# US 10,504,116 B2 · Verification for payment transactions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,504,116 B2 - Document ID: US10504116B2 - Status: Granted - Kind: B2 - Application number: 15/267,349 - Filed: 2016-09-16 - Published: 2017-03-23 - Granted: 2019-12-10 - Earliest claimed: 2015-09-18 - Assignees: Mastercard International Incorporated - Applicants: MasterCard International Incorporated - Inventors: Mehdi Collinge; Patrik Smets - Web page: https://patentgrep.com/patent/US10504116B2 ## CPC - G06Q 20/4014: {Identity check for transactions} - G06Q 20/3224: {Transactions dependent on location of M-devices} - G06Q 20/3227: {using secure elements embedded in M-devices} - G06Q 20/326: {Payment applications installed on the mobile devices} - G06Q 20/327: {Short range or proximity payments by means of M-devices} - G06Q 20/36: using electronic wallets or electronic money safes - G06Q 20/3674: {involving authentication} - G06Q 20/382: {insuring higher security of transaction} - G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists - G06Q 20/401: {Transaction verification} - G06Q 20/4016: {involving fraud or risk level assessment in transaction processing} - G06Q 20/409: {Device specific authentication in transaction processing} - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract A method is described for providing user authentication and user consent for a transaction made with a payment device. A user authentication step is taken to verify that a user is entitled to use the payment device, and a user consent step is taken to verify that the user consents to the transaction. The user authentication step is discrete from the user consent step. A payment device adapted to perform this method is also described. ## Claims ### Claim 1 A method for providing user authentication and user consent for a contactless transaction made with a mobile payment device, comprising: providing on the mobile payment device a digital wallet module, comprising: a communication module; a wallet processor; a consent risk manager module; and a payment application module; wherein the consent risk manager module is electronically coupled to the wallet processor and wherein the consent risk manager module further includes a decision module on the payment device, wherein the consent risk manager module provides authentication based on a consumer device cardholder verification method (CDCVM); a user authentication step, executed by the consent risk manager module, to verify that a user is entitled to use the payment device for a specific transaction; an implicit user consent step, determined by a decision module of the consent risk manager module, to verify that the user implicitly consents to the specific transaction, wherein: implicit consent is based on contextual information that is not directly related to providing explicit consent to the specific transaction, bypassing the need for any additional user action to indicate explicit consent, the user authentication step is discrete from the user consent step, the implicit user consent step is based on an order of events, and the events comprise correlating at least a plurality of user actions and behavioral information, transaction context information, payment device information, terminal data, environmental information and proprietary check data; outputting, from the decision module to the payment application module, implicit consent data indicating that implicit consent for the specific transaction has been determined based on an analysis of the events; combining as CDCVM data the implicit consent data and authentication data associated with the CDCVM; and communicating, via the communication module and using an EMV data structure, the combined implicit consent data and CDCVM authentication data to an Issuer of an account associated with the mobile payment device. ### Claim 2 (depends on 1) The method of claim 1, wherein the user authentication step is taken outside a transaction context, but persists into a transaction context. ### Claim 3 (depends on 1) The method of claim 1, wherein the user consent step is an explicit user consent made within a transaction process. ### Claim 4 (depends on 1) The method of claim 1, wherein the user consent is an implicit user consent inferred from user or device actions or user or device context. ### Claim 5 (depends on 1) The method of claim 1, wherein results of the user authentication step and the user consent step are provided within a transaction. ### Claim 6 (depends on 5) The method of claim 5, wherein the results of the user consent step comprise a type of consent. ### Claim 7 (depends on 5) The method of claim 5, wherein the results of the user consent step comprise a rating of the user consent step. ### Claim 8 (depends on 5) The method of claim 5, wherein the results of the user authentication step comprise a type of user authentication used. ### Claim 9 (depends on 5) The method of claim 5, wherein the results of the user consent step comprise a rating of the user authentication step. ### Claim 10 (depends on 5) The method of claim 5, wherein the results of the user authentication step and the user consent step are transmitted as magnetic stripe track data. ### Claim 11 (depends on 10) The method of claim 10, further comprising encoding the results of the user authentication step and the user consent step into a coded value before transmission in the transaction. ### Claim 12 A mobile payment device comprising a digital wallet module, the digital wallet module comprising: a wallet processor electronically coupled to a consent risk manager module and a payment application module, and a communication module, wherein the consent risk manager module further includes a decision module on the payment device, wherein the consent risk manager module provides authentication based on a consumer device cardholder verification method (CDCVM), the digital wallet module programmed to perform the following steps to provide user authentication and user consent for a contactless transaction made with the mobile payment device, the steps comprising: a user authentication step, executed by the consent risk manager module to verify that a user is entitled to use the payment device for a specific transaction and; an implicit user consent step, determined by a decision module of the consent risk manager module, to verify that the user implicitly consents to the specific transaction, wherein: implicit consent is based on contextual information that is not directly related to providing explicit consent to the specific transaction, bypassing the need for any additional user action to indicate explicit consent, the user authentication step is discrete from the user consent step, the implicit user consent step is based on an order of events, and the events comprise correlating at least a plurality of user actions and behavioral information, transaction context information, payment device information, terminal data, environmental information and proprietary check data; an output from the decision module to the payment application module, implicit consent data indicating that implicit consent for the specific transaction has been determined based on an analysis of the events; a combination of the implicit consent data and authentication data associated with the CDCVM as CDCVM data; and communication, via the communication module and using an EMV data structure, the combined implicit consent data and CDCVM authentication data to an Issuer of an account associated with the mobile payment device. ### Claim 13 (depends on 12) The payment device of claim 12, wherein the payment device is adapted to provide results of the user authentication step and the user consent step within a transaction.