Systems and methods for cross coupling risk analytics and one-time-passcodes
Example embodiments provide systems and methods for validating an action using a physical token, such as a near-field-communications (NFC)-capable chip. A server may receive a request to perform the action, and may require validation from the holder of the physical token. The holder of the physical token may log into an application using their login credentials, providing a first tier of authentication. The holder may then scan the physical token with a reader on their mobile device, which provides a second tier of authentication. The scan may reveal a value for a counter on the physical token, which may be compared to a counter at the server in order to validate that the physical token has been used as expected. If the server deems it appropriate, a third (or further) tier may be required, such as scanning a photographic identification of the holder.
1 . A computer-implemented method, comprising:
receiving, by a server system, a request from a computer device, the request associated with a transaction and a user account;
identifying, by the server system, a validation action based on a risk analysis performed on information associated with the request;
sending, by the server system, a validation request to a computing device associated with the user account;
receiving, by the server system, a validation response from the computing device based on the validation request, the validation response comprising a cryptogram and a counter value from a contactless card;
identifying, by the server system, a counter value range based on a risk tier associated with the transaction, the counter value range defining an acceptable range of variance between the counter value received from the contactless card and a stored counter value on the server, and the counter value range for a lower risk tier is larger than the counter value range for a higher risk tier;
determining, by the server system, the counter value from the contactless card is within the counter value range for the transaction; and
approving, by the server system, occurrence of the transaction.
2 . The computer-implemented method of claim 1 , wherein the risk analysis is based on an amount of the transaction, a location of the transaction, a purchase history of the user, or a combination thereof.
3 . The computer-implemented method of claim 1 , wherein the risk analysis is based on an overall risk environment including one or more factors.
4 . The computer-implemented method of claim 3 , wherein the one or more factors comprise whether an issuing back is under a fraud attack, whether other banks have reported a recent increase in fraud), whether the transaction is typical of the user's activity based on price, location, or both.
5 . The computer-implemented method of claim 1 , comprising:
decrypting at least a portion of the validation response prior to determining the counter value is within the counter value range; and
validating the contactless card based on the token identifier in the validation response matching a stored token identifier.
6 . The computer-implemented method of claim 5 , comprising:
retrieving a user record corresponding to a user account, the user record comprising the stored token identifier and the stored counter value; and
comparing the counter value to the stored counter value to determine the counter value is within the counter value range;
wherein the counter value range is determined dynamically based on historical data associated with the user account.
7 . The computer-implemented method of claim 1 , wherein the cryptogram is generated by the contactless card utilizing a session key.
8 . A non-transitory computer-readable storage medium, the computer-readable storage medium including instructions that when executed by a computer, cause the computer to:
receive a request from a computer device, the request associated with a transaction and a user account;
identify a validation action based on a risk analysis performed on information associated with the request;
send a validation request to a computing device associated with the user account;
receive a validation response from the computing device based on the validation request, the validation response comprising a cryptogram and a counter value from a contactless card;
identify a counter value range based on a risk tier associated with the transaction, the counter value range defining an acceptable range of variance between the counter value received from the contactless card and a stored counter value on the computer, and the counter value range for a lower risk tier is larger than the counter value range for a higher risk tier;
determine the counter value from the contactless card is within the counter value range for the transaction; and
approve occurrence of the transaction.
9 . The computer-readable storage medium of claim 8 , wherein the risk analysis is based on an amount of the transaction, a location of the transaction, a purchase history of the user, or a combination thereof.
10 . The computer-readable storage medium of claim 8 , wherein the risk analysis is based on an overall risk environment including one or more factors.
11 . The computer-readable storage medium of claim 10 , wherein the one or more factors comprise whether an issuing back is under a fraud attack, whether other banks have reported a recent increase in fraud), whether the transaction is typical of the user's activity based on price, location, or both.
12 . The computer-readable storage medium of claim 8 , comprising the computer to:
decrypt at least a portion of the validation response prior to determining the counter value is within the counter value range; and
validate the contactless card based on the token identifier in the validation response matching a stored token identifier.
13 . The computer-readable storage medium of claim 12 , comprising the computer to:
retrieve a user record corresponding to a user account, the user record comprising the stored token identifier and the stored counter value; and
compare the counter value to the stored counter value to determine the counter value is within the counter value range; and
wherein the counter value range is determined dynamically based on historical data associated with the user account.
14 . The computer-readable storage medium of claim 8 , wherein the cryptogram is generated by the contactless card utilize a session key.
15 . A computing apparatus comprising:
a processor; and
a memory storing instructions that, when executed by the processor, configure the processor to:
receive a request from a computer device, the request associated with a transaction and a user account;
identify, by the server system, a validation action based on a risk analysis performed on information associated with the request;
send a validation request to a computing device associated with the user account;
receive a validation response from the computing device based on the validation request, the validation response comprising a cryptogram and a counter value from a contactless card;
identify a counter value range based on a risk tier associated with the transaction, the counter value range defining an acceptable range of variance between the counter value received from the contactless card and a stored counter value on the server, and the counter value range for a lower risk tier is larger than the counter value range for a higher risk tier;
determine whether the counter value from the contactless card is within the counter value range for the transaction;
in response to the counter value from the contactless card not being in range, deny the transaction; and
in response to the counter value from the contactless card being in range, approve occurrence of the transaction.
16 . The computing apparatus of claim 15 , wherein the risk analysis is based on an amount of the transaction, a location of the transaction, a purchase history of the user, or a combination thereof.
17 . The computing apparatus of claim 15 , wherein the risk analysis is based on an overall risk environment include one or more factors.
18 . The computing apparatus of claim 17 , wherein the one or more factors comprise whether an issuing back is under a fraud attack, whether other banks have reported a recent increase in fraud), whether the transaction is typical of the user's activity based on price, location, or both.
19 . The computing apparatus of claim 15 , comprising the processor:
decrypt at least a portion of the validation response prior to determining the counter value is within the counter value range; and
validate the contactless card based on the token identifier in the validation response matching a stored token identifier.
20 . The computing apparatus of claim 19 , comprising the processor to:
retrieve a user record corresponding to a user account, the user record comprising the stored token identifier and a stored counter value; and
compare the counter value to the stored counter value to determine the counter value is within the counter value range; and
wherein the counter value range is determined dynamically based on historical data associated with the user account.