Patent Application
20130030934
1. Field of the Invention
Embodiments of the present invention generally relate to credit card transaction security and, more specifically, to systems and methods for credit card transaction approval based on mobile subscriber terminal location.
2. Description of the Related Art
It has become common practice for individual consumers to use credit cards for conducting transactions not only at conventional point-of-sale (POS) locations, but also for on-line transactions performed on the Internet. In addition, credit cards are frequently used during foreign travel to avoid the fees associated with exchanging large amounts of cash into one or more foreign currencies. However, the convenience of credit card transactions is often negated by security measures commonly used to prevent fraudulent transactions, since transactions may be unexpectedly denied and additional action must be taken by the user to complete a transaction.
In on-line credit card transactions, particularly those exceeding a specified dollar amount, a bank or other authorization entity associated with the credit card may require identity verification by the user before authorizing a requested transaction. For example, a personal identification number (PIN) or other alpha-numeric credential may be sent via text message to a mobile subscriber terminal, e.g., a mobile phone, pre-registered as the mobile device of the credit card user. The user then uses the PIN to verify his or her identity to the authorization entity, which then authorizes the requested transaction. Identity verification using text messaging can be problematic since text messaging adds cost to each transaction, is not always reliably received by a targeted mobile device in a timely manner, and not all mobile phone users have text messaging plans.
In POS credit card transactions, a bank or other authorization entity associated with the credit card may deny any requested transactions that fall outside the normal pattern of use for that particular credit card, such as when the credit card is used for a transaction in a different country or city than the residence of the credit card user. When such transaction denials occur, the credit card user may be required to contact the authorization entity via a customer service phone number for transaction authorization, a procedure that can be time-consuming, frustrating, and, in cases where the user is engaged in foreign travel, quite expensive.
Accordingly, there is a need in the art for less cumbersome credit card transaction approval techniques, particularly for Internet-based transactions and transactions taking place during foreign travel.
According to one or more embodiments, a user activity, which may be a credit card transaction or an on-line access, is approved based on the user's location at the time of the transaction or access. If the transaction or access is denied, the user may call or send a text message to the authorizing entity to permit the authorizing entity to determine the user's location. Then, the authorizing entity transmits a request to locate the user and receives location data indicating the location of the user in response thereto. If the user location is within a predetermined proximity to the location of the user activity, the user activity is authorized.
So that the manner in which the above recited features of the present invention can be understood in detail, a more particular description of the invention, briefly summarized above, may be had by reference to embodiments, some of which are illustrated in the appended drawings. It is to be noted, however, that the appended drawings illustrate only typical embodiments of this invention and are therefore not to be considered limiting of its scope, for the invention may admit to other equally effective embodiments.
For clarity, identical reference numbers have been used, where applicable, to designate identical elements that are common between figures. It is contemplated that features of one embodiment may be incorporated in other embodiments without further recitation.
Home network 101 is a wireless communication system that includes at least one Mobile Switching Center (MSC) 102, a Home Location Register (HLR) 103, and a plurality of cell towers 161-165. MSC 102 connects the landline public switched telephone network system to home network 101. Home network 101 may be a small network and only include a single MSC 102. Alternatively, home network 101 may be a relatively large network, i.e., a network that services a large geographical area, and may include multiple MSCs 102. For clarity, only a single MSC 102 is depicted in
System 150 includes a location provider 106 and a location mapping database 108. Location provider 106 is a logical module, program, or algorithm that determines the location of mobile subscriber terminal 100 by querying location mapping database 108. Location mapping database 108 is a data structure that maps each MSC 102 in home network 101 to a specific geographical location. In some embodiments, location mapping database 108 also maps each of cell towers 161-165 to a specific geographical location. In some embodiments, system 150 may be an integral part of the Operational Support System (OSS) of the cellular service provider. Consequently, location provider 106 and location mapping database 108 may be constructed, maintained, and populated by the operator of home network 101. In other embodiments, system 150 may be a separate entity from home network 101 and therefore may be constructed, maintained, and populated by a third party.
Communication between home network 101 and system 150 is carried out via communication network 107. In some embodiments, communication network 107 may comprise the Internet, the Signaling System 7 (SS7) network, the Public Switched Telephone Network (PSTN) or a combination thereof. The SS7 network is used for communicating control, status, and signaling information between nodes in a telecommunication network.
In operation, when mobile subscriber terminal 100 physically enters the geographical region served by home network 101, mobile subscriber terminal 100 registers with home network 101 and MSC 102 captures the identity of the specific cell tower of cell towers 161-165 that is closest to mobile subscriber terminal 100. This registration process enables mobile subscriber terminal 100 to be alerted to an incoming phone-call or message. Calls are completed and messages delivered via this closest cell tower.
