ELECTRONIC VERIFICATION SERVICE SYSTEMS AND METHODS

• US 20090178120A1
• Filed: 01/08/2008
• Published: 07/09/2009
• Est. Priority Date: 01/08/2008
• Status: Active Grant

• Current Assignee: First Data Corporation (Fiserv Incorporated)
• Original Assignee: First Data Corporation (Fiserv Incorporated)
• Inventors: Freisheim, Robert A. JR., Royyuru, Vijay K., Conway, Craig, Ruppe, Daniel J., Sindaco, Jean M.
• Granted Patent: US 7,979,894 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G07C 9/23 by means of a password
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

Systems and methods for authenticating an applicant. In one implementation, the applicant indicates to an acquirer an existing account for which the applicant wishes to be authenticated. The acquirer sends a message over an electronic funds transfer (EFT) network to an issuer of the account requesting a set of questions to ask the applicant. The issuer replies with a set of questions. The acquirer asks the applicant the questions, and forwards the applicant'"'"'s answers to the issuer. The issuer compares the answers with known information relating to the account and decides, based on the comparison, whether the applicant is authenticated. The issuer then communicates its decision to the acquirer. Preferably, the messages and their associated replies are added to the set of messages handled by the EFT network, so that authentication may be handled in a standardized way without proliferating applicants'"'"' secret information.

Claims

1. A method of authenticating an applicant, the method performed by a computer executing a program stored on a computer readable medium, the method comprising:

receiving an indication of an existing account purportedly owned by the applicant;

transmitting a question request message, the question request message identifying the account and requesting one or more questions relating to the account to be asked to the applicant;

receiving a first reply in response to the question request message, the first reply comprising a set of the one or more questions;

asking the applicant the set of one or more questions relating to the account;

receiving answers to the questions from the applicant;

transmitting an answer message to an issuer of the account, the answer message comprising the applicant'"'"'s answers to the questions; and

receiving a second reply from the issuer in response to the answer message, the second reply indicating whether the applicant is authenticated as the owner of the account;

and wherein the messages and replies are carried over an electronic funds transfer network.

2. The method of claim 1, wherein the first reply is supplied by an operator of the electronic funds transfer network.

3. The method of claim 1, wherein the first reply is supplied by the issuer.

4. The method of claim 1, further comprising reformatting at least one of the questions before asking the applicant the questions.

5. The method of claim 1, wherein interaction with the applicant is accomplished through a series of web pages served over the Internet.

6. The method of claim 1, wherein interaction with the applicant is accomplished via telephone or at least in part via wireless communication.

7. The method of claim 1, wherein the method is performed by an acquirer, and wherein the acquirer does not learn the content of the answer message.

8. The method of claim 1, further comprising encrypting the content of the answer message before sending it over the electronic funds transfer network.

9. The method of claim 1, wherein the method is performed by an acquirer, and wherein the applicant is an applicant for enrollment in a service offered by the acquirer.

10. A method of authenticating an applicant, the method performed by a computer executing a program stored on a computer readable medium, comprising:

receiving a question request message, the question request message identifying an existing account and requesting a set of one or more questions relating to the account to be asked of the applicant;

transmitting a reply to the question request message, the reply to the question request message comprising the set of one or more questions;

receiving an answer message, the answer message comprising a set of answers given by an applicant to the set of one or more questions relating to the account;

comparing the answers with known information relating to the account;

deciding, based on the comparison, whether the applicant is authenticated as the account owner; and

transmitting a reply in response to the answer message, the reply to the answer message indicating whether the applicant is authenticated;

wherein the messages and replies are carried over an electronic funds transfer network.

11. The method of claim 10, further comprising selecting the one or more questions from a set of standard questions defined by an operator of the electronic funds transfer network.

12. The method of claim 11, further comprising supplying in advance, by an issuer of the account to an operator of the electronic funds transfer network, a list of challenge questions, and wherein the operator supplies the first reply comprising one or more questions from the list.

13. The method of claim 10, wherein at least one of the questions tests the applicant'"'"'s knowledge of secret information previously shared between the issuer and the holder of the account.

14. The method of claim 10, wherein at least one of the questions tests the applicant'"'"'s knowledge of a transaction history of the account.

15. The method of claim 14, wherein at least one of the questions tests the applicant'"'"'s knowledge of one or more patterns or anomalies in the transaction history of the account.

16. The method of claim 10, wherein at least one of the questions tests the applicant'"'"'s knowledge of a card associated with the account.

17. The method of claim 10, wherein at least one of the questions is formed such that the correct answer to the question changes over time.

18. The method of claim 10, wherein at least one of the questions tests the applicant'"'"'s knowledge of an object or piece of information provided by the issuer to the account holder for the purpose of later authentication.

19. The method of claim 10, wherein at least one of the questions is a multiple choice question.

20. The method of claim 10, wherein the first reply comprises formatting guidance for use in presenting the questions to the applicant.

21. The method of claim 10, wherein deciding, based on the comparison, whether the applicant is authenticated as the account owner further comprises deciding that the applicant is authenticated when the comparison indicates that the applicant supplied a first predetermined number of correct answers to a second predetermined number of questions.

22. A system for authenticating an applicant, the system comprising:

a host computer executing a program stored on a computer readable medium, the host computer configured to

receive an indication of an account purportedly owned by the applicant;

transmit, over an electronic funds transfer network, a question request message, the question request message identifying the account and requesting a set of one or more questions about the account to be asked to the applicant;

receive, over the electronic funds transfer network, a first reply in response to the question request message, the first reply comprising the set of one or more questions;

ask the applicant the questions;

receive, from the applicant, answers to the questions;

transmit, over the electronic funds transfer network, an answer message to an issuer of the account, the answer message comprising the applicant'"'"'s answers to the questions; and

receive, over the electronic funds transfer network, a second reply from the issuer in response to the answer message, the second reply indicating whether the applicant is authenticated as the owner of the account.

23. The system of claim 22, wherein the host computer is configured to interact with the applicant via a series of web pages served over the Internet.

24. A system for authenticating an applicant, the system comprising:

a host computer executing a program stored on a computer readable medium, the host computer configured to

receive, over an electronic funds transfer network, a question request message, the question request message identifying an account and requesting one or more questions relating to the account to be asked of the applicant;

transmit, over the electronic funds transfer network in response to the question request message a first reply, the first reply comprising the one or more questions;

receive, over the electronic funds transfer network, an answer message, the answer message comprising a set of answers given by the applicant to the questions;

compare the answers with known information relating to the account;

decide, based on the comparison, whether the applicant is authenticated as the account owner; and

transmit, over the electronic funds transfer network, a second reply in response to the answer message, the second reply indicating whether the applicant is authenticated.

25. A method comprising adding, to a set of messages handled by an electronic funds transfer network, two messages and their associated replies, wherein:

the first message requests a set of questions to be asked of an applicant for authentication;

the reply to the first message comprises a set of questions to ask the applicant;

the second message communicates the applicant'"'"'s answers to a recipient of the second message; and

the reply to the second message communicates an indication of whether the applicant is authenticated.

26. The method of claim 25, wherein the questions and answers are carried in existing data elements in a message format based at least in part on the ISO 8583 standard.