# US 12,223,506 B2 · Methods and systems for multi-factor authentication based payment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,223,506 B2 - Document ID: US12223506B2 - Status: Granted - Kind: B2 - Application number: 18/062,702 - Filed: 2022-12-07 - Published: 2023-06-22 - Granted: 2025-02-11 - Earliest claimed: 2021-12-21 - Assignees: Mastercard International Incorporated - Applicants: Mastercard International Incorporated - Inventors: Sachin Kumar Singh; Sandeep Parvathareddy; Hemant Arora - Web page: https://patentgrep.com/patent/US12223506B2 ## CPC - G06Q 20/385: {using an alias or single-use codes} - G06Q 20/4016: {involving fraud or risk level assessment in transaction processing} - G06Q 20/3821: {Electronic credentials} - G06Q 20/4014: {Identity check for transactions} - G06Q 20/4093: {Monitoring of device authentication} - G06Q 20/42: Confirmation, e.g. check or permission by the legal debtor of payment - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract Embodiments provide methods and systems for analyzing device behavior data in multi-factor authentication (MFA) process. The method includes receiving, by a server system, a request in association with a payment transaction between a cardholder and a merchant. The request includes a cardholder identifier and information of a successful verification of a user input entered by the cardholder to perform MFA of the payment transaction. The method includes identifying user profile data stored in a database based on the cardholder identifier. The user profile data includes information of a plurality of registered user devices associated with the cardholder. The method includes performing device behavioral analysis of one or more user devices. The method includes generating an MFA token associated with the payment transaction based on the device behavioral analysis. The method includes transmitting the MFA token for authorizing the payment transaction to a payment server associated with a payment network. ## Claims ### Claim 1 A computer-implemented method, comprising: receiving, by a server system, a request in association with a payment transaction between a cardholder and a merchant, the request comprising a cardholder identifier associated with the cardholder, and information of a successful verification of a user input entered by the cardholder for performing multi-factor authentication (MFA) of the payment transaction; identifying, by the server system, user profile data stored in a database based, at least in part, on the cardholder identifier, the user profile data comprising information of a plurality of registered user devices associated with the cardholder for the MFA; performing, by the server system, device behavioral analysis of one or more user devices from the plurality of registered user devices associated with the cardholder including calculating a device behavioral score by: (a) obtaining device identifiers from the one or more user devices and comparing the obtained device identifiers with authenticated identifiers already stored in the user profile data associated with the cardholder, (b) determining that the cardholder is logged into email accounts of the cardholder running on the one or more user devices, (c) determining a time of receipt of a one time password (OTP) associated with performing multi-factor authentication (MFA) of the payment transaction and calculating a time differences between a received time of the OTP and a time of entering the OTP, (d) determining a period of the one or more user devices spent in a dark mode, (e) calculating a device behavioral score for the user device based, at least in part, on results of steps (a), (b), (c), and (d), and generating, by the server system, an MFA token associated with the payment transaction based, at least in part, on the device behavioral analysis; transmitting, by the server system, the MFA token to a payment server associated with a payment network, wherein the MFA token is utilized for authorizing the payment transaction; and authorizing the payment transaction. ### Claim 2 (depends on 1) The computer-implemented method as claimed in claim 1, wherein the information of the plurality of registered user devices in the user profile data comprises a set of device authentication parameters associated with each user device of the plurality of registered user devices captured during a device registration process. ### Claim 3 (depends on 2) The computer-implemented method as claimed in claim 2, wherein the set of device authentication parameters comprises device universally unique identifier (UUID), hard drive serial number, MachineGUID, media access control (MAC) address, dynamic host configuration protocol (DHCP) value, and domain name system (DNS) value. ### Claim 4 (depends on 3) The computer-implemented method as claimed in claim 3, wherein a new device detection flag is set upon identifying that a new user device is used for reading the OTP. ### Claim 5 (depends on 3) The computer-implemented method as claimed in claim 3, wherein the device behavioral flag is set when the device behavioral score of each user device of the one or more user devices is greater than a predetermined threshold value. ### Claim 6 (depends on 1) The computer-implemented method as claimed in claim 1, wherein the MFA token comprises (a) transaction identifier, (b) merchant identifier, (c) device behavior analyzer service opt-in flag, (d) new device detection flag, (e) device behavioral flag, and (f) device activity status flag. ### Claim 7 (depends on 1) The computer-implemented method as claimed in claim 1, wherein method further includes: comparing the calculated device behavioral score with a threshold value; setting a device behavioral flag in the MFA token to Yes upon determining that the calculated device behavioral score is greater than the threshold value; or setting a device behavioral flag in the MFA token to No upon determining that the device behavioral score is less than the threshold value. ### Claim 8 (depends on 1) The computer-implemented method as claimed in claim 1, further comprising: to determining a zero user activity on the one or more user devices; in response to determining the zero user activity on the one or more user devices, identifying, by the server system, a new user device associated with the cardholder that is used for reading the OTP by the cardholder; sending, by the server system, an enrolment verification request to at least one of the plurality of registered user devices; receiving, by the server system, user consent from at least one of the plurality of registered user devices for enrolling the new user device for the MFA; capturing, by the server system, a plurality of device authentication parameters associated with the new user device from the new user device; and storing, by the server system, the plurality of device authentication parameters into the user profile data of the cardholder. ### Claim 9 (depends on 1) The computer-implemented method as claimed in claim 1, wherein the server system is associated with the payment network. ### Claim 10 A server system comprising: a memory storing computer-executable instructions; and a processor configured to execute the instructions to: receive, by a server system, a request in association with a payment transaction between a cardholder and a merchant, the request comprising a cardholder identifier associated with the