# US 12,015,610 B2 · Secure online ID validation and review system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,610 B2 - Document ID: US12015610B2 - Status: Granted - Kind: B2 - Application number: 17/366,970 - Filed: 2021-07-02 - Published: 2021-10-28 - Granted: 2024-06-18 - Earliest claimed: 2019-06-17 - Assignees: Namecheap, Inc. - Applicants: Namecheap, Inc. - Inventors: Phillip McKegney; Hicham Al Mallah - Web page: https://patentgrep.com/patent/US12015610B2 ## CPC - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - G06F 16/22: Indexing; Data structures therefor; Storage structures - G06F 16/245: Query processing - G06F 16/248: Presentation of query results - G06F 21/31: User authentication - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - G06Q 50/265: {Personal security, identity or safety} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/30: {for supporting lawful interception, monitoring or retaining of communications or communication related information (circuit switched telephony call monitoring H04M3/2281)} - H04W 12/06: Authentication - H04W 12/68: Gesture-dependent or behaviour-dependent - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method of detecting fraudulent activity during authenticating users and user identifications includes initiating a user's device to capture a sequence of images of the user to be authenticated commencing when the camera is operational and prior to receiving from the user a selection of the control that triggers capture of images and continuing until detecting that the user has selected the control to trigger capture of images, thereby enabling capture of activity performed by the user prior to and contemporaneous with selecting the control, including any attempted fraudulent activity of the user to be authenticated. Video, still images and audio of the user seeking authentication can be captured. ## Claims ### Claim 1 A method for detecting fraudulent activity during authenticating users and user identifications, including: receiving at a security server implementing a security service system, a request to authenticate a user device of a user with the security server; wherein the request was generated subsequent to the user device prompting the user seeking to authenticate with the security server to present one or more identification documents to a camera of the user device and to present their face and to select a control to trigger capture of images of the one or more identification documents and face of the user by the user device; obtaining a sequence of images of the user to be authenticated, the sequence of images including images captured commencing when the camera is operational and prior to receiving from the user a selection of the control that triggers capture of images, thereby enabling the sequence of images to have captured activity performed by the user prior to and contemporaneous with selecting the control, including any attempted fraudulent activity of the user seeking to be authenticated; wherein a live video image of the user was displayed by the user device when the sequence of images was captured, the live video image displayed comprising a close up presentation of at least a portion of the user's person and having a narrower field of view than the camera of the user device, so that the sequence of images includes images comprising at least one of background or periphery including any objects and actions therein and wherein capture of the at least one of background or periphery including any objects and actions is not indicated to the user; and providing for review via a portal accessible by an authorized representative of a client of the security service system, the sequence of images obtained, and based on the review of the sequence of images, marking, by the authorized representative, the request to authenticate as approved or as rejected. ### Claim 2 (depends on 1) The method of claim 1, wherein initiating obtaining a sequence of images further includes initiating capturing live video images of the user as the user is interacting with the user device and initiating capture of at least one still image. ### Claim 3 (depends on 2) The method of claim 2, further including initiating obtaining live audio of the user as the user is interacting with the user device. ### Claim 4 (depends on 1) The method of claim 1, further including commanding the camera of the user device to adjust focus to capture activity in the at least one of background and periphery. ### Claim 5 (depends on 1) The method of claim 1, wherein initiating obtaining a sequence of images of the user to be authenticated includes capturing a temporal sequence of 10 to 20 frames of the user, including the at least one of background and the periphery commencing prior to the user activating the control of the camera; and capturing at least one snapshot including a close up presentation of a user's head and having a narrower field of view than the camera of the user device. ### Claim 6 (depends on 1) The method of claim 1, further including revealing to an authorized representative a chain of evidence indicating that a crime is being committed by: storing in an activity database an activity data structure for each of a plurality of authentication attempts, including legitimate authentication attempts and fraudulent authentication attempts, the activity data structure including an activity attribute selected from a geolocation, a machine identifier and a network based identifier; receiving from the authorized representative a selection indicating interest in a particular activity data structure representing one of the plurality of authentication attempts; searching the activity database for additional activity data structures having one or more activity attributes related to the particular activity data structure selected; and providing results of the search to the authorized representative; thereby revealing to the authorized representative a set of authentication attempts related by the one or more activity attribute and indicating criminal activity. ### Claim 7 (depends on 6) The method of claim 6, wherein searching the activity database includes detecting patterns of behavior of users being authenticated that indicate criminal activity. ### Claim 8 (depends on 7) The method of claim 7, wherein detecting patterns of behavior of users being authenticated that indicate criminal activity includes detecting at least one selected from a common picture, a common background and a common ID used in different authentication