# US 10,311,434 B2 · Systems and methods for reporting compromised card accounts

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,311,434 B2
- Document ID: US10311434B2
- Status: Granted
- Kind: B2
- Application number: 14/290,865
- Filed: 2014-05-29
- Published: 2015-12-03
- Granted: 2019-06-04
- Earliest claimed: 2014-05-29
- Assignees: Paypal, Inc.
- Applicants: PayPal, Inc.
- Inventors: Brad Wardman; Jeffrey Alan Edelen
- Web page: https://patentgrep.com/patent/US10311434B2

## CPC

- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- G06Q 10/0635: Risk analysis of enterprise or organisation activities
- G06Q 10/10: Office automation; Time management
- G06Q 50/265: {Personal security, identity or safety}
- Y04S 10/50: Systems or methods supporting the power network operation or management, involving a certain degree of interaction with the load-side end user applications
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- Y04S: SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS

## Abstract

A system or method is provided to generate and send a notification to a card issuing bank to report a compromised card. In particular, the notification may be embedded in a pseudo card transaction message based on the ISO 8583 protocol message format. Card issuing banks may be a participant in a compromised card account reporting program to receive the notifications via the ISO 8583 transaction messages from a merchant or a payment service provider. In particular, data elements within the ISO 8583 protocol that are not reserved for carrying information for a transaction may be designated to carry information for reporting the compromised card account. Thus, merchants or payment service providers may send notifications of compromised card accounts to card issuing banks in a secured manner using ISO 8583 transaction messages.

## Claims

### Claim 1

A server machine, associated with a first service provider, for detecting compromised user accounts, comprising:
a non-transitory memory; and
one or more hardware processors coupled to the non-transitory memory and configured to execute instructions from the non-transitory memory to cause the server machine to perform operations comprising:
monitoring a plurality of online resources for information associated with user accounts;
analyzing information collected from the plurality of online resources during the monitoring;
detecting, by the first service provider based on the analyzing, a compromised user account maintained by a second service provider;
automatically restricting use of the compromised user account with the first service provider;
automatically generating and sending a first ISO 8583 security message to a different server machine of the second service provider, the first ISO 8583 security message comprising one or more first data elements comprising data reporting the compromised user account;
receiving, after the sending the first ISO 8583 security message, a second ISO 8583 security message from the second service provider;
analyzing the second ISO 8583 security message to determine that the second ISO 8583 security message comprises one or more second data elements indicating that the second service provider has received the data reporting the compromised user account; and
responsive to the determining that the second ISO 8583 security message comprises the one or more second data elements indicating that the second service provider has received the data reporting the compromised user account, automatically removing the restriction of the use of the compromised user account with the first service provider.

### Claim 2 (depends on 1)

The server machine of claim 1, wherein one or more of the one or more first data elements are unreserved ISO 8583 data elements and the first ISO 8583 security message further comprises a bitmap indicating a location of the first data elements within the first ISO 8583 security message.

### Claim 3 (depends on 1)

The server machine of claim 1, wherein the data reporting the compromised user account includes one or more of: a type of compromise, a risk level, a probability that the user account is compromised, a source of the compromised user account, or a description of an incident of abuse.

### Claim 4 (depends on 1)

The server machine of claim 1, wherein the first ISO 8583 security message comprises a pseudo-message unassociated with a pending transaction and comprising a transaction request of a zero amount, and wherein the second ISO 8583 security message further comprises a designated bit confirming receipt of the first ISO 8583 security message.

### Claim 5 (depends on 1)

The server machine of claim 1, wherein the first data elements are located within at least one of data field numbers 55-63, 105-112, 114-123, and 127 of the first ISO 8583 security message.

### Claim 6 (depends on 1)

The server machine of claim 1, wherein the first ISO 8583 security message is associated with a pending request, and wherein the second ISO 8583 security message comprises information regarding an approval decision associated with the pending request.

### Claim 7 (depends on 6)

The server machine of claim 6, wherein the operations further comprise processing the pending request when the second ISO 8583 security message indicates that the pending request is approved by the second service provider.

### Claim 8 (depends on 6)

The server machine of claim 6, wherein the operations further comprise declining the pending request when the second ISO 8583 security message indicates that the pending request is not approved by the second service provider.

### Claim 9

A machine-implemented method comprising:
receiving, by one or more hardware processors of a first server machine of a first party responsible for a user account, a first security message from a second server machine of a second party, wherein the first security message is in an ISO 8583 format and comprising one or more first data elements comprising data reporting the user account as being compromised;
analyzing, by one or more of the hardware processors, the first data elements of the security message;
identifying, by one or more of the hardware processors, the user account as being compromised based on the analyzing of the one or more first data elements;
generating, by one or more of the hardware processors after the identifying the user account as being compromised, a second security message in an ISO 8583 format, the second security message comprising one or more second data elements indicating that the first party received the data reporting the user account as being compromised; and
sending, by one or more of the hardware processors, the second security message to the second server machine.

### Claim 10 (depends on 9)

The machine-implemented method of claim 9, wherein one or more of the first data elements in the first security message are unreserved ISO 8583 data elements and the first security message further comprises a bitmap indicating a location of the first data elements within the first security message based on ISO 8583.

### Claim 11 (depends on 9)

The machine-implemented method of claim 9, wherein the second security message comprises an approval determination regarding a pending request involving the user account.

### Claim 12

A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
analyzing information collected from one or more online resources;
detecting, based on the analyzing, a compromised user account maintained by another party;
automatically placing an account restriction on the compromised user account;
automatically generating and sending, to a server machine of the another party responsible for the compromised user account, a first ISO 8583 security message comprising one or more first data elements comprising a report identifying the compromised user account;
receiving, after the sending the first ISO 8583 security message, a second ISO 8583 security message from the another party;
analyzing the second ISO 8583 security message to determine that the second ISO 8583 comprises data indicating that the another party has confirmed receipt of the report identifying the compromised user account; and
in response to the analyzing the second ISO 8583 security message confirming receipt of the report by the another party, automatically removing the account restriction.

### Claim 13 (depends on 12)

The non-transitory machine-readable medium of claim 12, wherein the first ISO 8583 security message comprises a pseudo-message that is unassociated with any pending transaction comprising a transaction request of a zero amount.

### Claim 14 (depends on 1)

The server machine of claim 1, wherein the monitoring of the online resources comprises monitoring live network traffic.

### Claim 15 (depends on 1)

The server machine of claim 1, wherein the monitoring of the online resources comprises monitoring botnet communications over a network.

### Claim 16 (depends on 1)

The server machine of claim 1, wherein the monitoring of the online resources comprises monitoring a plurality of online sites associated with cybercriminal activity.

### Claim 17 (depends on 1)

The server machine of claim 1, wherein the automatically generating and sending of the first ISO 8583 security message is based, at least in part, on determining that the second service provider maintaining the compromised user account participates in a compromised user account reporting program.

### Claim 18 (depends on 9)

The machine-implemented method of claim 9, wherein a logical value of one in a bit array data structure of the first security message indicates that a corresponding data element among the one or more data elements includes information about the user account.

### Claim 19 (depends on 9)

The machine-implemented method of claim 9, wherein the first data elements are located within at least one of data field numbers 55-63, 105-112, 114-123, and 127 of the first ISO 8583 security message.

### Claim 20 (depends on 19)

The machine-implemented method of claim 19, wherein the first data elements are located within at least one of data field numbers 55-63, 105-112, 114-123, and 127 of the first ISO 8583 security message, and wherein the first ISO 8583 security message further comprises a bitmap indicating the location of the first data elements within the first ISO 8583 security message.