Abstract: Systems and methods for multi-factor authentication are based on validation of an inherence factor and a possession factor obtained in a “frictionless” or almost frictionless manner. A method conducted at a software application executing on a user device associated with a user and connected to a server computer, includes obtaining signing or encryption of a set of data elements using a cryptographic key securely stored for exclusive use by the software application and transmitting the signed or encrypted data elements to the server computer. The method includes transmitting, to the server computer, a payload including contextual data which includes behavioural data collected via one or more contextual data sources. The signed data elements represent a possession factor and the payload including contextual data represents an inherence factor for validation and multi-factor authentication by the server computer.

Abstract: A system and method for maintaining a fraud risk profile in a fraud risk engine are described. In a method conducted at a remote server, a payload from a secure mobile application executing on a user mobile device associated with a user is received. The payload including contextual data having been obtained by the secure mobile application and a trust indicator linked to the contextual data. Validity of the contextual data is confirmed by verifying the trust indicator. If the trust indicator is verified, the contextual data is input into a fraud risk engine as truth data. The fraud risk engine maintains a fraud risk profile associated with the user. The fraud risk profile is usable by the fraud risk engine in evaluating a fraud risk associated with an activity associated with the user.

Abstract: Systems and methods for multi-factor authentication are based on validation of an inherence factor and a possession factor obtained in a “frictionless” or almost frictionless manner. A method conducted at a software application executing on a user device associated with a user and connected to a server computer, includes obtaining signing or encryption of a set of data elements using a cryptographic key securely stored for exclusive use by the software application and transmitting the signed or encrypted data elements to the server computer. The method includes transmitting, to the server computer, a payload including contextual data which includes behavioural data collected via one or more contextual data sources. The signed data elements represent a possession factor and the payload including contextual data represents an inherence factor for validation and multi-factor authentication by the server computer.

Abstract: A system and method for processing a transaction are provided. In a method conducted at a server computer associated with an issuer, a transaction request is received via a secure communication channel from a communication device. The transaction request relates to a transaction with a merchant which a consumer intends to conduct using the consumer device. The secure communication channel is established with the communication device. The consumer is authenticated by the issuer over the secure communication channel. The transaction request includes at least a transaction reference or transaction details. A cryptogram which is based on the transaction details and information in association with the consumer which is stored based on the transaction details and information associated with the consumer, which is stored at the server, is obtained and provided to the merchant for use in processing the transaction.

Abstract: A system and method for maintaining a fraud risk profile in a fraud risk engine are described. In a method conducted at a remote server, a payload from a secure mobile application executing on a user mobile device associated with a user is received. The payload including contextual data having been obtained by the secure mobile application and a trust indicator linked to the contextual data. Validity of the contextual data is confirmed by verifying the trust indicator. If the trust indicator is verified, the contextual data is input into a fraud risk engine as truth data. The fraud risk engine maintains a fraud risk profile associated with the user. The fraud risk profile is usable by the fraud risk engine in evaluating a fraud risk associated with an activity associated with the user.

Abstract: A method and system for authenticating secure transactions between a transacting user and a secure transaction host is provided. The system includes a mobile phone software application installed on a transacting user's mobile phone which is configured to compose a digital fingerprint uniquely associated with the specific mobile phone on which it is installed. The system further includes an authentication service provider with which users of the system may be enrolled by registering at least the digital identifiers composed by the applications installed on their mobile communication devices in an authentication database. The authentication service provider is configured to authenticate secure transactions on request from secure transaction hosts by sending transaction confirmation requests to mobile phones of enrolled users requiring them to confirm or deny secure transactions before such transactions are allowed to be finalized.

Abstract: A method and system for authenticating secure transactions between a transacting user (9) and a secure transaction host (15) is provided. The system includes a mobile phone software application (59) installed on a transacting user's mobile phone (7) which is configured to compose a digital fingerprint (13) uniquely associated with the specific mobile phone (7) on which it is installed. The system further includes an authentication service provider with which users of the system may be enrolled by registering at least the digital identifiers composed by the applications installed on their mobile communication devices in an authentication database (5). The authentication service provider is configured to authenticate secure transactions on request from secure transaction hosts by sending transaction confirmation requests to mobile phones of enrolled users requiring them to confirm or deny secure transactions before such transactions are allowed to be finalized.