IL157018A - Apparatus and method for real time reduction of credit card fraud - Google Patents

Abstract

A method for reducing credit card fraud comprising the steps of: detecting a request to transfer funds by means of a credit card; sending a short message service message over wireless communication channel to at least one end user device; the at least one end user device being associated in advance with the credit card; determining whether to approve the request in view of an end user response. 2779 י" ב בתשרי התשס" ה - September 27, 2004 פירוט זה נבחן בהתאם לתקנה 35 לתקנות הפטנטים, תשכ" ח-1968 This specification was examined in accordance with regulation 35 of the Patent Regulations, 5728-1968.

Description

AN APPARATUS AND METHOD FOR REAL TIME REDUCTION OF CREDIT CARD FRAUD FILED OF THE INVENTIUON This invention relates to systems and methods for reducing credit card fraud based upon real time feedback from the credit card owner.

BACKGROUND OF THE INVENTION Credit card anti fraud methods Credit cards are vastly used in modern commerce. They dramatically simplify funds transfer, but they are also prone to frauds. The increasing amount of credit card frauds has led to various anti-fraud measures.

A first type of anti-fraud measures involves credit card owner identification. This may involve presenting an identification certificate of the owner (such as a passport, a driving license and the like) , printing the credit card owner signature on an anti-tamper tape and a comparison of the owner's signature to that signature, and additionally or alternatively, etching the credit card owner's image on the credit card. In the near future biometric identification means may be used.

Another type of anti-fraud measures aims to reduce or eliminate unlawful duplication or generation of credit cards. A credit card includes a magnetic strip that stores credit card related information. This information is read by a credit card reader and sent to a remote entity (such as a server) that is usually managed by the credit card provider. Credit cards are often unlawfully duplicated by reading the magnetic strip (by a handheld card reader) and then copying the magnetic strip content. In order to prevent the usage of such an unlawfully duplicated card, an organization names Chip and Pin started testing a new credit card that requires its owner to verify a transaction by keying a four-digit PIN number instead of signing a receipt. The keyed PIN number is compared to a predefined PIN number that is stored in a remote database. In addition, many credit cards include holograms that are hard to duplicate.

The third type of anti-fraud measures is based upon the introduction of predefined parameters within a remote database that may include the credit card monetary limitations, owner buying patterns, ID number, social security number and the like.

In most cases the communication links between merchant and these databases are highly secured, using advanced cryptology methods. Two method for imposing credit card owner buying pattern oriented limitations are suggested by U.S patent 6052675 and U.S. patent application serial number 20020099648 of DeVoe et al.

U.S patent 6052675 of Checchio's, titled "Method and apparatus for preauthorizing credit card type transactions " describes a method and apparatus for preauthorizing transactions includes providing a communications device to a vendor and a credit card owner. The credit card owner initiates a credit card transaction by communicating to a credit card company database, and storing therein, a distinguishing piece of information that characterizes a specific transaction to be made by an authorized user of the credit card at a later time. The information is accepted as "network data" in the database only if a correct personal identification code (PIC) is used with the communication. The "network data" will serve to later authorize that specific transaction. The credit card owner or other authorized user can then only make that specific transaction with the credit card. Because the transaction is pre-authorized, the vendor does not need to see or transmit a PIC. In addition, if the credit card is lost or stolen, it cannot be used because all sales using the credit card must be pre-authorized using the confidential PIC.

U.S. patent application serial number 20020099648 of DeVoe et al, titled "Method of reducing fraud in credit card and other E-business" describes a credit card account having increased protection against fraud, wherein the credit card account has a usage line, which is a paradigm of rules for accessing the line of credit of the card account, where the usage line is set up and administered by the authorized user of the credit card account, and where the paradigm reflects the users buying preferences and level of concern for security. The authorized user can access the usage line over the internet, to periodically update buying plans, require explicit email approval for designated purchases, create rules for employee users, view a log of approved and declined transaction requests for purposes of analyzing for fraud, and remove all usage line constraints.

Short message services (SMS) messages.

The SMS is a service that enables to exchange text messages with users of wireless networks. The SMS messages can be delivered to an end user even if he is in the middle of a voice or data call. SMS messages are relatively small in comparison to voice messages. SMS messages are provided to an end user after being received and stored in a SMS center and may be further filtered according to certain policy rules and/or in response to available memory space in the end user terminal.

