Methods and systems for mitigating fraud losses during a payment card transaction

• US 9,858,571 B2
• Filed: 01/02/2013
• Issued: 01/02/2018
• Est. Priority Date: 01/02/2013
• Status: Active Grant

• Current Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Original Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Inventors: Pacher, Frederick Michael, Dinsmore, Craig Robert, Flood, Eoin Patrick, Blinov, Mikhail
• Primary Examiner(s): OJIAKU, CHIKAODINAKA
• Application Number:
  US13/732,977
• Publication Number:
  US 20140188723A1
• Time in Patent Office: 1,826 Days
• Field of Search: None
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 20/405 Establishing or using transaction specific rules

Abstract

Computer systems and methods for identifying a potentially fraudulent payment card transaction in progress, and mitigating losses arising from completion of a fraudulent payment card transaction are provided. The computer system is programmed to receive an authorization request message for authorization of a payment card-initiated transaction, when the transaction is initiated using a payment card that includes a first security device operable for transactions initiated within a predefined geographic region and a second security device operable for transactions initiated both within the predefined geographic region and outside of the predefined geographic region. When the transaction is initiated outside the predefined geographic region, the computer system compares data on the payment card to stored data corresponding to a plurality of payment cards previously-approved for transactions outside of the predefined geographic region approval, and applies one or more sets of rules to the transaction as appropriate.

Claims

1. A computer-implemented method for mitigating fraud losses during a transaction initiated at an ATM that is located outside of a predefined geographic region associated with an issuer of a payment card used in the transaction, the method implemented using an authorization computer device coupled to the ATM over an interchange network, the method comprising:

receiving, from an ATM located outside of a predefined geographic region associated with an issuer of a payment card, over an interchange network, an authorization request message requesting authorization of a transaction conducted using the payment card, wherein the payment card includes (i) a first security device comprising an integrated-circuit chip configured to communicate with automated teller machines and operable for transactions initiated within the predefined geographic region and (ii) a second security device comprising a magnetically-encoded strip readable by automated teller machines and operable for transactions initiated both within the predefined geographic region and outside of the predefined geographic region, wherein the authorization request message includes at least a transaction bank identification number (BIN) and a transaction account number acquired from the second security device included on the payment card, wherein the transaction BIN is associated with the issuer, wherein the issuer is not a member of the interchange network, and wherein the authorization computer device does not have access, over the interchange network, to data maintained by the issuer;

retrieving, from a database communicatively coupled to the authorization computer device, a plurality of ranges of BINs, wherein each of the plurality of ranges of BINs (i) corresponds to a plurality of payment cards previously-registered for transactions occurring outside of the predefined geographical region, and (ii) is associated with account service level data;

determining that the transaction BIN is included in one of the retrieved plurality of ranges of BINs;

determining whether the received transaction account number corresponds to one of the plurality of previously-registered payment cards that corresponds to the one of the plurality of ranges of BINs;

in response to determining that the transaction account number does not correspond to one of the plurality of previously-registered payment cards, registering the payment card by storing the transaction account number and transaction BIN in the database;

applying a set of transaction limit rules to the transaction based on the account service level data associated with the one of the retrieved plurality of ranges of BINs; and

determining whether to approve the transaction based on the application of the set of transaction limit rules.

2. The method in accordance with claim 1, wherein applying the set of transaction limit rules includes applying a first rule declining the transaction if a value of the transaction is in excess of a value limit defined in the account service level data associated with the one of the retrieved plurality of ranges of BINs.

3. The method in accordance with claim 1, wherein the transaction is a cash withdrawal from the ATM.

4. An authorization computer system for mitigating fraud losses during a transaction initiated at an ATM that is located outside of a predefined geographic region associated with an issuer of a payment card used in the transaction, the authorization computer system coupled to the ATM over an interchange network and comprising:

a processor; and

a computer-readable storage device having encoded thereon computer executable instructions that are executable by the processor to perform functions comprising;

