METRICS SYSTEMS AND METHODS FOR TOKEN TRANSACTIONS

• US 20090048953A1
• Filed: 08/16/2007
• Published: 02/19/2009
• Est. Priority Date: 08/16/2007
• Status: Active Grant

• Current Assignee: Verifone, Inc. (Verifone Systems, Inc.)
• Original Assignee: Verifone, Inc. (Verifone Systems, Inc.)
• Inventors: Yale, Scott, Hazel, Patrick, Wood, Blake Joseph, Catinella, Paul Elbridge, von Mueller, Clay
• Granted Patent: US 8,355,982 B2
• Time in Patent Office: Days
• US Class Current: 705/35
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/389 Keeping log of transactions for guaranteeing non-repudiation of a transaction
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 20/403 Solvency checks
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G07F 7/084 Additional components relating to data transfer and storing, e.g. error detection, self-diagnosis
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: G07G 3/003 Anti-theft control theft alarms G08B13/00

Abstract

Systems and methods for monitoring token access transactions are provided. In one embodiment, the invention provides receiving transaction records for a plurality of bank card transactions, wherein the transaction records include transaction information and infrastructure information; determining whether a reportable event has occurred based on the transaction information with the transaction records; and providing an alert representing the reportable event.

Claims

1. A method of evaluating bank card transactions, comprising:

receiving transaction records for a plurality of bank card transactions, wherein the transaction records include transaction information and infrastructure information;

determining whether a reportable event has occurred based on the transaction information with the transaction records; and

providing an alert representing the reportable event.

2. The method of claim 1, wherein the infrastructure information comprises an identification of a card swipe terminal used in a transaction and the encryption status of the card swipe terminal for that transaction.

3. The method of claim 2, wherein the identification of the card swipe terminal comprises a terminal ID.

4. The method of claim 2, wherein the identification of the card swipe terminal comprises a serial number of the terminal.

5. The method of claim 2, wherein the alert is sent to a merchant identified with the card swipe terminal notifying the merchant of the encrypting status of the merchant'"'"'s terminal.

6. The method of claim 2, wherein the alert is sent to an issuing bank of the bank card used in the transaction, informing the issuing bank of the encrypting status of the merchant'"'"'s terminal.

7. The method of claim 1, wherein the transaction records include authentication information identifying authenticity of the bank card used in a bank card transaction.

8. The method of claim 7, wherein the alert is sent to a merchant identified with the card swipe terminal notifying the merchant that the bank card used in the bank card transaction is not an authentic token.

9. The method of claim 7, wherein the alert is sent to an issuing bank of the bank card used in the transaction, informing the issuing bank that a skimmed or otherwise unauthenticated token was presented for a transaction.

10. The method of claim 1, wherein the alert comprises an email message generated and sent to a designated holder of a bank card used in a bank card transaction upon occurrence of the bank card transaction.

11. The method of claim 1, wherein the transaction information comprises information used to determine whether a bank card is being used in multiple duplicate bank card transactions.

12. The method of claim 11, wherein the transaction information includes a counter value.

13. The method of claim 12, wherein the counter value is a value of a counter at a terminal at which the bank card is presented for the transaction, and wherein the counter is incremented upon execution of a predetermined quantity of transactions.

14. The method of claim 12, wherein the counter value is used to encrypt at least a portion of the transaction data.

15. The method of claim 11, wherein the alert is sent to an issuing bank of the bank card used in the multiple duplicate transactions.

16. The method of claim 11, wherein the alert is sent to an authorized holder of the bank card used in the multiple duplicate transactions.

17. The method of claim 1, wherein the transaction information comprises location information used to determine a location of a terminal used in the transaction.

18. The method of claim 17, wherein the location information is compared with a predetermined location of the terminal to determine the validity of the transaction.

19. The method of claim 17, wherein the location information for a presented bank card is compared with other transactions for the same bank card to identify possible fraudulent activity.

20. The method of claim 17, wherein the location information for a presented bank card is compared with location and time-stamp information for other transactions for the same bank card to identify possible fraudulent activity.