As mobile subscriber terminal 100 changes location in home network 101, the identity of the closest cell tower is maintained by MSC 102. Location provider 106 periodically queries HLR 103 via communication network 107 in order to track the current MSC and/or cell tower that is closest to mobile subscriber terminal 100. In some embodiments, the cell phone number associated with mobile subscriber terminal 100 is used to identify mobile subscriber terminal 100. In other embodiments, location provider 106 uses a serialized equipment number associated with mobile subscriber terminal 100 to identify mobile subscriber terminal 100. If the mobile registry is null, i.e., mobile subscriber terminal 100 is not currently registered in home network 101, then a “not-in-network” message is returned to location provider 106 by HLR 103.
After location provider 106 receives a reply from HLR 103 that identifies the closest MSC and/or cell tower to mobile subscriber terminal 100, location provider 106 queries location mapping database 108 via query 109. Query 109 includes the MSCID of said MSC and/or the appropriate cell tower number. Location mapping database 108 then returns the geographical location of MSC 102 to location provider 106 via reply 110. In some embodiments, the granularity of position of mobile subscription terminal 100 is enhanced by also providing cell tower location in reply 110. In other embodiments, inclusion of the geographical location of MSC 102 in reply 110 is sufficient. Thus, location provider 106 is continuously updated with the current geographical location of mobile subscriber terminal 100 and, presumably, the mobile subscriber, and consequently can provide such location information to any authorized party, e.g., employer, spouse, bank, on-line merchant, etc.
Roaming network 201 is substantially similar in organization and operation to home network 101, and includes one or more MSCs 202, each with its attendant cell towers 361-365. In addition to HLR 103, home network 101 includes a remote HLR, herein referred to as HLR-R 203. HLR-R 203 contains information regarding the MSC 202 in roaming network 201 in which mobile subscriber terminal 100 has registered. Similar to HLR 103, HLR-R 203 contains geographical information regarding mobile subscriber terminal 100. In contrast to HLR 103, HLR-R 203 contains a data structure 205 that identifies the particular MSC 202 in roaming network 201 that is currently serving mobile subscriber terminal 100. Information contained in data structure 205 includes a mobile subscriber identification number, MSC identification number, mobile subscriber terminal serial number, etc. In some embodiments, data structure 205 may also include the cell tower number of the closest cell tower to mobile subscriber terminal 100.
System 350 is substantially similar in organization and operation to system 150 in
When mobile subscriber terminal 100 is outside home network 101, roaming network 201 accepts registry of mobile subscriber terminal 100, assuming there is a roaming agreement between the operator of home network 101 and the operator of roaming network 201. As part of normal operation of home network 101 and roaming network 201, the identity of mobile subscriber terminal 100 is communicated over a telephony signaling network 210 to home network 101, together with the appropriate MSC identification for MSC 202 for inclusion in data structure 205, where MSC 202 is the MSC currently serving mobile subscriber terminal 100. Such information that is communicated from roaming network 201 to home network 101 may be maintained in roaming network 201 in a database equivalent to data structure 105 in HLR 103 for mobile subscriber terminals from other networks, i.e., mobile subscriber terminals roaming in roaming network 201. This database containing information related to roaming subscriber units is called the Visitor Location Registry (VLR).
In operation, location provider 306 queries home network 101 regarding the location of mobile subscriber terminal 100. When HLR 103 is queried by location provider 306, mobile subscriber terminal 100 is discovered to be roaming. Location provider 306 then queries HLR-R 203, and receives the MSC ID of MSC 202, which is the MSC currently serving mobile subscriber terminal 100 in roaming network 201. The geographical location of mobile subscriber terminal 100 is then obtained from location mapping database 308 in the same way that system 150 obtains geographical location for mobile subscriber terminal 100 from location mapping database 108. Thus, location provider 306 is continuously updated with the current geographical location of mobile subscriber terminal 100, even when mobile subscriber terminal 100 is located in a foreign country or otherwise roaming outside home network 101. Consequently, location provider 306 can readily provide location information for mobile subscriber terminal 100 to any authorized party, e.g., employer, spouse, bank, on-line merchant, etc.
