Using a change in information associated with a mobile device network ID as a risk indicator in mobile network-based authentication

• US 10,623,961 B1
• Filed: 12/11/2018
• Issued: 04/14/2020
• Est. Priority Date: 12/11/2018
• Status: Active Grant

• Current Assignee: Zumigo, Inc.
• Original Assignee: Zumigo, Inc.
• Inventors: Manepalli, Harish, Bakshi, Chirag C., Parimi, Venkatarama, Long, Lyndi Rebecca
• Primary Examiner(s): Patel, Mahendra R
• Application Number:
  US16/216,637
• Time in Patent Office: 490 Days
• Field of Search: 455411, 455406, 4554521, 370280, 370329, 726 1, 726 7
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles
• CPC Class Codes: H04W 12/69 Identity-dependent
• CPC Class Codes: H04W 12/73 Access point logical identity
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support

Abstract

The network ID of a mobile device can be securely employed as a possession factor. When an access to a restricted access application server or a restricted access account on the application server is attempted via a computing device, and possession of a mobile device programmed with a network ID is employed as a verification factor, the application server or a network ID monitoring server can determine whether certain information associated with the network ID has been changed within a predetermined time interval, indicating potentially fraudulent activity. Based on the presence or absence of recent changes in the information associated with the network ID, the user activity is either authorized or denied.

Claims

1. A computer-implemented method of authorizing a user activity based on a network identification (ID) of a mobile device, that has been activated, the method comprising:

receiving a request from a computing device to initiate a transfer of funds from a restricted-access account on an application server, wherein the request references the network ID;

determining whether or not there is a change of information associated with the network ID during a predetermined time interval by querying a network ID server for the change of information associated with the network ID;

upon determining that the information associated with the network ID has not changed during the predetermined time interval, transmitting a one-time password to the mobile device; and

upon receipt of the one-time password from the mobile device, authorizing the transfer of funds,

wherein the change of information associated with the network ID is a change in a name for a mobile account associated with the network ID.

2. The computer-implemented method of claim 1, wherein the request from the computing device includes a user name associated with the restricted-access account.

3. The computer-implemented method of claim 1, wherein the request from the computing device includes the network identification ID.

4. The computer-implemented method of claim 1, wherein the request from the computing device includes a user name associated with the restricted-access account and the network identification ID.

5. The computer-implemented method of claim 1, wherein the change of information associated with the network ID is multiple changes in the name for the mobile account associated with the network ID.

6. The computer-implemented method of claim 5, wherein the predetermined time interval is a week.

7. The computer-implemented method of claim 1, wherein the restricted-access account is a bank account.

8. The computer-implemented method of claim 7, wherein the one-time password is transmitted to the mobile device as a text message.