EP2979237A1

EP2979237A1 - Method for issuing a location assertion

Info

Publication number: EP2979237A1
Application number: EP14713484.5A
Authority: EP
Inventors: Michel Leger
Original assignee: Ingenico Group SA
Current assignee: Banks and Acquirers International Holding SAS
Priority date: 2013-03-28
Filing date: 2014-03-28
Publication date: 2016-02-03
Also published as: AU2014242913A1; RU2015146303A; FR3003976B1; BR112015024761A2; CA2907630C; WO2014154902A1; FR3003976A1; US20160063495A1; CA2907630A1

Abstract

The invention relates to a method for providing a location assertion for a transaction device (Dt) that has requested, from a server and via a communication network, acceptance of a financial transaction involving the use of banking information. According to the invention, such a method includes: a step (10) of receiving a transaction request (Rq) from said transaction device (Dt), including at least one user identifier (id) with which said banking information is associated; a step (11) of obtaining an IP address (@IP) associated with said transaction device (Dt); a step (12) of determining a current location (LOCC) associated with said IP address (@IP); a step (13) of comparing said current location (LOCC) to at least one authorized location (LOCAs) on the basis of said identifier (id) of said user; and a step (14) of providing a location assertion (Al) to an entity (Ent) when said comparison step yields a positive result.

Description

Method for issuing a location assertion

1. Field of the invention

The invention relates to securing payments. More particularly, the invention relates to securing payments made online.

Online payments represent a growing share of payments made daily around the world. They can be made either through payment providers, such as Paypal ™, or by making use of traditional banking organizations.

However, the online payment is marked by a relatively high fraud rate. In France, it is estimated that about five percent of online payments made on the internet are fraudulent. These five percent fraudulent payments account for about thirty-three percent of the total cost of fraud. It is therefore necessary to have means on the one hand to identify fraud attempts and on the other hand to block these attempts.

Mostly, online payments are made using a credit card. These payments require on the one hand the seizure of a credit card number, a date of validity of this credit card, a name of the holder and often a security code on the back of this card. In order to ensure that his information is not stolen, the holder is frequently advised to carry out transactions on so-called "secure" sites. Such sites are said to be secure because they implement at least one technique for encrypting session data that protects the exchanged data. Unfortunately the attacks are not often realized at the time of the payment made by the holder. On the contrary, a standard attack consists of targeting either the payment server independently of any transaction or even better the merchant's server, when the merchant is interfacing between the customer and the bank. These servers are less secure than the session in which the data is transmitted. They are therefore easier to hack. Thus, by hacking these servers, attackers often have a large amount of banking data, which they subsequently transfer to other people. These people then use this information to make fraudulent transactions. One of the problems in online transactions is that these transactions are carried out in "card not present" mode (ie CNP, for "Card Not Present" in English). In this mode, since there is no device in charge of verifying the integrity of the card (such as for example a payment terminal), it is not possible to verify that the cardholder has the PIN code needed to validate a transaction.

2. Prior Art

Thus, to try to secure transactions made in CNP mode, systems and methods have been proposed to address these fraud problems. These methods pose either user convenience issues or other security issues. This is for example the method described in the patent application published under the number WO2012053780. In this patent application, a system and method of verification are described. More particularly, in this document, a method and a system using information on the MAC address of a client terminal is described. During a transaction involving a payment, a stronger authentication process is implemented, in which the MAC address of the terminal used by the customer who wishes to make a payment is compared to a reference MAC address, which has been defined or obtained by the banking server which must authorize a payment or a transaction.

This method, although potentially interesting, is nonetheless impractical. In fact, on the one hand this method obliges the customer to always use the same device to make a payment (except to define several devices authorized to carry out a transaction). On the other hand, there are many methods for falsifying a MAC address of a device. More particularly, the method described in WO2012053780 is based on obtaining a MAC address from a web browser. However, a hacker who wishes to obtain a MAC address of a user would have no difficulty in obtaining this address when he seizes the credit card details of the user in question, for example using a method such as as previously described (by attacking a merchant's server). Thus, the method of WO2012053780 would not be very useful since the complementary information (the MAC address of the transactional device) would be as vulnerable as the others. The method described would therefore have little chance of actually securing the transaction.

