System, method, and computer program product for authenticating a transaction based on behavioral biometric data

A system comprising:

• a computing device of a user executing a merchant webpage or a mobile application, the computing device programmed and/or configured to display a user interface configured with a first frame pointing to a first domain of an issuer via a first uniform resource locator (URL), the first URL configured to allow communication between the computing device and an issuer system of the issuer separate from a transaction service provider system, and the user interface further configured with a second frame pointing to a second domain of a behavioral biometrics server computer of the transaction service provider system via a second URL, the second URL configured to allow communication between the computing device and the behavioral biometrics server computer;
• at least one server computer of the transaction service provider system, the at least one server computer including at least one processor, the at least one server computer programmed and/or configured to:
• receive historic transaction data associated with one or more historical transactions involving a payment device of the user;
• receive an authorization request message from a merchant system, the authorization request message associated with a transaction between the merchant system and the payment device, the authorization request message initiated by the user of the payment device through the merchant webpage or the mobile application, and the authorization request message comprising transaction data;
• determine that an additional security authentication should be applied to the authorization request message based on the transaction data and based on the payment device being associated with the issuer that has specified that behavioral biometrics should be employed as a secondary form of authentication;
• communicate a request to the merchant webpage or the mobile application for a user response to a second factor authentication process in the first frame;
• in response to determining that the additional security authentication should be applied, and before the authorization request message is transmitted to the issuer system of the issuer, communicate an authenticity assessment request to the behavioral biometrics server computer that is associated with a transaction service provider system and independent of the issuer system, the authenticity assessment request communicated to the behavioral biometrics server computer while the user is responding to the second factor authentication process in the first frame, and the authenticity assessment request comprising at least a portion of the transaction data;
• receive, from the behavioral biometrics server computer, an authenticity assessment response generated by the behavioral biometrics server computer in response to the authenticity assessment request and based on the at least a portion of the transaction data and at least a portion of behavioral biometrics signals received via the second frame, wherein the authenticity assessment response comprises authenticity assessment data;
• in response to receiving the authenticity assessment response and before the authorization request message is transmitted to the issuer system, insert at least a portion of the authenticity assessment data into the authorization request message to produce an updated authorization request message;
• transmit the updated authorization request message to the issuer system;
• and
• generate, based on the authenticity assessment response, an authentication response message to the issuer system, wherein the authentication response message is configured to authenticate the transaction when the portion of the authenticity assessment data is evaluated by the issuer system in combination with the user response to the second factor authentication process;
• and
• the behavioral biometrics server computer comprising at least one processor programmed and/or configured to collect the behavioral biometrics signals based on (i) the historic transaction data received from the transaction service provider system and, (ii) user activity data received from the computing device via the second frame.

A computer program product comprising at least one non-transitory computer-readable medium including program instructions that, when executed by at least one processor of a computing device of a user executing a merchant webpage or a mobile application, cause the at least one processor of the computing device to:

• display a user interface configured with a first frame pointing to a first domain of an issuer via a first uniform resource locator (URL), the first URL configured to allow communication between the computing device and an issuer system of the issuer separate from a transaction service provider system, and the user interface further configured with a second frame pointing to a second domain of a behavioral biometrics server computer of the transaction service provider system via a second URL, the second URL configured to allow communication between the computing device and the behavioral biometrics server computer;
• wherein the program instructions further cause at least one processor of the transaction service provider system to:
• receive historic transaction data associated with one or more historical transactions involving a payment device of the user;
• receive an authorization request message from a merchant system, the authorization request message associated with a transaction between the merchant system and the payment device, the authorization request message initiated by the user of the payment device through the merchant webpage or the mobile application, and the authorization request message comprising transaction data;
• determine that an additional security authentication should be applied to the authorization request message based on the transaction data and based on the payment device being associated with the issuer that has specified that behavioral biometrics should be employed as a secondary form of authentication;
• communicate a request to the merchant webpage or the mobile application for a user response to a second factor authentication process in the first frame;
• in response to determining that the additional security authentication should be applied, and before the authorization request message is transmitted to the issuer system of the issuer, communicate an authenticity assessment request to the behavioral biometrics server computer that is associated with a transaction service provider system and independent of the issuer system, the authenticity assessment request communicated to the behavioral biometrics server computer while the user is responding to the second factor authentication process in the first frame, and the authenticity assessment request comprising at least a portion of the transaction data;
• receive, from the behavioral biometrics server computer, an authenticity assessment response generated by the behavioral biometrics server computer in response to the authenticity assessment request and based on the at least a portion of the transaction data and at least a portion of behavioral biometrics signals received via the second frame, wherein the authenticity assessment response comprises authenticity assessment data;
• in response to receiving the authenticity assessment response and before the authorization request message is transmitted to the issuer system, insert at least a portion of the authenticity assessment data into the authorization request message to produce an updated authorization request message;
• transmit the updated authorization request message to the issuer system;
• and
• generate, based on the authenticity assessment response, an authentication response message to the issuer system, wherein the authentication response message is configured to authenticate the transaction when the portion of the authenticity assessment data is evaluated by the issuer system in combination with the user response to the second factor authentication process;
• and
• wherein the program instructions further cause at least one processor of the behavioral biometrics server computer to:
• collect the behavioral biometrics signals based on (i) the historic transaction data received from the transaction service provider system and, (ii) user activity data received from the computing device via the second frame.