Adaptive authentication options

Patent metadata

Field	Value
Publication number	US-10346837-B2
Application number	US-93574007-A
Country	US
Kind code	B2
Filing date	Nov 6, 2007
Priority date	Nov 16, 2006
Publication date	Jul 9, 2019
Grant date	Jul 9, 2019

Abstract

A method for authenticating a consumer for a portable consumer device is disclosed. One embodiment of the invention includes receiving a transaction message relating to a request by a consumer to conduct a transaction using a portable consumer device, wherein the consumer was previously enrolled in an authentication program and the consumer was previously authenticated, analyzing the transaction message to determine if a re-authentication event has taken place, causing a re-authentication message to be sent to the consumer before initiating an authorization request message to the issuer if the re-authentication event has taken place, and initiating the authorization request message to the issuer without sending the re-authentication message to the consumer if the re-authentication event has not taken place.

First claim

What is claimed is:

1. A method comprising:
receiving, by a server computer, a transaction message relating to a request by a consumer to conduct a transaction using a portable consumer device associated with a payment account number;
determining, by the server computer, that the portable consumer device is enrolled in an authentication program that provides greater security for the consumer when the consumer conducts transactions using the portable consumer device, by contacting a directory server which sends a request to an access control server operated by an issuer of the payment account number to determine if the portable consumer device is enrolled in the authentication program and receives a response from the access control server;
analyzing, by the server computer, the transaction message to determine if the transaction is a specialized transaction, wherein the specialized transaction is a purchase transaction and involves a recurring payment, a micro-payment, or a one-step online payment;
determining that the transaction is the specialized transaction;
analyzing the transaction message, using the server computer, to determine if a re-authentication event has taken place or has not taken place by analyzing data in the transaction message against re-authentication events in a re-authentication event database;
determining that the re-authentication event has not taken place; and
in response to determining that the re-authentication event has not taken place, initiating an authorization request message comprising the payment account number and an amount of the transaction to the issuer of the payment account number for approval, using the server computer, without sending a re-authentication message to the consumer.

2. The method of claim 1 , wherein the re-authentication event is a change in the consumer's home address, payment terms, shipping address, billing address, email address, name, account number, payment method, portable consumer device expiration date, or password, and wherein the consumer was previously authenticated to the issuer.

3. The method of claim 1 , wherein the re-authentication event is a new or different IP address, an out of pattern activity, an order amount above a specified dollar amount, or a long period of inactivity in the payment account.

4. The method of claim 1 , wherein the re-authentication event is where a previous transaction was associated with an authentication failure or attempt.

5. The method of claim 1 , wherein the transaction is a first transaction, the request is a first request, the transaction message is a first transaction message, the authorization request message is a first authorization request message, and the re-authentication event is a first re-authentication event, and wherein the method further comprises:
receiving by the server computer, a second transaction message relating to a second request by the consumer to conduct a second transaction using the portable consumer device;
determining, by the server computer, that the portable consumer device is enrolled in the authentication program;
analyzing, by the server computer, the second transaction message to determine if the second transaction is another specialized transaction;
determining that the second transaction is another specialized transaction;
analyzing the second transaction message, using the server computer, to determine if a second re-authentication event has taken place or has not taken place;
determining that the second re-authentication event has taken place; and
in response to determining that the second re-authentication event has taken place, initiating, by the server computer, a re-authentication process with the consumer;
determining, by the server computer, that the consumer is authentic; and
in response to determining that the consumer is authentic, initiating a second authorization request message to the issuer, using the server computer.

6. The method of claim 5 , wherein the re-authentication process comprises sending, by the server computer and via the directory server, a first message to an access control server at the issuer, wherein the access control server thereafter sends a re-authentication request message to a client computer operated by the consumer and subsequently receives a password from the consumer via the client computer, and sends a second message to the server computer indicating that the consumer has been authenticated.

7. The method of claim 6 wherein the portable consumer device is in the form of a card and wherein the second transaction message comprises a digital certificate of the issuer.

8. The method of claim 1 , wherein initiating the authorization request message to the issuer, using the server computer, comprises generating the authorization request message and sending the authorization request message to the issuer through an acquirer and a payment processing network.

9. A server computer comprising a non-transitory computer readable medium storing a computer program containing instructions thereon for instructing the server computer to perform a method comprising the steps of:
receiving a transaction message relating to a request by a consumer to conduct a transaction using a portable consumer device associated with a payment account number;
determining that the portable consumer device is enrolled in an authentication program that provides greater security for the consumer when the consumer conducts transactions using the portable consumer device, by contacting a directory server which sends a request to an access control server operated by an issuer of the payment account number to determine if the portable consumer device is enrolled in the authentication program and receives a response from the access control server;
analyzing the transaction message to determine if the transaction is a specialized transaction, wherein the specialized transaction is a purchase transaction and involves a recurring payment, a micro-payment, or a one-step online payment;
determining that the transaction is the specialized transaction;
analyzing the transaction message to determine if a re-authentication event has not taken place by analyzing data in the transaction message against re-authentication events in a re-authentication event database;
determining that the re-authentication event has taken place or has not taken place; and
in response to determining that the re-authentication event has not taken place, initiating an authorization request message comprising the payment account number and an amount of the transaction to the issuer of the payment account number for approval, using the server computer, without sending a re-authentication message to the consumer.

10. The server computer of claim 9 wherein the transaction is a first transaction, the request is a first request, the transaction message is a first transaction message, the authorization request message is a first authorization request message, and the re-authentication event is a first re-authentication event, and wherein the method further comprises:
receiving by the server computer, a second transaction message relating to a second request by the consumer to conduct a second transaction using the portable consumer device;
determining, by the server computer, that the portable consumer device is enrolled in the authentication program;
analyzing, by the server computer, the second transaction message to determine if the second transaction is another specialized transaction;
determining that the second transaction is another specialized transaction;
analyzing the second transaction message, using the server computer, to determine if a second re-authentication event has taken pla

Assignees

• Steele Kim
• Yakel Mike
• Weller Kevin
• Faith Patrick
• Van Deloo Lori D
• Visa Usa Inc

Inventors

• Steele Kim
• Yakel Mike
• Weller Kevin
• Faith Patrick
• Van Deloo Lori D

Classifications

• G06Q20/4014

  Identity check for transactions · CPC title

• G06Q20/341

  Active cards, i.e. cards including their own processing means, e.g. including an IC or chip · CPC title

• G07F7/1008

  Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system · CPC title

• G06Q20/40 Primary

  Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists · CPC title

• G06Q30/06

  Buying, selling or leasing transactions · CPC title