Systems and methods for cryptographic authentication of contactless cards using risk factors

An authentication system comprising:

• one or more servers,
• wherein the one or more servers are configured to:
• receive, a transaction request, wherein the transaction request includes account information for an account requesting to engage in a transaction and transaction information for the transaction,
• determine a risk factor associated with the transaction by:
• identifying that the transaction is between the account and a predetermined merchant that is associated with one or more fraudulent transactions, and
• evaluating historical patterns for the transaction based on transaction history of the account,
• transmit, based on the determination, a plurality of authentication requests, wherein at least one authentication request selected from the plurality of authentication requests is configured to request a first authentication factor associated with verification of a received cryptogram, the at least one authentication request comprising:
• generating an authentication diversified key based on a master key and a unique identifier,
• generating a session key based on the authentication diversified key, and
• verifying the cryptogram based on the session key using one or more cryptographic algorithms, and
• authorize the transaction based on the verified cryptogram.

A method of authenticating a transaction, comprising:

• receiving, by one or more processors, a first request wherein the request includes account information for an account requesting to engage in a transaction and transaction information for the transaction,
• identifying, by the one or more processors, a risk factor associated with the transaction based on the received first request by determining that the transaction is between the account and a predetermined merchant that is associated with one or more fraudulent transactions and evaluating historical patterns for the transaction based on transaction history of the account;
• transmitting, by the one or more processors, a plurality of authentication requests based on the identified risk factor, wherein at least one authentication request selected from the plurality of authentication requests is configured to request at least one authentication factor associated with verification of a received cryptogram, the at least one authentication request comprising:
• generating an authentication diversified key based on a master key and a unique identifier,
• generating a session key based on the authentication diversified key, and
• verifying the cryptogram based on the session key using one or more cryptographic algorithms, and
• authorizing, by the one or more processors, the transaction based on the verified cryptogram.