In some embodiments, location mapping database 308 maps mobile subscriber terminal 100 to the physical location of a serving MSC in roaming network 201, e.g., MSC 202. Granularity of the position of mobile subscriber terminal 100 may be increased when location mapping data base 308 includes serving cell tower ID 401 and/or latitude/longitude coordinate 402 in roaming network 201, thereby mapping to the closest cell-tower and/or latitude/longitude coordinate. Latitude/longitude coordinate 402 may correspond to a fixed cell tower or MSC location, or may be a triangulated position between cell towers 361-365 that is determined by roaming network 201, or may be a GPS (Global Positioning Satellite) coordinate received directly from mobile subscriber terminal 100. Time-stamp 403 serves to indicate when the location entries were made to mapping database 308, and error radius 404 serves to quantify the granularity of the location estimate for mobile subscriber terminal 100.
As shown, a credit card user 501 initiates a credit card transaction 521 at a POS merchant 502 by presenting a credit card. POS merchant 502 then submits an authorization request 522 to an authorization entity 504, such as the issuing entity of the credit card. POS merchant 502 accepts the credit card as form of payment for the purchase only when the transaction is authorized by authorization entity 504. Thus, POS merchant 502 only accepts the credit card for transaction 521 after receiving authorization response 523 from authorization entity 504. According to embodiments of the invention, authorization entity 504 does not authorize the transaction associated with authorization request 522 unless a two-factor authentication process involving verification of credit card user 501 location is successfully completed. Specifically, authorization response 523 is only issued by authorization entity 504 if the location of credit card user 501 is verified to be within a predetermined radius of the location of POS merchant 502. To that end, authorization request 522 includes location information for POS merchant 502 in addition to credit card transaction information that is normally sent to authorization entity 504.
In some embodiments, when authorization entity 504 receives authorization request 522, authorization entity 504 first determines whether a two-factor authentication process (involving verification of user location) is desired. For example, such two-factor authentication may be desired when authorization request 522 is recognized to fall outside the normal pattern of use for the credit card used for transaction 521, such as when POS merchant 502 is located outside a normal geographical region of use associated with the credit card (e.g., city, country, etc.). Similarly, two-factor authentication may be desired by authorization entity 504 when the transaction at POS merchant 502 exceeds a predetermined dollar amount, a predetermined frequency of use, and the like. In other embodiments, authorization entity 504 may require two-factor authentication as described herein for all transactions using a particular credit card.
When authorization entity 504 determines the need for two-factor authentication but credit card user 501 has not given prior authorization to locate the mobile subscriber terminal or mobile phone associated with_credit card user 501, authorization entity 504 denies authorization request 522 by transmitting a notification of transaction denial 524 to the credit card console located at POS merchant 502, to credit card user 501 directly, or to both POS merchant 502 and credit card user 501. In addition to notifying POS merchant 502 that authorization request 522 has been denied pending additional authentication, notification of transaction denial 524 also includes a message instructing credit card user 501 to call a telephone number associated with location verification entity 505 using the mobile phone or other mobile subscriber terminal that is associated with the credit card, e.g., mobile subscriber terminal 100 in
In some embodiments, call 525 to the telephone number associated with location verification entity 505 is a conventional phone call. It is noted that with conventional caller identification technologies currently in use by authorization entities, such as credit card issuing agencies, a caller can be successfully identified without a call being completed. Thus, in some embodiments, credit card user 501 can call the telephone number associated with location verification entity 505 and can hang up once the called number begins to ring, thereby using a “missed call” to communicate the location of credit card user 501 to location verification entity 505. In such an embodiment, credit card user 501 does not have to incur the expense of a mobile phone call, which can be significant when roaming internationally. In other embodiments, call 525 may communicate with location verification entity 505 in a different manner, such as via a text message. In such embodiments, the text message may be a conventional short message service (SMS) message or may be a wireless chat message, such as Apple's iMessage, which avoids standard SMS texting fees. It is noted that any of the above embodiments is significantly less time-consuming and costly than making a call to a customer service phone number when a credit card transaction is denied while traveling. Furthermore, POS vendor 502 avoids the loss of business that often occurs when a credit card transaction is unexpectedly denied, since the call 525 takes place at the time and place of transaction 521, and can be completed in a few seconds.
In some embodiments, call 525 also acts as an authorization, or “opt-in,” action for allowing authorization entity 504 and/or location verification entity 505 to query location provider 506 for the current location of credit card user 501. Due to privacy issues associated with tracking the location of individuals without prior notification, the opt-in feature of call 525 establishes that credit card user 501 has explicitly authorized such a location look-up. In such embodiments, the opt-in configuration of call 525 may be introduced to credit card user 501 when a mobile phone or other mobile subscriber terminal is associated with a credit card as part of a registration process. Alternatively, an explanation of the opt-in action associated with call 525 may be included in notification of transaction denial 524.
