Transaction authentication and risk analysis
View Patent ↗Aspects of the present disclosure relate to techniques for managing transactions, including receiving a first transaction request directed to an account of a first web application. Additionally, initiating, by a rate-limiting engine, a rate-limiting process in response to the first transaction request. The techniques further include obtaining a rate-limiting identifier, where the rate limiting identifier uniquely identifies the first web application, and where the rate-limiting identifier identifies an account owner. The techniques further include determining an alternate notification method exists for the account owner and sending a verification request to the account owner, where the verification request is sent using the alternate notification method. The techniques further include receiving a response to the verification request, performing a risk assessment, and adjusting a first security parameter in response to the risk assessment.
1. A computer-implemented method comprising:
receiving, from a first client entity, a first transaction request, wherein the first transaction request is directed to a target account of a first web application;
obtaining, by a rate-limiting engine, a rate-limiting identifier, wherein the rate-limiting identifier identifies the target account and an account owner associated with the target account;
initiating, by the rate-limiting engine, a rate-limiting process in response to the first transaction request being directed to the target account;
determining an alternate notification method exists for the account owner;
sending a verification request to the account owner, wherein the verification request is sent using the alternate notification method;
receiving a response to the verification request;
performing a risk assessment, wherein the risk assessment is based on the response and a set of previous risk assessments performed on the account; and
adjusting, based on feedback from the account owner, a first security parameter in response to the risk assessment, wherein the first security parameter is an amount of rate limiting.
2. The computer-implemented method of claim 1 , wherein the verification request is sent out of band from the first transaction request.
3. The computer-implemented method of claim 2 , wherein the verification request is sent to a second client entity.
4. The computer-implemented method of claim 1 , wherein the first transaction request is a rate-limiting event.
5. The computer-implemented method of claim 1 , further comprising:
receiving, from a third client entity, a second transaction request.
6. The computer-implemented method of claim 1 , wherein the account owner is a user, and wherein the first transaction request is fraudulent.
7. The computer-implemented method of claim 1 , wherein the response to the verification request is selected from the group consisting of: a positive verification, a negative verification, and no response.
8. The computer-implemented method of claim 7 , wherein the risk assessment is based on the response to the verification request.
9. The computer-implemented method of claim 1 , wherein the adjusting the first security parameter comprises locking the account.
10. The computer-implemented method of claim 1 , wherein the adjusting the first security parameter comprises adjusting the rate-limiting process.
11. A system comprising:
a processor; and
a computer-readable storage medium communicatively coupled to the processor and storing program instructions which, when executed by the processor, are configured to cause the processor to perform a method comprising:
receiving, from a first client entity, a first transaction request, wherein the first transaction request is directed to a target account of a first web application;
obtaining, by a rate-limiting engine, a rate-limiting identifier, wherein the rate-limiting identifier identifies the target account and an account owner associated with the target account;
initiating, by the rate-limiting engine, a rate-limiting process in response to the first transaction request being directed to the target account;
determining an alternate notification method exists for the account owner;
sending a verification request to the account owner, wherein the verification request is sent using the alternate notification method;
receiving a response to the verification request;
performing a risk assessment, wherein the risk assessment is based on the response and a set of previous risk assessments performed on the account; and
adjusting, based on feedback from the account owner, a first security parameter in response to the risk assessment, wherein the first security parameter is an amount of rate limiting.
12. The system of claim 11 , wherein the verification request is sent out of band from the first transaction request.
13. The system of claim 12 , wherein the verification request is sent to a second client entity.
14. The system of claim 11 , wherein the first transaction request is a rate-limiting event.
15. The system of claim 11 , wherein the program instructions are further configured to cause the processor to perform operations further comprising:
receiving, from a third client entity, a second transaction request.
16. A computer-implemented method for preventing fraudulent transactions, the method comprising:
implementing an identity aware rate limiting system on an account, wherein the account is associated with a user;
determining, by a rate-limiting engine, a transaction request is potentially fraudulent, wherein the transaction request is directed to the account;
identifying, based on a rate-limiting identifier obtained from the identity aware rate limiting system, the user;
notifying the user of the potentially fraudulent transaction request;
requesting a response from the user, wherein the response comprises an indication that the user is aware of the transaction request;
performing, in response to the response, a risk assessment, wherein the risk assessment is based on the response and a set of previous risk assessments performed on the account; and
adjusting, based on the response, a first security parameter in response to the risk assessment, wherein the first security parameter is an amount of rate limiting.
17. The computer-implemented method of claim 16 , wherein the notifying and the request are sent out of band from the transaction request.
18. The computer-implemented method of claim 16 , wherein the response indicates that the user is aware of the transaction request, the method further comprising:
processing the transaction request.
19. The computer-implemented method of claim 16 , wherein the response indicates that the user is not aware of the transaction request, the method further comprising:
blocking the transaction request.