DYNAMIC ITINERARY-DRIVEN PROFILING FOR PREVENTING UNAUTHORIZED CARD TRANSACTIONS

• US 20100023455A1
• Filed: 09/16/2008
• Published: 01/28/2010
• Est. Priority Date: 07/24/2008
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Dispensa, Jean-Claude, Gregoire, Philippe, Picard, Dominique
• Granted Patent: US 8,229,853 B2
• Time in Patent Office: Days
• US Class Current: 705/44
• CPC Class Codes: G06Q 10/02 Reservations, e.g. for tickets, services or events
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes

Abstract

A method and system for preventing unauthorized card transactions via dynamic itinerary-driven profiling. Authorization record(s) including authorized geographic locations and authorized periods of time are received from a travel reservation system (TRS). The authorization record(s) identify an itinerary specified by a travel booking(s) purchased via the TRS using a debit or credit card. The itinerary specifies that the cardholder is scheduled to be in the authorized geographic locations for the authorized periods of time. In response to receiving a request for an authorization of a card transaction, a location and date associated with the card transaction are retrieved from the request. The card transaction is rejected based on a determination that the retrieved location is not within the authorized geographic locations and/or the retrieved date is not within the authorized periods of time. A notification of the retrieved location and retrieved date is logged and displayed.

Claims

1. A computer-implemented method of preventing an unauthorized card transaction via dynamic itinerary-driven profiling, comprising:

receiving, by a first computing system and from a travel reservation system (TRS) executing on a second computing system, an authorization record, wherein said authorization record includes an identifier of a cardholder to whom a card is issued, an identifier of said card, one or more identifiers that specify an authorized geographic location, an identification of a travel itinerary associated with a trip to be taken by said cardholder, an authorized period of time, and an authorization indicator that indicates that a usage of said card in said authorized geographic location in said authorized period of time is granted, wherein said card is a credit card or a debit card, wherein said card is used by said cardholder for a purchase, via said TRS, of one or more geo-localized travel bookings that specify said travel itinerary, and wherein said travel itinerary specifies that in said trip said cardholder is scheduled to be in said authorized geographic location for said authorized period of time;

storing, by said first computing system and in response to said receiving said authorization record, said authorization record in a profile table included in a database residing on a computer data storage unit;

receiving, by said first computing system and subsequent to said storing, a request for an authorization of a card transaction that is initiated via a usage of said card;

retrieving, by said first computing system, from said request, and in response to said receiving said request for said authorization, said identifier of said card, an identifier of a retrieved location in which said card transaction is initiated and a retrieved date on which said card transaction is initiated;

determining a rejection condition by said first computing system and subsequent to said retrieving from said request, wherein said determining said rejection condition includes;

comparing said retrieved date to said authorized period of time included in said authorization record and to any other authorized period of time included in any other authorization record stored in said profile table;

retrieving one or more authorization records from said profile table based on a result of said comparing said retrieved date, wherein said one or more authorization records include one or more authorized periods of time and one or more authorized geographic locations, wherein each authorized period of time includes said retrieved date, wherein said authorization record is included in said one or more authorization records, wherein said authorized period of time is included in said one or more authorized periods of time, and wherein said authorized geographic location is included in said one or more authorized geographic locations;

comparing said retrieved location to said one or more authorized geographic locations; and

determining that said one or more authorized geographic locations do not include said retrieved location based on a result of said comparing said retrieved location;

rejecting, by said first computing system and in response to said determining said rejection condition, said card transaction; and

sending, by said first computing system and subsequent to said determining said rejection condition, a notification for display on a display device, wherein said notification includes said retrieved location and said retrieved date.

2. The method of claim 1, further comprising:

purchasing, prior to said receiving said authorization record and via said TRS, said one or more geo-localized travel bookings, wherein said purchasing includes using said card for a payment for said one or more geo-localized travel bookings,

wherein said receiving said authorization record includes receiving a request for an addition of said authorization record to said profile table, wherein said request includes a set of profiling data and an authentication, and wherein said set of profiling data includes said identifier of said cardholder, said identifier of said card, said one or more identifiers that specify said authorized geographic location, said identification of said travel itinerary, and said authorized period of time;

retrieving, by said first computing system, from said request for said addition of said authorization record, and subsequent to said receiving said request for said addition of said authorization record, said set of profiling data and said authentication;

verifying said authentication by said first computing system and subsequent to said retrieving said authentication; and

validating said set of profiling data by said first computing system and subsequent to said retrieving said set of profiling data,

wherein said storing said authorization record includes adding, subsequent to said validating, said set of profiling data as said authentication record in said profile table.