In some embodiments, when authorization entity 504 determines the need for two-factor authentication, authorization entity 504 also transmits a notification of transaction denial 526 to location verification entity 505. Notification of transaction denial 526 informs location verification entity 505 that a location look-up is pending for the mobile subscriber terminal associated with credit card user 501 and the credit card being used for transaction 521. Notification of transaction denial 526 includes the credit card number used in transaction 521, location information associated with POS merchant 502, and the phone number of the mobile subscriber terminal associated with the credit card being used in transaction 521. In some embodiments, notification of transaction denial 526 may also include a desired error radius similar to error radius 404 in
When location verification entity 505 receives call 525 from credit card user 501, location verification entity 505 confirms the location of credit card user 501 by querying a location provider 506 for the current location of the credit card holder. It is noted that in such embodiments, the mobile phone or other mobile subscriber terminal associated with the credit card has been pre-registered with authorization entity 504 prior to transaction 521, and call 525 is placed by the pre-registered mobile subscriber terminal. Location verification entity 505 sends location request 527 to location provider 506 and awaits location response 528. In some embodiments, location provider 506 is substantially similar in organization and operation to either location provider 106 in
Upon receiving location response 528, location verification entity 505 determines the proximity of the mobile subscriber terminal associated with the credit card to the location of POS merchant 502. Presumably, credit card user 501 has the same location as the mobile subscriber terminal associated with the credit card and with credit card user 501. If the current location of credit card user 501, as determined by location verification entity 505, is not within a predetermined radius of the physical location of POS merchant 502, location verification entity 505 transmits a location verification 529 to authorization entity 504 indicating that credit card user 501 is not present at POS merchant 502 for transaction 521. Thus, an unauthorized user may be fraudulently using the credit card for transaction 521. Consequently, authorization entity 504 denies authorization request 522 by transmitting authorization denial 530 to POS merchant 502. If the current location of credit card user 501 is within a predetermined radius of the physical location of POS merchant 502, location verification 530 indicates that credit card user 501 is present at POS merchant 502 for transaction 521. Thus, an unauthorized user is not fraudulently using the credit card for transaction 521. Authorization entity 504 may then further base the authorization of authorization request 522 on other parameters such as credit limit, etc.
In some embodiments, interactions with credit card user 501 are minimized by configuring location verification entity 505 with a database 540 of registered credit card users that have “opted-in” for pre-authorized location look-up by authorization entity 504 and/or location verification entity 505. Database 540 is configured to store the numbers of credit cards issued by authorization entity 504, the number of any mobile subscriber terminal associated with each credit card, and the current location look-up authorization status. Current location look-up authorization status indicates if the credit card user associated with a specific credit card has authorized location verification by authorization entity 504 and/or location verification entity 505. In such embodiments, a credit card user may opt-in to authorize authorization entity 504 and/or location verification entity 505 to perform location verification at some time prior to transaction 521. For example, the credit card user may opt-in when a mobile subscriber terminal is initially registered with authorization entity 504 to be associated with the credit card. In another example, the credit card user may opt-in prior to traveling outside the normal use area of the credit card. Furthermore, the credit card user may opt-in by making call 525. In such an embodiment, when call 525 is received, location verification entity 505 may update the opt-in status of the credit card in database 540 so that future transactions at POS merchants can utilize a two-factor authentication process based on user location without the need for credit card user 501 to make call 525 as described above. Instead, when database 540 indicates that credit card user 501 has already opted-in to location verification, notification of transaction denial 524 is not transmitted to POS merchant 502 or credit card user 501, and call 525 is not needed by location verification entity 505 to verify the location of credit card user 501; location verification entity 505 queries location provider 506 directly without receiving call 525.
In the embodiment illustrated in
In the embodiment illustrated in
In sum, one or more embodiments of the invention provide techniques for providing a two-factor authentication process for a credit card transaction, where the second authentication factor includes verification of user location at the time of the transaction. Advantageously, verifying the location of a credit card user based on the location of a mobile subscriber terminal associated with the credit card makes two-factor authentication of credit card transactions more convenient and reliable, and less costly, than techniques known in the art.
While the foregoing is directed to embodiments of the present invention, other and further embodiments of the invention may be devised without departing from the basic scope thereof, and the scope thereof is determined by the claims that follow.
This application is a continuation-in-part of U.S. patent application Ser. No. 13/016,368, filed Jan. 28, 2011, the entire contents of which are incorporated by reference herein.
| Number | Date | Country | |
|---|---|---|---|
| Parent | 13016368 | Jan 2011 | US |
| Child | 13560655 | US |