Other methods are also available. Some involve providing the user with one-time bank card numbers. These numbers are provided according to customer needs. This method is interesting but does not remove (hopefully) the ability for the customer to use their own card information to perform transactions. Other methods, currently widely used, are to transmit an SMS-type message to the customer who performs a transaction to ensure that he is the bearer of the card. The customer must enter, at the time of the transaction, a password that is transmitted in the SMS. Therefore, the bank makes sure with a reasonable probability that the one who makes the transaction is the customer. This method suffers from two disadvantages: on the one hand it forces the customer to provide his telephone number to the bank before any transaction and in a secure manner (this is done mostly visually with a bank advisor); on the other hand, this method only works if the customer's bank is also the bank that manages the transaction on behalf of the merchant. This is rarely the case, especially abroad. Indeed, a large part of fraud is carried out abroad. Thus, the aforementioned method is not very effective in this case.

3. Summary of the invention

The method proposed by the inventors does not pose these problems of the prior art. Indeed, it is proposed a method of locating a user making a payment in CNP mode.

More particularly, the invention relates to a method for providing a location assertion of a transactional device, having requested, from a server, via a communication network, an acceptance of a financial transaction involving the use of bank details. According to the invention this process comprises: a step of receiving a transactional request, resulting from said transactional device, comprising at least one identifier of a user to whom said bank details are associated;

a step of obtaining an IP address associated with said transactional device; a step of determining a current location associated with said IP address;

a step of comparing said current location with at least one authorized location, according to said identifier of said user;

a step of providing an entity with a location assertion when said comparing step is positive.

Thus, the invention makes it possible to validate a bank transaction (such as an online payment) on the basis of the location of the terminal performing the transaction, by using the IP address of this terminal. The proposed method is therefore much simpler and less restrictive to implement than authorization methods based on a MAC address.

According to a particular embodiment, said method further comprises: a step of obtaining a route taken by data packets to reach said IP address associated with said transactional device, issuing a list of borrowed IP addresses;

a step of associating at least one IP address of said list of IP addresses with at least one location, said transport location;

Thus, the invention makes it possible to trace the path taken by a data packet that wishes to join the IP address associated with the terminal. This provides additional data to protect against theft or theft of IP address.

According to one particular characteristic, said method further comprises:

a step of calculating a coefficient of confidence as a function of coefficients associated with said at least one transport location;

and in that said step of issuing the location assertion takes into account a confidence threshold associated with said user. Thus, the invention makes it possible to classify the locations at risk and to define thresholds below which transactions are not accepted.

According to a particular characteristic, said step of issuing the location assertion is performed when none of the transport locations is part of a prohibited location list.

Thus, it is possible to prevent data packets from passing through forbidden locations. This allows on the one hand to reduce the rate of fraud and on the other hand to prevent data from being intercepted, even when the fraud is not proven.

According to a particular embodiment, said method further comprises: a step of obtaining a current location of a mobile terminal associated with said user;

a step of comparing the current location of the transactional device with the current location of the mobile terminal associated with said user; and

when one of these two locations differs from the other beyond a predetermined comparison parameter, an exit step of the validation process without issuing a location assertion;

when these two locations differ within a predetermined comparison parameter, an exit step of the validation process with delivery of a location assertion.

Thus, the invention makes it possible to couple the location of the transaction terminal to the location of another device in the possession of the user. It is therefore a double control that is effective because in most cases, transactions are passed from the user's home. At this home, the probability that the user's mobile terminal is connected to the residential home gateway is strong. In this case, the location of the terminals will be identical and will be obtained very quickly.

In another embodiment, the invention also relates to a server for providing a location assertion of a transactional device, which has requested, from a server, through a communication network, an acceptance of a financial transaction involving the use of bank details. According to the invention, such a server comprises:

means for receiving a transaction request, from said transactional device, comprising at least one identifier of a user to which said bank details are associated;

means for obtaining an IP address associated with said transactional device;

means for determining a current location associated with said IP address;

means for comparing said current location with at least one authorized location, according to said identifier of said user;

supply means, to an entity of a location assertion when said comparison is positive.

According to a preferred implementation, the various steps of the methods according to the invention are implemented by one or more software or computer programs, comprising software instructions intended to be executed by a data processor of a relay module according to the invention. invention and being designed to control the execution of the various process steps.

Accordingly, the invention is also directed to a program that can be executed by a computer or a data processor, which program includes instructions for controlling the execution of the steps of a method as mentioned above.

This program can use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other form desirable shape.