cardholder, and information of a successful verification of a user input entered by the cardholder for performing multi-factor authentication (MFA) of the payment transaction; identify, by the server system, user profile data stored in a database based, at least in part, on the cardholder identifier, the user profile data comprising information of a plurality of registered user devices associated with the cardholder for the MFA; perform, by the server system, device behavioral analysis of one or more user devices from the plurality of registered user devices associated with the cardholder including calculating a device behavioral score by: (a) obtaining device identifiers from the one or more user devices and comparing the obtained device identifiers with authenticated identifiers already stored in the user profile data associated with the cardholder, (b) determining that the cardholder is logged into email accounts of the cardholder running on the one or more user devices, (c) determining a time of receipt of a one time password (OTP) associated with performing multi-factor authentication (MFA) of the payment transaction and calculating a time differences between a received time of the OTP and a time of entering the OTP, (d) determining a period of the one or more user devices spent in a dark mode, (e) calculating a device behavioral score for the user device based, at least in part, on results of steps (a), (b), (c), and (d), and generate, by the server system, an MFA token associated with the payment transaction based, at least in part, on the device behavioral analysis; transmit, by the server system, the MFA token to a payment server associated with a payment network, wherein the MFA token is utilized for authorizing the payment transaction; and authorize the payment transaction. ### Claim 11 (depends on 10) The server system as claimed in claim 10, wherein the information of the plurality of registered user devices in the user profile data comprises a set of device authentication parameters associated with each user device of the plurality of registered user devices captured during a device registration process. ### Claim 12 (depends on 11) The server system as claimed in claim 11, wherein the set of device authentication parameters comprises device universally unique identifier (UUID), hard drive serial number, MachineGUID, media access control (MAC) address, dynamic host configuration protocol (DHCP) value, and domain name system (DNS) value. ### Claim 13 (depends on 12) The server system as claimed in claim 12, wherein a new device detection flag is set upon identifying that a new user device is used for reading the OTP. ### Claim 14 (depends on 12) The server system as claimed in claim 12, wherein the device behavioral flag is set when the device behavioral score of each user device of the one or more user devices is greater than a predetermined threshold value. ### Claim 15 (depends on 10) The server system as claimed in claim 10, wherein the MFA token comprises (a) transaction identifier, (b) merchant identifier, (c) device behavior analyzer service opt-in flag, (d) new device detection flag, (e) device behavioral flag, and (f) device activity status flag. ### Claim 16 (depends on 10) The server system as claimed in claim 10, wherein the processor is configured to: compare the calculated device behavioral score with a threshold value; set a device behavioral flag in the MFA token to Yes upon determining that the calculated device behavioral score is greater than the threshold value; or set a device behavioral flag in the MFA token to No upon determining that the device behavioral score is less than the threshold value. ### Claim 17 (depends on 10) The server system as claimed in claim 10, wherein the processor is further configured to execute the instructions to: determine a zero user activity on the one or more user devices; in response to determining the zero user activity on the one or more user devices, identify, by the server system, a new user device associated with the cardholder that is used for reading the OTP by the cardholder; send, by the server system, an enrolment verification request to at least one of the plurality of registered user devices; receive, by the server system, user consent from at least one of the plurality of registered user devices for enrolling the new user device for the MFA; capture, by the server system, a plurality of device authentication parameters associated with the new user device from the new user device; and store, by the server system, the plurality of device authentication parameters into the user profile data of the cardholder. ### Claim 18 (depends on 10) The server system as claimed in claim 10, wherein the server system is associated with the payment network. ### Claim 19 One or more non-transitory computer storage media having computer-executable instructions that, upon execution by a processor, cause the processor to at least: receive a request in association with a payment transaction between a cardholder and a merchant, the request comprising a cardholder identifier associated with the cardholder, and information of a successful verification of a user input entered by the cardholder for performing multi-factor authentication (MFA) of the payment transaction; identify user profile data stored in a database based, at least in part, on the cardholder identifier, the user profile data comprising information of a plurality of registered user devices associated with the cardholder for the MFA; perform device behavioral analysis of one or more user devices from the plurality of registered user devices associated with the cardholder including calculating a device behavioral score by: (a) obtaining device identifiers from the one or more user devices and comparing the obtained device identifiers with authenticated identifiers already stored in the user profile data associated with the cardholder, (b) determining that the cardholder is logged into email accounts of the cardholder running on the one or more user devices, (c) determining a time of receipt of a one time password (OTP) associated with performing multi-factor authentication (MFA) of the payment transaction and calculating a time differences between a received time of the OTP and a time of entering the OTP, (d) determining a period of the one or more user devices spent in a dark mode, (e) calculating a device behavioral score for the user device based, at least in part, on results of steps (a), (b), (c), and (d), and generate, by the server system, an MFA token associated with the payment transaction based, at least in part, on the device behavioral analysis; transmit, by the server system, the MFA token to a payment server associated with a payment network, wherein the MFA token is utilized for authorizing the payment transaction and authorize the payment transaction. ### Claim 20 (depends on 19) The one or more non-transitory computer storage media of claim 19, wherein the computer-executable instructions upon execution by the processor, further cause the processor to: compare the calculated device behavioral score with a threshold value; set a device behavioral flag in the MFA token to Yes upon determining that the calculated device behavioral score is greater than the threshold value; or set a device behavioral flag in the MFA token to No upon determining that the device behavioral score is less than the threshold value.