Fraud analyst smart cookie

• US 20070061273A1
• Filed: 08/24/2006
• Published: 03/15/2007
• Est. Priority Date: 09/17/2004
• Status: Abandoned Application

• Current Assignee: David Helsper, Todd Greene
• Original Assignee: David Helsper, Todd Greene
• Inventors: Helsper, David, Greene, Todd
• Application Number:
  US11/509,130
• Publication Number:
  US 20070061273A1
• Time in Patent Office: Days
• US Class Current: 705/80
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 30/0603 Catalogue ordering
• CPC Class Codes: G06Q 40/08 Insurance
• CPC Class Codes: G06Q 50/188 Electronic negotiation

Abstract

A fraudulent business transaction application (FBTA) is provided in embodiments of the present invention for monitoring fraudulent transactions. When a consumer supplies account access information in order to carry out an Internet business transaction, the FBTA uses an online fraud mitigation engine to detect phishing intrusions and identity theft. Embodiments are also provided for calculating travel velocity and transaction frequency, which are useful for determining a fraudulent transaction. Further embodiments are provided for authenticating a transaction using a cookie stored on a client device and a behavior profile stored on a server.

Claims

1-6. -6. (canceled)

7. A method for authenticating a transaction performed by a user operating a client device which contains a cookie, the cookie including at least a first identifier associated with the client device, and wherein a behavior profile is associated with the user and stored on a server, the method comprising the steps of:

a. performing a first comparison between one or more factors derived from the transaction and one or more factors stored in the behavior profile;

b. performing a second comparison between the first device identifier and a second device identifier derived from the transaction;

c. performing a third comparison between a last access time associated with the user and stored in the behavior profile and a last access time stored in the cookie; and

d. authenticating the transaction based on the first comparison, the second comparison, and the third comparison.

8. The method of claim 7, wherein a factor is at least one of an access location, access date, access time, geographical location, domain information, network Id, connection type, one or more IP addresses, user name, email address, debit card number, credit card number, bank account number, social security number, HTTP header information, travel velocity, telephone number, area code, transaction frequency, operating system, processor identification number, natural language, host type, demographic information, or advertising information.

9. The method of claim 7, wherein the behavior profile includes a unique identifier associated with the user.

10. The method of claim 9, wherein the unique identifier is one of a user name, debit card number, credit card number, bank account number, or social security number.

11. The method of claim 7, wherein the first device identifier and the second device identifier each comprise HTTP header information.

12. The method of claim 7, wherein the contents of the cookie are encrypted.

13. The method of claim 12, wherein a key to decrypt the cookie is stored in the behavior profile.

14. The method of claim 13, further comprising the step of decrypting the contents of the cookie using the key.

15. The method of claim 7, wherein the authenticating step comprises the step of authenticating the transaction based on the first comparison, the second comparison, the third comparison, and a comparison between an IP address associated with the transaction and a plurality of IP addresses stored in the cookie.

16-25. -25. (canceled)