Patent Application
20110202453
The present disclosure relates to providing secure point of sale (POS) transactions by way of mobile devices. In particular, the present disclosure provides mobile device users with a way to securely perform POS transactions with high confidence.
It is commonplace to employ bank cards such as debit cards and credit cards and the like to facilitate financial transactions. The bank cards carry account information and related data that allow the bank card holder the ability to conduct financial transactions. There is a movement towards assigning financial information that is normally associated with bank cards to mobile devices, such as smart phones. In such an embodiment, the smart phone effectively acts like the bank card. As a result, instead of requiring a user to have a bank card to facilitate a financial transaction, the user can use his mobile device to transfer the account information and related data to a service provider or transactor to facilitate a financial transaction. Such financial transactions are referred to as mobile financial transactions. The financial information carried by the mobile device may be, but is not limited to, a system number, a bank number, an account number, a check number, a check digit, a country code, a name, an expiration date and discretionary data.
During a mobile financial transaction attempt, the financial information carried by the mobile device is wirelessly transferred from the mobile device to a service provider or transactor via a point of sale (POS) terminal, etc. Owners of mobile devices such as smart phones carrying financial information can typically perform the same financial transactions that are available to traditional bank card users. However, a problem exists in that a stolen smart phone having financial information can be used to criminally access bank accounts and make fraudulent financial transactions. As such, there is a need for a system and method that is useable to prevent fraudulent financial transactions via a stolen mobile device that is carrying financial information.
The present disclosure addresses the need to prevent fraudulent transactions via a stolen mobile device, such as a stolen smart phone carrying the financial information of a bank card. In general, a mobile secure transaction confidence (MSTC) score is generated and reported to a financial transactor to help prevent stolen mobile devices from being used to conduct fraudulent mobile financial transactions. For example, if an MSTC score for a mobile financial transaction is within a predetermined range, the mobile financial transaction is allowed to complete. If an MSTC score for the mobile financial transaction is outside of the predetermined range, the transaction is prevented from completing.
MSTC scores can be determined based on mobile device interaction characteristics, user traits, mobile device use characteristics, or any combination thereof. A mobile device interaction characteristic is an attribute that indicates how a mobile device is operated by a user of the mobile device. A user trait is an attribute of the mobile device user that is detectable by the mobile device. A device use characteristic is an attribute that indicates how content is acquired and consumed by the user.
Other type of characteristics such as location information associated with the mobile device or user may be used to supplement the determination of MSTC scores. For example, a mobile device interaction characteristic and the location of the user may need to both fall within defined criteria before a MSTC score that is acceptable to a transactor can be determined. Moreover, a voice characteristic and/or image characteristic from a photograph of the user may also further supplement the determination of MSTC scores.
In particular, an MSTC score is determined based upon operational data collected from a user's mobile device and is determined by comparing the mobile device's short term usage patterns to the mobile device's long term usage patterns. The MSTC score is sent to a financial transactor, such as a merchant or payment processor that ultimately decides whether or not to allow a requested mobile financial transaction to complete.
Those skilled in the art will appreciate the scope of the present invention and realize additional aspects thereof after reading the following detailed description of the preferred embodiments in association with the accompanying drawing figures.
The accompanying drawing figures incorporated in and forming a part of this specification illustrate several aspects of the invention, and together with the description serve to explain the principles of the invention.
The embodiments set forth below represent the necessary information to enable those skilled in the art to practice the invention and illustrate the best mode of practicing the invention. Upon reading the following description in light of the accompanying drawing figures, those skilled in the art will understand the concepts of the invention and will recognize applications of these concepts not particularly addressed herein. It should be understood that these concepts and applications fall within the scope of the disclosure and the accompanying claims.
The secure data collector 20 securely collects operational data from the mobile device 12 for various factors such as mobile device interaction characteristics, user traits, and mobile device use characteristics. The TCS 14 stores the collected operational data for later analysis and immediate comparison to determine a mobile secure transaction confidence (MSTC) score. The operational data for each factor type may be mathematically operated on by known statistical methods to produce factor values for comparison. An MSTC score may be calculated by the TCS 14 after a long term pattern and a short term pattern for each factor making up the operational data is established. An MSTC score reflects anomalies between the short term and long term patterns as negative contributors. Anomalies can be detected by comparing a recently collected discrete or continuous factor value with long term pattern values of the same factor type. For example, a factor, such as a user trait short term pattern, may be compared with user trait long term pattern.
