the data skews positive, with most values clustered near the low end and a long tail extending rightward to occasional high outliers (e.g., transaction data, which comprises mostly non-fraudulent transactions and a relatively small amount of fraudulent transactions), and where the data grows multiplicatively/cumulatively (e.g., a plurality of historical transaction data) -- by transforming such data with a logarithm, it can be normalized, allowing for easier analysis with powerful standard statistical techniques, such as calculating z-scores, performing linear regression, estimating parameters using Maximum Likelihood Estimation (MLE), etc.
Regarding Claim 29
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claim 1 as set forth above. Comeaux further teaches
wherein the risk indicator (alert probability score) is further generated based in part on … the processed action … a plurality of previous processed actions. (11:26-32 alert-generating server 102 evaluates the event (the processed action) to determine (generate) alert probability score (risk indicator) by using a model with (based in part on) historical data (plurality of previous processed actions); note that Comeaux's "historical data" (11:29-30) can be financial data (processed actions), because, as per 9:58-63, 16:11-24 (note the language: "financial data," e.g., "events" such as "transfer funds," etc.), the behavior profile (user data) used with the model to determine the alert probability score can include historical financial data)
Comeaux in view of Petersen, Shevyrev, and Laptiev does not explicitly disclose but Pavlovic teaches:
… a log-norm scaling of … against …. (Note Applicant’s specification (0045) defines “log-norm scaling” thus: “Log-norm scaling may refer to applying a logarithmic transformation to values, which transforms the values onto a scale that approximates the normality”; Pavlovic, p. 3, teaches the same thing: “Let’s say your data [values] fits a log-normal distribution. If you then take the logarithm of [applying a logarithmic transformation to] all your data points [values], the newly transformed [logarithmically transformed] points [values] will now fit a normal distribution [a scale that approximates the normality].”)
It would have been obvious to one of ordinary skill in the art not later than the effective filing date of the claimed invention to have modified the combination of Comeaux's systems and methods for detecting and preventing fraudulent events, as modified by Petersen's teachings regarding enriching log message data (e.g., re financial transaction) by appending thereto an identity profile key or identity profile information during processing, as further modified by Shevyrev's teachings regarding (i) identifying returns as a risk factor and (ii) a tripartite decision/outcome structure including explicit high/medium/low risk level categorization, and as further modified by Laptiev's teachings regarding a model fit and tuning risk scores (model outputs) based on previous risk scores, by incorporating therein these teachings of Pavlovic regarding log-norm scaling, because this is a known way to model various natural phenomena, see Pavlovic, p. 1, and has particular advantages under certain circumstances applicable to the combination, e.g., where the data cannot be negative, (e.g., data such as a probability of fraud / a risk value), where the data skews positive, with most values clustered near the low end and a long tail extending rightward to occasional high outliers (e.g., transaction data, which comprises mostly non-fraudulent transactions and a relatively small amount of fraudulent transactions), and where the data grows multiplicatively/cumulatively (e.g., a plurality of historical transaction data) -- by transforming such data with a logarithm, it can be normalized, allowing for easier analysis with powerful standard statistical techniques, such as calculating z-scores, performing linear regression, estimating parameters using Maximum Likelihood Estimation (MLE), etc.
Regarding Claim 34
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claim 1 as set forth above. Shevyrev further teaches:
wherein the generating includes: computing a model probability that the processed action belongs to a class indicating a likelihood of fraudulent activity; (0018 "In particular embodiments, the check-return machine-learning model generates a check-return prediction indicating a probability that the mobile check deposit corresponds to a certain class of mobile check deposit fraud (e.g., altered checks, forged checks, duplicate checks, etc.)."; see also 0029 and 0044 for similar teachings and 0003 for background)
computing a … probability … score based on a deposit amount associated with the processed action, …; and (0017, 0051, 0055, 0061, 0077, Table 1 (e.g., "mobile check deposit amount" and numerous other deposit amounts), all teaching deposit amount as an input feature/factor for generating a fraud probability score for the transaction)
computing a probability value indicative of whether the processed action is an unauthorized action, wherein the probability value (feature scores) is used to generate the risk indicator (check-return prediction score 310 comprising an aggregate of the feature scores). (0064 "In particular embodiments, the check-return machine-learning model 308 generates the check-return prediction score 310 [risk indicator] composed of or based on feature scores [probability value] (e.g., that indicate particular check-return scores for different features identified at the act 304). For instance, the check-return prediction score 310 may include an aggregate of the feature scores.")
