Patent Application
20180336561
The system 100 includes a conventional payment card/device 102. As is familiar to those who are skilled in the art, the payment card/device 102 may be a magnetic stripe card, an IC (integrated circuit) card, a fob, a payment-enabled smartphone, etc. The payment card/device 102 is shown being carried and used by an account holder/user 103.
The system 100 further includes a reader component 104 associated with a POS terminal 106. In some known manner (depending on the type of the payment card/device 102) the reader component 104 is capable of reading the payment account number and other information from the payment card/device 102.
The reader component 104 and the POS terminal 106 may be located at the premises of a retail store and operated by a sales associate of the retailer for the purpose of processing retail transactions. The payment card/device 102 is shown in
A computer 108 operated by an acquirer (acquiring financial institution) is also shown as part of the system 100 in
One well known example of a payment network is referred to as the “Banknet” system, and is operated by MasterCard International Incorporated, which is the assignee hereof.
The payment account issuer server computer 112 may be operated by or on behalf of a financial institution (“FI”) that issues payment accounts to individual users. For example, the payment account issuer server computer 112 may perform such functions as (a) receiving and responding to requests for authorization of payment account transactions to be charged to payment accounts issued by the FI; (b) tracking and storing transactions and maintaining account records; (c) rendering periodic account statements; (d) receiving and tracking payments to the issuer from the account holders; and (e) clearing transactions.
The components of the system 100 as depicted in
Referring again to the payment card/device 102 and the reader component 104, some conventional types of interactions between those devices will now be described in more detail.
If the payment card/device 102 is a magnetic stripe card, it may be the case that the magnetic stripe portion (not separately shown) is swiped through a card-stripe reading slot (not separately shown) on the reader component 104 so that the reader component 104 may read card data magnetically stored on the magnetic stripe.
If the payment card/device 102 is an IC card, there are two well-known ways in which the card may be presented to the reader. If the card is of the “contact” variety, then it has electrically conductive contacts on the front surface of the card. The portion of the card having the contacts may be inserted into a chip-reading slot in the reader component 104 to allow an electrically conductive signal path to be established between the card chip (i.e., the IC on the card) and electronic components of the reader component 104, via the contacts on the card.
If the card is of the “contactless” variety (some cards support both contact and contactless operation), then the card includes a loop antenna or the like to support an exchange of short-range radio communications for data exchange between the card and the reader component 104. In practice, the card may be brought very close to, or briefly tapped on, a designated location on the housing (not separately shown) of the reader component 104 to permit the short-range radio communications to occur between the reader component 104 and the card.
If the payment card/device 102 is a payment-enabled mobile device, then it is typically configured to emulate the functionality of a contactless IC payment card. In such cases, the payment-enabled mobile device may be tapped on the designated location on the reader housing, again to permit an exchange of short-range radio communications.
Similarly, if the payment card/device 102 is a fob or similar device, again it may emulate the functionality of a contactless IC payment card.
One advantage of contactless interactions between the payment card/device 102 and the reader component 104 is that the corresponding payment account transactions may be accomplished very quickly and efficiently. Nevertheless, concerns for the security of contactless transactions tend to present a trade-off against speed and convenience. For many merchant locations, the trade-off is implemented by requiring the user/account holder 103 to enter a PIN (personal identification number), but only for transactions above a certain set amount (say USD 25.00 or 50.00).
The present inventor has now recognized an opportunity to improve the trade-off between speed/convenience on one hand versus transaction security on the other hand in connection with contactless payment account transactions.
Features and advantages of some embodiments of the present disclosure, and the manner in which the same are accomplished, will become more readily apparent upon consideration of the following detailed description of the disclosure taken in conjunction with the accompanying drawings, which illustrate preferred and exemplary embodiments and which are not necessarily drawn to scale, wherein:
In general, and for the purpose of introducing concepts of embodiments of the present disclosure, a threshold for determining whether to require PIN entry in a contactless payment account transaction may be determined based on account-holder-by-account-holder and merchant-category-by-merchant-category records of account holder spending habits. The threshold may be based on an outlier detection analysis for detecting particular transactions that are outliers relative to the account holder's habitual spending patterns.
The payment system 200 may also include a POS device 106 connected to the reader device, to receive payment account information input to the POS device 106 from the payment device 102 via the reader device 104a. In arrangements where the POS device, rather than the reader device, would otherwise enforce a PIN-entry transaction amount threshold, the POS device may be modified in the same manner as was described in the previous paragraph relative to reader device 104a.
