LOCATION OBFUSCATION FOR AUTHENTICATION

• US 20150186891A1
• Filed: 12/30/2014
• Published: 07/02/2015
• Est. Priority Date: 01/02/2014
• Status: Abandoned Application

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Wagner, Kim, Sheets, John
• Application Number:
  US14/585,770
• Publication Number:
  US 20150186891A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/3224 Transactions dependent on location of M-devices
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

Methods, system, and apparatuses are presented for performing location-based fraud detection (e.g., in e-commerce transactions) while alleviating privacy concerns. Location-based fraud detection may utilize an intermediary (i.e., third party server), which collects the actual location of mobile phones and then obfuscates the collected location information. Obfuscation of location information may comprise assigning region identifiers to geographical regions, where a region identifier can be associated with a transaction that was conducted in a corresponding geographical region. Overlapping regions of varying resolutions may be utilized, each region size corresponding to a set of regions. The intermediary may provide obfuscated location information to an entity (i.e., fraud detection system) that performs the location-based fraud detection based on the obfuscated location information. The entity may aggregate statistical values based on received obfuscated location information of a user'"'"'s historical transactions and utilize the values when performing the location-based fraud detection.

Claims

1. A method comprising:

receiving, at a fraud detection system, transaction data for a first transaction by a user, the transaction data including a first time of the first transaction;

receiving, at the fraud detection system from a third party server, a first region identifier that corresponds to a first geographical region in which the first transaction occurred at the first time, wherein the third party server is configured to;

store a mapping of geographical coordinates to region identifiers of geographical regions, each geographical region having an assigned region identifier;

determine first geographical coordinates of the user at the first time based on a location of a mobile device of the user; and

select the first region identifier from the region identifiers using the first geographical coordinates, the first region identifier obfuscating the first geographical coordinates from the fraud detection system;

accessing, by the fraud detection system, historical transaction information of the user from a database, the historical transaction information including one or more statistical values associated with each of a plurality of the region identifiers of geographical regions, each of the statistical values conveying an amount of transactions by the user within a specified time period for the geographical region corresponding to the region identifier associated with the statistical value;

identifying, by the fraud detection system, the one or more statistical values associated with the first region identifier received from the third party server; and

calculating, by the fraud detection system, a classification of fraud for the first transaction based on the one or more identified statistical values corresponding to the first region identifier.

2. The method of claim 1, further comprising:

not authorizing the first transaction if the classification of fraud for the first transaction exceeds a threshold.

3. The method of claim 1, further comprising:

sending an alert if the classification of fraud for the first transaction exceeds a threshold.

4. The method of claim 1, wherein a first set of the geographic regions are of a first size and a second set of the geographic regions are of a second size that is larger than the first size.

5. The method of claim 4, wherein at least a portion of the geographic regions of the first set overlap with two geographic regions of the second set.

6. The method of claim 5, wherein the first geographical region is of the second set, the method further comprising:

receiving, at the fraud detection system from the third party server, a second region identifier that corresponds to a second geographical region of the first set in which the first transaction occurred at the first time;

identifying that the second geographic region overlaps with the first geographical region and with a third geographical region of the second set, a third region identifier assigned to the third geographical region;

calculating, by the fraud detection system, the classification of fraud for the first transaction based further on the one or more identified statistical values corresponding to the third region identifier.

7. The method of claim 4, wherein the first geographical region is of the first set, the method further comprising:

receiving, at the fraud detection system from the third party server, a second region identifier that corresponds to a second geographical region of the second set in which the first transaction occurred at the first time;

identifying, by the fraud detection system, the one or more statistical values associated with the second region identifier received from the third party server; and

calculating, by the fraud detection system, the classification of fraud for the first transaction based further on the one or more identified statistical values corresponding to the second region identifier.

8. The method of claim 7, wherein calculating the classification of fraud for the first transaction based on the one or more identified statistical values corresponding to the first and second region identifiers includes:

calculating a first classification based on the one or more identified statistical values corresponding to the first identifier;

calculating a second classification based on the one or more identified statistical values corresponding to the second region identifier;

computing the classification of fraud as a combination of the first classification and the second classification, wherein the second classification is weighted less the first classification as a result of the second geographical region being larger than the first geographical region.

