Method and system for mitigating risk of fraud in internet banking

• US 8,788,419 B2
• Filed: 12/30/2006
• Issued: 07/22/2014
• Est. Priority Date: 12/30/2006
• Status: Active Grant

• Current Assignee: Apiture, Inc.
• Original Assignee: First Data Corporation (Fiserv Incorporated)
• Inventors: Samuels, Maurice, Bruce, Joseph, Lieblich, Cindi
• Primary Examiner(s): Badii, Behrang
• Assistant Examiner(s): GREENE, DANIEL LAWSON
• Application Number:
  US11/648,066
• Publication Number:
  US 20080162338A1
• Time in Patent Office: 2,761 Days
• Field of Search: 705/42, 705/44
• US Class Current: 705/44
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/108 Remote banking, e.g. home banking
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method and system are provided for mitigating the risk of fraud in Internet banking. In an embodiment comprising an end user seeking access to the Internet banking site of a financial institution, the end user having already satisfied a first authentication requirement (such as providing a valid user ID and password), the end user is required to satisfy a second authentication test when a measure of improbability associated with the login exceeds a threshold. The measure of improbability, in an embodiment, is based on the improbability of a combination of session statistics such as IP address, browser ID, hour of day, and time since the user'"'"'s last valid login.

Claims

1. A method, comprising:

receiving from a remote site a request for access to an online banking site associated with a financial institution, said request having satisfied a first authentication requirement associated with a customer of the financial institution and said request having two or more attributes, wherein the attributes comprise at least a browser ID of the remote site;

employing a processor associated with a site to calculate, based at least in part on the two or more attributes, a plurality of scores, wherein the plurality of scores comprises two or more of a network score, a browser score, a time of day score, or a frequency score;

employing the processor associated with the site to calculate a composite score based at least in part on a weighted improbability measure for each of the plurality of scores or an average of the plurality of scores;

employing the processor associated with the site to calculate a custom-configured score, wherein the custom-configured score indicates an amount and a type of identity risk specified by the financial institution; and

mitigating the risk of fraud in online banking based at least in part on conditioning approval of the request on satisfaction of a second authentication requirement on whether the composite score exceeds the custom-configured score based at least in part on a report generated in real-time.

2. The method of claim 1, wherein the measure of improbability is based on a plurality of previous online banking transactions by the customer.

3. The method of claim 1, further comprising reporting the composite score to the financial institution.

4. The method of claim 1, wherein the site is the online banking site associated with the financial institution.

5. The method of claim 1, wherein the two or more attributes comprise the following:

the Internet network address of the remote site;

the browser footprint of the remote site;

the time of day of the request;

or

the time since the last online banking transaction by the customer.

6. The method of claim 5, wherein the request for access seeks initial access to the online banking site associated with the financial institution.

7. The method of claim 5, wherein the two or more attributes further comprise one or more of the following:

presence of a persistent cookie;

or

referrer ID.

8. The method of claim 5, wherein the request for access seeks access to a transaction page within the online banking site associated with the financial institution.

9. The method of claim 8, wherein the two or more attributes further include one or more of the following:

number of clicks in an end user session;

or

duration of session.

10. A method comprising:

receiving from a remote site a request for access to an online banking site associated with a financial institution;

employing a processor associated with a site to determine that the request is unusual based on the improbability of occurrence of a plurality of attributes of the request, wherein the plurality of attributes comprise at least a browser ID of the remote site, wherein determining that the request is unusual comprises;

calculating, based at least in part on the plurality of attributes, a plurality of scores, wherein the plurality of scores comprises two or more of a network score, a browser score, a time of day score, or a frequency score, and

calculating an improbability measure for each one of the network score, the browser score, the time of day score, and the frequency score, and wherein a composite score is calculated based at least in part on a weighted improbability measure for each of the plurality of scores or an average of the plurality of scores; and

reporting the request to the financial institution;

employing the processor associated with the site to calculate a custom-configured score, wherein the custom-configured score indicates an amount and a type of identity risk specified by the financial institution; and

mitigating the risk of fraud in online banking based at least in part on conditioning approval of the request on whether the composite score exceeds the custom-configured score based at least in part on a report generated in real-time.

11. The method of claim 10, wherein the request is reported to the financial institution in real time.

12. The method of claim 10, further comprising refusing access until at least two authentication requirements have been satisfied.