The payment system 200 may also include the acquirer computer 108 and the issuer computer 112, as described in connection with
Referring to
In this embodiment, the payment device 102 further includes an IC 303 and an antenna 306. The antenna 306 may be coupled to the IC 303 at connection points 308 and 310.
The antenna 306 may be mounted in, embedded in and/or otherwise supported by the card-shaped body. As shown, the antenna 306 may comprise several loops arranged along the periphery of the card-shaped body. Alternatively, the antenna 306 may be of a different type and/or configuration.
The IC 303 may include suitable circuitry for storing payment account data and related data typically stored in a payment device, as well as circuitry for engaging in data communications with contactless reader devices via the antenna 306.
To some extent, it will be posited in the following discussion, without limitation, that the mobile device 102 is a smartphone.
The mobile device 102 may include a housing 403. In many embodiments, the front of the housing 403 is predominantly constituted by a touchscreen (not separately shown), which is a key element of the user interface 404 of the mobile device 102.
The mobile device 102 further includes a mobile processor/control circuit 406, which is contained within the housing 403. Also included in the mobile device 102 is a storage/memory device or devices (reference numeral 408). The storage/memory devices 408 are in communication with the processor/control circuit 406 and may contain program instructions to control the processor/control circuit 406 to manage and perform various functions of the mobile device 102. As is well-known, a smartphone may function as what is in effect a pocket-sized personal computer, via programming with a number of application programs, or “apps”, as well as a mobile operating system (OS). (The apps are represented at block 410 in
Also shown in
To the extent that the SE includes processing capabilities, it may functionally (though likely not physically) overlap with block 406; to the extent that the SE includes storage (and particularly program storage) capabilities, it may functionally (though likely not physically) overlap with block 408.
The wallet app 411 may have one or more digitized payment account cards/payment applications (not separately shown) associated therewith and accessible via the wallet app 411.
As is typical for smartphones, the mobile device 102 may include mobile communications functions as represented by block 412. The mobile communications functions may include voice and data communications via a mobile communication network (not shown) with which the mobile device 102 is registered.
In addition, to facilitate use as a payment-enabled device, the mobile device 102 may include short-range radio communications capabilities (block 414), including for example NFC (near field communication). Thus block 414 may represent a suitable antenna (not separately shown) that is appropriate for NFC communications as well as driving and receiving circuitry associated with the antenna. It will be appreciated that the NFC antenna may be separate and different from the antenna (not separately shown) utilized by the mobile device 102 for the mobile communication functions represented by block 412. With the NFC capability, the wallet app and one or more digitized payment account cards/payment apps, the mobile device 102 may be functional to be presented at a reader device 104/104a to execute a purchase transaction via contactless transaction processing with the point of sale.
From the foregoing discussion, it will be appreciated that the blocks depicted in
Although the mobile device 102 has been described herein primarily as a smartphone, in other embodiments, other types of mobile devices with similar capabilities may be used in place of a smartphone.
In some embodiments, hardware aspects of the transaction control server computer 202 may be constituted by typical server computer and/or mainframe computer hardware, but may be controlled by software to cause it to function as described herein.
The transaction control server computer 202 may include a processor 500 operatively coupled to a communication device 501, a storage device 504, an input device 506 and an output device 508. The communication device 501, the storage device 504, the input device 506 and the output device 508 may all be in communication with the processor 500.
The processor 500 may be constituted by one or more processors. The processor 500 may operate to execute processor-executable steps, contained in program instructions described below, so as to control the transaction control server computer 202 to provide desired functionality.
Communication device 501 may be used to facilitate communication with, for example, other devices (such as one or more components of the payment network 110a). For example, communication device 501 may comprise numerous communication ports (not separately shown), to allow the transaction control server computer 202 to engage in data communication simultaneously concerning numerous payment account transaction requests.
Input device 506 may comprise one or more of any type of peripheral device typically used to input data into a computer. For example, the input device 506 may include a keyboard and a mouse. Output device 508 may comprise, for example, a display and/or a printer.
