Patent ID: 11861582
Assignee: VISA INTERNATIONAL SERVICE ASSOCIATION
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 16:
17. An executable software product stored on a non-transitory computer-readable medium containing program instructions that cause a processor of a computing system to perform security protection of association between a user device and a user, in response to execution of the instructions by the processor, to:
receive, from a service provider through a first communication path between the service provider and the computing system, a notification that an identifier of a user device has been activated in the user device to be associated with a user identifier and to replace an existing identifier of the user device associated with the user identifier, wherein the identifier of the user device is a hardware based network identifier including a subscriber identity module (SIM) card or a media access control (MAC) address of the user device, and the user identifier includes a phone number or an email address to identify the user to the service provider, wherein the notification is sent to the computing system to determine whether an attacker is attempting to gain control over the user identifier by transferring the user identifier to another user device under control of the attacker to cause security information related to the user to be sent to that other user device, wherein user authentication via a phone or IoT one-time password (OTP) is not allowed until the user is authenticated as a valid user;
store, in a storage device coupled to the processor, the user identifier of the user to indicate that the existing identifier of the user device associated with the user identifier has been changed;
receive, by the processor, from the user device through a second communication path between the user device and the computing system, a request for information associated with the user identifier to be sent to the user device associated with the identifier of the user device;
search the storage device to look up the user identifier;
send, to the user through a third communication path between the user and the computing system, when the user identifier is found in the storage device, a request for authentication information different from the user identifier of the user;
receive, from the user, a response message to the request for authentication information; and
authenticate the user based on the response message and a set of rules, wherein the user authentication via the third communication path protects against an attacker from attempting to use the user device from performing an account take over (ATO) of that user.