Multi-device transaction verification

Patent metadata

Field	Value
Publication number	US-10515369-B2
Application number	US-201816214553-A
Country	US
Kind code	B2
Filing date	Dec 10, 2018
Priority date	Mar 17, 2015
Publication date	Dec 24, 2019
Grant date	Dec 24, 2019

Abstract

When a user enters a resource provider location with a portable communication device, the portable communication device provides an indication to a transaction processing system that the portable communication device is currently at the resource provider location. At a later time when the user conducts a transaction with a portable transaction device, the fact that the user's portable communication device had been detected at the resource provider a short time ago is taken into account as a positive indicator that the transaction is not fraudulent. By verifying that both the portable communication device and the portable transaction device are present at the resource provider, the risk of approving a fraudulent transaction from a stolen portable transaction device can be reduced.

First claim

What is claimed is:

1. A method comprising:
receiving, by a server computer, device information and a resource provider identifier from a portable communication device of a user, wherein the resource provider identifier was received by the portable communication device from a base station at a resource provider location identified by the resource provider identifier;
determining a credential or token associated with the portable communication device;
storing the received resource provider identifier, the credential or the token, and an additional resource provider identifier associated with the base station together in a database;
receiving, by the server computer and from an access device in a transaction, an authorization request message comprising the credential or the token, and the additional resource provider identifier; and
analyzing, by the server computer, the authorization request message to determine if the user of the portable communication device is also conducting the transaction at the access device, by determining the resource provider identifier from the credential or token in the authorization request message, and determining if the resource provider identifier is associated with the additional resource provider identifier in the authorization request message.

2. The method of claim 1 , wherein the resource provider identifier is in the form of a base station identifier, wherein the base station only advertises a presence of the base station and does not receive signals from the portable communication device.

3. The method of claim 1 , wherein the portable communication device is a mobile phone.

4. The method of claim 1 , wherein the base station and the access device are both at the resource provider location.

5. The method of claim 1 , further comprising:
validating, by the server computer, the device information.

6. The method of claim 1 , wherein the portable communication device communicates with the access device using a contactless based method.

7. The method of claim 1 , wherein the additional resource provider identifier is a terminal ID.

8. The method of claim 1 , further comprising:
transmitting an authorization response message to the access device.

9. The method of claim 1 , wherein the base station and the portable communication device communicate using Bluetooth low energy (BLE).

10. The method of claim 1 , wherein the determining the credential or token comprises determining the token, wherein storing the credential or token comprises storing the token, and wherein the authorization request message comprises the token.

11. A server computer comprising:
a processor; and
a computer readable medium coupled to the processor, the computer readable medium comprising code executable by the processor, to cause the processor to implement a method comprising:
receiving device information and a resource provider identifier from a portable communication device of a user, wherein the resource provider identifier was received by the portable communication device from a base station at a resource provider location identified by the resource provider identifier,
determining a credential or token associated with the portable communication device;
storing the received resource provider identifier, the credential or the token, and an additional resource provider identifier associated with the base station together in a database;
receiving from an access device in a transaction, an authorization request message comprising the credential or the token, and the additional resource provider identifier; and
analyzing the authorization request message to determine if the user of the portable communication device is also conducting the transaction at the access device, by determining the resource provider identifier from the credential or token in the authorization request message, and determining if the resource provider identifier is associated with the additional resource provider identifier in the authorization request message.

12. The server computer of claim 11 , wherein the resource provider identifier is in the form of a base station identifier, wherein the base station only advertises a presence of the base station and does not receive signals from the portable communication device.

13. The server computer of claim 11 , wherein the portable communication device is a mobile phone.

14. The server computer of claim 11 , wherein the base station and the access device are both at the resource provider location.

15. The server computer of claim 11 , wherein the method further comprises:
validating the device information.

16. The server computer of claim 11 , wherein the portable communication device communicates with the access device using a contactless based method.

17. The server computer of claim 11 , wherein the additional resource provider identifier is a terminal ID.

18. The server computer of claim 11 , wherein the method further comprises:
transmitting an authorization response message to the access device.

19. The server computer of claim 11 , wherein the base station and the portable communication device communicate using Bluetooth low energy (BLE).

20. The server computer of claim 11 , wherein the determining the credential or token comprises determining the token, wherein storing the credential or token comprises storing the token, and wherein the authorization request message comprises the token.

Assignees

• Visa Int Service Ass

Inventors

• Wagner Kim
• Sheets John F
• Nelsen Mark
• Jin Jing

Classifications

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title

• G06Q20/4016 Primary

  involving fraud or risk level assessment in transaction processing · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• G06Q20/3224 Primary

  Transactions dependent on location of M-devices · CPC title

• H04W12/08

  Access security · CPC title