13. The method of claim 10, further comprising creating a composite score, the composite score comprising a weighted improbability measure for each one of the plurality of attributes.

14. The method of claim 13, wherein the plurality of attributes of the request comprises a first attribute and a second attribute, the second attribute being different from the first attribute, wherein the first attribute and the second attribute are selected from a group consisting of:

an Internet network address of the remote site, a browser footprint of the remote site, the time of day of the request, the time since a previous access to the online banking site, the number of clicks in an end user session, the duration of a session, and a referrer ID.

15. A system, comprising:

a server comprising an authentication module wherein the authentication module includes instructions for;

receiving from a remote site a request for access to an online banking site associated with a financial institution;

mitigating the risk of fraud in online banking based at least in part on determining that the request is unusual based on the improbability of occurrence of a plurality of attributes of the request, wherein the plurality of attributes comprise at least a browser ID of the remote site, wherein determining that the request is unusual comprises;

calculating, based at least in part on the plurality of attributes, a plurality of scores, wherein the plurality of scores comprises two or more of a network score, a browser score, a time of day score, and a frequency score,

calculating a composite score based at least in part on a weighted improbability measure for each of the plurality of scores or an average of the plurality of scores,

calculating a custom-configured score, wherein the custom-configured score indicates an amount and a type of identity risk specified by the financial institution, and

conditioning approval of the request on whether the composite score exceeds the custom-configured score based at least in part on a report generated in real-time; and

reporting the request to the financial institution.

16. The system of claim 15, wherein the authentication module further includes instructions for denying the request unless two or more authentication requirements are met.

17. A system, comprising:

a session statistics module that computes a plurality of scores based at least in part on session attributes associated with a request for access to an online banking web site associated with a financial institution, wherein the session attributes comprise at least a browser ID of a remote site, and the session statistics module further computes

the plurality of scores, wherein the plurality of scores comprise two or more of a network score, a browser score, a time of day score, or a frequency score,

a composite score based at least in part on a weighted improbability measure for each of the plurality of scores or an average of the plurality of scores, and

a custom-configured score, wherein the custom-configured score indicates an amount and a type of identity risk specified by the financial institution; and

an additional authorization module for mitigating the risk of fraud in online banking that requires satisfaction of two or more authentication requirements before allowing access to the online banking site, wherein at least one of the two or more authentication requirements comprises conditioning approval of the request on whether the composite score exceeds the custom-configured score based at least in part on a report generated in real-time.

18. The system of claim 17, further comprising a reporting module that reports a plurality of session attributes and the improbability measure to the financial institution.

19. A system, comprising:

a server comprising;

a processor; and

a memory containing instructions that are executed by the processor for;

receiving from a remote site a request for access to an online banking site associated with a financial institution, said request having satisfied a first authentication requirement associated with a customer of the financial institution and said request having a plurality of attributes, wherein the plurality of attributes comprise at least a browser ID of the remote site;

calculating a plurality of scores based at least in part on the plurality of attributes, wherein the plurality of scores comprises two or more of a network score, a browser score, a time of day score, or a frequency score;

calculating a composite score based at least in part on a weighted improbability measure for each of the plurality of scores or an average of the plurality of scores;

calculating a custom-configured score, wherein the custom-configured score indicates an amount and a type of risk specified by the financial institution; and

mitigating the risk of fraud in online banking based at least in part on conditioning approval of the request on satisfaction of a second authentication requirement on whether the composite score exceeds the custom-configured score based at least in part on a report generated in real-time.

20. A computer readable storage medium comprising instructions for:

receiving from a remote site a request for access to an online banking site associated with a financial institution, said request having satisfied a first authentication requirement associated with a customer of the financial institution and said request having a plurality of attributes, wherein the plurality of attributes comprise at least a browser ID of the remote site;

calculating a plurality of scores based at least in part on the plurality of attributes, wherein the plurality of scores comprises two or more of a network score, a browser score, a time of day score, or a frequency score;

calculating a composite score, wherein the composite score is calculated based at least in part on a weighted improbability measure for each of the plurality of scores or an average of the plurality of scores;

calculating a custom-configured score, wherein the custom-configured score indicates an amount and type of identity risk specified by the financial institution; and

mitigating the risk of fraud in online banking based at least in part on conditioning approval of the request on satisfaction of a second authentication requirement on whether the composite score exceeds the custom-configured score based at least in part on a report generated in real-time.