SMS technology is quite mature and many systems for conveying SMS messages, as well as generating SMS messages and responding to SMS messages are available. A brief view of the state of the art is given in the following patents: (i) U.S patents 6505052 of Jou titled "system for transmitting and receiving short message service messages", (ii) U.S. Patent 6529717 of Blants et al, titled "Menu-driven input of SMS-messages", (iii) U.S patent 6301484 of Rogers et al., titled "Method and apparatus for remote activation of wireless device features using short message services (SMS)", (iv) U.S patent 6151507 of Laiho et al, titled" Individual short message service (SMS) options", (v) U.S. patent 6125281 of Wells et al titled "Real time SMS application messaging using an SMSC-linked server", (vi) U.S patent 5915222 of Olsson el al, titled "Transporting short message service (SMS) messages within a telecommunications network", (vii) U.S patent 6289223 of Mukherjee at al, titled "System and method for selective multipoint transmission of short message service messages", (viii) U.S patent 6119014 of Alperovich et al titled "System and method for displaying short messages depending upon location, priority, and user-defined indicators", and (ix) U.S patent 6052597 of Ekstrom titled "short message initiated cellular mobile positioning system" that describes a positioning sequence that is initiated by sending an SMS message by generating an SMS message; provide an adequate view of the state of the art relating to SMS messages.

U.S patent 6505052 of Jou describes a system for accessing broadcast SMS messages over a wireless communication system. A base station transmits SMS messages periodically and a-periodically over a broadcast channel. The base station allocates periodic slots in the broadcast channel for each of the subscriber services providing the SMS messages and transmits slot parameters to mobile units. Using the slot parameter information, the mobile units periodically wake up to scan the broadcast channel. The period for each category of broadcast SMS messages may be different and the period may apply to a single broadcast channel. Messages arriving a-periodically can be queued and transmitted in pre-scheduled broadcast channel frames. Messages with inter-arrival interval greater than the specified transmission period are simply repeated.

U.S. patent 6529717 of Blants et al describes a mobile communication device that utilizes the short message service of its communication network to generate messages. The messages are constructed from a series of fields. From stored data a series of questions and optional answers are presented. The user can select the appropriate answer from the memory. Each of the answers is correlated to message components that are compiled by the microprocessor to form a complete message.

U.S patent 6301484 of Rogers et al describes a method and apparatus for remote control of software and hardware features of a wireless communication device using Short Message Services (SMS) . A wireless communication device with SMS capabilities can be remotely configured by sending specifically configured SMS messages. A manufacturer can configure a wireless device to have control over certain features accessible through SMS messages. A configuring SMS message is constructed using a specific format to inform the wireless device of the presence of a feature control message. The wireless device receives the SMS message and identifies it as a feature control command by noting the presence of a message start delimiter. The message is then parsed according to the field delimiters within the message. The wireless device then configures software and hardware features according to the contents of the SMS message fields .

U.S patent 6151507 of Laiho describes a bidirectional cellular radiotelephone that is coupled through a wireless interface to a network operating in accordance with a wireless communication protocol. A text message may be transmitted to the network using a selected configuration. The user of the radiotelephone may also specify that a SMS message transmitted from the radiotelephone be converted to another message type (e.g., a facsimile message, a page message, or an electronic mail message) by the network, before being forwarded by the network.

U.S patent 6119014 of Alperovich et al describes a system and method for organizing SMS messages sent to a mobile terminal based on the location of the mobile terminal or the time of delivery of the SMS messages. The originating subscriber of an SMS message can specify the priority associated with the message and/or the time of delivery of the SMS message. The receiving subscriber can control the display of the SMS messages by moving the received SMS messages to an action list, and then specifying when and/or where the SMS messages should be displayed again.

BRIEF DESCRIPTION OF THE DRAWINGS In order to understand the invention and to see how it may be carried out in practice, a preferred embodiment will now be described, by way of non-limiting example only, with reference to the accompanying drawings, in which: Figure 1 is a schematic diagram of a system for reducing credit card fraud, in accordance with an embodiment of the invention; Figure 2 is a schematic diagram of an end user device, in accordance with an embodiment of the invention; Figure 3 is a flow chart illustrating a method for reducing credit card fraud, in accordance with an embodiment of the invention; Figure 4 is a flow chart illustrating a method for reducing credit card fraud, in accordance with another embodiment of the invention; and Figure 5 is a schematic illustration of a registration interface, in accordance with another embodiment of the invention.

