Systems and methods for cross coupling risk analytics and one-time-passcodes

Patent metadata

Field	Value
Publication number	US-11748466-B2
Application number	US-202117165527-A
Country	US
Kind code	B2
Filing date	Feb 2, 2021
Priority date	Oct 2, 2018
Publication date	Sep 5, 2023
Grant date	Sep 5, 2023

Abstract

Example embodiments provide systems and methods for validating an action using a physical token, such as a near-field-communications (NFC)-capable chip. A server may receive a request to perform the action, and may require validation from the holder of the physical token. The holder of the physical token may log into an application using their log-in credentials, providing a first tier of authentication. The holder may then scan the physical token with a reader on their mobile device, which provides a second tier of authentication. The scan may reveal a value for a counter on the physical token, which may be compared to a counter at the server in order to validate that the physical token has been used as expected. If the server deems it appropriate, a third (or further) tier may be required, such as scanning a photographic identification of the holder.

First claim

What is claimed is:

1. A non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor to:
receive, by a computing device, a request from a validation server, the request associated with a user account associated with a user;
perform, by an application on the computing device, a first validation action by authenticating a username and password of the user to gain additional access to the application on the computing device;
perform, by the application on the computing device and subsequent to successfully performing the first validation action, a second validation action, wherein the second validation action comprises receiving, via a short-range communication protocol, a code from contactless card in response to tapping the contactless card on the surface;
generate, by the application on the computing device, a validation response package identifying the user and the code retrieved from the physical token; and
communicate, by the application on the computing device, the response package to the validation server
receive and process, by the application, an escalated validation request in response to the code being outside a range and a risk analysis, the escalated validation request comprising a requested validation action.

2. The medium of claim 1 , wherein the short-range communication protocol is a near field communication (NFC) protocol.

3. The medium of claim 1 , wherein the code comprises counter stored on the contactless card that is incremented each time the code is read from the contactless card.

4. The medium of claim 1 , wherein the contactless card comprises, a debit card, a rewards card, or a credit card.

5. The medium of claim 1 , wherein the requested validation action comprises a request to provide a security question, and the medium further storing instructions to cause the processor to:
present, via the application and on a display of the computing device, the security question;
receive, by the application, a response to the security question; and
communicate, by the application, the response to the validation server.

6. The medium of claim 1 , wherein the requested validation action comprises a request to provide a biometric input, and the medium further storing instructions to cause the processor to:
receive, by the application and via a biometric device of the computing device, the biometric input; and
communicate, by the application, the biometric input to the validation server.

7. The medium of claim 1 , wherein the requested validation action comprises a request to provide a photograph, and the medium further storing instructions to cause the processor to:
receive, by the application, the photograph from a camera of the computing device;
generate, by the application, a response to the escalated validation request, the response including the photograph; and
communicate, by the application, the response to the validation server.

8. The medium of claim 7 , wherein the photograph is a picture of an identification associated with the user.

9. A computer-implemented method, comprising:
processing, by a computing device, a request from a validation server, the request associated with a user account associated with a user;
performing, by an application on the computing device, a first validation action, the first validation action comprising validating a username and a password associated with the user to log into the application;
performing, by the application on the computing device and subsequent to successfully performing the first validation action, a second validation action, the second validation action comprising presenting a prompt to provide a physical token within a short-range communication range of the computing device, and receiving a code from the physical token based on a short-range communication protocol;
generating, by the application on the computing device, a validation response package identifying the user and the code received from the physical token;
sending, by the application on the computing device, the response package to the validation server; and
receive and process, by the application, an escalated validation request in response to the code being outside a range and a risk analysis, the escalated validation request comprising a requested validation action.

10. The computer-implemented method of claim 9 , wherein the code comprises a counter stored on the contactless card that is incremented each time the code is read from the contactless card.

11. The computer-implemented method of claim 9 wherein the requested validation action comprises a request to provide a security question, and the method comprising:
presenting, by the application on a display of the computing device, the security question;
receiving, by the application, a response to the security question; and
sending, by the application, the response to the validation server.

12. The computer-implemented method of claim 9 , wherein the requested validation action comprises a request to provide a biometric input, and the method comprising:
receiving, by the application via a biometric device of the computing device, the biometric input; and
transmitting, by the application, the biometric input to the validation server.

13. The computer-implemented method of claim 9 , wherein the requested validation action comprises a request to provide a photograph, and the method comprising:
receiving, by the application, the photograph from a camera of the computing device;
generating, by the application, a response to the escalated validation request, the response including the photograph; and
transmit by the application, the response to the validation server.

14. An apparatus, comprising:
a memory storing instructions for one or more applications; and
a hardware processor circuit configured to execute the instructions to:
receive, by a first application of the one or more applications, a request from a validation server, the request associated with a user account associated with a user;
perform, by the first application a first validation action on a computing device, the first validation action to validate a username and a password of the user to continue to execute the first application;
perform, by the first application, a second validation action by presenting a prompt to provide a physical token within a short-range communication range of the computing device, and scanning a code from the physical token based on a short-range communication protocol;
generate, by the first application, a validation response package identifying the user and the code retrieved from the physical token;
send, by the first application, the response package to the validation server; and
receive and process, by the application, an escalated validation request in response to the code being outside a range and a risk analysis, the escalated validation request comprising a requested validation action.

15. The apparatus of claim 14 , the processor to:
receive the escalated validation request to answer a security question;
present, on a display, the security question;
receive a response to the security question; and
send the response to the validation server.

16. The apparatus of claim 14 , the processor to:
receive escalated validation request to provide a biometric input;
receive, via a biometric device, the biometric input; and
send the biometric input to the validation server.

17. The apparatus of claim 14 , the processor to:
receive escalated validation request to provide a photograph

Assignees

• Capital One Services Llc

Inventors

• Duane William
• Osborn Kevin

Classifications

• G06F21/34 Primary

  involving the use of external additional devices, e.g. dongles or smart cards · CPC title

• G06Q20/385

  using an alias or single-use codes · CPC title

• G06Q20/40

  Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists · CPC title

• G06Q20/401

  Transaction verification · CPC title

• G06Q20/4016

  involving fraud or risk level assessment in transaction processing · CPC title