It would have been obvious to one of ordinary skill in the art not later than the effective filing date of the claimed invention to have modified the combination of Comeaux's systems and methods for detecting and preventing fraudulent events, as modified by Petersen's teachings regarding enriching log message data (e.g., re financial transaction) by appending thereto an identity profile key or identity profile information during processing, as further modified by Shevyrev's teachings regarding (i) identifying returns as a risk factor and (ii) a tripartite decision/outcome structure including explicit high/medium/low risk level categorization, and as further modified by Laptiev's teachings regarding a model fit and tuning risk scores (model outputs) based on previous risk scores, by incorporating therein these further teachings of Shevyrev regarding (a) computing a probability of belonging to a class indicating likely fraud, (b) including deposit amount as a feature for generating a probability score, and (c) computing a probability of fraud based on feature scores (probability values), because (a) and (b) represent known fraud risk factors, and accordingly the incorporation of these further teachings of Shevyrev would cause the heretofore combination to take into account a greater range of known fraud risk factors, and thus would render the heretofore combination more comprehensive, robust and accurate, see Comeaux, 1:23-56 (“organizations that are especially vulnerable to fraudulent activity, such as the banking and insurance industries, need tools to detect, investigate, analyze, and prevent fraud as accurately and efficiently as possible … Based on the afore-mentioned reasons, it is clear that the current fraud analytics techniques are neither efficient nor accurate enough.”), see Shevyrev, 0001-0003 (“Without more granular identification capabilities, conventional network-transaction-security systems perpetuate inaccuracies of check-return identification” (0003)), MPEP 2143.I.A.,G., and because (c) represents a more granular/thorough determination of likelihood of fraud, thereby increasing accuracy/ precision, see Shevyrev, 0001-0003 (“Without more granular identification capabilities, conventional network-transaction-security systems perpetuate inaccuracies of check-return identification” (0003)), see Comeaux, 1:23-56 (“organizations that are especially vulnerable to fraudulent activity, such as the banking and insurance industries, need tools to detect, investigate, analyze, and prevent fraud as accurately and efficiently as possible … Based on the afore-mentioned reasons, it is clear that the current fraud analytics techniques are neither efficient nor accurate enough.”), MPEP 2143.I.A.,B.,C.,D.,G.
Comeaux in view of Petersen, Shevyrev, and Laptiev does not explicitly disclose a log-normal probability density score but Pavlovic teaches:
computing a log-normal probability density score based on …, wherein computing the log-normal probability density score includes using a first parameter and a second parameter; and (e.g., pp. 1- 3; regarding the recited parameters, see also pp. 4-7)
It would have been obvious to one of ordinary skill in the art not later than the effective filing date of the claimed invention to have modified the combination of Comeaux's systems and methods for detecting and preventing fraudulent events, as modified by Petersen's teachings regarding enriching log message data (e.g., re financial transaction) by appending thereto an identity profile key or identity profile information during processing, as further modified by Shevyrev's teachings regarding (i) identifying returns as a risk factor, (ii) a tripartite decision/outcome structure including explicit high/medium/low risk level categorization, and (iii) (a) computing a probability of belonging to a class indicating likely fraud, (b) including deposit amount as a feature for generating a probability score, and (c) computing a probability of fraud based on feature scores (probability values), and as further modified by Laptiev's teachings regarding a model fit and tuning risk scores (model outputs) based on previous risk scores, by incorporating therein these teachings of Pavlovic regarding a log-norm probability density function, because this is a known way to model various natural phenomena, see Pavlovic, p. 1, and has particular advantages under certain circumstances applicable to the combination, e.g., where the data cannot be negative, (e.g., data such as a probability of fraud / a risk value), where the data skews positive, with most values clustered near the low end and a long tail extending rightward to occasional high outliers (e.g., transaction data, which comprises mostly non-fraudulent transactions and a relatively small amount of fraudulent transactions), and where the data grows multiplicatively/cumulatively (e.g., a plurality of historical transaction data) -- by transforming such data with a logarithm, it can be normalized, allowing for easier analysis with powerful standard statistical techniques, such as calculating z-scores, performing linear regression, estimating parameters using Maximum Likelihood Estimation (MLE), etc.
