Online authentication in access transactions
Embodiments of the invention are directed to access transactions. A gate access device may interact with a payment card such as a credit card. The gate access device may generate and transmit a first authorization request message to a payment processing network computer. The first authorization request message does not include an amount for the transaction, but only contains identification information. A first authorization response message is transmitted back to the gate access device. At a later point in time, a second authorization request message containing the transaction amount is transmitted from the gate access device to the issuer, and a response is received from the issuer.
1. A method comprising:
reading, by a gate access device, an account identifier and a cryptogram from a portable consumer device associated with a user that is conducting an access transaction;
determining, a transaction amount to be associated with the access transaction;
determining, by the gate access device, that the account identifier is not on a black list or on a white list;
in response to determining that the account identifier is not on the black list or on the white list, generating, by the gate access device or an access host computer coupled to the gate access device, a first authorization request message comprising the account identifier, the cryptogram, and a first transaction amount data field, the first transaction amount data field indicating that the first authorization request message is for authentication by virtue of being empty or including a value of zero;
transmitting, by the gate access device or the access host computer, to a payment processing computer, the first authorization request message;
receiving, by the gate access device or the access host computer, from the payment processing computer, a first authorization response message comprising an authentication result, the authentication result including a fraud score;
determining, by the gate access device, that the authentication result is positive, the authentication result being positive when the fraud score is less than a threshold value;
in response to determining that the authentication result is positive, actuating, by the gate access device, a gate device such that the user can physically enter a restricted physical area;
in response to determining that the authentication result is not positive, preventing actuating the gate device such that the user cannot physically enter the restricted physical area;
generating, by the gate access device or the access host computer after actuating the gate device, a second authorization request message comprising the account identifier and a second transaction amount data field, the second transaction amount data field including the transaction amount for the access transaction;
transmitting, by the gate access device or the access host computer, to the payment processing computer, the second authorization request message comprising the account identifier and the transaction amount for the access transaction; and
receiving, by the gate access device or the access host computer, from the payment processing computer, a second authorization response message, wherein the second authorization response message indicates that the access transaction is authorized.
2. The method of claim 1 wherein the access transaction is a transit transaction, and wherein the first authorization request message passes to the payment processing computer through an acquirer computer.
3. The method of claim 1 wherein the user is allowed to enter the restricted physical area within a predetermined amount of time after reading the account identifier.
4. The method of claim 3 wherein the predetermined amount of time is 300 milliseconds, 500 milliseconds, or 1 second.
5. The method of claim 1 wherein the portable consumer device is an open-loop payment card.
6. The method of claim 1 wherein the payment processing computer does not transmit the first authorization request message to an issuer computer, and wherein the payment processing computer does not authorize the access transaction.
7. The method of claim 1 wherein the payment processing computer generates the fraud score based on transaction data for previous transactions that were conducted using the account identifier, and that were conducted at other merchants.
8. The method of claim 1 wherein the payment processing computer generates the fraud score based on transaction data for previous transactions that were conducted with the account identifier, and that were not access transactions.
9. The method of claim 1 wherein the second authorization response message is received from the payment processing computer via an acquirer computer.
10. The method of claim 1 wherein the payment processing computer is associated with a payment processing network.
11. The method of claim 1 wherein the payment processing computer processes transactions between multiple merchant computers and multiple issuer computers.
12. The method of claim 1 , wherein the access transaction is a first access transaction, and further comprising:
adding the account identifier to the white list based on the second authorization response message;
reading, by the gate access device, the account identifier from the portable consumer device for a second access transaction;
determining by the gate access device that the account identifier is on the white list;
causing the gate access device to allow the user to enter the restricted physical area based on determining the account identifier is on the white list;
generating, by the gate access device or the access host computer, a third authorization request message comprising the account identifier and a second amount for the second access transaction;
transmitting, to the payment processing computer, the third authorization request message comprising the account identifier and the second amount for the second access transaction, wherein the payment processing computer transmits the third authorization request message to an issuer computer, wherein the issuer computer authorizes the second access transaction based on the account identifier and the second amount, and wherein the issuer computer generates a third authorization response message and transmits the third authorization response message to the payment processing computer; and
receiving, from the payment processing computer, the third authorization response message, wherein the third authorization response message indicates that the second access transaction is authorized.
13. The method of claim 1 , wherein the first authorization request message is formatted as an ISO 8583 message, and wherein the second authorization request message is formatted as an ISO 8583 message.
14. The method of claim 1 , wherein the first authorization request message is not a standard authorization request message, and wherein the payment processing computer does not transmit the first authorization request message to an issuer computer because the first authorization request message is not a standard authorization request message.
15. A gate access device comprising:
a processor;
a reader coupled to the processor;
a gate device coupled to the processor; and
a non-transitory computer readable medium coupled to the processor, the non-transitory computer readable medium comprising code executable by the processor for implementing a method comprising:
reading, by the reader, an account identifier and a cryptogram from a portable consumer device associated with a user that is conducting an access transaction;
determining that the account identifier is not on a black list or on a white list;
in response to determining that the account identifier is not on the black list or on the white list, generating a first authorization request message comprising the account identifier, the cryptogram, and a first transaction amount data field, the first transaction amount data field indicating that the first authorization request message is for authentication by virtue of being empty or including a value of zero;
transmitting, to a payment processing computer, the first authorization request message;
receiving, from the payment processing computer, a first authorization response message comprising an authentication result, the authentication result including a fraud score;
determining, by the gate access device, that the authentication result is positive, the authentication result being positive when the fraud score is less than a threshold value;
in response to determining that the authentication result is positive, actuating the gate device such that the user can physically enter a restricted physical area;
generating, after actuating the gate device, a second authorization request message comprising the account identifier and a second transaction amount data field, the second transaction amount data field including an amount for the access transaction;
transmitting to the payment processing computer, the second authorization request message comprising the account identifier and the amount for the access transaction; and
receiving from the payment processing computer, a second authorization response message, wherein the second authorization response message indicates that the access transaction is authorized.
16. The gate access device of claim 15 wherein the access transaction is a transit transaction.
17. The gate access device of claim 16 wherein the reader is a contactless reader.