System and method for caller verification
A caller is verified by receiving a unique identifier from the caller, identifying an account based at least in part on the unique identifier, sending a soft token verification request to an identity provider to send a soft token push notification to a device associated with an owner of the account, and receiving a result of the soft token push notification from the identity provider. Upon the result of the soft token push notification being successful, the caller is classified as verified for the account.
1 . A computer-implemented method for verifying a caller attempting to access a resource, the method comprising:
registering, with a third party identity-providing entity, a device associated with an owner of an account, said registering including registering a soft token as a factor of authentication for said account;
receiving, at a call receiver device, a call from the caller;
receiving, at the call receiver device, a request for access to said account from the caller, said request for access comprising a unique identifier;
accessing, by a user of the call receiver device, said user of the call receiver device being distinct from said caller, a caller verification entity via a web interface on said call receiver device, wherein hosting for said web interface is provided by a cloud provider in one or more geographically localized containers, said cloud provider providing access restrictions to said web interface, said accessing comprising:
providing said user of said call receiver device with an access token;
transmitting, by said call receiver device, a Hypertext Transfer Protocol Secure (HTTPS) request for access to said caller verification entity via a representational state transfer (REST) application programming interface (API);
confirming, by said cloud provider, that said user of said call receiver device complies with said access restrictions for said web interface;
confirming, by said cloud provider, that said call receiver device complies with said access restrictions for said web interface;
authenticating, by the caller verification entity, said user of said call receiver device based on said access token provided to said user of said call receiver device;
receiving, at the caller verification entity, said unique identifier from said call receiver device;
identifying, by said caller verification entity, an account based on the unique identifier, said identifying comprising:
transmitting, by said caller verification entity, said unique identifier to said third party identity-providing entity via said REST API;
identifying, by said third party identity-providing entity, said account based on the unique identifier;
displaying, on a graphical user interface of said caller verification entity, a plurality of authentication options for said account, said plurality of authentication options including at least a push, a time-based one-time password (TOTP), and an authenticator application;
selecting, by said user of said call receiver device, one of said plurality of authentication options;
sending, by said caller verification entity via said REST API, a soft token transmission request to said third party identity-providing entity;
responsive to receiving said soft token transmission request, transmitting, by said third party identity-providing entity via said REST API, a soft token push notification to said registered device associated with said owner of said account based on said registered soft token for said account, wherein said soft token push notification includes said selected authentication option;
receiving, at said caller verification entity, a result of said soft token push notification from said third party identity-providing entity; and
upon the result of the soft token push notification being successful, classifying the caller as verified at said caller verification entity;
granting access to said resource upon classifying the caller as verified at said caller verification entity; and
logging, by said caller verification entity, all verification events associated with said request for access to said account from said caller.
2 . The computer-implemented method of claim 1 , wherein serving the web interface is over Hypertext Transfer Protocol Secure (HTTPS).
3 . The computer-implemented method of claim 1 , further comprising displaying the result on the web interface at said caller verification entity.
4 . The computer-implemented method of claim 1 , wherein the unique identifier includes one or more of an email address, a phone number, or an account number.
5 . The computer-implemented method of claim 1 , further comprising upon the result being unsuccessful, sending a notification of the response to a fraud department.
6 . A computer system comprising:
a processor; and
a non-transitory computer-readable storage medium having stored thereon computer-executable instructions that, when executed by the processor, cause the processor to:
register, with a third party identity-providing entity, a device associated with an owner of an account, said registering including registering a soft token as a factor of authentication for said account;
receive, at a call receiver device, a call from a caller;
receive, at the call receiver device, a request for access to said account from the caller, said request for access comprising a unique identifier;
access, by a user of the call receiver device, said user of said call receiver device being distinct from said caller, a caller verification entity via a web interface on said call receiver device, wherein hosting for said web interface is provided by a cloud provider in one or more geographically localized containers, said cloud provider providing access restrictions to said web interface, said accessing comprising:
providing said user of said call receiver device with an access token;
transmitting, by said call receiver device, a hypertext transfer protocol secure (HTTPS) request for access to said caller verification entity via a representational state transfer (REST) application programming interface (API);
confirming, by said cloud provider, that said user of said call receiver device complies with said access restrictions for said web interface;
confirming, by said cloud provider, that said call receiver device complies with said access restrictions for said web interface;
authenticating, by the caller verification entity, said user of said call receiver device based on said access token provided to said user of said call receiver device;
receive, at the caller verification entity, said unique identifier from said call receiver device;
identify, by said caller verification entity, an account based on the unique identifier, said identifying comprising:
transmitting, by said caller verification entity, said unique identifier to said third party identity-providing entity via said REST API;
identifying, by said third party identity-providing entity, said account based on the unique identifier;
display, on a graphical user interface of said caller verification entity, a plurality of authentication options for said account, said plurality of authentication options including at least a push, a time-based one-time password (TOTP), and an authenticator application;
select, by said user of said call receiver device, one of said plurality of authentication options;
send, by said caller verification entity via said REST API, a soft token transmission request to said third party identity-providing entity;
responsive to receiving said soft token transmission request, transmitting, by said third party identity-providing entity via said REST API, a soft token push notification to said registered device associated with said owner of said account based on said registered soft token for said account, wherein said soft token push notification includes said selected authentication option;
receive, at said caller verification entity, a result of said soft token push notification from said third party identity-providing entity;
upon the result of the soft token push notification being successful, classify the caller as verified at said caller verification entity;
grant access to said resource upon classifying the caller as verified at said caller verification entity; and
log, by said caller verification entity, all verification events associated with said request for access to said account from said caller.
