Systems and methods for reporting compromised card accounts

• US 10,311,434 B2
• Filed: 05/29/2014
• Issued: 06/04/2019
• Est. Priority Date: 05/29/2014
• Status: Active Grant

• Current Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Original Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Inventors: Wardman, Brad, Edelen, Jeffrey Alan
• Primary Examiner(s): Gart, Matthew S
• Assistant Examiner(s): Swartz, Stephen S
• Application Number:
  US14/290,865
• Publication Number:
  US 20150347965A1
• Time in Patent Office: 1,832 Days
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety
• CPC Class Codes: Y04S 10/50 Systems or methods supporting the power network operation or management, involving a certain degree of interaction with the load-side end user applications

Abstract

A system or method is provided to generate and send a notification to a card issuing bank to report a compromised card. In particular, the notification may be embedded in a pseudo card transaction message based on the ISO 8583 protocol message format. Card issuing banks may be a participant in a compromised card account reporting program to receive the notifications via the ISO 8583 transaction messages from a merchant or a payment service provider. In particular, data elements within the ISO 8583 protocol that are not reserved for carrying information for a transaction may be designated to carry information for reporting the compromised card account. Thus, merchants or payment service providers may send notifications of compromised card accounts to card issuing banks in a secured manner using ISO 8583 transaction messages.

Claims

1. A server machine, associated with a first service provider, for detecting compromised user accounts, comprising:

a non-transitory memory; and

one or more hardware processors coupled to the non-transitory memory and configured to execute instructions from the non-transitory memory to cause the server machine to perform operations comprising;

monitoring a plurality of online resources for information associated with user accounts;

analyzing information collected from the plurality of online resources during the monitoring;

detecting, by the first service provider based on the analyzing, a compromised user account maintained by a second service provider;

automatically restricting use of the compromised user account with the first service provider;

automatically generating and sending a first ISO 8583 security message to a different server machine of the second service provider, the first ISO 8583 security message comprising one or more first data elements comprising data reporting the compromised user account;

receiving, after the sending the first ISO 8583 security message, a second ISO 8583 security message from the second service provider;

analyzing the second ISO 8583 security message to determine that the second ISO 8583 security message comprises one or more second data elements indicating that the second service provider has received the data reporting the compromised user account; and

responsive to the determining that the second ISO 8583 security message comprises the one or more second data elements indicating that the second service provider has received the data reporting the compromised user account, automatically removing the restriction of the use of the compromised user account with the first service provider.

2. The server machine of claim 1, wherein one or more of the one or more first data elements are unreserved ISO 8583 data elements and the first ISO 8583 security message further comprises a bitmap indicating a location of the first data elements within the first ISO 8583 security message.

3. The server machine of claim 1, wherein the data reporting the compromised user account includes one or more of:

a type of compromise, a risk level, a probability that the user account is compromised, a source of the compromised user account, or a description of an incident of abuse.

4. The server machine of claim 1, wherein the first ISO 8583 security message comprises a pseudo-message unassociated with a pending transaction and comprising a transaction request of a zero amount, and wherein the second ISO 8583 security message further comprises a designated bit confirming receipt of the first ISO 8583 security message.

5. The server machine of claim 1, wherein the first data elements are located within at least one of data field numbers 55-63, 105-112, 114-123, and 127 of the first ISO 8583 security message.

6. The server machine of claim 1, wherein the first ISO 8583 security message is associated with a pending request, and wherein the second ISO 8583 security message comprises information regarding an approval decision associated with the pending request.

7. The server machine of claim 6, wherein the operations further comprise processing the pending request when the second ISO 8583 security message indicates that the pending request is approved by the second service provider.

8. The server machine of claim 6, wherein the operations further comprise declining the pending request when the second ISO 8583 security message indicates that the pending request is not approved by the second service provider.

14. The server machine of claim 1, wherein the monitoring of the online resources comprises monitoring live network traffic.

15. The server machine of claim 1, wherein the monitoring of the online resources comprises monitoring botnet communications over a network.

16. The server machine of claim 1, wherein the monitoring of the online resources comprises monitoring a plurality of online sites associated with cybercriminal activity.

17. The server machine of claim 1, wherein the automatically generating and sending of the first ISO 8583 security message is based, at least in part, on determining that the second service provider maintaining the compromised user account participates in a compromised user account reporting program.

9. A machine-implemented method comprising:

receiving, by one or more hardware processors of a first server machine of a first party responsible for a user account, a first security message from a second server machine of a second party, wherein the first security message is in an ISO 8583 format and comprising one or more first data elements comprising data reporting the user account as being compromised;

analyzing, by one or more of the hardware processors, the first data elements of the security message;

identifying, by one or more of the hardware processors, the user account as being compromised based on the analyzing of the one or more first data elements;

generating, by one or more of the hardware processors after the identifying the user account as being compromised, a second security message in an ISO 8583 format, the second security message comprising one or more second data elements indicating that the first party received the data reporting the user account as being compromised; and

sending, by one or more of the hardware processors, the second security message to the second server machine.

10. The machine-implemented method of claim 9, wherein one or more of the first data elements in the first security message are unreserved ISO 8583 data elements and the first security message further comprises a bitmap indicating a location of the first data elements within the first security message based on ISO 8583.

11. The machine-implemented method of claim 9, wherein the second security message comprises an approval determination regarding a pending request involving the user account.

18. The machine-implemented method of claim 9, wherein a logical value of one in a bit array data structure of the first security message indicates that a corresponding data element among the one or more data elements includes information about the user account.

19. The machine-implemented method of claim 9, wherein the first data elements are located within at least one of data field numbers 55-63, 105-112, 114-123, and 127 of the first ISO 8583 security message.

20. The machine-implemented method of claim 19, wherein the first data elements are located within at least one of data field numbers 55-63, 105-112, 114-123, and 127 of the first ISO 8583 security message, and wherein the first ISO 8583 security message further comprises a bitmap indicating the location of the first data elements within the first ISO 8583 security message.

12. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:

analyzing information collected from one or more online resources;

detecting, based on the analyzing, a compromised user account maintained by another party;

automatically placing an account restriction on the compromised user account;

automatically generating and sending, to a server machine of the another party responsible for the compromised user account, a first ISO 8583 security message comprising one or more first data elements comprising a report identifying the compromised user account;

receiving, after the sending the first ISO 8583 security message, a second ISO 8583 security message from the another party;

analyzing the second ISO 8583 security message to determine that the second ISO 8583 comprises data indicating that the another party has confirmed receipt of the report identifying the compromised user account; and

in response to the analyzing the second ISO 8583 security message confirming receipt of the report by the another party, automatically removing the account restriction.

13. The non-transitory machine-readable medium of claim 12, wherein the first ISO 8583 security message comprises a pseudo-message that is unassociated with any pending transaction comprising a transaction request of a zero amount.