# US 9,882,922 B2 · Methods and systems for detecting an electronic intrusion > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,882,922 B2 - Document ID: US9882922B2 - Status: Granted - Kind: B2 - Application number: 15/386,865 - Filed: 2016-12-21 - Published: 2017-04-13 - Granted: 2018-01-30 - Earliest claimed: 2012-11-07 - Assignees: eBay Inc. - Applicants: eBay Inc. - Inventors: Srinivasan Raman - Web page: https://patentgrep.com/patent/US9882922B2 ## CPC - H04W 4/02: Services making use of location information - G06F 21/554: {involving event detection and direct action} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods and systems for detecting an electronic intrusion are described. A user activity may be identified for a user account. A location of a user corresponding to the user account may be determined. It may be identified, based in part on the location of the user, whether to communicate a request to the user for instructions to respond to the user activity. A response may be received from the user in response to determining to communicate the request to the user for instructions. The response may include instructions to block access to the user account at a server. Command information may be communicated to the server. The command information may include a command to block access to the user account. ## Claims ### Claim 1 A method comprising: receiving, from a server, an indication of a user activity for a user account for a service provided by the server; determining a location of a user corresponding to the user account; identifying, in part based on the location of the user, whether to communicate a request to the user for instructions to respond to the user activity; in response to determining to communicate the request to the user for instructions, receiving a response from the user, the response including instructions to block access to the user account at the server; and communicating command information to the server based on the response, the command information including a command to block access to the user account, the command to block access to the user account preventing access to the user account until a command to unblock access to the account is received. ### Claim 2 (depends on 1) The method of claim 1, wherein the command to block access to the user account allows read-only access to the user account. ### Claim 3 (depends on 1) The method of claim 1, further comprising: receiving a status update from the user; identifying, from the status update, instructions to unblock access to the user account at the server; and communicating updated command information to the server based on the status update, the updated command information including a command to unblock access to the user account. ### Claim 4 (depends on 1) The method of claim 1, further comprising registering a mobile device of the user for communication of the request. ### Claim 5 (depends on 4) The method of claim 4, wherein the determining the location of the user includes receiving an indication of the location from the mobile device. ### Claim 6 (depends on 1) The method of claim 1, further comprising: identifying a second user activity at a second server; receiving a second response from the user including instructions to permit access to a second user account at the second server; and communicating second server command information to the second server based on the second response, the second server command information including a command to permit access to the second user account. ### Claim 7 A system comprising: at least one processor; a memory; and a set of instructions operable on the at least one processor to: receive, from a server, identification of a user activity for a user account for a service provided by the server; determine a location of a user corresponding to the user account; identify whether to communicate a request to the user for instructions to respond to the user activity, based at least in part on the location of the user; responsive to determination to communicate the request to the user for instructions, receive a response from the user, the response including instructions to block access to the user account at the server; and communicate command information to the server based on the response, the command information including a command to block access to the user account, wherein the command to block access to the user account prevents access to the user account until a command to unblock access to the account is received. ### Claim 8 (depends on 7) The system of claim 7, wherein the command to block access to the user account allows read-only access to the user account. ### Claim 9 (depends on 7) The system of claim 7, the set of instructions operable on the at least one processor further to: receive a status update from the user; identify, from the status update, instructions to unblock access to the user account at the server; and communicate updated command information to the server based on the status update, the updated command information including a command to unblock access to the user account. ### Claim 10 (depends on 7) The system of claim 7, the set of instructions operable on the at least one processor further to register a mobile device of the user for communication of the request. ### Claim 11 (depends on 10) The system of claim 10, wherein the set of instructions to determine the location of the user include instructions to receive an indication of the location from the mobile device. ### Claim 12 (depends on 7) The system of claim 7, the set of instructions operable on the one or more processors further to: identify a second user activity at a second server; receive a second response from the user including instructions to permit access to a second user account at the second server; and communicate second server command information to the second server based on the second response, the second server command information including a command to permit access to the second user account. ### Claim 13 (depends on 12) The system of claim 12, wherein the set of instructions to identify the second user activity include instructions to transmit a request to the user to authorize the application programming interface calls by the server. ### Claim 14 A non-transitory machine readable medium that stores instructions which when operated by a machine, cause the machine to perform operations comprising: receiving, from a server, identification of a user activity for a user account for a service provided by the server; determining a location of a user corresponding to the user account; identifying whether to communicate a request to the user for instructions to respond to the user activity, based at least in part on the location of the user; responsive to determination to communicate the request to the user for instructions, receiving a response from the user, the response including instructions to block access to the user account at the server; and communicating command information to the server based on the response, the command information including a command to block access to the user account, the command to block access to the user account preventing access to the user account until a command to unblock access to the account is received. ### Claim 15 (depends on 14) The machine readable medium of claim 14, wherein the command to block access to the user account allows read-only access to the user account. ### Claim 16 (depends on 14) The machine readable medium of claim 14, further comprising: receiving a status update from the user; identifying, from the status update, instructions to unblock access to the user account at the server; and communicating updated command information to the server based on the status update, the updated command information including a command to unblock access to the user account. ### Claim 17 (depends on 14) The machine readable medium of claim 14, further comprising registering a mobile device of the user for communication of the request. ### Claim 18 (depends on 17) The machine readable medium of claim 17, wherein the determining the location of the user includes receiving an indication of the location from the mobile device. ### Claim 19 (depends on 14) The machine readable medium of claim 14, further comprising: identifying a second user activity at a second server; receiving a second response from the user including instructions to permit access to a second user account at the second server; and communicating second server command information to the second server based on the second response, the second server command information including a command to permit access to the second user account. ### Claim 20 (depends on 19) The machine readable medium of claim 19, wherein the identifying the second user activity further comprises transmitting a request to the user to authorize the application programming interface calls by the server.