The invention also provides a data carrier readable by a data processor, and including instructions of a program as mentioned above. The information carrier may be any entity or device capable of storing the program. For example, the medium may comprise storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or a magnetic recording medium, for example a floppy disk or a disk. hard.

On the other hand, the information medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means. The program according to the invention can be downloaded in particular on an Internet type network.

Alternatively, the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.

According to one embodiment, the invention is implemented by means of software and / or hardware components. In this context, the term "module" may correspond in this document as well to a software component, a hardware component or a set of hardware and software components.

A software component corresponds to one or more computer programs, one or more subroutines of a program, or more generally to any element of a program or software capable of implementing a function or a program. set of functions, as described below for the module concerned. Such a software component is executed by a data processor of a physical entity (terminal, server, gateway, set-top-box, router, etc.) and is capable of accessing the hardware resources of this physical entity (memories, supports recording, communication bus, input / output electronic boards, user interfaces, etc.).

In the same way, a hardware component corresponds to any element of a hardware set (or hardware) able to implement a function or a set of functions, as described below for the module concerned. It can be a programmable hardware component or with an integrated processor for executing software, for example an integrated circuit, a smart card, a memory card, an electronic card for executing a firmware, etc.

Each component of the previously described system naturally implements its own software modules.

The various embodiments mentioned above are combinable with each other for the implementation of the invention.

4. Figures

Other characteristics and advantages of the invention will appear more clearly on reading the following description of a preferred embodiment, given as a simple illustrative and nonlimiting example, and the appended drawings, among which:

Figure 1 depicts an embodiment of the location assertion delivery method;

Figure 2 depicts an embodiment derived from the location assertion delivery method;

FIG. 3 depicts a complementary embodiment of the location assertion delivery method;

FIG. 4 illustrates an architecture of a server able to implement a location assertion delivery method;

FIG. 5 illustrates an architecture of a client capable of implementing a location assertion issuing method.

5. Description of an embodiment

5.1. Recall of the principle of invention

As previously stated, it was found that current solutions do not necessarily ensure that the payment is made from the holder of the credit card whose information is used. The purpose of the proposed method is to ensure that, when using credit card data in CNP mode, it is still possible to obtain information on the holder of the payment card. In summary, the goal is to move from a CNP mode to a mode where the carrier map is located without changing the habits of the cardholder and in any discretion.

To do this, the usual steps leading to the validation of the transaction are modified. In at least one embodiment of the proposed method, in addition to banking data, the IP address from which the transaction is initiated is obtained. In a basic mode, this IP address is compared to a list of allowed IP addresses, list maintained by the entity in charge of carrying out the payment transactions (it can be a bank, an institution or an intermediary institution, such as a payment service manager).

In a more advanced embodiment, the IP address is not the data to validate the transaction. In this embodiment, the data validating or not the transaction is a location. The IP address of the terminal from which the transaction is made is always obtained, but this IP address serves only as a means of obtaining a location. The location becomes the information to deliver the transaction authorization (that is, to validate that a transaction can be performed). This embodiment has several advantages. In the first place, this embodiment makes it possible to overcome the problems of address translations. Indeed, it is very common that the device that is used to perform a bank transaction be behind a gateway or a proxy. However, it can be complex to recover an IP address that is exploitable. In general, the IP address retrieved is the IP address of the gateway, but this is not assured. In the second place, this embodiment makes it possible not to limit the number of devices that can be used to carry out transactions. More specifically, unlike a MAC address, for example, an IP address is often shared by multiple devices (for example, the address of a home gateway is shared by all user devices connected to that home gateway. ). It is therefore not necessary to retrieve all the MAC addresses of the devices that can be used.

In at least one embodiment, the location used is that of the city of the IP address. In other embodiments, the location may be more precise, like for example a street in the city. The accuracy obtained depends on the one hand on the available databases and on the other hand on the legal constraints in force in the geographical areas where the invention is implemented.

Subsequently, an implementation of the principle outlined above is presented. This implementation is in no way limiting and any other implementation including the same characteristics as those exposed is possible.

5.2. Description of an embodiment

In this embodiment, presented in connection with FIGS. 1 and 2, the IP address (@IP) of the terminal (Dt) from which the transaction is performed is used. As already indicated, the terminal from which the transaction is made is not a payment terminal (in the sense of a terminal in which the bank card is inserted and in which a PIN code is entered). It is a terminal such as a computer or a tablet or a smartphone and not a payment terminal such as those installed at merchants.

