Contacts for misdirected payments and user authentication

Patent metadata

Field	Value
Publication number	US-9934502-B1
Application number	US-201715419921-A
Country	US
Kind code	B1
Filing date	Jan 30, 2017
Priority date	Jan 30, 2017
Publication date	Apr 3, 2018
Grant date	Apr 3, 2018

Abstract

Disclosed herein are systems and methods for processing a payment request that use mobile devices to have money transferred. These mobile devices are capable of running a payment transfer application that facilitates a transfer of money. A user can then execute the payment transfer application using a mobile device to send money, through a payment processing system that runs the payment transfer application, to a recipient account. One or more techniques authenticate a user of the mobile device by multi factor authentication prior to processing requests for money transfer initiated by the user.

First claim

What is claimed is:

1. A method for authenticating a payment service user accessing an application executed by mobile devices, the method comprising:
generating, by a first application executing on a first mobile device, a first plurality of hash values representing each of a first plurality of contact records stored on the first mobile device,
receiving, by a server, from the first application, the first plurality of hash values wherein the server does not receive the first plurality of contact records in a plaintext format;
storing, by the server, into a database the first plurality of hash values of the first plurality of contact records, wherein the first plurality of hash values is associated with a user record of the user stored in the database;
upon the server receiving from a second mobile device an authentication request for the user to access the application executed by the second mobile device:
generating, by a second application executing on the second mobile device, a second plurality of hash values representing each of a second plurality of contact records stored on the second mobile device,
receiving, by the server, from the second application, the second plurality of hash values wherein the computer does not receive the second plurality of contact records in the plaintext format;
granting, by the server, the user access to the second application executing on the second mobile device, in response to determining that the second plurality of hash values received from the second application satisfy a threshold amount of matches between the second plurality of hash values and the first plurality of hash values associated with the user record stored in the database;

receiving, by the server, a payment request from the second application on the second mobile device, the payment request containing a recipient-user identifier and a corresponding hash value of the recipient-user identifier;
querying, by the server, the user record to confirm availability of funds for the payment request and to identify a hash value of a contact record in the user record matching the hash value of the recipient-user identifier; and
upon the server confirming the availability of funds for the payment request and identifying the hash value of the contact matching the hash value of the recipient-user identifier, transmitting, by the server, a payment confirmation message corresponding to the payment request to the second mobile device.

2. The method according to claim 1 , wherein the user record comprises information regarding prior recipients in a payment history record of the user.

3. The method according to claim 2 , upon declining the user access to the application, the method further comprises:
generating, by the server, a graphical user interface (GUI) containing a credentials prompt requesting the user to input a set of user credentials; and
transmitting, by the server, to the second user mobile device the graphical user interface containing the credentials prompt,
wherein the user is granted access to the second application executed by the second mobile device, in response to the server determining that a set of purported credentials received from the second mobile device via the credentials prompt matches a set of credentials authenticating the user that are stored in a system database.

4. The method according to claim 1 , wherein determining that the second plurality of hash values received from the second application executing on the second mobile device satisfies the threshold amount of matches between the second plurality of hash values and the first plurality of hash values associated with the user record stored in the database further comprises:
comparing, by the server, the second plurality of hash values against the first plurality of hash values stored in the database to determine a number of matches.

5. The method according to claim 1 , wherein the server does not require a password to grant access to the application executed by the second mobile device.

6. A method for authenticating a user accessing an application executed by mobile devices, the method comprising:
receiving, by a server, from a first application, a first plurality of hash values representing each of a first plurality of contact records stored in a first mobile device;
upon the server receiving from a second mobile device an authentication request for the user to access the application executed by the second mobile device:
generating, by a second application executing on the second mobile device, a second plurality of hash values representing each of a second plurality of contact records stored on the second mobile device,
receiving, by the server, from the second application, the second plurality of hash values;
computing, by the server, a contact similarity score based on a comparison of the second plurality of hash values with the first plurality of hash values associated with a user record stored in the database;
granting, by the server, the user access to the second application executed on the second mobile device, in response to determining that the contact similarity score satisfies a threshold amount;
receiving, by the server, a payment request from the second application on the second mobile device, the payment request containing a recipient-user identifier and a corresponding hash value of the recipient-user identifier;
querying, by the server, the user record, to confirm availability of funds for the payment request and to identify a hash value of a contact record in the user record matching the hash value of the recipient-user identifier; and
upon the server confirming the availability of funds for the payment request and identifying the hash value of the contact matching the hash value of the recipient-user identifier, transmitting, by the server, a payment confirmation message corresponding to the payment request to the second mobile device.

7. The method according to claim 6 , wherein the user record comprises information regarding prior recipients in a payment history record of the user.

8. The method according to claim 7 , upon declining the user access to the application, the method further comprises:
generating, by the server, a graphical user interface (GUI) containing a credentials prompt requesting the user to input a set of user credentials; and
transmitting, by the server, to the second user mobile device the graphical user interface containing the credentials prompt,
wherein the user is granted access to the second application executed by the second mobile device, in response to the server determining that a set of purported credentials received from the second mobile device via the credentials prompt matches a set of credentials authenticating the user that are stored in a system database.

9. The method according to claim 6 , wherein the first application executing on the first mobile device generates hash values for each respective contact record stored on the first mobile device according to a hash function.

10. The method according to claim 6 , wherein the second application executing on the second mobile device generates hash values for each respective contact record stored on the second mobile device according to the hash function.

11. The method according to claim 10 , wherein the server does not receive the second plurality of contact records in the plaintext format.

12. The method according to claim 6 , further comprising receiving, by the server, the second plurality of hash values representing each of the second plurality of contact records stored in the second mobile device.

13. The method according to claim 6 , wherein

Assignees

• Square Inc

Inventors

• Grassadonia Brian
• Omojola Ayokunle
• Moring Michael
• Andersen Robert
• Perito Daniele
• Stipech Kristopher

Classifications

• H04W12/06

  Authentication · CPC title

• G06Q20/10

  specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems · CPC title

• G06Q20/3223

  Realising banking transactions through M-devices · CPC title

• G06F16/22

  Indexing; Data structures therefor; Storage structures · CPC title

• G06Q20/4014

  Identity check for transactions · CPC title