Authentication and security for mobile-device transactions
A method including collecting transactional information from a mobile application on the mobile device. The mobile device can be used by a user to initiate an activity at a risk moment. The method also can include aggregating a set of risk signals. The method additionally can include obtaining a first set of risk rules for a model specific to the activity requested by the user. Each risk rule of the first set of risk rules can define weights when the risk rule is triggered based on one or more risk signals of the set of risk signals. The method further can include executing a risk engine using the first set of risk rules for the model and using the set of risk signals to generate a risk score. The risk score can be based on the weights of triggered risk rules of the first set of risk rules. The method additionally can include generating a disposition based on a comparison of the risk score to one or more predefined thresholds scores for the model. Other embodiments of related systems and methods are disclosed.
1. A system, for determining a disposition of a request of an activity initiated by a mobile device of a user at a risk moment, wherein the mobile device comprises a mobile payment application and a device data collector, the system comprising:
an application server;
an authentication system; and
a risk determination system;
wherein the application server in data communication with the mobile application on the mobile device, the application server comprising an application server processor and an application server memory storing application server instructions that, when executed by the application server processor, cause the application server processor to perform:
receiving transactional information from the mobile payment application on the mobile device, wherein the transaction information comprises information of the request from the mobile device at the risk moment;
generating first risk data based on the transactional information from the mobile payment application;
sending the received transaction information to the authentication system;
wherein the authentication system in data communication with the application server and the mobile device, the authentication system comprising an authentication system processor and an authentication system memory storing authentication system instructions that, when executed by the authentication system processor, cause the authentication system processor to perform:
activating the device data collector on the mobile device, wherein the activating the device data collector further comprises receiving device data from the device data collector of the mobile device;
authenticating the user, wherein the authenticating comprises a multi-factor authentication of the user via the mobile device;
generating second risk data based on the device data from the mobile device and the multi-factor authentication;
wherein the risk determination system in data communication with the application server and the authentication system, the risk determination system comprising a risk determination system processor and a risk determination system memory storing a risk engine and risk determination system instructions that, when executed by the risk determination system processor, cause the risk determination system processor to perform:
receiving the first risk data from the application server and the second risk data from the authentication system;
aggregating a set of risk data based on the first risk data and the second risk data;
obtaining a first set of risk rules associated with a model of the activity based on the aggregated set of risk data, wherein each risk rule of the first set of risk rules is associated with weights;
generating a risk score by executing a risk engine using the obtained first set of risk rules and the aggregated set of risk data, wherein the generating the risk score further comprises summing the weights associated with the obtained first set of risk rules;
comparing the generated risk score to one or more threshold scores of the model;
generating the disposition based on the comparison;
sending the disposition to the application server;
wherein the application server memory stores additional application server instructions, that when executed by the application server processor, further cause the application server processor to perform:
receiving the disposition from the risk determination system; and
providing an approval or a rejection of the activity based on the disposition.
2. The system of claim 1 , wherein: the application server memory stores additional application server instructions, when executed by the application server processor, further cause the application server processor to perform:
performing, based on the received disposition, an outsort activity prior to providing the approval of the activity.
3. The system of claim 1 , wherein the application server memory stores additional application server instructions, when executed by the application server processor, further cause the application server processor to perform:
performing, based on the received disposition, an outsort activity prior to providing the rejection of the activity.
4. The system of claim 1 , wherein the risk determination system memory stores additional the risk determination system instructions, when executed by the risk determination system processor, further cause the risk determination system processor to perform:
storing a plurality of models, wherein each of the plurality of models is associated with a different activity wherein the plurality of models comprise the model associated with the activity requested by the user.
5. The system of claim 4 , wherein:
each of the plurality of models is non-probabilistic.
6. The system of claim 4 , wherein:
each of the plurality of models comprises a set of risk rules each comprising a weight; and
each of the plurality of models comprises a predefined outsort threshold score and a predefined decline threshold score that is different from the predefined outsort threshold score.
7. The system of claim 6 , wherein:
each of the plurality of models is tunable to allow adjustment of the set of risk rules applicable to the model, the weights for the set of risk rules, the predefined outsort threshold score, and the predefined decline threshold score.
