# US 12,002,037 B2 · Consumer authentication system and method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,002,037 B2
- Document ID: US12002037B2
- Status: Granted
- Kind: B2
- Application number: 17/944,069
- Filed: 2022-09-13
- Published: 2023-01-05
- Granted: 2024-06-04
- Earliest claimed: 2006-06-19
- Assignees: Visa U.S.A. Inc.
- Applicants: Visa U.S.A. Inc.
- Inventors: Ayman Hammad; Patrick Faith; Mark Carlson
- Web page: https://patentgrep.com/patent/US12002037B2

## CPC

- G06Q 20/382: {insuring higher security of transaction}
- G06Q 20/085: {involving remote charge determination or related payment systems}
- G06Q 20/20: Point-of-sale [POS] network systems
- G06Q 20/367: {involving electronic purses or money safes}
- G06Q 20/3672: {initialising or reloading thereof}
- G06Q 20/3674: {involving authentication}
- G06Q 20/3821: {Electronic credentials}
- G06Q 20/3829: {involving key management}
- G06Q 20/385: {using an alias or single-use codes}
- G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q 20/401: {Transaction verification}
- G06Q 30/06: Buying, selling or leasing transactions
- G06Q 40/00: Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- H04L 9/3271: {using challenge-response}
- G06Q 20/105: {involving programming of a portable memory device, e.g. IC cards, "electronic purses"}
- G06Q 20/204: {comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit}
- G06Q 2220/00: Business processing using cryptography
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method for authenticating a consumer. The method includes receiving an authorization request message associated with a consumer conducting a transaction with a portable consumer device. A challenge message is sent to the consumer, where the challenge message is dynamic or semi-dynamic. A challenge response message is received from the consumer, and an authorization response message is sent to the consumer. The authorization response message indicates whether or not the transaction is authorized.

## Claims

### Claim 1

A method comprising:
receiving, by a server computer from an access device associated with a merchant, an authorization request message relating to a transaction conducted using a portable consumer device associated with a consumer;
determining, by the server computer, whether a challenge message is needed by determining whether a series of features relating to the transaction, the consumer, and the merchant exceed predetermined ranges;
responsive to determining that the challenge message is needed, generating, by the server computer, a challenge message that includes content that is dynamic and is based on a credit card or debit card transaction history specific to the consumer;
sending, by the server computer, the challenge message to a mobile device of the consumer;
receiving, by the server computer, a challenge response message from the access device, the challenge response message responsive to the challenge message with content that is dynamic and that is based upon the transaction history of the consumer;
validating, by the server computer, the challenge response message by determining that the content of the challenge response message corresponds to the challenge message; and
sending, by the server computer, an authorization response message to the access device or to the consumer, wherein the authorization response message indicates whether or not the transaction is authorized based on whether the challenge response message is validated.

### Claim 2 (depends on 1)

The method of claim 1 wherein the portable consumer device is in the form of a card.

### Claim 3 (depends on 1)

The method of claim 1 wherein the challenge message includes a question.

### Claim 4 (depends on 1)

The method of claim 1 wherein the server computer is in a payment processing network, and wherein the method further comprises:
forwarding the authorization request message to an issuer computer operated by an issuer of the portable consumer device; and
receiving the authorization response message from the issuer computer before sending the authorization response message to the consumer.

### Claim 5 (depends on 1)

The method of claim 1, wherein the authorization response message is sent to the access device.

### Claim 6 (depends on 1)

The method of claim 1, wherein the challenge message includes a question, and uses a location of the consumer to create the challenge message.

### Claim 7 (depends on 1)

The method of claim 1, wherein the portable consumer device is a credit card.

### Claim 8 (depends on 7)

The method of claim 7, wherein the access device is a POS terminal.

### Claim 9 (depends on 1)

The method of claim 1, wherein the authorization request message is a first authorization request message, and the challenge response message is in a second authorization request message.

### Claim 10 (depends on 1)

The method of claim 1, wherein the authorization request message comprises a primary account number of an account of the consumer.

### Claim 11

A server computer comprising:
a processor; and
a computer readable medium coupled to the processor, the computer readable medium comprising code, executable by the processor, to implement a method comprising:
receiving, from an access device associated with a merchant, an authorization request message relating to a transaction conducted using a portable consumer device associated with a consumer;
determining whether a challenge message is needed by determining whether a series of features relating to the transaction, the consumer, and the merchant exceed predetermined ranges;
responsive to determining that the challenge message is needed, generating a challenge message that includes content that is dynamic and is based on a credit card or debit card transaction history specific to the consumer;
sending the challenge message to a mobile device of the consumer;
receiving a challenge response message from the access device, the challenge response message responsive to the challenge message with content that is dynamic and that is based upon the transaction history of the consumer;
validating the challenge response message by determining that the content of the challenge response message corresponds to the challenge message; and
sending an authorization response message to the access device or to the consumer, wherein the authorization response message indicates whether or not the transaction is authorized based on whether the challenge response message is validated.

### Claim 12 (depends on 11)

The server computer of claim 11, wherein the portable consumer device is in the form of a card or a mobile phone.

### Claim 13 (depends on 11)

The server computer of claim 11, wherein the challenge message includes a question.

### Claim 14 (depends on 11)

The server computer of claim 11, wherein the server computer is in a payment processing network, and wherein the method further comprises:
forwarding the authorization request message to an issuer computer operated by an issuer of the portable consumer device; and
receiving the authorization response message from the issuer computer before sending the authorization response message to the consumer.

### Claim 15 (depends on 11)

The server computer of claim 11, wherein the server computer is an issuer computer.

### Claim 16 (depends on 11)

The server computer of claim 11, wherein the challenge message includes a question, and uses a location of the consumer to create the challenge message.

### Claim 17 (depends on 11)

The server computer of claim 11, wherein sending, by the server computer, the authorization response message to the consumer comprises sending the authorization response message to the access device.

### Claim 18 (depends on 11)

The server computer of claim 11, wherein the access device is a POS terminal.

### Claim 19 (depends on 11)

The server computer of claim 11, wherein the authorization request message is a first authorization request message, and the challenge response message is in a second authorization request message.

### Claim 20 (depends on 11)

The server computer of claim 11, wherein the series of features relate to one or more of: a geographic distance between the portable consumer device and the access device, the transaction exceeding a threshold amount, and the merchant being included in a listing of merchants with a higher tendency for fraudulent transactions.