Claim 22 is rejected under 35 U.S.C. 103 as being unpatentable over Comeaux et al. (U.S. Patent No. 11,669,844), hereafter Comeaux, in view of Petersen et al. (U.S. Patent Application Publication No. 2020/0125725 A1), hereafter Petersen, further in view of Shevyrev et al. (U.S. Patent Application Publication No. 2023/0281629 A1), hereafter Shevyrev, further in view of Laptiev et al. (U.S. Patent Application Publication No. 2023/0385844 A1), hereafter Laptiev, and further in view of Waters et al. (U.S. Patent Application Publication No. 2012/0246047 A1), hereafter Waters.
Regarding Claim 22
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claim 1 as set forth above. Comeaux in view of Petersen, Shevyrev, and Laptiev does not explicitly disclose but Waters teaches:
wherein the machine learning model is trained based on at least one charge-off. (Abstract, 0014, 0037-0039, Fig. 1, 0051, Table 1, 0056, Table 2, risk of fraud is determined (S114) based on metrics calculated (S104, S110) from initial data assessment (S100) and inputs (S108) (performance metrics/KPIs), which include various charge-off data, as per Tables 1 (items 3-4, 58-60) and 2 (items 7-10))
It would have been obvious to one of ordinary skill in the art not later than the effective filing date of the claimed invention to have modified the combination of Comeaux's systems and methods for detecting and preventing fraudulent events, as modified by Petersen's teachings regarding enriching log message data (e.g., re financial transaction) by appending thereto an identity profile key or identity profile information during processing, as further modified by Shevyrev's teachings regarding (i) identifying returns as a risk factor and (ii) a tripartite decision/outcome structure including explicit high/medium/low risk level categorization, and as further modified by Laptiev's teachings regarding a model fit and tuning risk scores (model outputs) based on previous risk scores, by incorporating therein these teachings of Waters regarding charge-offs as a fraud risk factor, because charge-offs are a known fraud risk factor, and accordingly the incorporation of Waters' teachings would cause the heretofore combination to take into account a greater range of known fraud risk factors, and thus would render the heretofore combination more comprehensive, robust and accurate, see Waters, citations given, see Comeaux, 1:23-56 (“organizations that are especially vulnerable to fraudulent activity, such as the banking and insurance industries, need tools to detect, investigate, analyze, and prevent fraud as accurately and efficiently as possible … Based on the afore-mentioned reasons, it is clear that the current fraud analytics techniques are neither efficient nor accurate enough.”), MPEP 2143.I.A.,G.
Claim 24 is rejected under 35 U.S.C. 103 as being unpatentable over Comeaux et al. (U.S. Patent No. 11,669,844), hereafter Comeaux, in view of Petersen et al. (U.S. Patent Application Publication No. 2020/0125725 A1), hereafter Petersen, further in view of Shevyrev et al. (U.S. Patent Application Publication No. 2023/0281629 A1), hereafter Shevyrev, further in view of Laptiev et al. (U.S. Patent Application Publication No. 2023/0385844 A1), hereafter Laptiev, and further in view of Karpovsky et al. (U.S. Patent Application Publication No. 2022/0191173 A1), hereafter Karpovsky.
Regarding Claim 24
Comeaux in view of Petersen, Shevyrev, and Laptiev teaches the limitations of base claim 1 as set forth above. Comeaux in view of Petersen, Shevyrev, and Laptiev does not explicitly disclose but Karpovsky teaches:
wherein the risk indicator is assigned based on a Virtual Private Network (VPN) indicator (0027)
It would have been obvious to one of ordinary skill in the art not later than the effective filing date of the claimed invention to have modified the combination of Comeaux's systems and methods for detecting and preventing fraudulent events, as modified by Petersen's teachings regarding enriching log message data (e.g., re financial transaction) by appending thereto an identity profile key or identity profile information during processing, as further modified by Shevyrev's teachings regarding (i) identifying returns as a risk factor and (ii) a tripartite decision/outcome structure including explicit high/medium/low risk level categorization, and as further modified by Laptiev's teachings regarding a model fit and tuning risk scores (model outputs) based on previous risk scores, by incorporating therein these teachings of Karpovsky regarding a Virtual Private Network (VPN) indicator as a fraud risk factor, because this is a known fraud risk factor, and accordingly the incorporation of Karpovsky's teachings would cause the heretofore combination to take into account a greater range of known fraud risk factors, and thus would render the heretofore combination more comprehensive, robust and accurate, see Karpovsky, 0027, see Comeaux, 1:23-56 (“organizations that are especially vulnerable to fraudulent activity, such as the banking and insurance industries, need tools to detect, investigate, analyze, and prevent fraud as accurately and efficiently as possible … Based on the afore-mentioned reasons, it is clear that the current fraud analytics techniques are neither efficient nor accurate enough.”), MPEP 2143.I.A.,G.