In this embodiment, the method implemented comprises:

a step of receiving (10) a transaction request (q), resulting from a transactional device (Dt), comprising at least one identifier (id) of a user; it is not necessary, in this embodiment, that the query in question includes the bank data (card number, transaction amount, etc.), or even that it comes directly from the transaction terminal.

a step of obtaining (11) an IP address (@IP) associated with said transactional device (Dt);

a determination step (12) of a current location (LOCC) associated with said IP address (@IP);

a step of comparing (13) said current location (LOCC) with at least one authorized location (LOCAs), which is obtained using said identifier of said user (id); When said current location (LOCC) corresponds to at least one authorized location (LOCAs), a step of issuing (14) a location assertion (Al) to an entity (Ent).

The location assertion (Al) is then provided to validate the bank transaction (this bank transaction validation is performed up to the other parameters and values entering the validation process, of course) to an entity. Note that the entity in question may very well be one that implements the method just described.

Thus, the method makes it possible to compare the location of the IP address of the terminal that initiates the payment with an authorized location list. These locations can be defined by the user's bank, automatically. Indeed, it is very traditional for users to connect to their online bank account management systems from several different locations. Among the favorite locations of users, two are extremely common: this is on the one hand the user's home and on the other hand his place of work.

To implement the proposed method, and more particularly, to allow a discreet use of the proposed method, it is possible to retrieve the IP addresses of users when connecting to their online banking. On the other hand, in this embodiment, this recovery is not sufficient, as such. It is necessary, after an IP address retrieval, to obtain a more or less precise location of this address and to keep this location as an authorized location. This conservation can be implemented according to several criteria. For example, when an identified location corresponds to more than twenty or thirty percent of all locations of the user (these percentages are given for information only), it can be considered that this location can be preserved. On the other hand, when a location does not correspond to a usual location of the user, this location can be excluded from the locations authorized by the bank or the payment institution or the payment service manager. In this embodiment of the invention, the location is a country, a city or a street (or a combination of these data).

In a derivative embodiment, the current location of the transactional device is further completed by the implementation of a "trace route" type request. Such a request makes it possible to follow the path taken by an IP packet to reach a given address. In this complementary embodiment, at least some of the IP addresses obtained via the "trace route" request are used to obtain "intermediate" locations. This embodiment of the invention, although more or less significantly lengthening the delivery process of the location assertion, makes it possible to evaluate the path traversed by packets to reach the IP address of the transactional device. This gives a list of IP addresses at least some of which are associated with a location (for example country, city or street or a combination of these data). This list is ordered, in order to be able to evaluate the route taken by the packets.

Thus, for example, if the locations of the different IP addresses of the list are not in adequacy with the IP address as received from the transactional device (the location of the IP address of the transactional device indicates France while the list of successive locations are outside France such as in Russia, Albania, India, China, etc.), it is possible to modulate the delivery of the location assertion. This modulation can take several forms: either the location assertion is not delivered at all and the process is stopped, or a technique based on confidence coefficients is introduced.

In this technique, countries or regions of a country or even cities and streets, are assigned levels of trust. It is a coefficient less than or equal to the value 1. Each location of the list of successive locations is assigned a coefficient. The coefficients of the locations of the list are multiplied to obtain a level of confidence. When the confidence level is below a predetermined confidence level, the location assertion is not delivered. This confidence threshold may for example be a function of the number of banking incidents linked to the user or also of the frequency with which the bank has found that the user was moving (according to the withdrawals made in different countries or in different cities).

In this derivative embodiment, the method therefore comprises:

a step of obtaining (11) an IP address (@IP) associated with the transactional device (Dt);

a step of implementing (121) a request to obtain a route taken by data packets to reach said IP address (@IP) of said transactional device, issuing a list of IP addresses borrowed

(L @ IP);

an association step (122) of at least one IP address of said list of IP addresses (L @ IP) with at least one location, called transport location (LOCT);

and

o a step of calculating a coefficient of confidence as a function of coefficients associated with said at least one transport location and a step of issuing the location assertion according to a confidence threshold associated with said user;

or a step of issuing the location assertion when none of the transport locations are part of a prohibited location list.

In the description of FIG. 2, the previously presented steps are associated with a preliminary determination of an IP address location of the terminal. This is only one embodiment. It is quite possible to implement these steps independently.