activities. ### Claim 9 (depends on 6) The method of claim 6, wherein searching the activity database includes performing a search of data entries for activity occurring in the security service system logged in a non-relational format in an activity database. ### Claim 10 (depends on 6) The method of claim 6, further including storing in the activity database a time when an authentication is submitted, a time when an authentication request is created. ### Claim 11 (depends on 6) The method of claim 6, further including responsive to receiving an indication from the authorized representative that a particular activity is fraudulent: marking the particular activity as fraudulent; searching the activity database for related activities; and presenting to the authorized representative for review any related activities uncovered by searching. ### Claim 12 (depends on 6) The method of claim 6, further including using the activity database, tracking events performed by the authorized representative of a client of the security service system. ### Claim 13 (depends on 6) The method of claim 6, further including storing in the activity database a time when an authentication is submitted, a time when an authentication request is created. ### Claim 14 (depends on 1) The method of claim 1, further including sending the user device a link prompting the user to authenticate with the security server. ### Claim 15 (depends on 14) The method of claim 14, further including receiving from the user device a request to perform an action requires the user to authenticate with the security service system. ### Claim 16 (depends on 14) The method of claim 14, further including receiving from the authorized representative of the client of the security service system, a configurable set of criteria required for the user to authenticate with the client. ### Claim 17 (depends on 1) The method of claim 1, further including: creating an encryption key; using the encryption key, encrypting the sequence of images as a string base 64; and storing the string base 64 on a server inaccessible to the user being authenticated. ### Claim 18 (depends on 1) The method of claim 1, further including authenticating using an authorization server, the authorized representative of a client account using a subscription server. ### Claim 19 A non-transitory computer readable memory storing program instructions for detecting fraudulent activity during authenticating users and user identifications, which instructions when executed by one or more processors perform a method including: receiving at a security server implementing a security service system, a request to authenticate a user device of a user with the security server; wherein the request was generated subsequent to the user device to prompting the user seeking to authenticate with the security server to present one or more identification documents to a camera of the user device and to present their face and to select a control to trigger capture of images of the one or more identification documents and face of the user by the user device; obtaining a sequence of images of the user to be authenticated, the sequence of images including images captured commencing when the camera is operational and prior to receiving from the user a selection of the control that triggers capture of images, thereby enabling the sequence of images to have captured activity performed by the user prior to and contemporaneous with selecting the control, including any attempted fraudulent activity of the user seeking to be authenticated; and wherein a live video image of the user was displayed by the user device when the sequence of images was captured, the live video image displayed comprising a close up presentation of at least a portion of the user's person and having a narrower field of view than the camera of the user device, so that the sequence of images includes images comprising at least one of background or periphery including any objects and actions therein and wherein capture of the at least one of background or periphery including any objects and actions is not indicated to the user; providing for review via a portal accessible by an authorized representative, the sequence of images obtained, and based on the review of the sequence of images, marking, by the authorized representative, the request to authenticate as approved or as rejected. ### Claim 20 A system for detecting fraudulent activity during authenticating users and user identifications, including: a network interface that receives requests to authenticate from user devices equipped with cameras; and a security server including one or more processors coupled to memory storing instructions implementing a security service, which instructions when executed by the one or more processors: receive via the network interface a request to authenticate a user device of a user seeking to authenticate; wherein the request was generated subsequent to the user device prompting a user seeking to authenticate with the security server to present to a camera of their user device one or more identification documents and to present their face and to select a control to trigger capture of images of the one or more identification documents and face of the user by the user device; obtain a sequence of images of the user to be authenticated, the sequence of images including images captured commencing when the camera is operational and prior to receiving from the user a selection of the control that triggers capture of images, thereby enabling the sequence of images to have captured activity performed by the user prior to and contemporaneous with selecting the control, including any attempted fraudulent activity of the user seeking to be authenticated; wherein a live video image of the user was displayed by the user device when the sequence of images was captured, the live video image displayed comprising a close up presentation of at least a portion of the user's person and having a narrower field of view than the camera of the user device, the sequence of images includes images comprising at least one of background or periphery including any objects and actions therein and wherein capture of the at least one of background or periphery including any objects and actions is not indicated to the user; and provide for review via a portal accessible by an authorized representative, the sequence of images obtained, and based on the review of the sequence of images, marking, by the authorized representative, the request to authenticate as approved or as rejected.