Secure transaction card using biometrical validation
A validation scheme for use with a transaction card such as a calling card, et cetera, using personalized biometric profile data that is inherently coupled to the card owner/user. A configuration process is used for populating a profile database with sample voice or other biometric responses elicited from the owner/user in response to a plurality of questions relating to information uniquely linked to the user such as, e.g., name, age, hobbies, et cetera, or biometric responses such as fingerprints, retinal scans, and palm prints, or implanted ID chips. When a transaction is attempted using the transaction card, a determination is made if a voice profile validation is required for authentication. If so, a question from the plurality of questions used in the configuration process is randomly selected and directed to the user for a response. Access is provided only if a match between the response and corresponding sample is found. In a passive mode, the validation scheme may be utilized as an auxiliary fraud prevention scheme in addition to existing authentication systems.
1. A computing device implemented method for validating a user, comprising:
configuring a biometric profile to include a plurality of biometric sample responses and a plurality of non-biometric sample responses to a respective plurality of questions associated with a user;
configuring the biometric profile to include a plurality of voiceprints corresponding to the plurality of biometric sample responses;
storing an authentic password associated with the user;
receiving an attempt to perform a transaction from a party purporting to be the user;
receiving a password attempt from the party;
determining whether biometric validation is necessary for authorizing the transaction;
wherein determining whether biometric validation is necessary for authorizing the transaction further comprises: determining whether a fraudulent transaction is detected; and
performing the biometric validation, when it is determined that biometric validation is necessary for authorizing the transaction,
wherein the biometric validation comprises:
interrogating the party based on a question randomly selected from the plurality of questions;
receiving a biometric or non-biometric response to the question;
comparing, when the question corresponds to a biometric sample response, a user voiceprint based on the received biometric response to a corresponding voiceprint from the plurality of voiceprints that is associated with the question;
authorizing the transaction when the user voiceprint matches the corresponding voiceprint associated with the question;
determining, when the question corresponds to a non-biometric sample response, whether the received non-biometric response matches the non-biometric sample response corresponding to the question; and
authorizing the transaction when the received non-biometric response matches the corresponding non-biometric sample response associated with the question and the user.
2. The computing device implemented method of claim 1 , wherein the biometric sample responses comprise voice responses.
3. The computing device implemented method of claim 1 , wherein the non-biometric sample responses comprise dual tone multi frequency (DTMF) sample responses.
4. The computing device implemented method of claim 3 , wherein at least one of the plurality of DTMF sample responses comprises a personal identification number (PIN) associated with the user.
5. The computing device implemented method of claim 1 , wherein the biometric profile and the transaction are associated with a transaction card.
6. The computing device implemented method of claim 5 , wherein the transaction card comprises a calling card, an automated teller machine (ATM) card, a credit card, or a debit card.
7. The computing device implemented method of claim 1 , wherein the biometric profile and the transaction are associated with a user name or account number and wherein the transaction comprises access to an account associated with the user name or account number.
8. The computing device implemented method of claim 1 , wherein determining whether biometric validation is necessary for authorizing the transaction further comprises:
determining whether the password attempt from the party matches the corresponding authentic password.
9. A computing device implemented method for authenticating a user, comprising:
receiving, from a user, a first biometric response to a first question;
generating a first voiceprint based on the first biometric response;
associating the first voiceprint with the first question;
storing the first voiceprint in a voice profile associated with the user;
receiving, from the user, a second biometric response to a second question;
generating a second voiceprint based on the second biometric response;
associating the second voiceprint with the second question;
storing the second voiceprint in the voice profile;
storing an authentic password associated with the user;
receiving an authentication request from a party alleging to be the user, wherein the authentication request includes at least a password attempt from the party;
determining whether biometric validation is necessary for authorizing the transaction; and
performing the biometric validation, when it is determined that biometric validation is necessary for authorizing the transaction,
wherein determining whether biometric validation is necessary for authorizing the transaction further comprises:
determining whether a fraudulent transaction is detected; and
wherein the biometric validation comprises:
randomly selecting the first question or the second question; interrogating the party based on the randomly selected question; receiving a biometric interrogation response from the party; and
authenticating the party as valid when the received biometric interrogation response matches either the first voiceprint or the second voiceprint corresponding to the randomly selected question.
10. The method of claim 9 , further comprising:
receiving additional biometric responses to respective additional questions;
generating additional voiceprints based on the respective additional biometric responses; and
storing the additional voiceprints in the voice profile,
wherein randomly selecting the first question or the second question further comprises:
randomly selecting a question from the first question, the second question, or the additional questions.
11. The method of claim 9 , wherein the voice profile is associated with a user name or account number.
12. The method of claim 11 , wherein receiving the authentication request from the party alleging to be the user comprises receiving the user name or account number from the party.
13. The method of claim 12 , wherein the authentication request comprises a request to access an account associated with the voice profile.
14. The method of claim 9 , further comprising:
prompting the party alleging to be the user for a personal identification number (PIN) or password;
receiving a request to bypass PIN or password entry; and
performing the interrogating upon receipt of the request to bypass PIN or password entry.
15. The method of claim 14 , wherein receiving the request to bypass PIN or password entry comprises receiving a dual tone multi frequency (DTMF) response corresponding to the request to bypass PIN or password entry.
16. An access control system, comprising:
an authentication server operatively connected to a user terminal via a network; and
a profile database operatively connected to the authentication server for storing a plurality of biometric profiles and a plurality of authentic passwords associated with a plurality of users,
wherein each biometric profile includes a plurality of biometric sample responses and a plurality of non-biometric samples responses responsive to a plurality of questions associated with a respective user,
wherein each biometric profile includes a plurality of voiceprints corresponding to the plurality of biometric sample responses, and
wherein the authentication server is configured to:
receive an attempt to perform a transaction from a party purporting to be a particular user, wherein the attempt to perform a transaction includes at least a password attempt from the party;
determine whether biometric validation is necessary for authorizing the transaction;
wherein, when determining whether biometric validation is necessary for authorizing the transaction, the authentication server is configured to: determine whether a fraudulent transaction is detected; and
perform the biometric validation, when it is determined that biometric validation is necessary for authorizing the transaction,
wherein, when performing the biometric validation, the authentication server is configured to:
retrieve the biometric profile associated with the particular user from the profile database;
randomly select a question from the plurality of questions in the biometric profile associated with the particular user;
interrogate the party based on the question;
receive a biometric or non-biometric response to the question;
compare, when the question corresponds to a biometric sample response, a user voiceprint based on the received biometric response to a corresponding voiceprint from the plurality of voiceprints that is associated with the question;
authorize the transaction when the user voiceprint matches the corresponding voiceprint associated with the question;
determine, when the question corresponds to a non-biometric sample response, whether the received non-biometric response matches the non-biometric sample response corresponding to the question; and
authorize the transaction when the received biometric or non-biometric response matches the biometric or non-biometric sample response corresponding to the question.
17. The system of claim 16 , wherein the authentication server is further configured to:
determine, when the question corresponds to a biometric sample response, whether an answer corresponding to the received biometric response correctly answers the randomly selected question; and
authorize the transaction when the user voiceprint matches the corresponding voiceprint associated with the question and the answer corresponding to the received biometric response correctly answers the randomly selected question.
18. The system of claim 16 , wherein the authentication server comprises an Automated/Audio Response Unit (ARU).
19. The system of claim 16 , wherein, when determining whether biometric validation is necessary for authorizing the transaction, the authentication server is further configured to:
determine whether the password attempt from the party matches the corresponding authentic password; or
determine whether a fraudulent transaction is detected.