3. The method of claim 1, further comprising:

receiving, by said first computing system, a request from said TRS for a cancellation of said travel itinerary;

retrieving, by said first computing system, from said request for said cancellation, and subsequent to said receiving said request for said cancellation, a set of profiling data and an authentication, wherein said set of profiling data includes said identifier of said card and said identification of said travel itinerary;

determining, by said first computing system, that said identifier of said card is included in said authentication record in said profile table;

verifying said authentication by said first computing system and subsequent to said retrieving said authentication; and

removing, subsequent to said verifying said authentication, said authentication record from said profile table.

4. The method of claim 1, wherein said one or more authorization records further include one or more tolerance values, wherein said one or more timing tolerance values indicate one or more tolerances for said one or more authorized periods of time, wherein said comparing said retrieved date includes comparing said retrieved date to an extended period of time associated with said authorization record and to any other extended period of time associated with any other authorization record stored in said profile table, wherein said extended period of time is indicated by a start of said authorized period of time minus a timing tolerance value of said one or more timing tolerance values and by an end of said authorized period of time plus said timing tolerance value, wherein said retrieving said one or more authorization records is further based on a result of said comparing said retrieved date to said extended period of time and to said any other extended period of time, and wherein said extended period of time and said any other extended period of time include said retrieved date.

5. The method of claim 1, wherein said one or more authorization records further include one or more geographic tolerance values, wherein said one or more geographic tolerance values indicate one or more tolerances for said one or more authorized geographic locations, wherein said comparing said retrieved location includes comparing said retrieved location to a geographic footprint associated with said authorization record and to any other geographic footprint associated with any other authorization record included in said one or more authorization records, wherein said geographic footprint is said authorized geographic location extended by an operation that utilizes a geographic tolerance value of said one or more geographic tolerance values, wherein said determining that said one or more authorized geographic locations do not include said retrieved location is further based on a result of said comparing said retrieved location to said geographic location to said geographic footprint and to said any other geographic footprint, and wherein said determining that said one or more authorized geographic locations do not include said retrieved location includes determining that said geographic footprint and said any other geographic footprint do not include said retrieved location.

6. The method of claim 1, further comprising:

receiving, by said first computing system, a notification of a change of an arrival or a departure of a mode of transportation used in said travel itinerary; and

automatically updating, by said first computing system in real-time and in response to said receiving said notification of said change, said authorized period of time based on said change.

7. The method of claim 1, further comprising:

receiving, by said first computing system and subsequent to said storing, a second request for an authorization of a second card transaction that is initiated via a second usage of said card;

retrieving, by said first computing system, from said second request, and subsequent to said receiving said second request for said authorization, said identifier of said card, an identifier of a second retrieved location, and a second retrieved date;

determining an acceptance condition by said first computing system and subsequent to said retrieving from said second request, wherein said determining said acceptance condition includes;

comparing said second retrieved date to said authorized period of time included in said authorization record and to any other authorized period of time included in any other authorization record stored in said profile table;

retrieving a second set of one or more authorization records from said profile table based on a result of said comparing said second retrieved date, wherein said second set of one or more authorization records includes a second set of one or more authorized periods of time and a second set of one or more authorized geographic locations, wherein each authorized period of time of said second set of one or more authorized periods of time includes said second retrieved date;

comparing said second retrieved location to said authorized geographic location included in said second set of one or more authorized geographic locations; and

determining that said authorized geographic location includes said second retrieved location based on a result of said comparing said second retrieved location; and

authorizing, by said first computing system and in response to said determining said acceptance condition, said second card transaction.

8. The method of claim 1, further comprising storing, subsequent to said determining said rejection condition, an audit record in a database residing on a computer data storage device, wherein said audit record includes said retrieved location and said retrieved date.

