System and method for enforcing granular privacy controls during transaction fraud screening by a third party

Patent metadata

Field	Value
Publication number	US-12093959-B2
Application number	US-201715806368-A
Country	US
Kind code	B2
Filing date	Nov 8, 2017
Priority date	Sep 26, 2017
Publication date	Sep 17, 2024
Grant date	Sep 17, 2024

Abstract

Methods, computer program products, and systems are presented. The methods include customer specific information exchange and an adjustment of the privacy level of this information. For this purpose an abstraction layer and an obfuscation module are introduced. Using a “fraud vector” a risk assessment is performed on the obfuscated transaction data.

First claim

What is claimed is:

1. A method for transaction processing, the method comprising:
capturing, by an abstraction layer executing on a processor, a transaction request and process the transaction request, wherein processing the request includes authenticating a source of the transaction request;
creating, by the abstraction layer, a data set for the transaction based on the processing of the transaction request, the data set including financial data of a customer requesting the transaction;
determine a destination of the transaction request;
obfuscating at least one data item in the data set, wherein the at least one data item and a type of obfuscation are determined based at least in part on the destination of the transaction request and upon a user preference, wherein the user is the customer requesting the transaction and wherein the user is identified based upon the extracted data;
creating an updated transaction request including the data set having the obfuscations;
providing the updated transaction request to the destination;
receiving a request to reduce a level of obfuscation of the at least one data item;
based on a determination that the user preference is to not provide the at least one data item at the level of requested obfuscation to the destination, aborting the transaction request in response to the request; and
based on a determination that the user preference is to provide the at least one data item at the level of requested obfuscation to the destination, providing the updated transaction request having the level of requested obfuscation to the destination.

2. The method of claim 1 , wherein the at least one data item and the type of obfuscation are further determined based at least in part on a user preference, wherein the user is identified based upon the extracted data.

3. The method of claim 1 , wherein the type of obfuscation include one of a removal of the at least one data item, a replacement of the at least one data item with a random data of a same type, a replacement of the at least one data item with generalized information, and a replacement of the at least one data item with pseudo-anonymized information.

4. The method of claim 1 , wherein the destination is one of a customer associated with the transaction request, a counter party associated with the transaction request, a trusted third party, and a public party.

5. A method for transaction processing, the method comprising:
capture a transaction request and process the transaction request;
creating a data set for the transaction based on the processing of the transaction request, the data set including financial data of a customer requesting the transaction;
determining a destination of the transaction request;
obfuscating at least one data item in the data set, wherein the at least one data item and a type of obfuscation are determined based at least in part on the destination of the transaction request and upon a preference of the customer requesting the transaction;
creating an updated transaction request including the data set having the obfuscations;
providing the updated transaction request to the destination;
receiving, from the destination, a request to reduce a level of obfuscation of the at least one data item; and
based on a determination that the user preference is to not provide the at least one data item at the level of requested obfuscation to the destination; aborting the transaction request in response to the request.

Assignees

• IBM

Inventors

• Betzler Boas
• Buehrer Petra S
• Scheideler Tim U
• Seul Matthias

Classifications

• G06F21/6254 Primary

  by anonymising data, e.g. decorrelating personal data from the owner's identification · CPC title

• G06Q20/4014

  Identity check for transactions · CPC title

• G06F21/52

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• G06Q20/02

  involving a neutral party, e.g. certification authority, notary or trusted third party [TTP] · CPC title