# US 10,121,142 B2 · User authentication by token and comparison to visitation pattern > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,121,142 B2 - Document ID: US10121142B2 - Status: Granted - Kind: B2 - Application number: 14/251,291 - Filed: 2014-04-11 - Published: 2015-10-15 - Granted: 2018-11-06 - Earliest claimed: 2014-04-11 - Assignees: Bank of America Corporation - Applicants: Bank of America Corporation - Inventors: David M. Grigg; Richard Andrew Starbuck; Carrie Anne Hanson; Alicia C. Jones - Web page: https://patentgrep.com/patent/US10121142B2 ## CPC - G06Q 20/3821: {Electronic credentials} - G06Q 20/02: involving a neutral party, e.g. certification authority, notary or trusted third party [TTP] - G06Q 20/321: {using wearable devices} - G06Q 20/363: {with the personal data of a user} - G06Q 20/385: {using an alias or single-use codes} - G06Q 20/4016: {involving fraud or risk level assessment in transaction processing} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/102: {Entity profiles} - H04L 63/105: {Multiple levels of security} - G06Q 2220/00: Business processing using cryptography - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments are directed to receiving a token from a wearable device carried by a customer, the token for user authentication based on a visitation pattern of the customer. Embodiments include receive, from the wearable device carried by the customer, the token comprising user authentication information associated with the customer, wherein receiving the token indicates a current visit of the customer to the financial institution location; access, based at least in part on the user authentication information, a visitation history from a customer profile associated with the customer; determine, based at least in part on the visitation history, whether the current visit falls within a recognized visitation pattern; and authenticate, based at least in part on the determination, the customer for performing a transaction at the financial institution location. ## Claims ### Claim 1 An apparatus disposed proximate a financial institution location, the apparatus for receiving a token from a wearable device carried by a customer, the token for user authentication based on a visitation pattern of the customer, the apparatus comprising: a memory; a processor; and a module stored in the memory, executable by the processor, and configured to: receive, from the wearable device carried by the customer, the token comprising user authentication information associated with the customer, wherein receiving the token indicates a current visit of the customer to the financial institution location; receive, from the wearable device carried by the customer, financial transaction limitation information indicating at least one limitation on transactions performed with the token; access, based at least in part on the user authentication information, a visitation history from a customer profile associated with the customer; determine, based at least in part on the visitation history, whether the current visit falls within a recognized visitation pattern; if so, determine that a required level of authentication for the current visit is a soft level of authentication, wherein the soft level of authentication is one of a plurality of levels of authentication comprising a continuum of authentication; and if not, determine that the required level of authentication for the current visit is a hard level of authentication, wherein the hard level of authentication is one of the plurality of levels of authentication comprising the continuum of authentication and wherein the hard level of authentication requires full authentication credentials; receive a request to perform a financial transaction from the customer; determine that the requested financial transaction exceeds the at least one limitation indicated by the financial transaction limitation information; in response to determining that the requested financial transaction exceeds the at least one limitation, identify that the requested financial transaction qualifies for an exception to the at least one limitation indicated by the financial transaction limitation information based on at least one of: identifying that a number of days between a current real-time date and an expiration date of the token is less than a predetermined limit; and identifying that a category of the requested financial transaction is within a predetermined list of categories; and in response to determining that the requested financial transaction qualifies for the exception, authenticate, based on the required level of authentication, the customer to initiate the financial transaction at the financial institution location. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the current visit falls within the recognized visitation pattern; and wherein determining that the current visit requires the soft level of authentication comprises determining a zero level of authentication wherein authentication requires no additional credentials. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the current visit falls within the recognized visitation pattern; wherein determining the soft level of authentication requires authentication that is less than a full level of authentication; and wherein the soft level of authentication requires at least one additional authentication credential. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the visitation history comprises time information indicating when the customer typically visits the financial institution location; and wherein determining whether the current visit falls within the recognized visitation pattern comprises comparing a time, date, and/or day of a week associated with the current visit and the time information. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the visitation history comprises transaction information indicating an amount of a transaction conducted when the customer visits the financial institution location; and wherein determining whether the current visit falls within the recognized visitation pattern comprises comparing a transaction amount associated with the current visit and the transaction information. ### Claim 6 A method for receiving a token from a wearable device carried by a customer, the token for user authentication based on a visitation pattern of the customer, the method comprising: receiving, at an apparatus proximate a financial institution location and from the wearable device carried by the customer, the token comprising user authentication information associated with the customer, wherein receiving the token indicates a current visit of the customer to the financial institution location; receiving, by the apparatus, financial transaction limitation information indicating at least one limitation on transactions performed with the token from the wearable device carried by the customer; accessing, by the apparatus and based at least in part on the user authentication information, a visitation history from a customer profile associated with the customer; determining, by the apparatus and based at least in part on the visitation history, whether the current visit falls within a recognized visitation pattern; if so, determining that a required level of authentication for the current visit is a soft level of authentication, wherein the soft level