Identity verification systems and methods

• US 9,158,903 B2
• Filed: 08/02/2013
• Issued: 10/13/2015
• Est. Priority Date: 03/09/2009
• Status: Active Grant

• Current Assignee: Transunion Interactive, Inc. (TransUnion Corporation)
• Original Assignee: Transunion Interactive, Inc. (TransUnion Corporation)
• Inventors: Metzger, Scott
• Primary Examiner(s): Mehedi, Morshed
• Application Number:
  US13/958,311
• Publication Number:
  US 20130318588A1
• Time in Patent Office: 802 Days
• Field of Search: 713/176
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/313 using a call-back technique via a telephone network
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes

Abstract

Systems and methods for authenticating the identity of a user prior to giving access to confidential data at a user interface via a network are described. In an exemplary implementation in an Internet environment, a server hosts an application providing selective access by the user to confidential data related to the user. The user provides initial data to the application as part of a request to access the confidential data. At least one database having the confidential data stored therein is accessed by the server to retrieve confidential data relating to the user located in the database based on the initial data received from the client interface. An authentication function causes the server to transmit to the client interface and present to the user an incomplete portion of the confidential data relating to the user, which is not identical to the initial data, along with at least one other portion of data having a substantially identical format to the incomplete portion of the confidential data. The authentication function requests the user to provide additional data to complete the incomplete portion of the confidential data. The user is granted access to the confidential data subsequent to determination by the application that the user correctly completed the incomplete portion of the confidential data.

Claims

1. A method for authenticating an identity of a user seeking access to data related to the user via a client device in communication with a server, the method comprising the steps of:

requesting initial authentication data from the user, the initial authentication data comprising wallet information associated with the user;

using the initial authentication data, searching for a data file associated with the user in a database associated with the server, the data file including confidential data associated with the user; and

if the data file is found,

sending to the client device a plurality of randomly ordered and selectable options, wherein one of the selectable options corresponds to a correct option comprising an incomplete portion of an item in the data file, and wherein the other selectable options correspond to false options provided in a format similar to the correct option;

receiving a selection from the user of a selected one of the options, and

if the selected one of the options is the correct option;

requesting by the server and receiving from the client device additional data entered by the user in an attempt to complete the incomplete portion of the item;

determining by the server whether the additional data entered by the user correctly completes the incomplete portion of the item; and

granting the user access to the data file if the server determines that the additional data entered by the user correctly completes the incomplete portion of the item.

2. The method of claim 1, wherein the incomplete portion of the item corresponds to the last four digits of a telephone number associated with the user.

3. The method of claim 1, wherein the incomplete portion of the item is based on non-wallet information.

4. The method of claim 1, comprising the step of:

prior to granting the user access to the data file, placing a call to a telephone number in the data file if the server determines that the additional data entered by the user correctly completes the incomplete portion of the item.

5. The method of claim 4, comprising the step of:

prior to granting the user access to the data, communicating a PIN to be entered by the user into one of either the client device or a device associated with the telephone number.

10. The method of claim 1, wherein the server is associated with a credit bureau, a bank, an insurance company, or a hospital.

11. The method of claim 1, wherein the initial authentication data comprises an account number associated with the user.

12. The method of claim 1, wherein the wallet information comprises a name of the user.

13. The method of claim 1, wherein the wallet information comprises an address associated with the user.

14. The method of claim 1, wherein the wallet information comprises a date of birth associated with the user.

15. The method of claim 1, wherein the wallet information comprises at least a portion of a social security number associated with the user.

16. The method of claim 1, wherein the item comprises non-wallet information.

17. The method of claim 1, wherein the data file comprises a credit file of the user.

18. The method of claim 1, wherein the confidential data comprises a credit record, a tax record, a medical record, a financial record, or an insurance record.

19. The method of claim 1, wherein the incomplete portion of the item comprises an incomplete portion of a telephone number associated with the user.

20. The method of claim 19, comprising the step of:

placing a telephone call to the telephone number associated with the user when the server receives data indicative of the user completing the incomplete portion of the telephone number via entry into the client interface.

21. The method of claim 20, comprising the step of:

communicating instructions to the user via the telephone call to complete authentication.

22. The method of claim 1, comprising the step of:

placing a telephone call to a telephone number obtained from the data file.

23. The method of claim 22, comprising the step of:

communicating a PIN via the telephone call to enable the user to complete authentication.

24. The method of claim 23, wherein the PIN is randomly generated.

25. The method of claim 23, wherein the PIN expires after a predetermined time period.

6. A non-transitory computer-readable medium having computer-executable instructions for performing steps of a server process for authenticating an identity of a user seeking access to confidential data related to the user over a network via a client interface, the steps comprising:

requesting initial authentication data from the user, the initial authentication data comprising wallet information associated with the user;

using the initial authentication data, searching for a data file associated with the user in a database associated with the server, the data file comprising confidential data associated with the user; and

if the data file is found,

sending to the client device a plurality of randomly ordered and selectable options, wherein one of the selectable options corresponds to a correct option comprising an incomplete portion of an item in the data file, and wherein the other selectable options correspond to false options provided in a format similar to the correct option;

receiving a selection from the user of a selected one of the options, and if the selected one of the options is the correct option;

requesting by the server and receiving from the client interface additional data entered by the user in an attempt to complete the incomplete portion of the item;

determining whether the additional data entered by the user correctly completes the incomplete portion of the item; and

granting the user access to the data file including the confidential data associated with the user if the additional data entered by the user correctly completes the incomplete portion of the item.

7. The non-transitory computer-readable medium of claim 6, further comprising the step of:

prior to granting the user access to the data file including the confidential data, placing a call to a telephone number in the data file if the additional data entered by the user correctly completes the incomplete portion of the item.

8. The non-transitory computer-readable medium of claim 7, further comprising the step of:

prior to granting the user access to the data file including the confidential data, communicating a PIN to be entered by the user into one of either the client interface or a device associated with the telephone number.

9. A non-transitory computer readable medium having software code for execution on a computer processor, for authenticating an identity of a user seeking access to confidential data related to the user over a network via a client device, comprising:

a first code segment configured to receive initial authentication data from the user, the initial authentication data comprising wallet information associated with the user;

a second code segment configured to search, using the initial authentication data, for a data file associated with the user in at least one database, the data file comprising confidential data of the user;

a third code segment configured to transmit to the client device a plurality of randomly ordered and selectable options, wherein one of the selectable options corresponds to a correct option comprising an incomplete portion of an item in the data file, and wherein the other selectable options correspond to false options provided in a format similar to the correct option;

a fourth code segment configured to request and receive from the client device a selection from the user of a selected one of the options;

a fifth code segment configured to determine whether the selected one of the options is the correct option;

a sixth code segment configured to receive from the client device additional data entered by the user to complete the incomplete portion of the item;

a seventh code segment configured to determine whether the additional data entered by the user correctly completes the incomplete portion of the item; and

an eighth code segment configured to grant the user access to the data file including the confidential data related to the user if the additional data entered by the user correctly completes the incomplete portion of the item.