Transaction authentication using network

1. A method comprising:

receiving, by a server computer from an access device, a first authorization request message generated by the access device for a transaction between a merchant and a consumer, the first authorization request message including first dynamic data generated by a portable consumer device used by the consumer;

authenticating, by the server computer, the portable consumer device by using the first dynamic data received in the first authorization request message;

determining, by the server computer, that a series of features relating to the transaction, the consumer, and the merchant exceed a predetermined range;

retrieving, by the server computer, a challenge message from a database, wherein the challenge message is dynamic, and wherein the challenge message is a challenge question;

sending, by the server computer, the challenge message comprising the challenge question to the access device in a first authorization response message;

receiving, by the server computer from the access device, a second authorization request message comprising an account number associated with the portable consumer device, and a challenge response from the consumer;

validating, by the server computer, the received challenge response by comparing the challenge response to information stored in the database; and

in response to validating the received challenge response, initiating approval of the transaction.

2. The method of claim 1 wherein initiating approval of the transaction comprises transmitting the second authorization request message to an issuer computer associated with the portable consumer device, and wherein the portable consumer device is a card.

3. The method of claim 2 wherein the method further comprises:

transmitting, by the server computer, the challenge response to the issuer computer as part of the second authorization request message.

4. The method of claim 3 further comprising:

linking, by the server computer, the second authorization request message to the first authorization request message for the transaction by a transaction code.

5. The method of claim 1 wherein the first dynamic data is generated from one or more of transaction-specific data and consumer-specific data that include one or more of: a terminal ID, a telephone number, a SIM card number, the account number, a service code, an expiration date, and/or data regarding a prior transaction.

6. The method of claim 1 further comprising:

performing, by the server computer, additional authentication processing when a transaction amount for the transaction is greater than a predetermined dollar limit.

7. The method of claim 1 further comprising:

performing, by the server computer, additional authentication processing for the transaction based on an analysis of a geographic location of the transaction.

8. The method of claim 1 wherein the challenge question requests data regarding a physical location of the portable consumer device.

9. The method of claim 1 , wherein the method further comprises:

generating, by the server computer, the first authorization response message including the challenge message, and wherein sending the challenge message to the access deivce comprises

transmitting, by the server computer, the first authorization response message with the challenge message to the access device.

10. The method of claim 1 wherein the challenge message is dynamically generated, by the server computer, using real-time information regarding the consumer and a transaction history of the consumer stored in the database.

11. The method of claim 1 further comprising:

performing, by the server computer, a real-time risk analysis on the transaction.

12. The method of claim 1 wherein the portable consumer device is a mobile phone.

13. The method of claim 1 further comprising:

retrieving, by the server computer, data for the challenge message from an external server computer; and

storing, by the server computer, the data for the challenge message in the database.

14. The method of claim 1 further comprising:

determining, by the server computer, a merchant category associated with the merchant; and

determining, by the server computer, a number of challenge messages to retrieve for the transaction based on parameters provided by the consumer for the merchant category.

15. The method of claim 1 further comprising:

receiving, by the server computer from the portable consumer device, a geographic location for the portable consumer device.

16. The method of claim 6 wherein performing additional authentication processing for the transaction further comprises:

sending, by the server computer, a notification message for the transaction to the portable consumer device.

17. A server computer comprising:

a non-transitory computer readable medium having instructions stored thereon that, when executed, cause a computer to perform steps including:

receiving, by the server computer from an access device, a first authorization request message generated by the access device for a transaction between a merchant and a consumer, the first authorization request message including first dynamic data generated by a portable consumer device used by the consumer;

authenticating, by the server computer, the portable consumer device by using the first dynamic data received in the first authorization request message, wherein the first dynamic data is different for each transaction and is generated from one or more of transaction-specific data and/or consumer-specific data;

determining, by the server computer, that a series of features relating to the transaction, the consumer, and the merchant exceed a predetermined range;

retrieving, by the server computer, a challenge message from a database, wherein the challenge message is dynamic, and wherein the challenge message is a challenge question;

sending, by the server computer, the challenge message to the access device in a first authorization response message;

receiving, by the server computer from the access device, a second authorization request message comprising an account number associated with the portable consumer device, and a challenge response from the consumer;

validating, by the server computer, the received challenge response by comparing the challenge response to information stored in the database; and

in response to validating the received challenge response, initiating approval of the transaction.

18. A system comprising:

a server computer comprising

a computer readable medium having instructions stored thereon that, when executed, cause a computer to perform steps including

receiving, from an access device, a first authorization request message generated by the access device for a transaction between a merchant and a consumer, the first authorization request message including first dynamic data generated by a portable consumer device used by the consumer;

authenticating the portable consumer device by using the first dynamic data received in the first authorization request message;

determining that a series of features relating to the transaction, the consumer, and the merchant exceed a predetermined range;

retrieving a challenge message from a database, wherein the challenge message is dynamic, and wherein the challenge message is a challenge question;

sending the challenge message comprising the challenge question to the access device in a first authorization response message;

receiving, from the access device, a second authorization request message comprising an account number associated with the portable consumer device, and a challenge response from the consumer;

validating the received challenge response by comparing the challenge response to information stored in the database; and

in response to validating the received challenge response, initiating approval of the transaction; and

the access device in communication with the server computer.