Determination of an MSTC score may take place upon request or on a schedule. In a preferred embodiment of the present disclosure, an MSTC score is calculated by summing the differences between the long term patterns and short term patterns for each factor of operational data collected and recorded. Moreover, the TCS 14 processes transaction rules that may be unique for various circumstances or entities. For example, a user of the mobile device 12 may establish and configure transaction rules that weight all factor values evenly, whereas the TCS 14 may include service transaction rules that apply a standardized weighting policy that favors some factors over others. Moreover, the user may configure the transaction rules to scrutinize the mobile device interaction characteristics, user traits, and mobile device use characteristics based on specific criteria. As an example, the specific criteria could be a transaction's date and time, location, transaction amount as well as pertain to special occasions such as Christmas. Further still, a merchant using the POS terminal 16 may send rules to the TCS 14 that may be more or less strict than either the user transaction rules or the service transaction rules of the TCS 14. For example, the merchant rules may have different rule criteria such as not allowing purchases of more than a certain amount between specific hours for an MSTC score that is less than a predetermined value. The following equation is useable to calculate an MSTC score:
MSTC=Δf1+Δf2+ . . . Δfn
The deltas in the equation represent the difference between the factors of the same type (e.g., f1, f2 . . . fn). The deltas are factor values that may be weighted by transaction rules such as those described above.
The secure data collector 20 (
Moreover, the accelerometer 28 may also be employed to detect user traits. For example, the accelerometer 38 may be adapted as a pedometer to count the number of steps or strides per unit of time the user of the mobile device 12 generally takes while walking, running, or jogging. The step or stride count may be recorded as operational data of a pedometer factor type to establish a user trait pattern for the user of the mobile device 12.
As depicted in
Another mobile device interaction characteristic may be developed by collecting data pertaining to texting activities. As depicted in
At least a fraction of the operational data may be collected from an location based system (LBS) that gathers current and historical location data for the transport of the mobile device 12. For example, the GPS receiver 22 determines the location coordinates of the mobile device 12 at a predetermined interval, such as once every five minutes, etc. Upon detection of new location coordinates, the new location coordinates are time and date stamped and recorded to provide short term and long term patterns for the transport of the mobile device 12. In this way, a history of transport patterns for the mobile device 12 may be determined. For example, regular commutes and extended stays at particular locations, such as those involving the user's work location, develop a pattern that is regular for particular days and times of day.
As shown in
As depicted in
The TCS 14 may then compare the short term voice pattern to a long term voice pattern in order to determine a factor of the voice pattern type. The voice pattern factor type may then be summed with other factors, such as the acceleration type factor, to calculate an MSTC score. The digitized voice samples 66 may rank high in generating an MSTC score in situations in which the TCS 14 detects that the mobile device 12 is not in a normal patterned environment for the user of the mobile device 12. For example, the mobile device 12 may be in the possession of the user while the user is at a location outside the mobile device's 12 normal environment. In such a situation, the TCS 14 may be configured by the user to more heavily weight the value of a voice pattern factor calculated from the digitized voice samples 66 and/or other biometric samples, such as an immediate photograph of the user taken with the camera 34 (
The mobile device 12 then presents the transaction information to the purchaser (step 1016). The purchaser may then approve the purchase (step 1018). Once the purchase is approved, the merchant rules and the MSTC score request are sent to the TCS 14 (step 1020). While not essential, the purchaser may prefer that user transaction rules be processed first (step 1022). User transaction rules processing performed by the TCS 14 may weight various factor values more or less heavily based upon the purchaser's policy, which may be established by and included as data for access by the TCS 14.
The TCS 14 then calculates an MSTC score based on the results of the user transaction rules processing (step 1024). In this way, a fraud alert can be sent to the mobile device 12, which in turn immediately passes the fraud alert on to the POS terminal 16 to alert the clerk to possible fraud if the user transaction rules are not passed (steps 1026 and 1028).
However, if the user transaction rules are successfully passed, the merchant rules are processed (step 1030). Merchant rules processing performed by the TCS 14 may weight various factor values more or less heavily based upon the merchant's policy. The TCS 14 then calculates an MSTC score based on the merchant rules (step 1032).