Storage device 504 may comprise any appropriate information storage device, including combinations of magnetic storage devices (e.g., hard disk drives), optical storage devices such as CDs and/or DVDs, and/or semiconductor memory devices such as Random Access Memory (RAM) devices and Read Only Memory (ROM) devices, as well as so-called flash memory. Any one or more of such information storage devices may be considered to be a computer-readable storage medium or a computer usable medium or a memory.
Storage device 504 stores one or more programs for controlling processor 500. The programs comprise program instructions (which may be referred to as computer readable program code means) that contain processor-executable process steps of the transaction control server computer 202, executed by the processor 500 to cause the transaction control server computer 202 to function as described herein.
The programs may include one or more conventional operating systems (not shown) that control the processor 500 so as to manage and coordinate activities and sharing of resources in the transaction control server computer 202, and to serve as a host for application programs (described below) that run on the transaction control server computer 202.
The programs stored in the storage device 504 may also include a transaction handling application program 510. The transaction handling application program 510 may control the processor 500 to support functionality of the transaction control server computer 202 to receive and handle payment account transaction requests in a manner described below.
The storage device 504 may also store a database management program 512. The database management program may control the processor 500 to store and retrieve payment account transaction data in a manner described herein.
Further, the storage device 504 may store outlier detection model selection software 514. The outlier detection model selection software 514 may control the processor 500 such that the transaction control server computer 202 selects outlier detection models for each set of account- and merchant-category-specific data according to the suitability of the type of model to the data in the data set.
Still further, the storage device 504 may store outlier detection software 516. The outlier detection software 516 may control the processor 500 to control the transaction control server computer 202 to detect outlier transactions among the requests for payment account transaction referred to the transaction control server computer 202. Details will be provided below as to how, in some embodiments, the transaction control server computer 202 may perform outlier detection under the control of the outlier detection software 516.
The storage device 504 may also store, and the transaction control server computer 202 may also execute, other programs, which are not shown. For example, such other programs may also include, e.g., device drivers, communications software, etc.
In some embodiments, the storage device 504 may also store a database 518 of previous payment account transactions to be analyzed for the purpose of outlier detection. In addition, the storage device 504 may store other databases (not shown) that may be required for the operation of the transaction control server computer 202.
In some embodiments, the transaction control server computer 202 may be associated with the payment network 110a and/or under common operation with the payment network 110a. For example, in some embodiments the transaction control server computer 202 may be combined with or at least partially overlap with a computer or computers that provide the type of functionality available via the “InControl” service offered by Mastercard International Incorporated, the assignee hereof. As will be familiar to those who are skilled in the art, the “InControl” service provides features such as transaction alerts and voluntary transaction limit settings to holders of Mastercard-branded payment card accounts.
In other embodiments, at least some of the functionality ascribed herein to the transaction control server computer 202 may alternatively be provided by a suitably programmed/modified embodiment of the issuer server computer (represented by reference numeral 112a in
Block 602 in
At block 604 in
At block 606 in
Block 608 in
Based on the analysis at block 610, an outlier detection model may be fitted to the distribution of transaction amounts, as represented by block 614. In some instances, a Gaussian model may be selected as the best fitting model for the transaction amount data distribution. In other instances, a log normal model may be selected as the best-fitting model for the distribution of transaction amount data. In other embodiments and/or in other instances, other varieties of outlier detection models may be applied at block 614. The model fitting at block 614 may proceed in accordance with known principles for fitting models to data sets.
At block 616, using the model selected at 614, an outlier detection threshold may be set based on a predetermined criterion. For example, in the case of a Gaussian model, the threshold may be set as a nominal transaction amount that corresponds to a positive one sigma point calculated based on the Gaussian curve fitted to the data distribution. Alternatively, a positive one-and-one-half sigma or positive two sigma point may be used to calculate the outlier detection threshold. Other specific degrees of sigma may be used instead of those just specified.
In instances where a log normal model was selected at block 614, the resulting log normal curve may be transformed to a Gaussian curve, the threshold point may be determined according to one of the criterion referred to in the previous paragraph, and then the Gaussian curve including the calculated threshold point may be transformed back to the original log normal curve to indicate the threshold point on the log normal curve.
In some embodiments, for each merchant category (and for each account holder) the outlier threshold analysis and calculation may be updated regularly, or even dynamically each time new transaction data is received in the merchant category in question. In some embodiments, individual transaction data records may become stale and be discarded with the passage of time (e.g., after a year has elapsed since the transaction date). Discarding of stale data may also be dynamically reflected by recalculation of the outlier detection threshold.
