User authentication based on historical transaction data

• US 9,483,766 B2
• Filed: 02/18/2016
• Issued: 11/01/2016
• Est. Priority Date: 02/07/2014
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Grigg, David M., Bertanzetti, Peter John, Toth, Michael E., Hanson, Carrie Anne, Votaw, Elizabeth S.
• Primary Examiner(s): Mehedi, Morshed
• Assistant Examiner(s): Naghdali, Khalil
• Application Number:
  US15/047,114
• Publication Number:
  US 20160164857A1
• Time in Patent Office: 257 Days
• Field of Search: 726/7
• US Class Current: 1/1
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06Q 20/3224 Transactions dependent on location of M-devices
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/34 using cards, e.g. integrated circuit [IC] cards or magnetic cards
• CPC Class Codes: G06Q 20/384 using social networks
• CPC Class Codes: G06Q 20/386 using messaging services or messaging apps using mobile network messaging services for payment, e.g. SMS G06Q20/3255
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 20/405 Establishing or using transaction specific rules
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/61 Time-dependent
• CPC Class Codes: H04W 12/64 using geofenced areas

Abstract

Embodiments are directed to systems, methods and computer program products for providing user authentication based on transaction data. Embodiments receive from a user, a request to execute a user action associated with an application, wherein execution of the user action requires validation of authentication credentials; collect a transaction set of data comprising information related to transactions conducted by the user; collect a location set of data comprising information related to a physical location of the user; determine a transaction proximity score associated with the user and the transactions; determine a level of authentication associated with the determined transaction proximity score; determine which authentication types are associated with the level of authentication; request authentication credentials; receive authentication credentials from the user; validate the authentication credentials, thereby resulting in a successful validation of the authentication credentials; and, in response to the successful validation of the authentication credentials, execute the user action.

Claims

1. An apparatus for increasing confidence in user authentication based on transaction data indicating that one or more geographically proximate, card-present transactions were recently approved, the apparatus comprising:

a memory;

a processor; and

computer-executable instructions stored in the memory, executable by the processor, and configured to cause the processor to;

receive from a user, a request to execute a user action associated with a software application, wherein execution of the user action requires validation of one or more authentication credentials;

collect a transaction set of data comprising information related to one or more card-present transactions conducted by the user, the information indicating that the one or more card-present transactions were approved, card-present transactions and indicating one or more transaction locations at which the one or more card-present transactions were approved;

collect a location set of data comprising information related to a physical location of the user;

determine a current time of day;

determine a transaction proximity score associated with the user and the one or more card-present transactions, comprising;

determining a geographic distance between one or more of the card-present transactions represented in the transaction set of data and the location of the user;

determining an amount of time expired between approval of the one or more card-present transactions and the current time of day;

retrieving a proximity threshold associated with the one or more card-present transactions and the amount of time expired;

determining whether the user is within the proximity threshold based at least in part on the geographic distance; and

determining the transaction proximity score based at least in part on the determination whether the user is within the proximity threshold;

determine a level of authentication associated with the determined transaction proximity score, wherein the determined level of authentication varies as the geographic distance varies;

determine which one or more authentication types from a plurality of authentication types are associated with the level of authentication associated with the transaction proximity score;

request one or more authentication credentials corresponding to the determined one or more authentication types;

receive one or more authentication credentials from the user;

validate the one or more authentication credentials, thereby resulting in a successful validation of the one or more authentication credentials; and

in response to the successful validation of the one or more authentication credentials, allow the user action on the software application.

2. The apparatus of claim 1, wherein determining the transaction proximity score further comprises:

selecting one or more second transactions of the user;

determining a second proximity threshold associated with the one or more second transactions of the user; and

determining whether the user is within the second proximity threshold.

3. The apparatus of claim 2, wherein determining the transaction proximity score comprises:

determining a first partial score based at least in part on the determination of whether the user is within the proximity threshold, wherein the first partial score is weighted by a first weighting factor;

determining a second partial score based at least in part on the determination of whether the user is within the second proximity threshold, wherein the second partial score is weighted by a second weighting factor; and

combining the first partial score and the second partial score, thereby determining the transaction proximity score.

4. The apparatus of claim 3, wherein at least one of the first weighting factor and the second weighting factor are based on the elapsed time since their respective transactions occurred.

5. The apparatus of claim 1, wherein determining the transaction proximity score comprises:

determining a historical transaction pattern associated with the user;

determining whether the transaction set of data indicates a current transaction pattern that falls within a predetermined acceptable variance of the historical transaction pattern; and

if not, determining the transaction proximity score based at least in part on a variance of the current transaction pattern from the historical transaction pattern.

6. The apparatus of claim 1, wherein determining the transaction proximity score comprises:

determining a historical transaction pattern associated with the user; and

determining the transaction proximity score based at least in part on a variance of the current transaction pattern from the historical transaction pattern.