Turning now to
At any time the clerk the may ask for additional identification, such as a biometric identification (step 1046). The purchaser may respond to the biometric identification request with a biometric response that may be, but is not limited to, holding the mobile device 12 at the purchaser's natural talk position, providing a voice sample by speaking into the microphone 32 (
Once the biometric response is acquired by the mobile device 12, the mobile device 12 sends the biometric response in the form of operational data to the TCS 14 (step 1050). The TCS 14 in turn reprocesses operational data with the service transaction rules (step 1052). An MSTC score is then calculated by the TCS 14 based on the outcome of the service transaction rules (step 1054). If the service transaction rules are not successfully passed, a fraud alert can be sent to the mobile device 12, which turn may immediately pass the fraud alert on to the POS terminal 16 to alert the clerk of possible fraud (steps 1056 and 1058).
However, if the service transaction rules are passed, the MSTC score is passed to the mobile device 12 (step 1060). The mobile device 12 in turn sends the MSTC score to the POS terminal 16 (step 1062). The POS terminal 16 may then initiate communication with the payment processor 18 (step 1064).
Turning now to
During a purchase transaction, the POS terminal 16 may request an MSTC score (step 2008). In response, the TCS 14 will calculate an MSTC score (step 2010). If a user of the mobile device 12 desires enhanced security regarding the use of the MSTC score, the MSTC score may be accessed using a rights management system such as a Digital Rights Management (DRM) service 70. In such a case, the MSTC score is transmitted to the DRM service 70 (step 2012). The DRM service 70 then packages the MSTC score with a license that allows merchants or payment processors to be granted rights to the MSTC score for a limited amount of time (step 2014). The MSTC score and license are then transmitted to the POS terminal 16 (step 2016). It should be understood that other confidence report data may also be included and transmitted securely along with the MSTC score.
In another operational example, a user named Joe uses his mobile device 12 (
Over time, the TCS 14 (
In this example, Joe's mobile device 12 is stolen by a thief. The thief uses Joe's mobile device 12 in ways that do not match the usage patterns established by the TCS 14. For example, the thief holds Joe's mobile device 12 at a different orientation than Joe does during telephone conversations. Moreover, digitized voice samples 66 (
The TCS 14 calculates a low MSTC score based on all of the detectable usage pattern differences between Joe and the thief. Therefore, when the thief attempts to make a purchase with Joe's mobile device 12, the TCS 14 generates and transmits a confidence report having a low MSTC score to the payment processor 18. In turn, the payment processor 18 instructs a merchant to check the identification of the thief. When the thief fails to positively identify himself as Joe, the thief is arrested and the mobile device 12 is returned to Joe before a fraud can be committed.
On the transmit side, the baseband processor 82 receives digitized data, which may represent voice, data, or control information, from the control system 84, which it encodes for transmission. The encoded data is output to the radio frequency transmitter section 76, where it is used by a modulator 96 to modulate a carrier signal that is at a desired transmit frequency. Power amplifier circuitry 98 amplifies the modulated carrier signal to a level appropriate for transmission, and delivers the amplified and modulated carrier signal to the antenna 78 through the duplexer or switch 80.
A user may interact with the wireless smart phone 72 via the user interface 88, which may include interface circuitry 100 associated with a microphone 102 that is usable as the microphone 32 (
The microphone 102 will typically convert audio input, such as the user's voice, into an electrical signal, which is then digitized and passed directly or indirectly to the baseband processor 82. Audio information encoded in the received signal is recovered by the baseband processor 82, and converted by the interface circuitry 100 into an analog signal suitable for driving the speaker 104. The keypad 106 and the touch screen display 108 enable the user to interact with the wireless smart phone 72, input numbers to be dialed, address book information, build texting strings or the like, as well as monitor call progress information.
The control system 84 includes a memory 110 for storing data and software applications 112, and a processor 114 for running the operating system and executing the software applications 112. Moreover, provided that the memory 110 is large enough and the processor 114 is powerful enough, an application that provides the function of the TCS 14 could be stored in the memory of the wireless smart phone 72 and executed by the processor of the wireless smart phone 72.
Those skilled in the art will recognize improvements and modifications to the preferred embodiments of the present invention. For example, the mobile device 12 may notify the POS 16 as to whether or not to use a TCS 14 that is internal or external to mobile device 12. In a case in which the TCS 14 is external to the mobile device 12, the POS 16 may communicate directly with the TCS 14 for increased efficiency and security. The use of an external TCS 14 prevents the possibility of a hacked mobile device 12 reporting a false MSTC score. Another improvement would allow a financial transaction to occur between two mobile devices such as mobile device 12. A possible scenario for mobile device to mobile device transactions would be one user wanting to transfer funds to another user by tapping the users' mobile devices together to facilitate a funds transfer. All such improvements and modifications are considered within the scope of the concepts disclosed herein and the claims that follow.
