Portable consumer device verification system

• US 7,819,322 B2
• Filed: 06/18/2007
• Issued: 10/26/2010
• Est. Priority Date: 06/19/2006
• Status: Active Grant

• Current Assignee: Visa USA, Inc. (Visa, Inc.)
• Original Assignee: Visa USA, Inc. (Visa, Inc.)
• Inventors: Faith, Patrick, Hammad, Ayman
• Primary Examiner(s): Apple; Kristen S
• Assistant Examiner(s): GREGG, MARY M
• Application Number:
  US11/764,361
• Publication Number:
  US 20080040271A1
• Time in Patent Office: 1,226 Days
• Field of Search: 705/44, 235/449, 235/380, 324/690, 324/663, 324/662
• US Class Current: 235/449
• CPC Class Codes: G06Q 20/085 involving remote charge determination or related payment systems
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/204 comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A method for verifying a portable consumer device. The method includes receiving an authorization request message associated with a transaction conducted using a portable consumer device. The portable consumer device includes a portable consumer device fingerprint. The authorization request message includes an altered portable consumer device fingerprint and an algorithm identifier. The method also includes selecting an algorithm from among a plurality of algorithms using the algorithm identifier, determining the portable consumer device fingerprint using selected algorithm and the altered portable consumer device fingerprint, determining if the portable consumer device fingerprint matches a stored portable consumer device fingerprint, and sending an authorization response message after determining if the portable consumer device fingerprint matches the stored portable consumer device fingerprint.

Claims

1. A method comprising:

receiving, at a server computer, an authorization request message associated with a transaction conducted using a portable consumer device, wherein the portable consumer device comprises a portable consumer device fingerprint, and wherein the authorization request message comprises an altered portable consumer device fingerprint and an algorithm identifier, wherein the authorization request message further comprises an account number associated with the portable consumer device and a transaction amount associated with the transaction;

selecting, using the server computer, an algorithm from among a plurality of algorithms associated with different types of portable consumer device fingerprinting systems using the algorithm identifier, wherein the different types of portable consumer device fingerprinting systems are associated with different companies who each uses its own proprietary algorithm in an access device to alter the portable consumer device fingerprint;

determining, using the server computer, the portable consumer device fingerprint using the selected algorithm and the altered portable consumer device fingerprint;

determining, using the server computer, whether the transaction meets a confidence threshold by determining a reliability associated with the selected algorithm;

determining, using the server computer, if the portable consumer device fingerprint matches a stored portable consumer device fingerprint; and

sending, using the server computer, an authorization response message after determining if the portable consumer device fingerprint matches the stored portable consumer device fingerprint.

2. The method of claim 1 wherein the altered portable consumer device fingerprint was formed an at access device at a merchant.

3. The method of claim 1 wherein the stored portable consumer device fingerprint is stored in a database, which also stores an account number associated with the portable consumer device.

4. The method of claim 1 wherein the portable consumer device is a payment card comprising a magnetic stripe, wherein the portable consumer device fingerprint is a magnetic stripe fingerprint.

5. The method of claim 1 wherein the algorithm is a key used in an encryption process.

6. The method of claim 1 further comprising receiving the authorization response message from an issuer of the portable consumer device before sending the authorization response message.

18. The method of claim 1 further comprising sending a transaction notification message to a consumer to notify the consumer that a transaction associated with the portable consumer device is taking place, if the portable consumer device fingerprint does not match the stored portable consumer device fingerprint.

19. The method of claim 4 wherein the magnetic stripe fingerprint is embedded within the particular microscopic structure of the magnetic particles in the magnetic stripe in the payment card.

20. The method of claim 1 wherein the portable consumer device fingerprint includes a dynamic card verification value that can be generated by a chip in the portable consumer device.

21. The method of claim 1 wherein the algorithm identifier is associated with the algorithm used to create the altered portable consumer device fingerprint.

22. The method of claim 1 further comprising:

initiating additional authentication processes, if the transaction does not meet the confidence threshold, wherein additional authentication processes include sending a dynamic challenge to a consumer associated with the portable consumer device or notifying the consumer that the transaction is occurring.

23. The method of claim 1 wherein the confidence threshold is set according to predetermined rules.

24. The method of claim 1 wherein the confidence threshold is determined by using transaction characteristics to score the transaction as being authentic or potentially suspicious.

25. The method of claim 24 wherein the transaction characteristics are related to the access device and the portable consumer device.

7. An article of manufacture comprising:

a computer readable medium having computer readable program codes means embodied therein for;

receiving an authorization request message associated with a transaction conducted using a portable consumer device, wherein the portable consumer device comprises a portable consumer device fingerprint, and wherein the authorization request message comprises an altered portable consumer device fingerprint and an algorithm identifier, wherein the authorization request message further comprises an account number associated with the portable consumer device;

selecting an algorithm from among a plurality of algorithms associated with different types of portable consumer device fingerprinting systems using the algorithm identifier, wherein the different types of portable consumer device fingerprinting systems are associated with different companies who each uses its own proprietary algorithm in an access device to alter the portable consumer device fingerprint;

determining the portable consumer device fingerprint using the selected algorithm and the altered portable consumer device fingerprint;

determining, using the server computer, whether the transaction meets a confidence threshold by determining a reliability associated with the selected algorithm;

determining if the portable consumer device fingerprint matches a stored portable consumer device fingerprint; and

sending an authorization response message after determining if the portable consumer device fingerprint matches the stored portable consumer device fingerprint.