7 . A non-transitory computer-readable storage medium having stored thereon computer-executable instructions that, when executed by one or more processors, cause the one or more processors to:
register, with a third party identity-providing entity, a device associated with an owner of an account, said registering including registering a soft token as a factor of authentication for said account;
receive, at a call receiver device, a call from a caller;
receive, at the call receiver device, a request for access to said account from the caller, said request for access comprising a unique identifier;
access, by a user of the call receiver device, said user of said call receiver device being distinct from said caller, a caller verification entity via a web interface on said call receiver device, wherein hosting for said web interface is provided by a cloud provider in one or more geographically localized containers, said cloud provider providing access restrictions to said web interface, said accessing comprising:
providing said user of said call receiver device with an access token;
transmitting, by said call receiver device, a hypertext transfer protocol secure (HTTPS) request for access to said caller verification entity via a representational state transfer (REST) application programming interface (API);
confirming, by said cloud provider, that said user of said call receiver device complies with said access restrictions for said web interface;
confirming, by said cloud provider, that said call receiver device complies with said access restrictions for said web interface;
authenticating, by the caller verification entity, said user of said call receiver device based on said access token provided to said user of said call receiver device;
receive, at the caller verification entity, said unique identifier from said call receiver device;
identify, by said caller verification entity, an account based on the unique identifier, said identifying comprising:
transmitting, by said caller verification entity, said unique identifier to said third party identity-providing entity via said REST API;
identifying, by said third party identity-providing entity, said account based on the unique identifier;
display, on a graphical user interface of said caller verification entity, a plurality of authentication options for said account, said plurality of authentication options including at least a push, a time-based one-time password (TOTP), and an authenticator application;
select, by said user of said call receiver device, one of said plurality of authentication options;
send, by said caller verification entity via said REST API, a soft token transmission request to said third party identity-providing entity;
responsive to receiving said soft token transmission request, transmit, by said third party identity-providing entity via said REST API, a soft token push notification to said registered device associated with said owner of said account based on said registered soft token for said account, wherein said soft token push notification includes said selected authentication option;
receive, at said caller verification entity, a result of said soft token push notification from said third party identity-providing entity; and
upon the result of the soft token push notification being successful, classify the caller as verified at said caller verification entity;
grant access to said resource upon classifying the caller as verified at said caller verification entity; and
log, by said caller verification entity, all verification events associated with said request for access to said account from said caller.
8 . The computer-implemented method of claim 1 , wherein said soft token push notification is customized to depict a brand associated with said resource while displayed on said device associated with said owner of said account.
9 . The computer-implemented method of claim 1 , further comprising, after sending said soft token transmission request, starting a timer.
10 . The computer-implemented method of claim 9 , wherein when said timer reaches a predetermined time limit without receiving said result of said soft token push notification, classifying said caller as unauthorized at said caller verification entity.
11 . The computer-implemented method of claim 1 , wherein said soft token push notification includes a geographical location of said caller verification entity.
12 . The method of claim 1 , further comprising automatically scaling up one of said geographically localized containers in response to a traffic spike.
13 . The method of claim 1 , wherein said access restrictions for said web interface comprise web application firewall rules targeting specific access to network segments.
14 . The method of claim 1 , wherein said access restrictions comprise restricting access to said web interface to only designated users from within an authorized network.