In view of block 608 in
In view of block 602, the data collection and category-wise outlier threshold setting may be performed with respect to a number of different account holders—potentially for quite a large number of account holders—i.e., thousands, hundreds of thousands, or even more.
At block 902 in
In the process of
At decision block 906, the transaction control server computer 202 may determine whether the transaction request received at block 902 is an “outlier”. For example, in making this determination, the transaction control server computer 202 may compare the transaction amount indicated in the transaction request with the pertinent outlier detection threshold. If the transaction amount exceeds the outlier detection threshold, then a positive determination may be made at decision block 906. If the transaction amount does not exceed the outlier detection threshold, then a negative determination may be made at decision block 906.
If a negative determination is made at decision block 906, then block 908 may follow decision block 906 in the process of
If a positive determination is made at decision block 906, then block 910 may follow decision block 906. At block 910, the transaction control server computer 202 may act in such a manner that PIN entry is required for the requested transaction. For example, the transaction control server computer 202 may signal back to the payment network 110a to indicate that the transaction has been found to be an outlier and that PIN entry is required. The payment network 110a may then route a message to the point of sale to indicate that the point of sale is to request PIN entry from the account holder/user.
Referring again to decision block 904, it may be the case that a negative determination occurs (i.e., a determination that no pertinent outlier detection threshold has been set for this account and for this merchant category). If a negative determination is made at decision block 904, then block 912 may follow decision block 904. At block 912, a conventional decision-making process on whether to require PIN entry may prevail. For example, the process may be passed back to the point of sale to apply a standard, predetermined threshold in deciding whether to require PIN entry. Alternatively, the transaction control server computer 202, the payment network 110a or the account issuer may apply a standard threshold amount to determine whether PIN entry is to be required for the transaction. In some embodiments, alternatively, PIN entry may simply not be required when no outlier detection threshold has been established for an account and merchant category combination. As still another alternative, PIN entry may always be required when no outlier detection threshold has been established for the account and merchant category combination.
It is to be understood that the process of
With processes as described in
In some embodiments, as is conventional, PIN entry may be required for the next transaction (regardless of transaction amount) after a certain number (say, four or five) of consecutive transactions in which PIN entry was not required. A counter for that purpose may be maintained, e.g., in the payment device, at the account issuer computer, or in another convenient location.
In some embodiments, all the transactions stored for outlier detection analysis may be contactless transactions. In other embodiments, other types of transactions are also included. In some embodiments, online transactions are not included among the stored transactions for outlier detection analysis.
As used herein and in the appended claims, the term “computer” should be understood to encompass a single computer or two or more computers in communication with each other.
As used herein and in the appended claims, the term “processor” should be understood to encompass a single processor or two or more processors in communication with each other.
As used herein and in the appended claims, the term “memory” should be understood to encompass a single memory or storage device or two or more memories or storage devices.
As used herein and in the appended claims, a “server” includes a computer device or system that responds to numerous requests for service from other devices.
The flow charts and descriptions thereof herein should not be understood to prescribe a fixed order of performing the method steps described therein. Rather the method steps may be performed in any order that is practicable, including simultaneous performance of steps.
As used herein and in the appended claims, the term “payment card system account” includes a credit card account, a deposit account that the account holder may access using a debit card, a prepaid card account, or any other type of account from which payment transactions may be consummated. The terms “payment card system account” and “payment card account” and “payment account” are used interchangeably herein. The term “payment card account number” includes a number that identifies a payment card system account or a number carried by a payment card, or a number that is used to route a transaction in a payment system that handles debit card and/or credit card transactions. The term “payment card” includes a credit card, debit card, prepaid card, or other type of payment instrument, whether an actual physical card or virtual.
As used herein and in the appended claims, the term “payment card system” refers to a system for handling purchase transactions and related transactions. An example of such a system is the one operated by MasterCard International Incorporated, the assignee of the present disclosure. In some embodiments, the term “payment card system” may be limited to systems in which member financial institutions issue payment card accounts to individuals, businesses and/or other organizations.
Although the present disclosure has been described in connection with specific exemplary embodiments, it should be understood that various changes, substitutions, and alterations apparent to those skilled in the art can be made to the disclosed embodiments without departing from the spirit and scope of the disclosure as set forth in the appended claims.