9. A first computing system comprising a processor and a computer-readable memory unit coupled to said processor, said memory unit containing instructions that when executed by said processor implement a method of preventing an unauthorized card transaction via dynamic itinerary-driven profiling, said method comprising:

receiving, from a travel reservation system (TRS) executing on a second computing system, an authorization record, wherein said authorization record includes an identifier of a cardholder to whom a card is issued, an identifier of said card, one or more identifiers that specify an authorized geographic location, an identification of a travel itinerary associated with a trip to be taken by said cardholder, an authorized period of time, and an authorization indicator that indicates that a usage of said card in said authorized geographic location in said authorized period of time is granted, wherein said card is a credit card or a debit card, wherein said card is used by said cardholder for a purchase, via said TRS, of one or more geo-localized travel bookings that specify said travel itinerary, and wherein said travel itinerary specifies that in said trip said cardholder is scheduled to be in said authorized geographic location for said authorized period of time;

storing, in response to said receiving said authorization record, said authorization record in a profile table included in a database residing on a computer data storage unit;

receiving, subsequent to said storing, a request for an authorization of a card transaction that is initiated via a usage of said card;

retrieving, from said request and in response to said receiving said request for said authorization, said identifier of said card, an identifier of a retrieved location in which said card transaction is initiated and a retrieved date on which said card transaction is initiated;

determining a rejection condition subsequent to said retrieving from said request, wherein said determining said rejection condition includes;

comparing said retrieved date to said authorized period of time included in said authorization record and to any other authorized period of time included in any other authorization record stored in said profile table;

retrieving one or more authorization records from said profile table based on a result of said comparing said retrieved date, wherein said one or more authorization records include one or more authorized periods of time and one or more authorized geographic locations, wherein each authorized period of time includes said retrieved date, wherein said authorization record is included in said one or more authorization records, wherein said authorized period of time is included in said one or more authorized periods of time, and wherein said authorized geographic location is included in said one or more authorized geographic locations;

comparing said retrieved location to said one or more authorized geographic locations; and

determining that said one or more authorized geographic locations do not include said retrieved location based on a result of said comparing said retrieved location;

rejecting, in response to said determining said rejection condition, said card transaction; and

sending, subsequent to said determining said rejection condition, a notification for display on a display device, wherein said notification includes said retrieved location and said retrieved date.

10. The system of claim 9, wherein said method further comprises:

purchasing, prior to said receiving said authorization record and via said TRS, said one or more geo-localized travel bookings, wherein said purchasing includes using said card for a payment for said one or more geo-localized travel bookings,

wherein said receiving said authorization record includes receiving a request for an addition of said authorization record to said profile table, wherein said request includes a set of profiling data and an authentication, and wherein said set of profiling data includes said identifier of said cardholder, said identifier of said card, said one or more identifiers that specify said authorized geographic location, said identification of said travel itinerary, and said authorized period of time;

retrieving, from said request for said addition of said authorization record and subsequent to said receiving said request for said addition of said authorization record, said set of profiling data and said authentication;

verifying said authentication subsequent to said retrieving said authentication; and

validating said set of profiling data subsequent to said retrieving said set of profiling data,

wherein said storing said authorization record includes adding, subsequent to said validating, said set of profiling data as said authentication record in said profile table.

11. The system of claim 9, wherein said method further comprises:

receiving a request from said TRS for a cancellation of said travel itinerary;

retrieving, from said request for said cancellation and subsequent to said receiving said request for said cancellation, a set of profiling data and an authentication, wherein said set of profiling data includes said identifier of said card and said identification of said travel itinerary;

determining that said identifier of said card is included in said authentication record in said profile table;

verifying said authentication subsequent to said retrieving said authentication; and

removing, subsequent to said verifying said authentication, said authentication record from said profile table.

12. A computer program product, comprising a computer-usable medium having a computer-readable program code embodied therein, said computer-readable program code containing instructions that when executed by a processor of a first computing system implement a method of preventing an unauthorized card transaction via dynamic itinerary-driven profiling, said method comprising:

receiving, from a travel reservation system (TRS) executing on a second computing system, an authorization record, wherein said authorization record includes an identifier of a cardholder to whom a card is issued, an identifier of said card, one or more identifiers that specify an authorized geographic location, an identification of a travel itinerary associated with a trip to be taken by said cardholder, an authorized period of time, and an authorization indicator that indicates that a usage of said card in said authorized geographic location in said authorized period of time is granted, wherein said card is a credit card or a debit card, wherein said card is used by said cardholder for a purchase, via said TRS, of one or more geo-localized travel bookings that specify said travel itinerary, and wherein said travel itinerary specifies that in said trip said cardholder is scheduled to be in said authorized geographic location for said authorized period of time;

storing, in response to said receiving said authorization record, said authorization record in a profile table included in a database residing on a computer data storage unit;

receiving, subsequent to said storing, a request for an authorization of a card transaction that is initiated via a usage of said card;

