Adaptive authentication options

Patent metadata

Field	Value
Publication number	US-10748147-B2
Application number	US-201916429813-A
Country	US
Kind code	B2
Filing date	Jun 3, 2019
Priority date	Nov 16, 2006
Publication date	Aug 18, 2020
Grant date	Aug 18, 2020

Abstract

A method for authenticating a consumer for a portable consumer device is disclosed. One embodiment of the invention includes receiving a transaction message relating to a request by a consumer to conduct a transaction using a portable consumer device, wherein the consumer was previously enrolled in an authentication program and the consumer was previously authenticated, analyzing the transaction message to determine if a re-authentication event has taken place, causing a re-authentication message to be sent to the consumer before initiating an authorization request message to the issuer if the re-authentication event has taken place, and initiating the authorization request message to the issuer without sending the re-authentication message to the consumer if the re-authentication event has not taken place.

First claim

What is claimed is:

1. A method comprising:
receiving, by a server computer, a transaction message relating to a request by a consumer to conduct a transaction using a payment account identifier;
analyzing, by the server computer, the transaction message to determine if the transaction is a specialized transaction;
determining that the transaction is the specialized transaction;
analyzing the transaction message, using the server computer, to determine if a re-authentication event has taken place or has not taken place by analyzing data in the transaction message against re-authentication events in a re-authentication event database;
determining that the re-authentication event has not taken place; and
in response to determining that the re-authentication event has not taken place, initiating an authorization request message comprising the payment account identifier and an amount of the transaction to an issuer computer of an issuer of the payment account identifier for approval, using the server computer, without sending a re-authentication message to the consumer.

2. The method of claim 1 wherein the re-authentication event is a change in a home address of the consumer, payment terms, shipping address, billing address, email address, name, account identifier, payment method, portable consumer device expiration date, or password, and wherein the consumer was previously authenticated to the issuer.

3. The method of claim 1 wherein the re-authentication event is a new or different IP address, an out of pattern activity, an order amount above a specified dollar amount, or a long period of inactivity in a payment account associated with the payment account identifier.

4. The method of claim 1 , wherein the re-authentication event is where a previous transaction was associated with an authentication failure or attempt.

5. The method of claim 1 , wherein the transaction is a first transaction, the request is a first request, the transaction message is a first transaction message, the authorization request message is a first authorization request message, and the re-authentication event is a first re-authentication event, and wherein the method further comprises:
receiving by the server computer, a second transaction message relating to a second request by the consumer to conduct a second transaction using a portable consumer device including the account identifier;
analyzing, by the server computer, the second transaction message to determine if the second transaction is another specialized transaction;
determining that the second transaction is another specialized transaction;
analyzing the second transaction message, using the server computer, to determine if a second re-authentication event has taken place or has not taken place;
determining that the second re-authentication event has taken place; and
in response to determining that the second re-authentication event has taken place, initiating, by the server computer, a re-authentication process with the consumer;
determining, by the server computer, that the consumer is authentic; and
in response to determining that the consumer is authentic, initiating a second authorization request message to the issuer, using the server computer.

6. The method of claim 5 , wherein the re-authentication process comprises sending, by the server computer and via a directory server, a first message to an access control server at the issuer, wherein the access control server thereafter sends a re-authentication request message to a client computer operated by the consumer and subsequently receives a password from the consumer via the client computer, and sends a second message to the server computer indicating that the consumer has been authenticated.

7. The method of claim 6 wherein the transaction is conducted using a portable consumer device that is a card.

8. The method of claim 1 , wherein the specialized transaction is a purchase transaction and involves a recurring payment, a micropayment, or a one-step payment.

9. The method of claim 1 , wherein the re-authentication message requests a password from the consumer.

10. The method of claim 1 , wherein the transaction is conducted by the consumer with a merchant.

11. A server computer comprising a processor, and a non-transitory computer readable medium storing a computer program containing instructions thereon for instructing the server computer to perform a method comprising the steps of:
receiving a transaction message relating to a request by a consumer to conduct a transaction using a payment account identifier;
analyzing the transaction message to determine if the transaction is a specialized transaction;
determining that the transaction is the specialized transaction;
analyzing the transaction message, using the server computer, to determine if a re-authentication event has taken place or has not taken place by analyzing data in the transaction message against re-authentication events in a re-authentication event database;
determining that the re-authentication event has not taken place; and
in response to determining that the re-authentication event has not taken place, initiating an authorization request message comprising the payment account identifier and an amount of the transaction to an issuer computer of an issuer of the payment account identifier for approval, using the server computer, without sending a re-authentication message to the consumer.

12. The server computer of claim 11 wherein the re-authentication event is a change in a home address of the consumer, payment terms, shipping address, billing address, email address, name, account identifier, payment method, portable consumer device expiration date, or password, and wherein the consumer was previously authenticated to the issuer.

13. The server computer of claim 11 wherein the re-authentication event is a new or different IP address, an out of pattern activity, an order amount above a specified dollar amount, or a long period of inactivity in a payment account associated with the payment account identifier.

14. The server computer of claim 11 , wherein the re-authentication event is where a previous transaction was associated with an authentication failure or attempt.

15. The server computer of claim 11 , wherein the transaction is a first transaction, the request is a first request, the transaction message is a first transaction message, the authorization request message is a first authorization request message, and the re-authentication event is a first re-authentication event, and wherein the method further comprises:
receiving a second transaction message relating to a second request by the consumer to conduct a second transaction using a portable consumer device including the account identifier;
analyzing the second transaction message to determine if the second transaction is another specialized transaction;
determining that the second transaction is another specialized transaction;
analyzing the second transaction message, using the server computer, to determine if a second re-authentication event has taken place or has not taken place;
determining that the second re-authentication event has taken place; and
in response to determining that the second re-authentication event has taken place, initiating, by the server computer, a re-authentication process with the consumer;
determining, by the server computer, that the consumer is authentic; and
in response to determining that the consumer is authentic, initiating a second authorization request message to the issuer, using the server computer.

16.

Assignees

• Visa Usa Inc

Inventors

• Steele Kim
• Yakel Mike
• Weller Kevin
• Faith Patrick
• Van Deloo Lori D

Classifications

• G06Q30/06

  Buying, selling or leasing transactions · CPC title

• G06Q40/00

  Finance; Insurance; Tax strategies; Processing of corporate or income taxes · CPC title

• G06Q20/341

  Active cards, i.e. cards including their own processing means, e.g. including an IC or chip · CPC title

• G07F7/1008

  Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system · CPC title

• G06Q20/40 Primary

  Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists · CPC title