ADAPTIVE AUTHENTICATION OPTIONS

• US 20080120214A1
• Filed: 11/06/2007
• Published: 05/22/2008
• Est. Priority Date: 11/16/2006
• Status: Active Grant

• Current Assignee: Visa USA, Inc. (Visa, Inc.)
• Original Assignee: Visa USA, Inc. (Visa, Inc.)
• Inventors: Yakel, Mike, Faith, Patrick, Weller, Kevin, Steele, Kim, Van Deloo, Lori D.
• Granted Patent: US 10,346,837 B2
• Time in Patent Office: Days
• US Class Current: 705/35
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

A method for authenticating a consumer for a portable consumer device is disclosed. One embodiment of the invention includes receiving a transaction message relating to a request by a consumer to conduct a transaction using a portable consumer device, wherein the consumer was previously enrolled in an authentication program and the consumer was previously authenticated, analyzing the transaction message to determine if a re-authentication event has taken place, causing a re-authentication message to be sent to the consumer before initiating an authorization request message to the issuer if the re-authentication event has taken place, and initiating the authorization request message to the issuer without sending the re-authentication message to the consumer if the re-authentication event has not taken place.

Claims

1. A method comprising:

receiving a transaction message relating to a request by a consumer to conduct a transaction using a portable consumer device, wherein the consumer was previously enrolled in an authentication program and the consumer was previously authenticated;

analyzing the transaction message to determine if a re-authentication event has taken place;

causing a re-authentication message to be sent to the consumer before initiating an authorization request message to the issuer if the re-authentication event has taken place; and

initiating the authorization request message to the issuer without sending the re-authentication message to the consumer if the re-authentication event has not taken place.

2. The method of claim 1, wherein the transaction is a purchase transaction.

3. The method of claim 1, wherein the re-authentication event is a change in the consumer'"'"'s home address, shipping address, billing address, email address, name, account number, payment method, portable consumer device expiration date, or password, and wherein the consumer was previously authenticated to an issuer of the portable consumer device.

4. The method of claim 1, wherein the re-authentication event is a new or different IP address, an out of pattern activity, an order amount above a specified dollar amount, or a long period of inactivity in the account.

5. The method of claim 1, wherein the re-authentication event is where a previous transaction was an authentication failure or attempt.

6. The method of claim 1, wherein the re-authentication event is a change in payment terms.

7. The method of claim 1, wherein the re-authentication event is where authentication occurred more than a pre-set amount of times in the past and have failed.

8. The method of claim 1 wherein the transaction is a purchase transaction and involves a recurring payment, a micro-payment, or a one-step online payment.

9. The method of claim 1 further comprising:

sending an authentication message to a merchant, wherein the merchant thereafter sends an authorization request message to the issuer and the issuer thereafter returns an authorization response message back to the merchant.

10. The method of claim 1 wherein the portable consumer device is in the form of a card.

11. A method comprising:

sending a transaction message to a website by a consumer using a portable consumer device, wherein the consumer was previously enrolled in an authentication program;

receiving a re-authentication request for re-authentication information only if a re-authentication event has taken place; and

sending re-authentication information in response to the re-authentication request.

12. The method of claim 11, wherein the re-authentication information is selected from the group consisting of a password, a card verification value, a social security number, the consumer'"'"'s date of birth, and the consumer'"'"'s email address.

13. A computer readable medium comprising:

code for sending a transaction message to a website by a consumer using a portable consumer device, wherein the consumer was previously enrolled in an authentication program;

code for receiving a re-authentication request for re-authentication information only if a re-authentication event has taken place; and

code for sending re-authentication information in response to the re-authentication request.

14. A client terminal comprising the computer readable medium of claim 13.

15. A computer readable medium comprising:

code for receiving a transaction message relating to a request by a consumer to conduct a transaction using a portable consumer device, wherein the consumer was previously enrolled in an authentication program and the consumer was previously authenticated;

code for analyzing the transaction message to determine if a re-authentication event has taken place;

code for causing a re-authentication message to be sent to the consumer before initiating an authorization request message to the issuer if the re-authentication event has taken place; and

code for initiating the authorization request message to the issuer without sending the re-authentication message to the consumer if the re-authentication event has not taken place.

16. A server computer comprising the computer readable medium of claim 15.

17. A computer readable medium comprising:

code for receiving a transaction message relating to a request by a consumer to conduct a transaction using a portable consumer device;

code for analyzing the transaction message to determine if a re-authentication event has taken place;

code for causing an authentication message to be sent to the consumer before initiating an authorization request message if the re-authentication event has taken place; and

code for initiating the authorization request message without sending the authentication message to the consumer if the re-authentication event has not taken place, wherein the transaction is one of a recurring payment, a micro-payment, or a one-step online payment.

18. A server computer comprising the computer readable medium of claim 17.

19. A method comprising:

receiving a transaction message relating to a request by a consumer to conduct a transaction using a portable consumer device;

analyzing the transaction message to determine if a re-authentication event has taken place;

causing an authentication message to be sent to the consumer before initiating an authorization request message if the re-authentication event has taken place; and

initiating the authorization request message without sending the authentication message to the consumer if the re-authentication event has not taken place, wherein the transaction uses at least one of a recurring payment, a micro-payment, or a one-step online payment.

20. A computer readable medium comprising code for performing the method of claim 19.

21. A server computer comprising the computer readable medium of claim 20.