retrieving, from said request and in response to said receiving said request for said authorization, said identifier of said card, an identifier of a retrieved location in which said card transaction is initiated and a retrieved date on which said card transaction is initiated;

determining a rejection condition subsequent to said retrieving from said request, wherein said determining said rejection condition includes;

comparing said retrieved date to said authorized period of time included in said authorization record and to any other authorized period of time included in any other authorization record stored in said profile table;

retrieving one or more authorization records from said profile table based on a result of said comparing said retrieved date, wherein said one or more authorization records include one or more authorized periods of time and one or more authorized geographic locations, wherein each authorized period of time includes said retrieved date, wherein said authorization record is included in said one or more authorization records, wherein said authorized period of time is included in said one or more authorized periods of time, and wherein said authorized geographic location is included in said one or more authorized geographic locations;

comparing said retrieved location to said one or more authorized geographic locations; and

determining that said one or more authorized geographic locations do not include said retrieved location based on a result of said comparing said retrieved location;

rejecting, in response to said determining said rejection condition, said card transaction; and

sending, subsequent to said determining said rejection condition, a notification for display on a display device, wherein said notification includes said retrieved location and said retrieved date.

13. The program product of claim 12, wherein said method further comprises:

purchasing, prior to said receiving said authorization record and via said TRS, said one or more geo-localized travel bookings, wherein said purchasing includes using said card for a payment for said one or more geo-localized travel bookings,

wherein said receiving said authorization record includes receiving a request for an addition of said authorization record to said profile table, wherein said request includes a set of profiling data and an authentication, and wherein said set of profiling data includes said identifier of said cardholder, said identifier of said card, said one or more identifiers that specify said authorized geographic location, said identification of said travel itinerary, and said authorized period of time;

retrieving, from said request for said addition of said authorization record and subsequent to said receiving said request for said addition of said authorization record, said set of profiling data and said authentication;

verifying said authentication subsequent to said retrieving said authentication; and

validating said set of profiling data subsequent to said retrieving said set of profiling data,

wherein said storing said authorization record includes adding, subsequent to said validating, said set of profiling data as said authentication record in said profile table.

14. The program product of claim 12, wherein said method further comprises:

receiving a request from said TRS for a cancellation of said travel itinerary;

retrieving, from said request for said cancellation and subsequent to said receiving said request for said cancellation, a set of profiling data and an authentication, wherein said set of profiling data includes said identifier of said card and said identification of said travel itinerary;

determining that said identifier of said card is included in said authentication record in said profile table;

verifying said authentication subsequent to said retrieving said authentication; and

removing, subsequent to said verifying said authentication, said authentication record from said profile table.

15. The program product of claim 12, wherein said one or more authorization records further include one or more tolerance values, wherein said one or more timing tolerance values indicate one or more tolerances for said one or more authorized periods of time, wherein said comparing said retrieved date includes comparing said retrieved date to an extended period of time associated with said authorization record and to any other extended period of time associated with any other authorization record stored in said profile table, wherein said extended period of time is indicated by a start of said authorized period of time minus a timing tolerance value of said one or more said one or more timing tolerance values and by an end of said authorized period of time plus said timing tolerance value, wherein said retrieving said one or more authorization records is further based on a result of said comparing said retrieved date to said extended period of time and to said any other extended period of time, and wherein said extended period of time and said any other extended period of time include said retrieved date.

16. The program product of claim 12, wherein said one or more authorization records further include one or more geographic tolerance values, wherein said one or more geographic tolerance values indicate one or more tolerances for said one or more authorized geographic locations, wherein said comparing said retrieved location includes comparing said retrieved location to a geographic footprint associated with said authorization record and to any other geographic footprint associated with any other authorization record included in said one or more authorization records, wherein said geographic footprint is said authorized geographic location extended by an operation that utilizes a geographic tolerance value of said one or more geographic tolerance values, wherein said determining that said one or more authorized geographic locations do not include said retrieved location is further based on a result of said comparing said retrieved location to said geographic footprint and to said any other geographic footprint, and wherein said determining that said one or more authorized geographic locations do not include said retrieved location includes determining that said geographic footprint and said any other geographic footprint do not include said retrieved location.

17. The program product of claim 12, wherein said method further comprises:

receiving a notification of a change of an arrival or a departure of a mode of transportation used in said travel itinerary; and

automatically updating, in real-time and in response to said receiving said notification of said change, said authorized period of time based on said change.

