# US 2023/0053675 A1 · Systems and methods for interactive chatbot authentication of users

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2023/0053675 A1
- Document ID: US20230053675A1
- Status: Published application
- Kind: A1
- Application number: 17/408,219
- Filed: 2021-08-20
- Published: 2023-02-23
- Earliest claimed: 2021-08-20
- Assignees: Mastercard International Incorporated
- Applicants: Mastercard International Incorporated
- Inventors: David Scott Edwards; Asha Somayajula; Seth Kalpathy
- Web page: https://patentgrep.com/patent/US20230053675A1

## CPC

- G06F 21/31: User authentication
- G06Q 20/386: {using messaging services or messaging apps (using mobile network messaging services for payment, e.g. SMS G06Q20/3255)}
- G06Q 20/4014: {Identity check for transactions}
- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- H04L 51/02: using automatic reactions or user delegation, e.g. automatic replies or chatbot-generated messages
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- G06F 2221/2103: Challenge-response
- G06F 2221/2113: Multi-level security, e.g. mandatory access control
- G06Q 20/385: {using an alias or single-use codes}
- G06Q 20/40145: {Biometric identity checks}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A computing system for authenticating users utilizing an interactive chatbot is provided. The computing system includes a processor in communication with a memory, and the processor programmed to: (i) receive an authorization request message for a transaction initiated by a user, wherein the authorization request message includes transaction data, (ii) retrieve user data associated with the user, (iii) determine, based upon the transaction data and the user data, a risk associated with the transaction, (iv) generate, based upon the risk associated with the transaction, one or more prompts for the user, (v) transmit, via the interactive chatbot, the one or more prompts to the user, (vi) receive user input in response to the one or more prompts, and (vii) embed an authentication indicator into the authorization request message, wherein the authentication indicator indicates whether the user is authenticated based upon the user input.

## Claims

### Claim 1

A computing system for authenticating users utilizing an interactive chatbot, the computing system comprising at least one processor in communication with at least one memory, the at least one processor programmed to:
receive an authorization request message for a transaction initiated by a user, wherein the authorization request message includes transaction data;
retrieve, from the at least one memory, user data associated with the user;
determine, based upon the transaction data and the user data, a risk associated with the transaction;
generate, based upon the risk associated with the transaction, one or more prompts for the user;
transmit, via the interactive chatbot, the one or more prompts to the user;
receive user input in response to the one or more prompts; and
embed an authentication indicator into the authorization request message, wherein the authentication indicator indicates whether the user is authenticated based upon the user input.

### Claim 2 (depends on 1)

The computing system of claim 1, wherein the at least one processor is further programmed to:
compare the user input and the received user data;
determine, based upon the comparison, a risk score for the user input, wherein the risk score indicates an accuracy level of the user input;
determine, based upon the comparison, an assurance level for the user input, wherein the assurance level indicates an authentication level for the user based upon at least one the risk score and a difficulty level of the one or more prompts; and
embed the assurance level into the authorization request message.

### Claim 3 (depends on 2)

The computing system of claim 2, wherein the at least one processor is further programmed to:
receive, from one or more issuer computing devices, a predetermined threshold indicating a minimum risk score for the user to be authenticated;
store, in the at least one memory, the predetermined threshold; and
authenticate the user based upon the user having a risk score above the predetermined threshold.

### Claim 4 (depends on 3)

The computing system of claim 3, wherein the at least one processor is further programmed to:
generate, when the user has a risk score below the predetermined threshold, one or more additional prompts for the user, wherein the one or more additional prompts have a higher difficulty level than the difficulty level of the initial prompts;
transmit, via the interactive chatbot, the one or more additional prompts to the user;
receive additional user input in response to the one or more additional prompts;
determine the risk score of the additional user input;
authenticate the user based upon the user having a risk score for the additional user input above the predetermined threshold; and
decline authenticating the user based upon the user having a risk score for the additional user input below the predetermined threshold.

### Claim 5 (depends on 1)

The computing system of claim 1, wherein the at least one processor to be further programmed to:
generate one or more low difficulty prompts for the user based upon the risk associated with the transaction being low; and
generate one or more high difficulty prompts for the user based upon the risk associated with the transaction being high.

### Claim 6 (depends on 1)

The computing system of claim 1, wherein the at least one processor is further programmed to:
utilize at least one of a machine learning algorithm and an artificial intelligence algorithm to generate the one or more prompts for the user, wherein the generated prompts are specific to the user based upon the user data.

### Claim 7 (depends on 1)

The computing system of claim 1, wherein the at least one processor is further programmed to:
transmit the embedded authorization request message to a payment processing network for further processing of the transaction.

### Claim 8 (depends on 1)

The computing system of claim 1, wherein the transaction data is received from a merchant computing device and includes a payment account identifier, a merchant identifier, a transaction amount, and a transaction location, wherein the user data is received from at least one of a user computing device and an issuer computing device and includes a user address, transaction history, and previous fraudulent activity, and wherein the one or more prompts include user-specific questions based upon the user data, requests for biometric data, and a one-time use code sent to the user computing device.

