Analyzing hack attempts of E-cards

• US 9,355,424 B2
• Filed: 09/23/2014
• Issued: 05/31/2016
• Est. Priority Date: 09/23/2014
• Status: Active Grant

• Current Assignee: Sony Corporation (Sony Group Corp.)
• Original Assignee: Sony Corporation (Sony Group Corp.)
• Inventors: Candelore, Brant, Richman, Steven Martin, Zustak, Frederick J.
• Primary Examiner(s): Savusdiphol, Paultep
• Application Number:
  US14/494,006
• Publication Number:
  US 20160086287A1
• Time in Patent Office: 616 Days
• Field of Search: 235/375, 235/379, 235/380, 235/435
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/352 Contactless payments by cards
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 40/12 Accounting
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level

Abstract

Transactions using a bank customer'"'"'s electronic debit or credit card (“e-card”) are monitored by the card owner'"'"'s consumer electronic (CE) device and reported to a server associated with the financial institution maintaining the e-card records for analysis of aggregated hack attempts.

Claims

1. Apparatus comprising:

at least one computer memory that is not a transitory signal and that comprises instructions executable by at least one, processor to;

receive transaction records from plural consumer electronics (CE) devices of near field communication (NFC) interrogations of respective electronic transaction cards (e-cards);

aggregate the transaction records;

analyze the transaction records; and

output an indication of at least one interrogation pattern indicated by the transaction records.

2. The apparatus of claim 1, wherein the pattern is a location pattern.

3. The apparatus of claim 1, wherein the pattern is a temporal pattern.

4. The apparatus of claim 1, wherein the instructions are executable to:

compare locations of reported interrogations to locations of authorized point of sale (POS) terminals configured for NFC with the e-cards; and

output the indication based on determining that plural interrogations occurred within a threshold period in an area beyond NFC range of an authorized POS terminal.

5. The apparatus of claim 1, wherein the instructions are executable to:

determine that an interrogations is a deviant interrogation responsive to determining that the interrogation occurred beyond NFC range of an authorized POS terminal;

responsive to determining that N deviant transactions in aggregate reported from M CE devices, with N and M being integers greater than one, occurred at a locale beyond NFC range of an authorized POS terminal, return “

possible hacker habituating locale”

.

6. The apparatus of claim 5, wherein the instructions are executable to:

responsive to determining that the N deviant transactions occurred primarily in week days during daylight hours, return “

hacker has no job”

.

7. The apparatus of claim 5, Wherein the instructions are executable to:

responsive to determining that the N deviant transactions occurred primarily at limes after a normal work day, return “

hacker has a job”

.

8. Method comprising:

receiving transaction records from plural consumer electronics (CE) devices of near field communication (NFC) interrogations of electronic transaction cards (e-cards), the transaction records including temporal and locational information of the interrogations;

analyzing the transaction records for temporal and locational information of the interrogations; and

outputting an indication of least one interrogation pattern indicated by the transaction records.

9. The method of claim 8, wherein the pattern is a location pattern.

10. The method of claim 8, wherein the pattern is a temporal pattern.

11. The method of claim 8, comprising:

comparing locations of reported interrogations to locations of authorized point of sale (POS) terminals configured for NFC with the e-cards; and

outputting the indication based on determining that plural interrogations occurred within a threshold period in an area beyond NFC range of an authorized POS terminal.

12. The method of claim 8, comprising:

determining that an interrogation is a deviant interrogation responsive to determining that the interrogation occurred beyond NFC, range of an authorized POS terminal;

responsive to determining that N deviant transactions in aggregate reported from M CE devices, with N and M being integers greater than one, occurred at a locale beyond NFC range of an authorized POS terminal returning “

possible backer habituating locale ”

.

13. The method of claim 12, comprising:

responsive to determining that the N deviant transactions occurred primarily in week days during daylight hours, returning “

hacker has no job”

.

14. The method of claim 12, comprising:

responsive to determining that the N deviant transactions occurred primarily at times after a normal work day, return “

hacker has a job”

.

15. Computer memory that is not a transitory signal and including instructions executable by at least one processor for:

receiving transaction records from plural consumer electronics (CE) devices of near field communication (NFC) interrogations of electronic transaction cards (e-cards), the transaction records including temporal and locational information of the interrogations;

analyzing the transaction records for temporal and locational information of the interrogations; and

output an indication of at least one interrogation pattern indicated by the transaction records.

16. The computer memory of claim 15, wherein the pattern is a location pattern.

17. The computer memory of claim 15, wherein the pattern is a temporal pattern.

18. The computer memory of claim 15, wherein the instructions are executable for:

comparing locations of reported interrogations to locations of authorized point of sale (POS) terminals configured for NFC with the e-cards; and

outputting the indication based on determining that plural interrogations occurred within is threshold period in an area beyond NFC range of an authorized POS terminal.

19. The computer memory of claim 18, wherein the instructions are executable for:

determining that an interrogation is a deviant interrogation responsive to determining that the interrogation occurred beyond NFC range of an authorized POS terminal;

responsive to determining that N deviant transactions in aggregate reported from M CE devices, with N and M being integers greater than one, occurred at a locale beyond NFC range of an authorized POS terminal, returning “

possible hacker habituating locale”

.

20. The computer memory of claim 18, wherein the instructions are executable for:

responsive to determining that the N deviant transactions occurred primarily in week days during daylight hours, returning “

hacker has no job”

.