18. The program product of claim 12, wherein said method further comprises:

receiving, subsequent to said storing, a second request for an authorization of a second card transaction that is initiated via a second usage of said card;

retrieving, from said second request and subsequent to said receiving said second request for said authorization, said identifier of said card, an identifier of a second retrieved location, and a second retrieved date;

determining an acceptance condition subsequent to said retrieving from said second request, wherein said determining said acceptance condition includes;

comparing said second retrieved date to said authorized period of time included in said authorization record and to any other authorized period of time included in any other authorization record stored in said profile table;

retrieving a second set of one or more authorization records from said profile table based on a result of said comparing said second retrieved date, wherein said second set of one or more authorization records includes a second set of one or more authorized periods of time and a second set of one or more authorized geographic locations, wherein each authorized period of time of said second set of one or more authorized periods of time includes said second retrieved date;

comparing said second retrieved location to said authorized geographic location included in said second set of one or more authorized geographic locations; and

determining that said authorized geographic location includes said second retrieved location based on a result of said comparing said second retrieved location; and

authorizing, in response to said determining said acceptance condition, said second card transaction.

19. A process for supporting computing infrastructure, said process comprising providing at least one support service for at least one of creating, integrating, hosting, maintaining, and deploying computer-readable code in a first computing system, wherein the code in combination with the first computing system is capable of performing a method of preventing an unauthorized card transaction via dynamic itinerary-driven profiling, said method comprising:

receiving, from a travel reservation system (TRS) executing on a second computing system, an authorization record, wherein said authorization record includes an identifier of a cardholder to whom a card is issued, an identifier of said card, one or more identifiers that specify an authorized geographic location, an identification of a travel itinerary associated with a trip to be taken by said cardholder, an authorized period of time, and an authorization indicator that indicates that a usage of said card in said authorized geographic location in said authorized period of time is granted, wherein said card is a credit card or a debit card, wherein said card is used by said cardholder for a purchase, via said TRS, of one or more geo-localized travel bookings that specify said travel itinerary, and wherein said travel itinerary specifies that in said trip said cardholder is scheduled to be in said authorized geographic location for said authorized period of time;

storing, in response to said receiving said authorization record, said authorization record in a profile table included in a database residing on a computer data storage unit;

receiving, subsequent to said storing, a request for an authorization of a card transaction that is initiated via a usage of said card;

retrieving, from said request and in response to said receiving said request for said authorization, said identifier of said card, an identifier of a retrieved location in which said card transaction is initiated and a retrieved date on which said card transaction is initiated;

determining a rejection condition subsequent to said retrieving from said request, wherein said determining said rejection condition includes;

comparing said retrieved date to said authorized period of time included in said authorization record and to any other authorized period of time included in any other authorization record stored in said profile table;

retrieving one or more authorization records from said profile table based on a result of said comparing said retrieved date, wherein said one or more authorization records include one or more authorized periods of time and one or more authorized geographic locations, wherein each authorized period of time includes said retrieved date, wherein said authorization record is included in said one or more authorization records, wherein said authorized period of time is included in said one or more authorized periods of time, and wherein said authorized geographic location is included in said one or more authorized geographic locations;

comparing said retrieved location to said one or more authorized geographic locations; and

determining that said one or more authorized geographic locations do not include said retrieved location based on a result of said comparing said retrieved location;

rejecting, in response to said determining said rejection condition, said card transaction; and

sending, subsequent to said determining said rejection condition, a notification for display on a display device, wherein said notification includes said retrieved location and said retrieved date.

20. The process of claim 19, wherein said method further comprises:

purchasing, prior to said receiving said authorization record and via said TRS, said one or more geo-localized travel bookings, wherein said purchasing includes using said card for a payment for said one or more geo-localized travel bookings,

wherein said receiving said authorization record includes receiving a request for an addition of said authorization record to said profile table, wherein said request includes a set of profiling data and an authentication, and wherein said set of profiling data includes said identifier of said cardholder, said identifier of said card, said one or more identifiers that specify said authorized geographic location, said identification of said travel itinerary, and said authorized period of time;

retrieving, from said request for said addition of said authorization record and subsequent to said receiving said request for said addition of said authorization record, said set of profiling data and said authentication;

verifying said authentication subsequent to said retrieving said authentication; and

validating said set of profiling data subsequent to said retrieving said set of profiling data,

wherein said storing said authorization record includes adding, subsequent to said validating, said set of profiling data as said authentication record in said profile table.