Online authentication in access transactions

1 . A method comprising:

before a user enters a restricted physical area:

receiving, by a payment processing computer, from a gate access device or an access host computer coupled to the gate access device, a first authorization request message for a first access transaction, the first authorization request message comprising an account identifier from a portable consumer device associated with the user, a cryptogram from the portable consumer device;

determining, by the payment processing computer, an authentication result based on the account identifier and the cryptogram;

generating, by the payment processing computer, a first authorization response message comprising the authentication result; and

transmitting, by the payment processing computer, to the gate access device or the access host computer, the first authorization response message comprising the authentication result thereby causing actuation of a gate device such that the user can physically enter the restricted physical area;

after the user enters the restricted physical area:

receiving, by the payment processing computer, from the gate access device or the access host computer coupled to the gate access device, a second authorization request message for the first access transaction, the second authorization request message comprising the account identifier;

transmitting, by the payment processing computer, to an issuer computer, the second authorization request message;

receiving, by the payment processing computer, from the issuer computer, a second authorization response message for the first access transaction indicating that the first access transaction is authorized; and

transmitting, by the payment processing computer, to the gate access device or the access host computer, the second authorization response message, wherein the gate access device adds the account identifier to a white list based on the second authorization response message, reads the account identifier from the portable consumer device for a second access transaction, determines that the account identifier is on the white list, actuates the gate device such that the user can physically enter the restricted physical area in response the account identifier being on the white list; and

receiving, by the payment processing computer, a third authorization request message comprising the account identifier and a second amount for the second access transaction; and

transmitting, by the payment processing computer, a third authorization response message, wherein the third authorization response message indicates that the second access transaction is authorized.

2 . The method of claim 1 , wherein the first authorization request message includes the account identifier for a payment account even though the first authorization request message is not processed for authorization of a payment.

3 . The method of claim 1 , wherein the first authorization request message further comprises a first transaction amount data field, the first transaction amount data field indicating that the first authorization request message is for authentication by virtue of being empty or including a value of zero, and the second authorization request message further comprises a second transaction amount data field, the second transaction amount data field including an amount for the first access transaction.

4 . The method of claim 3 , wherein determining, by the payment processing computer, to not transmit the first authorization request message to the issuer computer is based on identifying that the first authorization request message is not a standard authorization request message as indicated by the first transaction amount data field including the value of zero.

5 . The method of claim 1 , wherein the white list is a first white list, and wherein determining the authentication result comprises determining whether the account identifier is on a black list or on a second white list at the payment processing computer.

6 . The method of claim 1 , wherein determining the authentication result comprises performing a fraud analysis on the first authorization request message to generate a fraud score, wherein the authentication result includes the fraud score.

7 . The method of claim 6 , wherein the authentication result is positive when the fraud score is less than a predetermined threshold value, the fraud score is generated based on transaction data for previous transactions that were conducted using the account identifier and that were conducted at a plurality of merchants, and at least one of the previous transactions is not an access transaction.

8 . The method of claim 1 , wherein the first access transaction is a transit transaction, and wherein the restricted physical area is a transit facility.

9 . The method of claim 1 , wherein authorization processing is performed by the issuer computer for the first access transaction based on the second authorization request message and not based on the first authorization request message, the payment processing computer does not authorize the first access transaction, and determining the authentication result comprises:

validating, by the payment processing computer, the cryptogram.

10 . The method of claim 1 , wherein the second authorization request message further comprises additional information for a plurality of additional transactions bundled together for authorization processing, and wherein the second authorization response message indicates that each of the plurality of additional transactions are authorized.

11 . The method of claim 1 , wherein the second authorization request message passes through an acquirer computer, and the first authorization request message does not pass through the acquirer computer.

12 . The method of claim 1 , wherein the first authorization response message does not indicate whether the first access transaction is authorized, and the gate device is actuated based on the authentication result and not based on whether the first access transaction is authorized, and the gate device is actuated at a time when the first access transaction is not yet authorized.

13 . The method of claim 1 , further comprising:

determining, by the payment processing computer, to not transmit the first authorization request message to an issuer computer, wherein the issuer computer does not receive the first authorization request message.