### Claim 9

A computer-implemented method for authenticating users using an interactive chatbot, the method implemented by a computing system including at least one processor in communication with at least one memory, the method comprising:
receiving an authorization request message for a transaction initiated by a user, wherein the authorization request message includes transaction data;
retrieving, from the at least one memory, user data associated with the user;
determining, based upon the transaction data and the user data, a risk associated with the transaction;
generating, based upon the risk associated with the transaction, one or more prompts for the user;
transmitting, via the interactive chatbot, the one or more prompts to the user;
receiving user input in response to the one or more prompts; and
embedding an authentication indicator into the authorization request message, wherein the authentication indicator indicates whether the user is authenticated based upon the user input.

### Claim 10 (depends on 9)

The computer-implemented method of claim 9 further comprising:
comparing the user input and the received user data;
determining, based upon the comparison, a risk score for the user input, wherein the risk score indicates an accuracy level of the user input;
determining, based upon the comparison, an assurance level for the user input, wherein the assurance level indicates an authentication level for the user based upon at least one the risk score and a difficulty level of the one or more prompts; and
embedding the assurance level into the authorization request message.

### Claim 11 (depends on 10)

The computer-implemented method of claim 10 further comprising:
receiving, from one or more issuer computing devices, a predetermined threshold indicating a minimum risk score for the user to be authenticated;
storing, in the at least one memory, the predetermined threshold; and
authenticating the user based upon the user having a risk score above the predetermined threshold.

### Claim 12 (depends on 11)

The computer-implemented method of claim 11 further comprising:
generate, when the user has a risk score below the predetermined threshold, one or more additional prompts for the user, wherein the one or more additional prompts have a higher difficulty level than the difficulty level of the initial prompts;
transmitting, via the interactive chatbot, the one or more additional prompts to the user;
receiving additional user input in response to the one or more additional prompts;
determining the risk score of the additional user input;
authenticating the user based upon the user having a risk score for the additional user input above the predetermined threshold; and
declining authenticating the user based upon the user having a risk score for the additional user input below the predetermined threshold.

### Claim 13 (depends on 9)

The computer-implemented method of claim 9 further comprising:
generating one or more low difficulty prompts for the user based upon the risk associated with the transaction being low; and
generating one or more high difficulty prompts for the user based upon the risk associated with the transaction being high.

### Claim 14 (depends on 9)

The computer-implemented method of claim 9 further comprising:
utilizing at least one of a machine learning algorithm and an artificial intelligence algorithm to generate the one or more prompts for the user, wherein the generated prompts are specific to the user based upon the user data.

### Claim 15

At least one non-transitory computer-readable storage media that includes computer-executable instructions for authenticating users using an interactive chatbot, wherein when executed by a computing system including at least one processor in communication with at least one memory, the computer-executable instructions cause the at least one processor to:
receive an authorization request message for a transaction initiated by a user, wherein the authorization request message includes transaction data;
retrieve, from the at least one memory, user data associated with the user;
determine, based upon the transaction data and the user data, a risk associated with the transaction;
generate, based upon the risk associated with the transaction, one or more prompts for the user;
transmit, via the interactive chatbot, the one or more prompts to the user;
receive user input in response to the one or more prompts; and
embed an authentication indicator into the authorization request message, wherein the authentication indicator indicates whether the user is authenticated based upon the user input.

### Claim 16 (depends on 15)

The at least one non-transitory computer-readable storage media of claim 15, wherein the computer-executable instructions further cause the at least one processor to:
compare the user input and the received user data;
determine, based upon the comparison, a risk score for the user input, wherein the risk score indicates an accuracy level of the user input;
determine, based upon the comparison, an assurance level for the user input, wherein the assurance level indicates an authentication level for the user based upon at least one the risk score and a difficulty level of the one or more prompts; and
embed the assurance level into the authorization request message.

### Claim 17 (depends on 16)

The at least one non-transitory computer-readable storage media of claim 16, wherein the computer-executable instructions further cause the at least one processor to:
receive, from one or more issuer computing devices, a predetermined threshold indicating a minimum risk score for the user to be authenticated;
store, in the at least one memory, the predetermined threshold; and
authenticate the user based upon the user having a risk score above the predetermined threshold.

### Claim 18 (depends on 17)

The at least one non-transitory computer-readable storage media of claim 17, wherein the computer-executable instructions further cause the at least one processor to:
generate, when the user has a risk score below the predetermined threshold, one or more additional prompts for the user, wherein the one or more additional prompts have a higher difficulty level than the difficulty level of the initial prompts;
transmit, via the interactive chatbot, the one or more additional prompts to the user;
receive additional user input in response to the one or more additional prompts;
determine the risk score of the additional user input;
authenticate the user based upon the user having a risk score for the additional user input above the predetermined threshold; and
decline authenticating the user based upon the user having a risk score for the additional user input below the predetermined threshold.

### Claim 19 (depends on 15)

The at least one non-transitory computer-readable storage media of claim 15, wherein the computer-executable instructions further cause the at least one processor to:
generate one or more low difficulty prompts for the user based upon the risk associated with the transaction being low; and
generate one or more high difficulty prompts for the user based upon the risk associated with the transaction being high.

### Claim 20 (depends on 15)

The at least one non-transitory computer-readable storage media of claim 15, wherein the computer-executable instructions further cause the at least one processor to:
utilize at least one of a machine learning algorithm and an artificial intelligence algorithm to generate the one or more prompts for the user, wherein the generated prompts are specific to the user based upon the user data.