9. The method of claim 1, wherein the region identifiers are assigned randomly to the geographical regions.

10. The method of claim 1 further comprising:

periodically receiving an update of assignments of region identifiers to the geographical regions; and

changing the statistical values to be associated with the updated region identifiers of geographical regions.

11. The method of claim 1, wherein the classification of fraud comprises a numerical fraud score.

12. A fraud detection system comprising:

one or more processors;

a database storing historical transaction information including one or more statistical values associated with each of a plurality of region identifiers of geographical regions, each of the statistical values conveying an amount of transactions by a user within a specified time period for a geographical region corresponding to a region identifier associated with the statistical value; and

a non-transitory computer-readable storage medium comprising code executable by the one or more processors for implementing a method comprising;

receiving transaction data for a first transaction by the user, the transaction data including a first time of the first transaction;

receiving, from a third party server, a first region identifier that corresponds to a first geographical region in which the first transaction occurred at the first time, wherein the third party server is configured to;

store a mapping of geographical coordinates to region identifiers of geographical regions, each geographical region having an assigned region identifier;

determine first geographical coordinates of the user at the first time based on a location of a mobile device of the user; and

select the first region identifier from the region identifiers using the first geographical coordinates, the first region identifier obfuscating the first geographical coordinates;

accessing historical transaction information of the user from the database;

identifying the one or more statistical values associated with the first region identifier received from the third party server; and

calculating a classification of fraud for the first transaction based on the one or more identified statistical values corresponding to the first region identifier.

13. The fraud detection system of claim 12, wherein a first set of the geographic regions are of a first size and a second set of the geographic regions are of a second size that is larger than the first size.

14. The fraud detection system of claim 13, wherein the first geographical region is of the second set, the method further comprising:

receiving, from the third party server, a second region identifier that corresponds to a second geographical region of the first set in which the first transaction occurred at the first time;

identifying that the second geographic region overlaps with the first geographical region and with a third geographical region of the second set, a third region identifier assigned to the third geographical region;

calculating the classification of fraud for the first transaction based further on the one or more identified statistical values corresponding to the third region identifier.

15. The fraud detection system of claim 13, wherein the first geographical region is of the first set, the method further comprising:

receiving, from the third party server, a second region identifier that corresponds to a second geographical region of the second set in which the first transaction occurred at the first time;

identifying the one or more statistical values associated with the second region identifier received from the third party server; and

calculating the classification of fraud for the first transaction based further on the one or more identified statistical values corresponding to the second region identifier.

16. The fraud detection system of claim 15, wherein calculating the classification of fraud for the first transaction based on the one or more identified statistical values corresponding to the first and second region identifiers further includes:

calculating a first classification based on the one or more identified statistical values corresponding to the first identifier;

calculating a second classification based on the one or more identified statistical values corresponding to the second region identifier;

computing the classification of fraud as a combination of the first classification and the second classification, wherein the second classification is weighted less the first classification as a result of the second geographical region being larger than the first geographical region.

17. The fraud detection system of claim 12, the method further comprising:

periodically receiving, from the third party server, an update of assignments of region identifiers to the geographical regions; and

changing the statistical values to be associated with the updated region identifiers of geographical regions.

18. A third party server comprising:

one or more processors;

a database storing a mapping of geographical coordinates to region identifiers of geographical regions, each geographical region having an assigned region identifier; and

a non-transitory computer-readable storage medium comprising code executable by the one or more processors for implementing a method comprising;

receiving a request from a fraud detection system, the request indicating a first time corresponding to a first transaction;

determining first geographical coordinates of a user at the first time based on a location of a mobile device of the user; and

selecting a first region identifier from the region identifiers using the first geographical coordinates, the first region identifier corresponding to a first geographical region that includes the first geographical coordinates; and

sending the first region to the fraud detection system, wherein the first region identifier obfuscates the first geographical coordinates from the fraud detection system.

19. The third party server of claim 18, wherein the region identifiers are assigned randomly to the geographical regions.

20. The third party server of claim 18, wherein the method further comprises:

periodically sending, to the fraud detection system, an update of assignments of region identifiers to the geographical regions.