Patent ID: 11875349
Assignee: MASTERCARD INTERNATIONAL INCORPORATED
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 10:
11. At least one non-transitory computer-readable storage media having computer-executable instructions embodied thereon for authenticating an online user on behalf of an access control server (ACS), wherein when executed by at least one processor, the computer-executable instructions cause the at least one processor to:
receive an authentication request message, the authentication request message including authentication data;
extract the authentication data from the authentication request message;
generate, based at least in part on the extracted authentication data, risk-based authentication (RBA) result data including a risk score, a risk analysis, and at least one reason code, the RBA result data generated by an RBA engine by performing RBA using the extracted authentication data and a database of historical transaction data for all transactions previously processed by a payment processing network, the RBA engine operated by the payment processing network and having access to the historical data for all transactions previously processed by the payment processing network, and the ACS only having access to transaction data for a smaller number of transactions than all transactions previously processed by the payment processing network, wherein the computer-executable instructions cause the at least one processor to generate the RBA result data by:
establishing a plurality of reason code categories, each reason code category including a plurality of anchors, wherein the plurality of reason code categories include at least a cardholder category, a merchant category, and an environment category;
activating, based on a comparison of the extracted authentication data to at least one long term variable stored in the database, a plurality of activated anchors, wherein at least one of the plurality of activated anchors is in the cardholder category or the merchant category; and
generating the at least one reason code based on the connections between the plurality of activated anchors by:
when at least one anchor in the cardholder category is activated, generating a positive reason code indicating a low risk of fraud;
when at least one anchor in the cardholder category is activated and at least one anchor in the merchant category is activated, generating a stronger positive reason code indicating a lower risk of fraud; and
when at least one anchor in the cardholder category is activated, at least one anchor in the merchant category is activated, and at least one anchor in the environment category is activated, generating an even stronger positive reason code indicating an even lower risk of fraud;

embed the RBA result data into the authentication request message to generate an enhanced authentication request message, wherein to embed the RBA result data, the instructions cause the at least one processor to append the risk score, the risk analysis, and the at least one reason code to the authentication request message as an extensible markup language (XML) extension such that the enhanced authentication request message includes the risk score, the risk analysis, and the at least one reason code generated by the RBA engine; and
transmit the enhanced authentication request message to the ACS to enable the ACS to make an authentication decision based on the RBA result data.