DETAILED DESCRIPTION OF THE DRAWINGS According to an embodiment of the invention a credit card fraud prevention method is provided that is based upon SMS message based transaction validation. A credit card owner receives an SMS message whenever a credit card based request to move funds is detected, and is given the opportunity to disapprove the transaction in real time.

The approval can be sent by an SMS message, and/or require the end user to phone a predetermined phone number.

According to an embodiment of the invention a system is provides that includes a relay server that receives indications about on-going transactions, generates and transmits an SMS message to a predefined cellular handset (usually the handset of the credit card owner) , waits to receive in response a predefined acceptance SMS message from that credit card owner and is able to prevent non-validated transactions from occurring.

According to an embodiment of the invention, an anti fraud system is provides that includes: (i) means for receiving a request to transfer funds by means of a credit card, (ii) means for sending a message over wireless communication channel to at least one end user device, whereas the at least one end user device being associated in advance with the credit card, and (iv) means for determining whether to approve the request in response to an end user response to the short textual message.

According to an embodiment of the invention a method for reducing credit card fraud is provided. The method includes the steps of: (i) detecting a request to transfer funds by means of a credit card; (ii) sending a message over wireless communication channel to at least one end user device; the at least one end user device being associated in advance with the credit card; and (iii) determining whether to approve the request in response to a response to the short textual message.

According to an embodiment of the invention, the method further includes sending a message to a credit card entity; and wherein the determination is further responsive to a response of the credit card entity to the message. The credit card entity can be a server and/or data bank or other computerized entity that is managed by a bank and/or a credit card company, whereas this entity is capable of checking whether the credit card is valid, whether a certain credit threshold was exceeds and the like.

According to an embodiment of the invention the message can be transmitted without establishing a telephone connection with the end user device, and can be an SMS message .

According to an embodiment of the invention, the recipients of the message may be equipped with various devices such as cellular phones, PDAs and the like. The end users may be the credit card owner and/or additional persons that were associated with the credit card. This association is stored in a database that is accessed by the relay server or any other transmitter that transmits the message over the wireless network.

The term relay server defined an entity that is able to exchange messages with end user device over wireless communication links and also exchange information with other entities such as credit card entities, credit card processors, law enforcement authorities and the like. The relay server include management capabilities for managing multiple end users and groups, and may include multiple sub units located remotely or in proximity to each other. According to an embodiment of the invention, the determination (whether to approve or stop the transaction) may be made according to various rules. A first rule may be not to approve the transaction if the end user did not respond within a predefined period. On the other hand another rule can be to approve a transaction unless the user sent a disapproval message, whereas the lack of response will not cause the transaction to be rejected. A second rule can be a filtering rule for automatically approving certain transactions and/or automatically disapproving other transactions. The approval can relate to the sum that is requested, to the merchant identity and the like.

According to various embodiments of the invention an end user has an end user device that is able to send a short response message after receiving the request message. By using well known techniques the response of the end user can be generated and transmitted without requiring the end user to perform more than few actions. A "one click" response can be utilized and predefined acceptance or rejection massage can be sent.

According to an embodiment of the invention the request as well as the acceptance or disapproval messages, or at least a representation of said messages are recorded, for further evaluation and/or for generation of various reports and statistics.

According to yet a further embodiment of the invention the method includes an additional step of defining request criteria that will result in automatic acceptance or rejection. The automatic acceptance or rejection may be later reported to the end user, as real time response may not be required.

According to a first embodiment of the invention the end user response is sent to a credit card entity that determines whether to accept or reject the transaction, but this is not necessarily so. For example, the relay server or even other entity (including the entity that generated the request to transfer funds) may receive both the end user response and a credit card entity response and determine whether to accept or reject the request in view of both responses.

According to another embodiment of the invention the end user is able to obtain information about his bank account. The end user can be updated whenever a transaction is made, in a periodical manner or a combination of both manners.

According to another embodiment of the invention once a determination is made and/or once the transaction is completed, a message is sent to the at least one end user device.

According to a further embodiment of the invention the end user is a car fleet owner or administrator that receiver indication abut a request to fuel one of his vehicles using an automatic fueling card, and can prevent said fueling event.

