Location based authentication

• US 9,721,250 B2
• Filed: 10/24/2008
• Issued: 08/01/2017
• Est. Priority Date: 10/25/2007
• Status: Active Grant

• Current Assignee: Visa USA, Inc. (Visa, Inc.)
• Original Assignee: Visa USA, Inc. (Visa, Inc.)
• Inventors: Hammad, Ayman, Faith, Patrick
• Primary Examiner(s): MARCUS, LELAND R
• Application Number:
  US12/258,322
• Publication Number:
  US 20090187492A1
• Time in Patent Office: 3,203 Days
• Field of Search: 705 35
• CPC Class Codes: G06Q 10/087 Inventory or stock management, e.g. order filling, procurement or balancing against orders
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/32 using wireless devices
• CPC Class Codes: G06Q 20/3223 Realising banking transactions through M-devices
• CPC Class Codes: G06Q 20/3224 Transactions dependent on location of M-devices
• CPC Class Codes: G06Q 20/3274 using a pictured code, e.g. barcode or QR-code, being displayed on the M-device
• CPC Class Codes: G06Q 20/3276 using a pictured code, e.g. barcode or QR-code, being read by the M-device
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/387 Payment using discounts or coupons relating to marketing G06Q30/02
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4015 using location information
• CPC Class Codes: G06Q 30/00 Commerce
• CPC Class Codes: G06Q 30/0212 Chance discounts or incentives
• CPC Class Codes: G06Q 30/0215 Including financial accounts
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof
• CPC Class Codes: G06Q 40/12 Accounting
• CPC Class Codes: G06Q 40/128 : Check-book balancing, updating or printing arrangements
• CPC Class Codes: H04L 63/18 : using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

A portable consumer device that is used to conduct a transaction at a merchant is authenticated. Information provided to a server computer includes locations of a merchant and a mobile communication device possessed by a consumer. If the location of the mobile communication device corresponds to the location of the merchant, the portable consumer device that is used to conduct the transaction is authenticated.

Claims

1. A method for conducting a transaction, the method comprising:

receiving, at a server in a payment processing network coupled with a mobile communication device held by a consumer, first location information associated with a particular location of the consumer'"'"'s mobile communication device during a transaction conducted with a merchant;

receiving, at the server, second location information associated with a particular fixed geographic location of the merchant at the time of the transaction, wherein the second location information is contained within a unique merchant identifier transferred from the merchant to the mobile communication device during the transaction, and wherein the second location information is then forwarded to the server from the mobile communication device via the payment processing network instead of from an access device operated by the merchant;

receiving an authorization request message at the server computer;

using the server computer, determining that a portable consumer device held by the consumer is authentic when the first location information matches the second location information; and

using the server computer, forwarding the authorization request message to an issuer with an indicator specifying that the consumer has been authenticated or that the consumer has not been authenticated;

wherein the first location information and the second location information are received from the mobile communication device held by the consumer, and wherein the second location information is provided to the mobile communication device directly from the access device operated by the merchant.

2. The method of claim 1 wherein the mobile communication device and the portable consumer device are the same device.

3. The method of claim 1, wherein the second location is a particular merchant location, and wherein the method further comprises:

in the event that a subsequent transaction is initiated using a different portable consumer device at a different merchant at a different merchant location, determining that the different portable consumer device is authentic based on at least one of a distance between the particular merchant location and the different merchant location and an amount of time elapsed between the transaction at the particular merchant location and the subsequent transaction at the different merchant location.

4. The method of claim 1 further comprising:

sending a message to the merchant indicating that the portable consumer device is authentic.

5. The method of claim 1 further comprising:

determining that a subsequent transaction is authentic using the first location information and the second location information.

6. The method of claim 1, wherein the second location information is generated by the access device operated by the merchant, and wherein the second location information does not pass through an acquirer associated with the access device operated by the merchant.

7. The method of claim 1, wherein the server computer determines the second location information of the merchant by determining a physical address or geographic coordinates that correspond to the unique merchant identifier received in the authorization request message.

8. The method of claim 1, wherein the consumer is authenticated to the payment processing network before initiating the transaction at the merchant.

9. The method of claim 1, wherein the second location information is encrypted at the merchant using an electronic signature before it is transferred to the consumer'"'"'s mobile communication device.

10. The method of claim 1, further comprising contacting the consumer to authenticate when the first location information and the second location information do not match.

11. The method of claim 1, further comprising authenticating the consumer with the mobile communication device before initiating the transaction with the merchant.

12. The method of claim 1, wherein the second location information is generated by the access device operated by the merchant, and wherein the first location information and the second location information are received at the server in the same authorization request message forwarded by the consumer'"'"'s mobile communication device.