receiving, from an ATM located outside of a predefined geographic region associated with an issuer of a payment card, over an interchange network, an authorization request message requesting authorization of a transaction conducted using the payment card, wherein the payment card includes (i) a first security device comprising an integrated-circuit chip configured to communicate with automated teller machines and operable for transactions initiated within the predefined geographic region and (ii) a second security device comprising a magnetically-encoded strip readable by automated teller machines and operable for transactions initiated both within the predefined geographic region and outside of the predefined geographic region, wherein the authorization request message includes at least a transaction bank identification number (BIN) and a transaction account number acquired from the second security device included on the payment card, wherein the transaction BIN is associated with the issuer, wherein the issuer is not a member of the interchange network, and wherein the authorization computer system does not have access, over the interchange network, to data maintained by the issuer;

retrieving, from a database communicatively coupled to the authorization computer system, a plurality of ranges of BINs, wherein each of the plurality of ranges of BINs (i) corresponds to a plurality of payment cards previously-registered for transactions occurring outside of the predefined geographical region, and (ii) is associated with account service level data;

determining that the transaction BIN is included in one of the retrieved plurality of ranges of BINs;

determining whether the received transaction account number corresponds to one of the plurality of previously-registered payment cards that corresponds to the one of the plurality of ranges of BINs;

in response to determining that the transaction account number does not correspond to one of the plurality of previously-registered payment cards, registering the payment card by storing the transaction account number and transaction BIN in the database;

applying a set of transaction limit rules to the transaction based on the account service level data associated with the one of the retrieved plurality of ranges of BINs; and

determining whether to approve the transaction based on the application of the set of transaction limit rules.

5. The authorization computer system in accordance with claim 4, wherein the computer-executable instructions cause the processor to apply a first rule declining the transaction if a value of the transaction is in excess of a value limit defined in the account service level data associated with the one of the retrieved plurality of ranges of BINs.

6. The authorization computer system in accordance with claim 4, wherein the transaction is a cash withdrawal from the ATM.

7. One or more non-transitory computer-readable storage media having computer-executable instructions embodied thereon for mitigating fraud losses during a transaction initiated at an ATM that is located outside of a predefined geographic region associated with an issuer of a payment card used in the transaction, wherein when executed by a processor of an authorization computer device coupled to the ATM over an interchange network, the computer-executable instructions cause said processor to:

receive, from an ATM located outside of a predefined geographic region associated with an issuer of a payment card, over an interchange network, an authorization request message requesting authorization of a transaction conducted using the payment card, wherein the payment card includes (i) a first security device comprising an integrated-circuit chip configured to communicate with automated teller machines and operable for transactions initiated within the predefined geographic region and (ii) a second security device comprising a magnetically-encoded strip readable by automated teller machines and operable for transactions initiated both within the predefined geographic region and outside of the predefined geographic region, wherein the authorization request message includes at least a transaction bank identification number (BIN) and a transaction account number acquired from the second security device included on the payment card, wherein the transaction BIN is associated with the issuer, wherein the issuer is not a member of the interchange network, and wherein the authorization computer device does not have access, over the interchange network, to data maintained by the issuer;

retrieving, from a database communicatively coupled to the authorization computer device, a plurality of ranges of BINs, wherein each of the plurality of ranges of BINs (i) corresponds to a plurality of payment cards previously-registered for transactions occurring outside of the predefined geographical region, and (ii) is associated with account service level data;

determining that the transaction BIN is included in one of the retrieved plurality of ranges of BINs;

determining whether the received transaction account number corresponds to one of the plurality of previously-registered payment cards that corresponds to the one of the plurality of ranges of BINs;

in response to determining that the transaction account number does not correspond to one of the plurality of previously-registered payment cards, registering the payment card by storing the transaction account number and transaction BIN in the database;

applying a set of transaction limit rules to the transaction based on the account service level data associated with the one of the retrieved plurality of ranges of BINs; and

determining whether to approve the transaction based on the application of the set of transaction limit rules.

8. The computer-readable storage media in accordance with claim 7, wherein the computer-executable instructions cause the processor to apply a first rule declining the transaction if a value of the transaction is in excess of a value limit defined in the account service level data associated with the one of the retrieved plurality of ranges of BINs.

9. The computer-readable storage media in accordance with claim 7, wherein the transaction is a cash withdrawal from the ATM.