According to the invention a credit card may be associated with a group of entities (including end users) that may respond (whereas some are only notified about) to the requested transaction. Usually, each end user can cancel the transaction, but this not necessarily so, as some end user may overrule other responses.

According to another embodiment the credit card entity and the relay server can be combined to a single entity. Conveniently, the reception and transmission of messages to end users as well as the reception of end user response will be done by a combination of hardware and software that at the credit card entity premises.

Referring to Figure 1 that illustrates a system 100 for reducing credit card fraud, as well as illustrating some messages that are exchanged between different entities of system 100.

System 100 includes credit card processor 10, connected over first communication channel 12 to credit card entity 20 that in turn is connected to relay server 30 over second communication channel 22. Relay server 30 is connected to an end user device 40 over wireless connection channel 32.

For simplicity of explanation the exact structure of each channel as well as additional relays, transmission entities, base stations, network components are omitted. These entities are known in the art and do not require detailed explanations. At least some of the communication channels are secured.

Credit card processor 10 is a device that is usually located at a merchant location and is able to read a credit card and to transmit (usually over a secured wired channel) transaction related information (such as credit card number, funds to be transferred) to a credit card entity, such as a bank server, a credit card server and the like. The credit card processor 10 will wait to receive an acceptance/ rejection to the request and in response either the transaction is completed or rejected. In prior art systems the acceptance/ rejection was managed by the credit card entity that checks various bank account parameters such as the validity of the credit card, credit limits and the like.

The credit card entity 20 makes its own determination regarding the acceptance/rejection of the transaction and also notifies the relay server 30 about the request, and waits to receive an end user response to the transaction. Usually, the credit card entity will receive the end user response and in view of both said response and its own determination will determine whether to accept or reject the transaction.

According to other embodiments of the credit card entity does not receive the end user response and makes the final determination, but another entity, such as the relay server 30 or the credit card processor 10 receives both responses and determines whether to accept or reject the transaction.

According to other embodiments of the invention other means than a relay server are used to initiate messages to end users and to process end users responses. These means can be a combination of hardware and software, or only software, these means can include interfaces to cellular networks and/or other computerized systems.

According to another aspect of the invention the message that is sent to the merchant may include an image of the credit card owner (or other end user authorized to sue the credit card) . The image may be retrieved from a database by the relay server and/or the credit card entity.

The right side of Figure 1 illustrates some messages that are exchanged between the various entities over the various communication channels, as well as their order within a message sequence. The first message is a request to transfer funds 52 that is sent from credit card processor 10 over first communication channel 12 to credit card entity 20 in a manner known in the art. The credit card entity 20 sends a representation 54 of the first message to relay server 30. The format of the message as well as the communication protocols may vary from one communication channel to the other. This second message is converted by relay server 30 to a message regarding the request 56 that is sent over wireless communication channel to an end user device or several end users devices, that were previously associated with the credit card. The details of end users devices that shall be contacted once a certain credit card is involved in a transaction as well as and how to contact the devices is stored in a data base to be retrieved once the relay server 30 receives the request. The data base content can be updated by authorized end users.

The end user receives an indication (visual and/or audio visual indication) about the request and send his response 58 to the relay server. The relay server 30 can determine that a response was receives if the end user did not respond during a predefined time period.

The relay server 30 relays (and/or reformats the response) the response to the credit card entity 20 that determines whether to accept or reject the transaction and sends an appropriate message 62 to the credit card processor 10.

Figure 2 is a schematic illustration of cellular phone 111, in accordance to an embodiment of the invention. Phone 111 has a processor/controller unit 120 that is connected to other components of the phone for coordinating their operation as well as performing various computational tasks. Phone 111 further includes transceiver unit 150 (connected to an RF antenna - not shown), keypad 140, memory unit 130 and display unit 110. The memory unit 130 can include software and information requires for a reception of an incoming transaction related message, to cause processor 120 to drive the display unit 110 such that text relating to the request message is displayed (an exemplary text denoted 180 is illustrated, but other text and additional or less information may be displayed) .