13. A method for conducting a transaction, the method comprising:

providing first location information to a server computer in a payment processing network, wherein the first location information corresponds to a location of a mobile communication device held by a consumer during a transaction conducted with a merchant;

providing second location information to the server computer, wherein the second location information corresponds to a fixed geographic location of the merchant at the time of the transaction, wherein the second location information is contained within a unique merchant identifier transferred from the merchant to the consumer'"'"'s mobile communication device during the transaction and is thereafter forwarded to the server computer from the mobile communication device via the payment processing network instead of from the merchant,

wherein the server computer is configured to determine that a portable consumer device used in the transaction is authentic when the first location information matches with the second location information; and

wherein the second location information is generated by an access device operated by the merchant; and

the first location information and the second location information are received from the mobile communication device, wherein the second location information is provided to the mobile communication device directly from the access device operated by the merchant, and

wherein the first and second location information do not pass through an acquirer in communication with the access device of the merchant, and

wherein the server computer forwards an authorization request message to an issuer with an indicator that it has determined that the consumer has been authenticated or that the consumer has not been authenticated.

14. The method of claim 13 wherein the first location information comprises global positioning system information associated with the mobile communication device, and wherein the second location information comprises a merchant identifier received in an authorization request message from an access device of the merchant that is conducting the transaction.

15. The method of claim 14 wherein the portable consumer device is the mobile communication device.

16. The method of claim 15 wherein the merchant identifier identifies the fixed geographic location of the merchant.

17. The method of claim 15 wherein the portable consumer device is in the form of a card.

18. The method of claim 15 wherein the server computer further performs the following:

in the event that a subsequent transaction is initiated using a different portable consumer device at a different merchant, determining that the different portable consumer device is authentic based on at least one of a distance between the particular merchant location and the different merchant location and an amount of time elapsed between the transaction and the subsequent transaction.

19. The method of claim 13 wherein the server computer further performs the following:

in the event that the first location information matches with the second location information, validating the transaction.

20. The method of claim 13, wherein the access device operated by the merchant is configured to provide the unique merchant identifier to the mobile communication device.

21. The method of claim 13, wherein the server computer determines the second location information of the merchant by determining a physical address or geographic coordinates that correspond to the unique merchant identifier received in the authorization request message.

22. The method of claim 13, wherein the consumer is authenticated to the payment processing network before initiating the transaction at the merchant.

23. The method of claim 13, wherein the second location information is encrypted at the merchant using an electronic signature before it is transferred to the consumer'"'"'s mobile communication device.

24. The method of claim 13, wherein the second location information is generated by the access device operated by the merchant, and wherein the first location information and the second location information are received at the server computer in the same authorization request message forwarded by the consumer'"'"'s mobile communication device.

25. The method of claim 13, wherein the second location information in the unique merchant identifier is forwarded to the server computer from the mobile communication device as evidence of interaction between the merchant and the mobile communication device.

26. A computer program product comprising a computer readable medium configured to store a plurality of instructions for controlling a processor of a server to perform an operation for conducting a transaction, the instructions comprising:

receiving, at a server computer in a payment processing network coupled with a mobile communication device held by a consumer, first location information associated with a particular location of the consumer'"'"'s mobile communication device during a transaction conducted with a merchant;

receiving, at the server, second location information associated with a particular fixed geographic location corresponding to the merchant at the time of the transaction, wherein the second location information is contained within a unique merchant identifier transferred from the merchant to the mobile communication device during the transaction and is thereafter provided to the server from the mobile communication device through the payment processing network instead of from an access device operated by the merchant;

receiving an authorization request message;

using the server computer, determining that a portable consumer device held by a consumer is authentic when the first location information matches the second location information; and

forwarding the authorization request message to an issuer with an indicator, wherein the indicator specifies whether the consumer has been authenticated or that the consumer has not been authenticated;

wherein the first location information and the second location information are received at the server computer from the mobile communication device of the consumer, and wherein the second location information is provided to the mobile communication device directly from the access device operated by the merchant wherein the unique merchant identifier is sent to the server computer from the mobile communication device as evidence of interaction between the access device of the merchant and the mobile communication device.

27. The computer program product of claim 26, wherein the consumer is contacted to authenticate when the first location information and the second location information do not match.

28. A method for conducting a transaction, the method comprising:

receiving, at a server in a payment processing network, an authorization request message including;

(1) first location information associated with a particular location of a mobile communication device held by a consumer conducting a transaction with a merchant; and

(2) second location information associated with a geographic location associated with the merchant, wherein the second location information is contained within a unique merchant identifier transferred from the merchant to the mobile communication device during the transaction, and wherein the second location information is forwarded to the server from the consumer'"'"'s mobile communication device via the payment processing network instead of from an access device operated by the merchant;

authenticating the consumer, at the server, when the first location information matches the second location information; and

forwarding, from the server, the authorization request message to an issuer with an indicator specifying whether the consumer has been authenticated or not.