Conclusion
The prior art made of record and not relied upon, as set forth in the accompanying Notice of References Cited (PTO-892), is considered pertinent to applicant's disclosure. Among the cited references:
Comeaux (US-10567402-B1) and Comeaux (US-11722502-B1) teach fraud detection/prevention similar to Comeaux (US-11669844-B1) but to greater depth in certain aspects;
Phatak (US-20220006899-A1) and Anderson (US-12136096-B1) teach a fraud alert queue that prioritizes fraud alerts based on fraud importance;
Vaswani (US-20220377090-A1) teaches fraud detection/prevention (including risk scores and alerts) similar to Comeaux (US-11669844-B1);
Karpovsky (US-20220191173-A1) teaches determining fraud risk based on VPN and/or proprietary knowledge and periodic monitoring; and
Pavlovic ("Log-normal Distribution - A simple explanation”) teaches content about log-normal distribution similar to that of Applicant's disclosure (specification paragraph 0045)
Vimal (US-20230186311-A1) (qualifying as prior art based on Indian priority date) teaches inter alia benchmarking a machine learning model based on precision, recall, F1, and/or F2 scores, see 0097.
Thomas (US-10997596-B1) teaches appending a fraud accuracy tag to a declined transaction, where the fraud accuracy tag is indicative of whether the decline of the transaction is a true positive decline or a false positive decline, whereby the fraud accuracy tag is suitable to provide insight into accuracy of a fraud strategy implemented in connection with the declined transaction.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to DOUGLAS W PINSKY whose telephone number is (571)272-4131. The examiner can normally be reached on 8:30 am - 5:30 pm ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jessica Lemieux can be reached on 571-270-3445. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/DOUGLAS W PINSKY/
Examiner, Art Unit 3626
1 Note the headings set forth below are abbreviated versions of Applicant's headings.
2 Subject Matter Eligibility Examples (Examples 37-42), pp. 18-19.
3 Note additional portions of Comeaux are cited in the rejection pertaining, e.g., to the "database" recited in the queuing step. However, Applicant does not argue regarding the "database."
4 Note additional portions of Comeaux are cited in the rejection pertaining, e.g., to the "database" recited in the retrieving step. However, Applicant does not argue regarding the "database."
5 The term "tuning" as recited here is interpreted as per the ordinary meaning of "tune," namely, to adjust, modify, or the like.
6 Note the recited "risk indicator" is the output of the machine learning model. That this is so is shown, e.g., by the "generating" step ("generate, by a machine learning model executed by the at least one processor, a risk indicator based on the processed action and the at least one supplemental input"). Relatedly, see the disclosure, ¶ 0081, Fig. 15, showing inputs 1508, model 1509, and risk indicators 1510, which are outputted from model 1509.
7 Note: as per the Claim Objections, B), above, the "the transaction channel device associated with the processed action" of claim 1 is understood to refer to the "transaction channel device" from which the "information corresponding to a processed action of a user" is received in the receiving step of claim 1.
8 The instant amendment adds a "currently generated risk indicator" and "one or more previously generated risk indicators." As best understood, the "currently generated risk indicator" is the same as the risk indicator generated in the generating step, i.e., is the same as the "generated risk indicator" recited in the storing step, responsive to a determination step, and assigning step. See Claim Objections, A), above.
9 Note while claim 1 recites "the corresponding risk indicator" (singular), in view of the queuing step as a whole it is understood that each alert in the "ordered list of generated alerts" has a corresponding risk indicator that dictates its place/position in the ordering/ordered list. See Claim Objections, C), above.
10 A dependent claim that does not further limit its base claim would be rejected under 35 U.S.C. 112(d).
11 See Claim Objections, B), above.
