System and method for providing a card transaction authorization fraud warning

• US 6,254,000 B1
• Filed: 11/13/1998
• Issued: 07/03/2001
• Est. Priority Date: 11/13/1998
• Status: Expired due to Term

• Current Assignee: First Data Corporation (Fiserv Incorporated)
• Original Assignee: First Data Corporation (Fiserv Incorporated)
• Inventors: Mellinger, Philip Thomas, Degen, Robert George
• Primary Examiner(s): Lee, Michael G.
• Assistant Examiner(s): FUREMAN, JARED
• Application Number:
  US09/191,956
• Time in Patent Office: 963 Days
• Field of Search: 235/380, 235/375, 235/379, 235/382, 235/383, 235/494, 902/4, 902/26, 902/27, 902/28, 902/40, 705/16, 705/17, 705/39, 705/44, 705/64, 705/67, 705/75, 705/78
• US Class Current: 235/380
• CPC Class Codes: G06Q 20/347 Passive cards
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G07F 7/10 together with a coded signal , e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
• CPC Class Codes: G07F 7/1075 PIN is checked remotely

Abstract

Identifying and notifying credit card issuing banks of an increased risk of credit card fraud. An early warning system assists credit card transaction processors and credit card issuing banks reduce occurrences of credit card fraud. By analyzing transaction data and credit card account information, an authorization decision is made and transmitted to the merchant. The authorization decision either approves or denies the credit card transaction. Conventional authorization systems employ a security code that can be transmitted with an authorization request to limit authorization to transactions including the proper security code. Because some issuing banks do not utilize the security code system, they are exposed to an increased risk of credit card fraud. The early warning system can be used to monitor the authorization decisions that are transmitted by the processor to the merchant. By compiling data on the occurrences of mismatches between an expected security code and the security code provided by the authorization request, the early warning system can notify processors and/or issuing banks that they are exposed to an increased risk of credit card fraud. Additionally, the early warning system can detect attempts by credit card thieves to identify exposed banks. Detected attempts at credit card fraud can also be used to initiate investigations to apprehend credit card thieves.

Claims

1. A system for notifying an issuing bank of an increased risk of card fraud, comprising:

a terminal for obtaining and transmitting transaction data corresponding to a particular transaction;

the terminal including a card reader for obtaining card identifying information relating to a card tendered in connection with the particular transaction;

a transaction processor for receiving the transaction data from the terminal and for transmitting an authorization decision to the terminal;

a monitoring means for monitoring the authorization decision, determining an actual security code, and comparing the actual security code to a transaction security code; and

the monitoring means further operating to generate a risk alarm, in response to a mismatch between the actual security code and the transaction security code when the authorization decision is a transaction approval.

2. The system of claim 1, wherein a portion of the card identifying information is the actual security code.

3. The system of claim 1, wherein the actual security code is calculable from at least a portion of the card identifying information.

4. The system of claim 1, wherein the transaction data includes an account number and actual security code corresponding to the card.

5. The system of claim 1, wherein at least a portion of the authorization decision contains a security code mismatch flag.

6. The system of claim 1, wherein the monitoring means is further operative to terminate the particular transaction, in response to a detection of a mismatch between the actual security code and the transaction security code.

7. The system of claim 1, further comprising a mismatch threshold, wherein the monitoring means is further operative to suppress the generation of the risk alarm until the mismatch threshold has been exceeded.

8. The system of claim 1, wherein the risk alarm is transmitted to the issuing bank.

9. The system of claim 1, wherein the risk alarm is transmitted to the transaction processor.

10. The system of claim 1, further comprising an alarm database, wherein transaction data and card identifying information can be stored, in response to the generation of a risk alarm.

11. A method of operating an authorization system to notify an issuing bank of its exposure to card fraud, comprising the steps of:

receiving an authorization decision from a transaction processor;

determining an actual security code;

comparing the actual security code to a transaction security code included in the authorization decision; and

generating a risk alarm in response to a mismatch between the actual security code and the transaction security code when the authorization decision is a transaction approval.

12. The method of claim 11, wherein the step of determining the actual security code comprises identifying the actual security code within the authorization decision.

13. The method of claim 11, wherein the step of determining the actual security code comprises calculating the actual security code from at least a portion of the authorization decision.

14. The method of claim 11, wherein at least a portion of the authorization decision contains a security code mismatch flag.

15. The method of claim 11, further comprising the step of terminating a card transaction, in response to a mismatch between the actual security code and the transaction security code.

16. The method of claim 11, wherein the generating step comprises the steps of:

checking a mismatch threshold; and

generating the risk alarm, in response to a determination that the mismatch threshold has been exceeded.

17. A method of operating an authorization system to notify an issuing bank of an increased risk of card fraud, comprising the steps of:

receiving transaction data from a transaction terminal, the transaction data corresponding to a particular transaction;

transmitting an authorization request to the issuing bank the authorization request including at least a portion of the transaction data;

receiving from the issuing bank a risk an authorization decision including a mismatch flag; and

transmitting to the issuing bank a risk alarm, in response to a determination that the mismatch flag indicates a mismatch between a transaction security code and an actual security code when the authorization decision is a transaction approval.

18. The method of claim 17, wherein at least a portion of the authorization decision contains the actual security code.

19. The method of claim 17, further comprising the step of terminating the particular transaction, in response to a determination that the mismatch flag indicates a mismatch between the transaction security code and the actual security code.

20. The method of claim 17, wherein the transmitting step comprises the steps of:

checking a mismatch threshold; and

transmitting the risk alarm to the issuing bank, in response to a determination that the mismatch threshold has been exceeded.

21. The method of claim 17, further comprising the step of storing transaction data and at least a portion of the authorization decision in an alarm database, in response to the transmission of a risk alarm.