# US 2013/0160104 A1 · Online account access control by mobile device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0160104 A1 - Document ID: US20130160104A1 - Status: Published application - Kind: A1 - Application number: 13/714,995 - Filed: 2012-12-14 - Published: 2013-06-20 - Earliest claimed: 2011-12-14 - Assignees: Visa International Service Association - Inventors: Mark Carlson - Web page: https://patentgrep.com/patent/US20130160104A1 ## CPC - G06F 21/31: User authentication - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04W 12/069: using certificates or pre-shared keys - H04L 63/0892: {by using authentication-authorization-accounting [AAA] servers or protocols} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems and methods for controlling access to an online account are described. An access control message including an action to be performed on an online account can be sent from a mobile device to a server. A user verification query message can be sent to the mobile device. A user verification response message can be received from the mobile device. The user verification response message can include verification information that is different from login information for the online account. The user verification response message can be verified by comparing the verification information to stored information. If the user verification response message is successfully verified, the action indicated in the access control message can be performed on the online account. ## Claims ### Claim 1 A method for controlling access to an online account, the method comprising: receiving an access control message from a mobile device, wherein the access control message includes an action to be performed on an online account, wherein the online account is accessed using login information; sending a user verification query message to the mobile device; receiving a user verification response message from the mobile device, wherein the user verification response message includes verification information that is different from the login information for the online account; verifying the user verification response message, wherein the verifying includes comparing the verification information to stored information; and if the user verification response message is verified, performing the action on an online account, wherein the action is based on the access control message. ### Claim 2 (depends on 1) The method of claim 1, further comprising verifying the mobile device, wherein the verifying includes comparing an identifier of the mobile device to a plurality of stored identifiers. ### Claim 3 (depends on 2) The method of claim 2, wherein the identifier of the mobile device includes at least one of a Mobile Subscriber Integrated Services Digital Network (MSISDN) number and an International Mobile Subscriber Identity (IMSI). ### Claim 4 (depends on 1) The method of claim 1, wherein at least one of the access control message, the user verification query message and the user verification response message is a short message service (SMS) message. ### Claim 5 (depends on 1) The method of claim 1, wherein the user verification response message includes a cryptographic hash value. ### Claim 6 (depends on 1) The method of claim 1, wherein at least one of the access control message, the user verification query message and the user verification response message is generated by a signed application. ### Claim 7 (depends on 1) The method of claim 1, wherein the action is preventing access to the online account using the login information for the online account. ### Claim 8 (depends on 1) The method of claim 1, wherein the action is enabling access to the online account using the login information for the online account. ### Claim 9 (depends on 1) The method of claim 1, wherein the action is disabling editing of information associated with the online account. ### Claim 10 (depends on 1) The method of claim 1, wherein the action is disabling transmitting e-mail from the account. ### Claim 11 (depends on 1) The method of claim 1, further comprising: enrolling the online account; and registering the mobile device in association with the online account. ### Claim 12 A mobile device, comprising: a processor; and a computer readable medium coupled to the processor, wherein the computer readable medium includes code executable by the processor, the code operative to: send an access control message to a server, wherein the access control message includes an action to be performed on an online account, wherein the online account in accessed using login information; receive a user verification query message from the server; and send a user verification response message to the server, wherein the user verification response message includes verification information that is different from the login information for the online account; wherein if the user verification response message is verified by the server; the action is performed on the online account. ### Claim 13 (depends on 12) The mobile device of claim 12, wherein at least one of the access control message, the user verification query message and the user verification response message is a short message service (SMS) message. ### Claim 14 (depends on 12) The mobile device of claim 12, wherein the code is further operative to generate a cryptographic hash value to include in the user verification response message. ### Claim 15 (depends on 12) The mobile device of claim 12, wherein at least one of the access control message, the user verification query message and the user verification response message is generated by a signed application. ### Claim 16 A system for controlling access to an online account, the system comprising: a processor; and a computer readable medium coupled to the processor, wherein the computer readable medium includes code executable by the processor, the code operative to: receive an access control message from a mobile device, wherein the access control message includes an action to be performed on an online account, wherein the online account is accessed using login information; send a user verification query message to the mobile device; receive a user verification response message from the mobile device, wherein the user verification response message includes verification information that is different from the login information for the online account; verify the user verification response message, wherein the verifying includes comparing the verification information to stored information; and if the user verification response message is verified, performing the action on an online account, wherein the action is based on the access control message. ### Claim 17 (depends on 16) The system of claim 16, wherein the code is further operative to verify the mobile device, wherein the verifying includes comparing an identifier of the mobile device to a plurality of stored identifiers. ### Claim 18 (depends on 16) The system of claim 16, wherein the identifier of the mobile device includes at least one of a Mobile Subscriber Integrated Services Digital Network (MSISDN) number and an International Mobile Subscriber Identity (IMSI). ### Claim 19 (depends on 16) The system of claim 16, wherein at least one of the access control message, the user verification query message and the user verification response message is a short message service (SMS) message. ### Claim 20 (depends on 16) The system of claim 16, wherein the action is preventing access to the online account using the login information for the online account. ### Claim 21 (depends on 16) The system of claim 16, wherein the action is enabling access to the online account using the login information for the online account. ### Claim 22 (depends on 16) The system of claim 16, wherein the action is disabling editing of information associated with the online account. ### Claim 23 (depends on 16) The system of claim 16, wherein the action is disabling transmitting e-mail from the account.