Text 180 includes information relating to the transaction: for example, a request to transfer a certain amount of funds ("X $") to a certain merchant ("to merchant Y") by means of a certain credit card ("by credit card Z") was initiated. The text 180 further can invoke the end user to accept or reject the transaction ("do you want to approve the transaction?") and can include instructions relating to a transmission of an end user response ("Press "Y" for approval and "N" for rejection") .

The memory unit 130 usually stores software and information (such as a predefined textual message, transmission information for automatic transmission of the message to the relay server 30 and the like. This information is retrieved by processor 120 that in response to an input of the end user (pressing a certain key of keypad 140) transmits an end user response message 58 to the relay server, and to additional entities (such as other end users) .

The display of textual messages, and a user-friendly manner of generating messages are known in the art, as partially described in the background to this invention. The end user device may also allow the end user to call a predefined phone number (or to dial a number) , also stored in memory unit 130.

Figure 3 illustrates method 200 for reducing credit card fraud, in accordance with an embodiment of the invention. Method 200 includes the steps of: (i) Step 210 of initiating and transmitting a request to transfer funds, by using a credit card, (ii) Step 220 of detecting the request by credit card entity. (Ill) Step 230 of transmitting a representation of the request to a relay server, (iv) Step 240 of detecting the request by the relay server and transmit a message over wireless link to end user device, (v) Step 250 of receiving the message by end user device and displaying a message on the display and/or generating an audio sequence informing the end user about the request . (vi) Step 260 of receiving end-user input (approval / rejection of request) , transmitting to the relay server an end user short response message, (vii) Step 270 of transmitting to the credit card entity a representation of the end client response. (VIII) Step 280 of determining, by credit card entity, whether to accept or approve request, in view of end user response and credit card entity own determination . (ix) Step 290 of transmitting approval/ rejection to entity that initiated and transmitted the request. In the case of a credit card processor, once the response is received the transaction is either completed or ended.

Figure 4 illustrates method 200' for reducing credit card fraud, in accordance with an embodiment of the invention. While in method 200 is a sequential process in which the credit card entity accepts the end user response and sends a final determination to the credit card processor, method 200' includes parallel validation steps, and the credit card processor that initiated the request makes the final determination.

Method 200' starts by step 210 of initiating and transmitting a request to transfer funds, by using a credit card. Steps 210, 220, 240, 250, 260 of method 200' are substantially the same as the coresponding steps of method 200.

Step 210 is followed by parallel validation processes, the first includes steps 220, 274 and 284 while the other validation process includes steps 240, 250, 260 and 286. Step 220 is followed by step 274 of determining by credit card entity, whether to accept or reject the request. Step 274 is followed by step 284 of transmitting the credit card entity response to the credit card processor that initiated the request.

Step 240 if followed by step 250 and 260 that in turn if followed by step 286 of transmitting to the credit card processor the end user response.

Steps 284 and 286 are followed by step 292 of deciding wheter to accept or reject the trasnaction in view of the credit card entity response and the end user response. Usually if one response is nagative the transaction is not accepted.

Figure 5 illustrates an interface for registrating a new end user. The end user must provide various information about himself, the credit card, his bank acocunt, communication related information (especially information required for exachaning information wuith a selected end user device) to and also group related information. It is noted that some of the information fields are optionals and some may be provided by other entities, such as credit card entities, once the end suer is registered. Referring to Figure 5, the information may include the end user first name (74), last name (76), username (72), password, ID number, social security number, email address (78), cellular phone number (80) that can also be selected froma list of predefined cellular phon numbers (82), account number (112), bank (108), bank branch (110), credit card number (104), credit card validity (106), end user address (84 - 86) and the like. The client can request to generate or update a group of end user (more specifically end user devices) that shall be notified about a transaction. The group may be selected from a list of previously defined groups (90), or can be a ne ely defined group (92) , end suer may unpdate there details, as well as cancell his registration and/or renew his registration by accessing the relays erver by various means, including the internet, mail, faximike , phone and the like.

It is noted that if the relay server, or another management entity that manages the registration of end users, receives the end user information it may check the validity of information with other entities, such as credit card entity, and may notify the end user is the information he entered was wrong. In such a case the credit card entity may be informed, the end user may be notified and the owner of the credit card, as registered in the credit card entity may be notified, in order to prevent false registration. If the credit card entity or the registered entity do not indicate that a false registration attempt was made, the end user may be given a change to correct the information.