5.3. Description of a second embodiment

In this second embodiment, security is enhanced. Indeed, in addition to the location of the place where the transaction is carried out (for example by using the IP address of the terminal from which this transaction is initiated), we use the locating a mobile terminal (for example a smartphone or tablet) in the possession of the user to determine the location of this terminal. In other words, in this embodiment, in addition to the location of the terminal from which the transaction is made, it also seeks to locate a mobile device that is in the possession of the user so as to correlate this location mobile device with that of the device from which the transaction is made.

Specifically, when the two locations obtained are not consistent, the location assertion is not provided and the transaction can not continue.

Thus, compared to the previous embodiment, the method further comprises, in relation to FIG.

a step of obtaining (123) a current location of a mobile terminal associated with said user (LOCTm);

a step of comparing (124) the current location of the transactional device (LOCC) with the current location of the mobile terminal associated with said user (LOCTm); and

Thus, two locations are used and correlated to deliver the location assertion.

The step of obtaining a current location of a mobile terminal associated with said user may comprise, depending on the embodiments, a direct transmission of a location by the terminal itself, if the terminal is able to make this transmission (for example via a dedicated application - see below). The obtaining of the location can also be implemented via the communication network to which the communication terminal is connected. As a general rule, this implies implementation through the intermediary of the telecommunication operator to which the user is subscribed (this can cause problems since the operators are generally reluctant to provide this kind of data, which they prefer to keep for their own purposes or for uses imposed by the laws of the Member States. different countries).

5.4. Application & Mobile Terminal

As mentioned previously, in at least one embodiment, the method is implemented via a mobile terminal, which terminal is assumed to be in the possession of the user. Unlike known techniques, the method does not include transmitting information to the mobile terminal to verify that the cardholder has its terminal to perform the transaction. On the contrary, the method consists in obtaining information from the terminal, which on the one hand is more discreet and on the other hand makes it possible not to solicit the user unnecessarily. The information obtained can be of several types. The information can be a geographical position obtained via a geolocation module (GPS type, GLONASS, GALILEO, etc.). The information can also be an IP address. This IP address can be the IP address of the gateway to which the terminal is connected, for example in WiFi, when this terminal is at the user's home. This IP address can be the one provided by an access provider in case of connection to the Internet via a 3G / 4G network. The information can still be a base station identifier, to which the terminal is connected (for example on a 2G / 3G / 4G network). Thus, one obtains, via the telephone, one or more information to achieve a location of the terminal.

In a specific embodiment of the invention, this implementation is provided by a mobile application. More particularly, according to a preferred implementation, this application is the user's banking application. It is indeed very common for users to have an application allowing them to manage their account from their mobile terminal. In general, this type of application enjoys enhanced security. More specifically, this type of application often uses a session data encryption protocol (SSL or TLS), which ensures a certain confidentiality of the transmitted data. In one embodiment specific, in which the delivery method of the location assertion is implemented by a third party (that is, not by the user's bank), the mobile application transmits, upon request, the data necessary for a bank server, which retransmits this data (or data transformed into location data) to the third party server (for example to the transactional server).

5.5. Transactional server

In at least one embodiment, the method described is implemented via a transactional server, presented in connection with FIG. 4. Such a server may, as desired, be implemented by a banking organization, a payment service provider or provider acting as an intermediary between one or more banks or payment institutions.

Such a management server comprises a memory 41, a processing unit 42 equipped for example with a microprocessor, and driven by the computer program 43, implementing the method according to the invention. In at least one embodiment, the invention is implemented in the form of a bank server, a payment system. Such a server includes:

means for receiving a transaction request, from said transactional device, comprising at least one identifier of a user to which said bank details are associated; These means can be embodied in the form of a connection interface (I) to one or more communication networks. They may be software interfaces or hardware interfaces (network card type or network communication hardware modules).

means for obtaining an IP address associated with said transactional device; These means can be embodied in the form of a connection interface (I) to one or more communication networks. They may be software interfaces or hardware interfaces (network card type or network communication hardware modules);

means for determining a current location associated with said IP address; means for comparing said current location with at least one authorized location, according to said identifier of said user;

supply means, to an entity of a location assertion when said comparison is positive. These means can be embodied in the form of a connection interface to one or more communication networks. They may be software interfaces or hardware interfaces (network card type or network communication hardware modules).