21. The method of claim 1, wherein the transaction information comprises time-stamp information.

22. The method of claim 1, wherein the alert comprises data indicating whether a given terminal is operating in an encrypting mode.

23. The method of claim 1, wherein the alert comprises data indicating whether a given terminal is operating in an authenticating mode.

24. The method of claim 1, wherein the alert comprises a report indicating a quantity of replay attacks.

25. The method of claim 1, wherein the alert comprises a report indicating a quantity of transactions on a compromised terminal.

26. The method of claim 1, wherein the bank card comprises a magnetic stripe card, a smart card or other token.

27. A server system for evaluating bank card transactions, comprising:

a processor configured to execute a plurality of instructions;

a data storage device coupled to the processor and configured to store the plurality of instructions;

a first module configured to receive transaction records for a plurality of bank card transactions, wherein the transaction records include transaction information and infrastructure information;

a second module configured to determine whether a reportable event has occurred based on the transaction information with the transaction records; and

a third module configured to provide an alert representing the reportable event;

wherein the modules comprise hardware coupled to the processor or computer

usable medium having computer program code configured to cause the processor to perform the recited function, or a combination thereof.

28. The system of claim 27, wherein the infrastructure information comprises an identification of a card swipe terminal used in a transaction and the encryption status of the card swipe terminal for that transaction.

29. The system of claim 28, wherein the identification of the card swipe terminal comprises a terminal ID.

30. The system of claim 28, wherein the identification of the card swipe terminal comprises a serial number of the terminal.

31. The system of claim 28, wherein the alert is sent to a merchant identified with the card swipe terminal notifying the merchant of the encrypting status of the merchant'"'"'s terminal.

32. The system of claim 28, wherein the alert is sent to an issuing bank of the bank card used in the transaction, informing the issuing bank of the encrypting status of the merchant'"'"'s terminal.

33. The system of claim 27, wherein the transaction records include authentication information identifying authenticity of the bank card used in a bank card transaction.

34. The system of claim 33, wherein the alert is sent to a merchant identified with the card swipe terminal notifying the merchant that the bank card used in the bank card transaction is not an authentic token.

35. The system of claim 33, wherein the alert is sent to an issuing bank of the bank card used in the transaction, informing the issuing bank that a skimmed or otherwise unauthenticated token was presented for a transaction.

36. The system of claim 27, wherein the alert comprises an email message generated and sent to a designated holder of a bank card used in a bank card transaction upon occurrence of the bank card transaction.

37. The system of claim 27, wherein the transaction information comprises information used to determine whether a bank card is being used in multiple duplicate bank card transactions.

38. The system of claim 37, wherein the transaction information includes a counter value.

39. The system of claim 38, wherein the counter value is a value of a counter at a terminal at which the bank card is presented for the transaction, and wherein the counter is incremented upon execution of a predetermined quantity of transactions.

40. The system of claim 39, wherein the counter value is used to encrypt at least a portion of the transaction data.

41. The system of claim 37, wherein the alert is sent to an issuing bank of the bank card used in the multiple duplicate transactions.

42. The system of claim 37, wherein the alert is sent to an authorized holder of the bank card used in the multiple duplicate transactions.

43. The system of claim 27, wherein the transaction information comprises location information used to determine a location of a terminal used in the transaction.

44. The system of claim 43, wherein the location information is compared with a predetermined location of the terminal to determine the validity of the transaction.

45. The system of claim 43, wherein the location information for a presented bank card is compared with other transactions for the same bank card to identify possible fraudulent activity.

46. The system of claim 43, wherein the location information for a presented bank card is compared with location and time-stamp information for other transactions for the same bank card to identify possible fraudulent activity.

47. The system of claim 27, wherein the transaction information comprises time-stamp information.

48. The system of claim 27, wherein the alert comprises data indicating whether a given terminal is operating in an encrypting mode.

49. The system of claim 27, wherein the alert comprises data indicating whether a given terminal is operating in an authenticating mode.

50. The system of claim 27, wherein the alert comprises a report indicating a quantity of replay attacks.

51. The system of claim 27, wherein the alert comprises a report indicating a quantity of transactions on a compromised terminal.