Consumer authentication system and method

• US 10,089,624 B2
• Filed: 01/17/2012
• Issued: 10/02/2018
• Est. Priority Date: 06/19/2006
• Status: Active Grant

• Current Assignee: Visa USA, Inc. (Visa, Inc.)
• Original Assignee: Visa USA, Inc. (Visa, Inc.)
• Inventors: Hammad, Ayman, Faith, Patrick, Carlson, Mark
• Primary Examiner(s): Kucab, Jamie R
• Application Number:
  US13/352,247
• Publication Number:
  US 20120158591A1
• Time in Patent Office: 2,450 Days
• Field of Search: None
• CPC Class Codes: G06Q 20/085 involving remote charge determination or related payment systems
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/204 comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A method for authenticating a consumer. The method includes receiving an authorization request message associated with a consumer conducting a transaction with a portable consumer device. A challenge message is sent to the consumer, where the challenge message is dynamic or semi-dynamic. A challenge response message is received from the consumer, and an authorization response message is sent to the consumer. The authorization response message indicates whether or not the transaction is authorized.

Claims

1. A method comprising:

determining a transaction amount and an account number associated with a portable consumer device;

initiating an authorization request message for a transaction, wherein the authorization request message comprises the transaction amount and the account number;

sending the authorization request message to an issuer associated with the portable consumer device, the transaction amount added to payment transaction history of a consumer associated with the account number;

receiving a challenge message, wherein the challenge message is dynamic and wherein the consumer'"'"'s payment transaction history is used to create the challenge message;

initiating a challenge response message, wherein the challenge response message is responsive to the challenge message; and

receiving an authorization response message, wherein the authorization response message indicates whether or not the transaction is authorized by the issuer associated with the portable consumer device.

2. The method of claim 1 wherein the authorization request message and the challenge message are initiated and received, respectively, by at least one of a merchant who is a party to the transaction or the consumer.

3. The method of claim 1 wherein the portable consumer device is a card or a mobile phone.

4. The method of claim 1 wherein the challenge message includes a question.

5. The method of claim 4 wherein the question asks the consumer if the consumer did or did not previously make a particular purchase.

6. The method of claim 1 wherein the authorization request message is sent to the issuer via a payment processing network and the challenge message is received from the issuer via the payment processing network;

and the method further comprising;

sending the challenge response message to the payment processing network; and

if the consumer provides a correct challenge response message;

receiving the authorization response message from the issuer of the portable consumer device after the authorization request message is sent to the issuer.

7. The method of claim 6 wherein the transaction involves a merchant, and wherein the authorization response message is sent to the portable consumer device.

8. The method of claim 1 wherein the challenge message is received from the issuer, and the method further comprising:

sending the challenge response message to the issuer.

9. The method of claim 2, further comprising:

implementing a timer to determine a length of time for authorization of the transaction.

10. The method of claim 1 wherein the challenge response message is part of a second authorization request message.

11. The method of claim 10 wherein the second authorization request message comprises a zero dollar amount.

12. The method of claim 1, further comprising:

providing a second challenge to the consumer, wherein the second challenge requests a consumer'"'"'s identification.

13. The method of claim 1 wherein the authorization response message indicates that the transaction is authorized when an account associated with the portable consumer device has sufficient funds or credit.

14. The method of claim 1 wherein the challenge response message includes a multiple choice or true-false answer that was selected by the consumer.

15. A non-transitory computer readable medium comprising code, executable by a processor, to implement a method comprising:

determining a transaction amount and an account number associated with a portable consumer device;

initiating an authorization request message for a transaction, wherein the authorization request message comprises the transaction amount and the account number;

sending the authorization request message to an issuer associated with the portable consumer device, the transaction amount added to payment transaction history of a consumer associated with the account number;

receiving a challenge message, wherein the challenge message is dynamic and wherein the consumer'"'"'s payment transaction history is used to create the challenge message;

initiating a challenge response message, wherein the challenge response message is responsive to the challenge message; and

receiving an authorization response message, wherein the authorization response message indicates whether or not the transaction is authorized by the issuer associated with the portable consumer device.

16. A phone comprising the non-transitory computer readable medium of claim 15.

17. An access device comprising:

a processor; and

a non-transitory computer readable medium programmed to perform a method comprising;

determining a transaction amount and an account number associated with a portable consumer device;

initiating an authorization request message for a transaction, wherein the authorization request message comprises the transaction amount and the account number;

sending the authorization request message to an issuer associated with the portable consumer device, the transaction amount added to payment transaction history of a consumer associated with the account number;

receiving a challenge message, wherein the challenge message is dynamic and wherein the consumer'"'"'s payment transaction history is used to create the challenge message;

initiating a challenge response message, wherein the challenge response message is responsive to the challenge message; and

receiving an authorization response message, wherein the authorization response message indicates whether or not the transaction is authorized by the issuer associated with the portable consumer device.