In at least one embodiment, such a server also comprises means for obtaining at least one piece of information coming from a mobile terminal that is supposed to be in the possession of the user whose transaction is to be validated. In this embodiment, this server may for example transmit a request to obtain this information to the mobile terminal. To do this, it can implement several techniques, the first being for example the transmission of an SMS-type message to an application installed on the terminal (see Application and Mobile Terminal).

Upon receipt of the location information, the server performs a concordance check between the location previously obtained (that of the terminal to which the user is connected) and the location obtained via the mobile terminal. When these locations are not matched, the transactional server does not provide a location assertion and the transaction is rolled back.

Cleverly, whenever possible, all the available information is transmitted (geolocation, IP address and base station identifier) by the mobile application to the transactional server and a cross-check of this information is then performed by the transactional server (to which this functionality overlap is added). This cross-checking of information is done in order of reliability of the information received. For example, it is considered that the identifier of the base station to which the mobile terminal of the user is connected (network 2G, 3G, 4G) is more reliable than the geolocation which is itself more reliable than the IP address . Thus, when the location obtained by the IP address is different from that obtained by the base station identifier, it can be estimated that the location by the IP address is probably less reliable than that of the network to which the terminal is connected. In this case, one can for example decide not to authorize a transaction (there is no delivery of location assertion).

5.4. Device for implementing the invention

In relation to FIG. 5, a simplified architecture of a mobile device capable of transmitting its position is presented. Such a mobile device comprises a memory 51, a processing unit 52 equipped for example with a microprocessor, and driven by the computer program 53, implementing the method according to the invention. In at least one embodiment, the invention is implemented in the form of a mobile application installed on a mobile device in the possession of the user. Such a mobile device comprises:

means for receiving a request to obtain localization from a server. These means can be embodied in the form of a connection interface (I) to one or more communication networks. They may be software interfaces or hardware interfaces (network card type or network communication hardware modules);

means for determining a position, for example via a GPS-type global positioning interface;

transmission means (T), said server, said at least one position. These means can be embodied in the form of a connection interface to one or more communication networks. They may be software interfaces or hardware interfaces (network card type or network communication hardware modules).

Claims

A method of providing a location assertion of a transactional device (Dt), having requested, from a server, via a communication network, an acceptance of a financial transaction involving the use of banking coordinates, the method comprising, receiving (10) a transactional request (q), resulting from the transactional device (Dt), comprising at least one identifier of a user (id) associated with the bank details, obtaining ( 11) an IP address (@IP) associated with the transactional device (Dt); determining (12) a current location (LOCC) associated with the IP address (@IP); comparing (13) the current location (LOCC) with at least one authorized location (LOCAs), based on said identifier of said user (Id) and the supply (14), with an entity (Ent) of a location assertion (Al) when the comparing step is positive, the method being characterized in that it further comprises:

a step of obtaining (121) a route taken by data packets to reach said IP address (@IP) associated with said transactional device (Dt), issuing a list of borrowed IP addresses (L @ IP);

A method of providing a location assertion according to claim 1, characterized in that it further comprises:

and in that said step of issuing the location assertion takes into account a confidence threshold associated with said user. A method of providing a location assertion according to claim 1, characterized in that said step of issuing the location assertion is performed when none of the transport locations are part of a prohibited location list.

a step of obtaining (123) a current location of a mobile terminal (LOCTm) associated with said user;

Server for providing a location assertion of a transactional device (Dt), which has requested, from a server, via a communication network, an acceptance of a financial transaction involving the use banking coordinates, server comprising:

means (10) for receiving a transaction request (q) from said transactional device (Dt), comprising at least one identifier of a user (id) to which said bank details are associated;

means (11) for obtaining an IP address (@IP) associated with said transactional device (Dt); means (12) for determining a current location (LOCC) associated with said IP address (@IP);

comparison means (13) of said current location (LOCC) with at least one authorized location (LOCAs), as a function of said identifier of said user (Id);

delivery means (14), to an entity (Ent) of a location assertion (Al) when said comparison is positive;

server characterized in that it comprises:

means for obtaining (121) a route taken by data packets to reach said IP address (@IP) associated with said transactional device (Dt), issuing a list of borrowed IP addresses (L @ IP);

means for associating (122) at least one IP address of said list of IP addresses (L @ IP) with at least one location, called transport location (LOCT);

Computer program product downloadable from a communication network and / or stored on a computer readable medium and / or executable by a microprocessor, characterized in that it comprises program code instructions for executing a method delivery device according to claim 1, when executed on a computer.