After the transactions and various messages relating to the transactions are recorded, various reports can be generated and transmitted to various end users, credit card entities and other entities. The reports may include subsets of transactions and messages, filtered by various parameters, such end user identity, end user group, end user response, credit card entity response, transaction request, status of end users (including disconnected end users), and the like.

Only exemplary embodiments of the present invention and but a few examples of its versatility are shown and described in the present disclosure. It is to be understood that the present invention is capable of use in various other combinations and environments and is capable of changes or modifications within the scope of the inventive concept as expressed herein.

Claims (32)

157018/2 WE CLAIM

1. A method for reducing credit card fraud comprising the steps of: detecting a request to transfer funds by means of a credit card; sending a short message service message over wireless communication channel to at least one end user device; the at least one end user device being associated in advance with the credit card; determining whether to approve the request in view of an end user response.

2. The method of claim 1 further comprising a step of notifying a credit card entity about the request and the end user response.

3. The method of claim 2 wherein the determination is further responsive to a response of the credit card entity to the message.

4. The method of claim 1 wherein the end user is the credit card owner.

5. The method of claim 1 wherein the at least one end user device comprises a group of end users devices associated with the credit.

6. The method of claim 1 wherein the step of determining comprises not to approve the transaction if not response was received during a predefined period. 157018/2

7. The method of claim 1 wherein the step of determining comprises not to approve the transaction if at least one end user sends a disapproval message.

8. The method of claim 1 wherein an end user can replay to the message by sending a short response message.

9. The method of claim 1 wherein the end user device is configured such as that few end user operations will result in a transmission of a response message.

10. The method of claim 1 further comprising generating a record of the requests and determinations.

11. The method of claim 1 further comprising notifying credit cart entities of disapproved requests.

12. The method of claim 1 further comprising a step of defining request criteria that will result in automatic acceptance or rejection.

13. The method of claim 1 further comprising a step of obtaining information about the end user account via the end user device.

14. The method of claim 1 further comprising a step of updating the at least one end user about the determination.

15. A system for reducing credit card fraud, the system comprising : means for receiving a request to transfer funds by means of a credit card; means for sending a short message service message over wireless communication channel to at least one end user 157018/2 device; the at least one end user device being associated in advance with the credit card; and means for determining whether to approve the request in response to an end user response to the short textual message .

16. The system of claim 15 wherein the means for determining is further capable of receiving a credit card entity response and to determine whether to accept the request in response to the end user response and to the credit card entity response.

17. The system of claim 15 wherein the means for determining are also capable of generating the request to transfer funds.

18. The system of claim 15 wherein the end user device are capable of transmitting an end user response over the wireless communication channel to the means for determining .

19. The system of claim 15 wherein the message is sent to a group of end user devices associated with the credit card.

20. The system of claim 15 wherein the determining means are operable not to approve the transaction if it did not receive a response within a predefined period.

21. The system of claim 15 wherein the determining means are operable not to approve the transaction if it receives a disapproval message. 157018/2

22. The system of claim 15 wherein an end user device is operable to transmit a short response message.

23. The system of claim 15 wherein the end user device is configured such as that few end user operations will result in a transmission of a response message.

24. The system of claim 15 further comprising means for generating a record of the requests and determinations.

25. The system of claim 15 further comprising means for obtaining information about the end user account via the end user device.

26. The system 15 of claim further comprising means for updating the at least one end user about the determination .

27. The system of claim 15 further comprising updating an end user about the determination whereas said updating comprises transmitting an image of an owner of the credit card.

28. The system of claim 15 further comprising updating an end user about the determination whereas said updating comprises transmitting an image of an end user that is allowed to use the credit card.

29. The method of claim 1 further comprising updating an end user about the determination whereas said updating comprises transmitting an image of an owner of the credit card.

30. The method of claim 15 further comprising updating an end user about the determination whereas said updating 157018/2 comprises transmitting an image of an end user that is allowed to use the credit card.

31. A method for reducing credit card fraud comprising the steps of: detecting a request to transfer funds by means of a credit card; sending a message over wireless communication channel to at least one end" user"clevice the" at" least one end user device being associated in advance with the credit card; determining whether to approve the request in view of an end user response; and updating an end user about the determination whereas said updating comprises transmitting an image of an end user that is allowed to use the credit card

32. The method of claim 31 wherein the image is the image of the credit card owner.