Transaction authentication using network

A server computer comprising:

• a computer readable medium having instructions stored thereon that, when executed, cause a computer to perform steps including:
• receiving, by the server computer from an access device, a first authorization request message generated by the access device for a transaction between a merchant and a consumer, the first authorization request message including first dynamic data generated by a portable consumer device used by the consumer after the portable consumer device interacts with the access device at the merchant, wherein the access device is a point of sale terminal, and wherein the first authorization request message further includes an account number associated with the portable consumer device and a transaction amount for the transaction;
• authenticating, by the server computer, the portable consumer device by using the first dynamic data received in the first authorization request message, wherein the first dynamic data is different for each transaction and is generated from one or more of transaction-specific data and/or consumer-specific data, wherein the portable consumer device is authenticated when the first dynamic data matches second dynamic data generated by the server computer, wherein the first dynamic data and the second dynamic data are from the account number and a counter;
• determining, by the server computer, that a series of features relating to the transaction, the consumer, and the merchant exceed a predetermined range, wherein the features relate to one or more of:
• a geographic distance between the portable consumer device and the access device, the transaction exceeding a threshold amount, and the merchant being included in a listing of merchants with a higher tendency for fraudulent transactions;
• responsive to receiving the first authorization request message and determining that the series of features exceed the predetermined range, retrieving, by the server computer, a challenge message from a database, wherein the challenge message is dynamic, and wherein the challenge message is a challenge question;
• sending, by the server computer, the challenge message comprising the challenge question about a previous transaction conducted by the consumer to the access device in a first authorization response message;
• receiving, by the server computer from the access device, a second authorization request message comprising the account number associated with the portable consumer device, and a challenge response from the consumer;
• validating, by the server computer, the received challenge response by comparing the challenge response to information stored in the database;
• and
• in response to validating the received challenge response, transmitting the second authorization request message to an issuer computer associated with the portable consumer device for approval of the transaction.

A system comprising:

• a server computer comprising
• a computer readable medium having instructions stored thereon that, when executed, cause a computer to perform steps including
• receiving, by a server computer from an access device, a first authorization request message generated by the access device for a transaction between a merchant and a consumer, the first authorization request message including first dynamic data generated by a portable consumer device used by the consumer after the portable consumer device interacts with the access device at the merchant, wherein the access device is a point of sale terminal, and wherein the first authorization request message further includes an account number associated with the portable consumer device and a transaction amount for the transaction;
• authenticating, by the server computer, the portable consumer device by using the first dynamic data received in the first authorization request message, wherein the first dynamic data is different for each transaction and is generated from one or more of transaction-specific data and/or consumer-specific data, wherein the portable consumer device is authenticated when the first dynamic data matches second dynamic data generated by the server computer, wherein the first dynamic data and the second dynamic data are from the account number and a counter;
• determining, by the server computer, that a series of features relating to the transaction, the consumer, and the merchant exceed a predetermined range, wherein the features relate to one or more of:
• a geographic distance between the portable consumer device and the access device, the transaction exceeding a threshold amount, and the merchant being included in a listing of merchants with a higher tendency for fraudulent transactions;
• responsive to receiving the first authorization request message and determining that the series of features exceed the predetermined range, retrieving, by the server computer, a challenge message from a database, wherein the challenge message is dynamic, and wherein the challenge message is a challenge question;
• sending, by the server computer, the challenge message comprising the challenge question about a previous transaction conducted by the consumer to the access device in a first authorization response message;
• receiving, by the server computer from the access device, a second authorization request message comprising the account number associated with the portable consumer device, and a challenge response from the consumer;
• validating, by the server computer, the received challenge response by comparing the challenge response to information stored in the database;
• and
• in response to validating the received challenge response, transmitting the second authorization request message to an issuer computer associated with the portable consumer device for approval of the transaction;
• the access device;
• and
• the portable consumer device.