8. The system of claim 1 , wherein:
a first portion of the first set of risk rules are stateless rules based on current data; and
a second portion of the first set of risk rules are based at least in part on historical data.
9. The system of claim 1 , wherein, before the risk determination system executes the risk engine, the activating the device data collector on the mobile device further comprises activating the device data collector on the mobile device to run system-level checks via system rules.
10. The system of claim 1 , wherein:
the multi-factor authentication is based at least in part on: (a) the device data, and (b) information obtained from one or more calls to at least one of: (i) a mobile network operator for the mobile device, or (ii) a card network that handles transactions for a card that is associated with the activity.
11. A method, for determining a disposition of a request of an activity initiated by a mobile device of a user at a risk moment, wherein the mobile device comprises a mobile payment application and a device data collector, the method comprising:
receiving, by an application server, transactional information from the mobile payment application on the mobile device, wherein the transaction information comprises information of the request from the mobile device at the risk moment;
generating, by the application server, first risk data based on the transactional information from the mobile payment application;
sending, by the application server, the received transaction information to an authentication system;
activating, by the authentication system, the device data collector on the mobile device, wherein the activating the device data collector further comprises receiving device data from the device data collector of the mobile device;
authenticating, by the authentication system, the user, wherein the authenticating comprises a multi-factor authentication of the user via the mobile device;
generating, by the authentication system, second risk data based on the device data from the mobile device and the multi-factor authentication;
receiving, by a risk determination system, the first risk data from the application server and the second risk data from the authentication system;
aggregating, by the risk determination system, a set of risk data based on the first risk data and the second risk data;
obtaining, by the risk determination system, a first set of risk rules associated with a model of the activity based on the aggregated set of risk data, wherein each risk rule of the first set of risk rules is associated with weight;
generating, by the risk determination system, a risk score by executing a risk engine using the obtained first set of risk rules and the aggregated set of risk data, wherein the generating the risk score further comprises summing the weights associated with the obtained first set of risk rules;
comparing, by the risk determination system, the generated risk score to one or more threshold scores of the model;
generating, by the risk determination system, the disposition based on the comparison;
sending, by the risk determination system, the disposition to the application server;
receiving, by the application server, the disposition from the risk determination system; and
providing, by the application server, an approval or a rejection of the activity based on the disposition.
12. The method of claim 11 , wherein the receiving the disposition from the risk determination system further comprises performing, by the application server, based on the received disposition, an outsort activity prior to providing the approval of the activity.
13. The method of claim 11 , wherein the receiving the disposition from the risk determination system further comprises performing, by the application server, based on the received disposition, an outsort activity prior to providing the rejection of the activity.
14. The method of claim 11 further comprising:
storing, by the risk determination system, a plurality of models, wherein each of the plurality of models is associated with a different activity, wherein the plurality of models comprise the model associated with the activity requested by the user.
15. The method of claim 14 , wherein:
each of the plurality of models is non-probabilistic.
16. The method of claim 14 , wherein:
each of the plurality of models comprises a set of risk rules each comprising a weight; and
each of the plurality of models comprises a predefined outsort threshold score and a predefined decline threshold score that is different from the predefined outsort threshold score.
17. The method of claim 16 , wherein:
each of the plurality of models is tunable to allow adjustment of the set of risk rules applicable to the model, the weights for the set of risk rules, the predefined outsort threshold score, and the predefined decline threshold score.
18. The method of claim 11 , wherein:
a first portion of the first set of risk rules are stateless rules based on current data; and
a second portion of the first set of risk rules are based at least in part on historical data.
19. The method of claim 11 , wherein, before the risk determination system executes the risk engine, the activating the device data collector on the mobile device further comprises activating, by the authentication system, the device data collector on the mobile device to run system-level checks via system rules.
20. The method of claim 11 , wherein:
the multi-factor authentication is based at least in part on: (a) the device data, and (b) information obtained from one or more calls to at least one of: (i) a mobile network operator for the mobile device, or (ii) a card network that handles transactions for a card that is associated with the activity.