Fraud reduction system for transactions

Patent metadata

Field	Value
Publication number	US-10089683-B2
Application number	US-90391610-A
Country	US
Kind code	B2
Filing date	Oct 13, 2010
Priority date	Feb 8, 2010
Publication date	Oct 2, 2018
Grant date	Oct 2, 2018

Abstract

A system, apparatus, and method for reducing fraud in payment or other transactions by providing issuers with a warning that a transaction being processed for authorization is potentially fraudulent. In some embodiments, the present invention processes data obtained from a consumer authentication process that is used in card not present (CNP) transactions to determine characteristics or indicia of fraud from previous transactions. The characteristics or indicia of fraud can be used to generate a set of fraud detection rules or another form of fraud assessment model. A proposed transaction can then be evaluated for potential fraud using the fraud assessment model.

First claim

What is claimed is:

1. A computer-implemented method of reducing fraud in transactions, comprising:
obtaining, by a risk management engine, authentication history data from an authentication history server, the authentication history server comprising an archive of authentication operations performed or attempted using an authentication protocol that requires a user to provide an authentication credential prior to authorization processing;
identifying, by the risk management engine, authentication process characteristics common to confirmed fraudulent transactions in the authentication history data;
generating, by the risk management engine, rules based upon the authentication process characteristics;
receiving, by a directory server, a verification request message from a merchant computer;
receiving, by the risk management engine from the directory server, a request to perform a fraud assessment for a payment account that is being used to conduct a payment transaction prior to initiation of the authorization processing for the payment transaction;
requesting, by the risk management engine and from the authentication history server, data regarding a history of authentication operations performed involving the payment account;
performing, by the risk management engine, a fraud assessment process using the rules and the data requested from the authentication history server;
determining, as a result of the fraud assessment process, by the risk management engine, that the risk of the payment transaction exceeds a specified threshold and is suspected of being fraudulent; and
generating, by the risk management engine, and sending an early warning message to the directory server and an access control server at an issuer of the payment account prior to generation of an authorization request message, by the access control server, for the payment transaction to prevent generation of the authorization request message for the payment transaction.

2. The computer-implemented method of claim 1 , wherein generating the rules comprises applying a linear regression model to generate the rules.

3. The computer-implemented method of claim 1 , wherein the fraud assessment comprises one or more of a velocity check, a limit check or a geo-location check.

4. The computer-implemented method of claim 1 , wherein the access control server is operated by an issuer of the payment account.

5. The computer-implemented method of claim 1 wherein the request to perform the fraud assessment is in response to receipt of a verify enrollment request by the directory server.

6. The computer-implemented method of claim 1 wherein the early warning message also prevents the generation of payer authentication request and response messages from being generated and transmitted for the payment transaction.

7. A risk management engine, comprising:
a processor programmed to execute a set of instructions;
a memory coupled to the processor for storing the set of instructions; and
the set of instructions stored in the memory, wherein when executed by the programmed processor implements a method comprising:
obtaining, by the risk management engine, authentication history data from the authentication history server, the authentication history server comprising an archive of authentication operations performed or attempted using an authentication protocol that requires a user to provide an authentication credential prior to authorization processing;
identifying, by the risk management engine, authentication process characteristics common to confirmed fraudulent transactions in the authentication history data;
generating, by the risk management engine, rules based upon the authentication process characteristics;
receiving, by a directory server, a verification request message from a merchant computer;
receiving, by the risk management engine and from the directory server, a request to perform a fraud assessment for a payment account that is being used to conduct a payment transaction prior to initiation of the authorization processing for the payment transaction;
requesting, by the risk management engine and from the authentication history server, data regarding a history of authentication operations performed involving the payment account;
performing, by the risk management engine, a fraud assessment process using the rules and the data requested from the authentication history server;
determining, as a result of the fraud assessment process, by the risk management engine, that the risk of the payment transaction exceeds a specified threshold and is suspected of being fraudulent; and
generating, by the risk management engine, and sending an early warning message to the directory server and an access control server at an issuer of the payment account prior to generation of an authorization request message, by the access control server, for the payment transaction to prevent generation of the authorization request message for the payment transaction.

8. The risk management engine of claim 7 , wherein generating the rules comprises using a linear regression model to generate the rules.

9. A system for reducing fraud in transactions, comprising:
an authentication history server storing data records of consumer authentication operations for card not present transactions; and
a risk management engine operative to:
obtain authentication history data from the authentication history server, the authentication history server comprising an archive of authentication operations performed or attempted using an authentication protocol that requires a user to provide an authentication credential prior to authorization processing;
identify authentication process characteristics common to confirmed fraudulent transactions in the authentication history data;
generate rules based upon the authentication process characteristics;
receive, via a directory server and a merchant computer, a verification request message;
receive, from the directory server, a request to perform a fraud assessment for a payment account that is being used to conduct a payment transaction prior to initiation of the authorization processing for the payment transaction;
request, from the authentication history server, data regarding a history of authentication operations performed involving the payment account;
perform a fraud assessment process using the rules and the data requested from the authentication history server;
determine, as a result of the fraud assessment process, that the risk of the payment transaction exceeds a specified threshold and is suspected of being fraudulent; and
generate and send an early warning message to the directory server and an access control server at an issuer of the payment account prior to generation of an authorization request message, by the access control server, for the payment transaction to prevent generation of the authorization request message for the payment transaction.

10. The system of claim 9 , wherein the directory server is operative to:
receive a verification request message, the message including an account number for the payment account; and
send a verification response message in response to receiving the verification request message.

11. The system of claim 9 , wherein generating the rules comprises applying a linear regression model to generate the rules.

12. The system of claim 9 , wherein the authentication history server stores data records that are used for resolving disputes associated with payment accounts.

13. The risk management engine of claim 7 , wherein the authentication credential includes a password.

14. The risk management

Assignees

• Dominguez Benedicto Hernandez
• Visa Int Service Ass

Inventors

• Dominguez Benedicto Hernandez

Classifications

• G06Q40/00 Primary

  Finance; Insurance; Tax strategies; Processing of corporate or income taxes · CPC title

• G06Q20/40

  Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists · CPC title

• G06Q20/4016

  involving fraud or risk level assessment in transaction processing · CPC title