of authentication is one of a plurality of levels of authentication comprising a continuum of authentication; and if not, determining that the required level of authentication for the current visit is a hard level of authentication, wherein the hard level of authentication is one of the plurality of levels of authentication comprising the continuum of authentication and wherein the hard level of authentication requires full authentication credentials; receiving a request to perform a financial transaction from the customer; determining that the requested financial transaction exceeds the at least one limitation indicated by the financial transaction limitation information; in response to determining that the requested financial transaction exceeds the at least one limitation, identify that the requested financial transaction qualifies for an exception to the at least one limitation indicated by the financial transaction limitation information based on at least one of: identifying that a number of days between a current real-time date and an expiration date of the token is less than a predetermined limit; and identifying that a category of the requested financial transaction is within a predetermined list of categories; and in response to determining that the requested financial transaction qualifies for the exception, authenticating, by the apparatus and based at least in part on the determination, the customer to initiate the financial transaction at the financial institution location. ### Claim 7 (depends on 6) The method of claim 6, wherein the current visit falls within the recognized visitation pattern; and wherein determining that the current visit requires the soft level of authentication comprises determining a zero level of authentication wherein the soft level of authentication requires no additional credentials. ### Claim 8 (depends on 6) The method of claim 6, wherein the current visit falls within the recognized visitation pattern; wherein determining the soft level of authentication comprises determining the soft level of authentication requires authentication that is less than a full level of authentication; and wherein the soft level of authentication requires at least one additional authentication credential. ### Claim 9 (depends on 6) The method of claim 6, wherein the visitation history comprises time information indicating when the customer typically visits the financial institution location; and wherein determining whether the current visit falls within the recognized visitation pattern comprises comparing a time, date, and/or day of a week associated with the current visit and the time information. ### Claim 10 (depends on 6) The method of claim 6, wherein the visitation history comprises transaction information indicating an amount of a transaction conducted when the customer visits the financial institution location; and wherein determining whether the current visit falls within the recognized visitation pattern comprises comparing a transaction amount associated with the current visit and the transaction information. ### Claim 11 A computer program product for receiving a token from a wearable device carried by a customer, the token for user authentication based on a visitation pattern of the customer, the computer program product comprising a non-transitory computer-readable medium comprising code causing a first apparatus to: receive, from the wearable device carried by the customer, the token comprising user authentication information associated with the customer, wherein receiving the token indicates a current visit of the customer to the financial institution location; receive, from the wearable device carried by the customer, financial transaction limitation information indicating at least one limitation on transactions performed with the token; access, based at least in part on the user authentication information, a visitation history from a customer profile associated with the customer; determine, based at least in part on the visitation history, whether the current visit falls within a recognized visitation pattern; if so, determine that a required level of authentication for the current visit is a soft level of authentication, wherein the soft level of authentication is one of a plurality of levels of authentication comprising a continuum of authentication; and if not, determine that the required level of authentication for the current visit is a hard level of authentication, wherein the hard level of authentication is one of the plurality of levels of authentication comprising the continuum of authentication and wherein the hard level of authentication requires full authentication credentials; receive a request to perform a financial transaction from the customer; determine that the requested financial transaction exceeds the at least one limitation indicated by the financial transaction limitation information; in response to determining that the requested financial transaction exceeds the at least one limitation, identify that the requested financial transaction qualifies for an exception to the at least one limitation indicated by the financial transaction limitation information based on at least one of: identifying that a number of days between a current real-time date and an expiration date of the token is less than a predetermined limit; and identifying that a category of the requested financial transaction is within a predetermined list of categories; and in response to determining that the requested financial transaction qualifies for the exception, authenticate, based on the required level of authentication, the customer to initiate the financial transaction at the financial institution location. ### Claim 12 (depends on 11) The computer program product of claim 11, wherein the visitation history comprises time information indicating when the customer typically visits the financial institution location; and wherein determining whether the current visit falls within the recognized visitation pattern comprises comparing a time, date, and/or day of a week associated with the current visit and the time information. ### Claim 13 (depends on 11) The computer program product of claim 11, wherein the visitation history comprises transaction information indicating an amount of a transaction conducted when the customer visits the financial institution location; and wherein determining whether the current visit falls within the recognized visitation pattern comprises comparing a transaction amount associated with the current visit and the transaction information. ### Claim 14 (depends on 11) The computer program product of claim 11, wherein the current visit falls within the recognized visitation pattern; and wherein determining that the current visit requires the soft level of authentication comprises determining a zero level of authentication wherein the soft level of authentication requires no additional credentials. ### Claim 15 (depends on 11) The computer program product of claim 11, wherein the current visit falls within the recognized visitation pattern; wherein determining the soft level of authentication comprises determining the soft level of authentication requires authentication that is less than a full level of authentication; and wherein the soft level of authentication requires at least one additional authentication credential.