14 . A method comprising:

before actuating a gate device so that a user can enter a restricted physical area:

reading, by a gate access device, an account identifier and a cryptogram from a portable consumer device associated with the user for a first access transaction;

generating, by the gate access device or an access host computer coupled to the gate access device, a first authorization request message comprising the account identifier and the cryptogram;

transmitting, by the gate access device or the access host computer, to a payment processing computer, the first authorization request message;

receiving, by the gate access device or the access host computer, from the payment processing computer, a first authorization response message comprising an authentication result; and

determining, by the gate access device or the access host computer, that the authentication result is positive;

in response to determining that the authentication result is positive, actuating, by the gate access device, the gate device such that the user can enter the restricted physical area;

after actuating the gate device so that the user can enter the restricted physical area:

generating, by the gate access device or the access host computer, a second authorization request message;

transmitting, by the gate access device or the access host computer, to the payment processing computer, the second authorization request message; and

receiving, by the gate access device or the access host computer, from the payment processing computer, a second authorization response message, wherein the second authorization response message indicates that the first access transaction is authorized;

adding the account identifier to a white list based on the second authorization response message;

reading, by the gate access device, the account identifier from the portable consumer device for a second access transaction;

determining, by the gate access device, that the account identifier is on the white list;

in response to determining that the account identifier is on the white list, actuating the gate device such that the user can physically enter the restricted physical area;

generating, by the gate access device or the access host computer, a third authorization request message comprising the account identifier and a second amount for the second access transaction;

transmitting, to the payment processing computer, the third authorization request message comprising the account identifier and the second amount for the second access transaction; and

receiving, from the payment processing computer, a third authorization response message, wherein the third authorization response message indicates that the second access transaction is authorized.

15 . The method of claim 14 , wherein the first authorization request message further comprises a first transaction amount data field, the first transaction amount data field indicating that the first authorization request message is for authentication by virtue of being empty or including a value of zero, and further comprising:

determining, by the gate access device or the access host computer coupled to the gate access device, a transaction amount to be associated with the first access transaction, wherein the second authorization request message comprises the account identifier and a second transaction amount data field, the second transaction amount data field including the transaction amount for the first access transaction.

16 . The method of claim 14 , further comprising:

determining, by the gate access device, that the account identifier is not on a black list or on the white list.

17 . The method of claim 14 , wherein the payment processing computer determines to not transmit the first authorization request message to an issuer computer based on the first authorization request message not being a standard authorization request message.

18 . The method of claim 14 , wherein the first access transaction is a transit transaction, and wherein the restricted physical area is a transit facility.

19 . A gate access device comprising:

a processor;

a reader coupled to the processor;

a gate device coupled to the processor; and

a non-transitory computer readable medium coupled to the processor, the non-transitory computer readable medium comprising code executable by the processor for implementing a method comprising:

before actuating the gate device so that a user can enter a restricted physical area:

reading, by the reader, an account identifier and a cryptogram from a portable consumer device associated with the user for a first access transaction;

generating a first authorization request message comprising the account identifier and the cryptogram;

transmitting to a payment processing computer, the first authorization request message;

receiving, from the payment processing computer, a first authorization response message comprising an authentication result; and

determining that the authentication result is positive;

in response to determining that the authentication result is positive, actuating the gate device such that the user can enter the restricted physical area;

after actuating the gate device so that the user can enter the restricted physical area:

generating a second authorization request message;

transmitting to the payment processing computer, the second authorization request message; and

receiving, from the payment processing computer, a second authorization response message, wherein the second authorization response message indicates that the first access transaction is authorized;

adding the account identifier to a white list based on the second authorization response message;

reading the account identifier from the portable consumer device for a second access transaction;

determining that the account identifier is on the white list;

in response to determining that the account identifier is on the white list, actuating the gate device such that the user can physically enter the restricted physical area;

generating a third authorization request message comprising the account identifier and a second amount for the second access transaction;

transmitting, to the payment processing computer, the third authorization request message comprising the account identifier and the second amount for the second access transaction; and

receiving, from the payment processing computer, a third authorization response message, wherein the third authorization response message indicates that the second access transaction is authorized.

20 . The gate access device of claim 19 , wherein the reader is a contactless reader.

21 . The method of claim 14 , wherein actuating the gate device such that the user can enter the restricted physical area occurs at a time when access transaction is not yet authorized.