System and method of fraud reduction

• US 20050273442A1
• Filed: 05/23/2005
• Published: 12/08/2005
• Est. Priority Date: 05/21/2004
• Status: Active Grant

• Current Assignee: Cyoia Inc., Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Bennett, Naftali, Golan, Lior, Rivner, Nira
• Granted Patent: US 8,781,975 B2
• Time in Patent Office: Days
• US Class Current: 705/67
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18

Abstract

A system and method may allow for extending authentication to a two factor, out of band form, requiring an additional data element or code via a channel different from the channel used for the primary transaction, where the different channel has the attribute that it is difficult or costly to achieve many access points to it, and it is possible to limit the number of users associated with a particular access point to it.

Claims

1. A method of authenticating a user participating in a transaction, the method comprising:

transmitting a data element to a user via a communication channel;

receiving the data element from the user via a different communication channel; and

determining based on the data element if the user is allowed to perform a transaction.

2. The method of claim 1, wherein the data item is a code.

3. The method of claim 1, wherein one communication channel is the Internet.

4. The method of claim 1, wherein the identity of one of the communication channels is provided by the user.

5. The method of claim 1, wherein the one of the communication channels is a telephone connection.

6. The method of claim 1, wherein one of the communication channel is an email connection.

7. The method of claim 1, wherein one of the communication channels has the characteristic that it is difficult to obtain many access points to it.

8. The method of claim 1, wherein one of the communication channels has the characteristic that it is expensive to obtain many access points to it.

9. The method of claim 1, comprising transmitting the data element to a user and receiving the data element from the user only when there is a greater probability of transaction risk.

10. The method of claim 1, comprising allowing the applicant to proceed with a transaction only if the data element received via the one communication channel is supplied correctly via a different communication channel.

11. The method of claim 1, wherein transaction is a financial transaction.

12. The method of claim 1, wherein one communication channel is the Internet and the other communication channel is a telephone connection.

13. The method of claim 1, wherein the one of the communication channels is used to perform the transaction.

14. The method of claim 1, comprising initiating contacting with the user via the one of the communication channels

15. A system for authenticating a transaction with a user, the system comprising:

a controller to;

transmit a data element to a user via a communication channel;

receive the data element from the user via a different communication channel; and

determine based on the data element if the user is allowed to perform the transaction.

16. The system of claim 15, wherein the data item is a code.

17. The system of claim 15, wherein one communication channel is the Internet.

18. The system of claim 15, wherein the identity of one of the communication channels is provided by the user

19. The system of claim 15, wherein one communication channel is a telephone connection.

20. The system of claim 15, wherein the controller is to transmit the data element to a user only upon the existence of a certain level risk.

21. The system of claim 15, wherein the controller is to allow the transaction to take place only if the data element is supplied correctly via the communication channel.

22. The system of claim 15, wherein the data is transmitted only if a certain level of risk is associated with the transaction.

23. The system in claim 21 where the level of risk is determined by an event outside of the transaction.

24. The system in claim 15, where one of the communication channels is such that it is difficult to obtain many different access points to it.

25. The system in claim 15, where one of the communication channels is such that it is expensive to obtain many different access points to it.

26. The system in claim 15, where it is possible to limit the number of users who may use an access point to one of the communication channels.

27. The system in claim 24, and 25, where it is possible to limit the number of users who may use an access point to one of the communication channels.

28. The system in claim 15, where an access point to one of the communication channels is invalid if it has existed for fewer than a certain number of days.

29. The system in claim 15, where the identity of the access point to one of the communication channels is collected before the transaction.

30. The system in claim 15, where the identity of the access point to one of the communication channels is collected during the transaction.

31. A method comprising, during a transaction with a user:

transmitting to the user, via one communication channel, a code; and

receiving the code from the user, via a different communication channel.

32. The method of claim 31, comprising:

conducting transactions with a plurality of users, and ensuring that with respect to one of the communication channels, that only a certain number of users can use each access point to such communication channel.

33. The method of claim 31, comprising allowing the transaction to proceed only if the received code matches the sent code.

34. The method of claim 31, wherein one of the communication channels is the communication channel by which the transaction is conducted.

35. The method of claim 31, comprising transmitting the code only on the suspicion as to the existence of a certain level of risk.

36. The method of claim 35, where the level of risk is related to the transaction

37. The method of claim 31, where the level of risk is related to an event outside of the transaction.

38. The method of claim 31, where one of the communication channels is such that it is difficult to obtain many different access points to it.

39. The method of claim 31, where one of the communication channels is such that it is expensive to obtain many different access points to it

40. The method of claim 31, comprising limiting the number of users who may use an access point to one of the communication channels.