Systems and methods to secure transactions via mobile devices

• US 8,412,626 B2
• Filed: 12/07/2010
• Issued: 04/02/2013
• Est. Priority Date: 12/10/2009
• Status: Active Grant

• Current Assignee: Boku Incorporated
• Original Assignee: Boku Incorporated
• Inventors: Hirson, Ron, Niejadlik, Martine
• Primary Examiner(s): Havan, Thu Thao
• Application Number:
  US12/962,048
• Publication Number:
  US 20110143711A1
• Time in Patent Office: 847 Days
• Field of Search: 705 35- 40
• US Class Current: 705/39
• CPC Class Codes: G06Q 20/32 using wireless devices
• CPC Class Codes: G06Q 20/3255 using mobile network messaging services for payment, e.g. SMS
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/68 Payment of value-added services
• CPC Class Codes: H04W 4/24 Accounting or billing

Abstract

Systems and methods are provided to improve security of payment transactions via mobile communications. In one aspect, a system includes an interchange having a common format processor and a plurality of converters to interface with a plurality of different controllers of mobile communications. The converters are configured to communicate with the controllers in different formats and to communicate with the common format processor in a common format for the confirmation of payment requests, made via mobile phones. The common format processor is to determine a risk of a payment request being fraudulent based on the personal identification information associated with a mobile phone and, after the payment request is confirmed and when the risk is below a threshold, to communicate one or more premium messages to the mobile phone to collect funds to fulfill the payment request.

Claims

1. A computer-implemented method, comprising:

receiving in a server computer a request for a transaction between a first party and a second party, the request including an indication of a phone number of the first party and an amount to be paid to the second party;

in response to the request, determining by the server computer a geographical location of a mobile phone at the phone number;

determining, by the server computer, a value indicating a risk of the request being fraudulent, based at least in part on the location; and

after the transaction is confirmed and if the risk as indicated by the value is below a threshold, transmitting by the server computer one or more messages to a telecommunication carrier of the mobile phone to collect, via the telecommunication carrier of the mobile phone, funds in accordance with the amount to be paid to the second party.

2. The method of claim 1, further comprising:

storing first personal identification information of the first party; and

storing second personal identification information as the location of the mobile phone as;

wherein the value is determined based on comparing the first personal identification information and the second personal identification information.

3. The method of claim 2, wherein the first personal identification information is associated with a computer from which the request is received;

the second personal identification information is associated with the mobile phone; and

the computer and the mobile phone are distinct and separate from each other.

4. The method of claim 2, further comprising:

communicating with the mobile phone at the phone number to confirm the request wherein the first personal identification information of the first party is stored before the request is received; and

the location of the mobile phone is received during the communicating by the server computer with the mobile phone to confirm the transaction.

5. The method of claim 2, wherein the value is proportional to a distance between the first personal identification information and the location of the mobile phone.

6. The method of claim 2, further comprising:

communicating with the mobile phone at the phone number to confirm the request wherein a level of risk is determined to be lower if the request is confirmed.

7. The method of claim 2, wherein the first personal identification information is an address of the first party.

8. The method of claim 7, wherein the address of the first party is a billing address of the phone number.

9. The method of claim 8, further comprising:

receiving by the server computer the billing address from the telecommunication carrier of the mobile phone.

10. The method of claim 7, further comprising:

obtaining by the server computer the address of the first party from a social networking website.

11. The method of claim 2, wherein the first personal identification information is a location of a computer from which the server computer receives the request.

12. The method of claim 2, wherein the first personal identification information is a location of the requester.

13. The method of claim 12, further comprising:

receiving the location of the requester from the second party.

14. The method of claim 2, wherein the first personal identification information includes locations associated with prior transactions confirmed via the phone number.

15. The method of claim 14, wherein the locations comprise locations of computers used to make requests for the prior transactions and locations of the mobile phone at the phone number where confirmations for the prior transactions were made.

16. The method of claim 14, wherein the mobile phone is identified by a Mobile Station International Subscriber Directory Number (MSISDN), and the method further comprises:

storing the locations in association with the MSISDN.

17. The method of claim 2, wherein the first personal identification information comprises one of:

a zip code, a portion of a street address, a portion of a social security number, and a PIN.

18. The method of claim 17, wherein the second personal identification information is received from the mobile phone during the communicating by the server computer with the mobile phone to confirm the transaction.

21. The method of claim 1, wherein the location of the mobile phone is determined from at least one of cell phone tower data and GPS data.

19. A computer-readable storage media storing instructions, the instructions causing a computer to perform a method, the method comprising:

receiving in a server computer a request for a transaction between a first party and a second party, the request including an indication of a phone number of the first party and an amount to be paid to the second party;

in response to the request, determining by the server computer a geographical location of a mobile phone at the phone number;

determining, by the server computer, a value indicating a risk of the request being fraudulent, based at least in part on the location; and

after the transaction is confirmed and if the risk as indicated by the value is below a threshold, transmitting by the server computer one or more messages to a telecommunication carrier of the mobile phone to collect, via the telecommunication carrier of the mobile phone, funds in accordance with the amount to be paid to the second party.

20. A system, comprising:

a data storage facility to store first personal identification information in association with a mobile phone number of a user; and

an interchange coupled with the data storage facility, the interchange including a common format processor and a plurality of converters to interface with a plurality of controllers, the converters configured to communicate with the controllers in different formats, the converters to communicate with the common format processor in a common format, the common format processor to instruct a first controller of the controllers, via a first converter of the converters, to communicate with a mobile phone at the mobile phone number of the user to confirm a payment request and obtain a geographical location, the common format processor to determine a risk of the request being fraudulent based on at least in part on the location and, after the request is confirmed and when the risk is below a threshold, to communicate one or more messages to a telecommunication carrier of the mobile phone to collect, via the telecommunication carrier of the mobile phone, funds in accordance with the request.