8. The computer readable medium of claim 7 wherein the portable consumer device is a payment card comprising a magnetic stripe, wherein the portable consumer device fingerprint is a magnetic stripe fingerprint.

9. A server computer comprising a computer readable medium storing a computer program containing instructions thereon for instructing the server computer to perform the steps of:

receiving an authorization request message associated with a transaction conducted using a portable consumer device, wherein the portable consumer device comprises a portable consumer device fingerprint, and wherein the authorization request message comprises an altered portable consumer device fingerprint and an algorithm identifier, wherein the authorization request message further comprises an account number associated with the portable consumer device;

selecting an algorithm from among a plurality of algorithms associated with different types of portable consumer device fingerprinting systems using the algorithm identifier, wherein the different types of portable consumer device fingerprinting systems are associated with different companies who each uses its own proprietary algorithm in an access device to alter the portable consumer device fingerprint;

determining the portable consumer device fingerprint using the selected algorithm and the altered portable consumer device fingerprint;

determining, using the server computer, whether the transaction meets a confidence threshold by determining a reliability associated with the selected algorithm;

determining if the portable consumer device fingerprint matches a stored portable consumer device fingerprint; and

sending an authorization response message after determining if the portable consumer device fingerprint matches the stored portable consumer device fingerprint.

10. A method comprising:

sending, using an access device, an authorization request message associated with a transaction conducted using a portable consumer device, wherein the portable consumer device comprises a portable consumer device fingerprint, and wherein the authorization request message comprises an altered portable consumer device fingerprint and an algorithm identifier, wherein the authorization request message comprises an account number, wherein an algorithm is selected from among a plurality of algorithms associated with different types of portable consumer device fingerprinting systems using the algorithm identifier, wherein the different types of portable consumer device fingerprinting systems are associated with different companies who each uses its ownproprietary algorithm in an access device to alter the portable consumer device fingerprint, the portable consumer device fingerprint is determined using the selected algorithm and the altered portable consumer device fingerprint, a server computer determines whether the transaction meets a confidence threshold by determining a reliability associated with the selected algorithm, and the server computer determines if the portable consumer device fingerprint matches a stored portable consumer device fingerprint; and

receiving, using an access device, an authorization response message, wherein the authorization response message indicates whether or not the transaction is approved.

11. The method of claim 10 wherein the portable consumer device is a phone.

12. The method of claim 10 wherein the portable consumer device is a payment card comprising a magnetic stripe, wherein the portable consumer device fingerprint is a magnetic stripe fingerprint.

13. The method of claim 10 wherein the algorithm is a key associated with an encryption process.

14. The method of claim 10 wherein the transaction is a payment transaction.

15. An article of manufacture comprising:

a computer readable medium having computer readable program codes means embodied therein for;

sending an authorization request message associated with a transaction conducted using a portable consumer device, wherein the portable consumer device comprises a portable consumer device fingerprint, and wherein the authorization request message comprises an altered portable consumer device fingerprint and an algorithm identifier, wherein the authorization request message further comprises an account number associated with the portable consumer device, wherein an algorithm is selected from among a plurality of algorithms associated with different types of portable consumer device fingerprinting systems using the algorithm identifier, wherein the different types of portable consumer device fingerprinting systems are associated with different companies who each uses its own proprietary algorithm in an access device to alter the portable consumer device fingerprint, the portable consumer device fingerprint is determined using the selected algorithm and the altered portable consumer device fingerprint, a server computer determines whether the transaction meets a confidence threshold by determining a reliability associated with the selected algorithm, and the server computer determines if the portable consumer device fingerprint matches a stored portable consumer device fingerprint; and

receiving an authorization response message, wherein the authorization response message indicates whether or not the transaction is approved.

16. An access device comprising a computer readable medium storing a computer program containing instructions thereon for instructing the access device to perform the steps of:

sending an authorization request message associated with a transaction conducted using a portable consumer device, wherein the portable consumer device comprises a portable consumer device fingerprint, and wherein the authorization request message comprises an altered portable consumer device fingerprint and an algorithm identifier, wherein the authorization request message further comprises an account number associated with the portable consumer device, wherein an algorithm is selected from among a plurality of algorithms associated with different types of portable consumer device fingerprinting systems using the algorithm identifier, wherein the different types of portable consumer device fingerprinting systems are associated with different companies who each uses its own proprietary algorithm in an access device to alter the portable consumer device fingerprint, the portable consumer device fingerprint is determined using the selected algorithm and the altered portable consumer device fingerprint, a server computer determines whether the transaction meets a confidence threshold by determining a reliability associated with the selected algorithm, and the server computer determines if the portable consumer device fingerprint matches a stored portable consumer device fmgerprint; and

receiving an authorization response message, wherein the authorization response message indicates whether or not the transaction is approved.

17. The access device of claim 16 wherein the access device is a point of sale terminal.