METHOD OF PROCESSING A TRANSACTION REQUEST
A transaction processing system is arranged to receive, from a user device, transaction data and outcome data associated with outcomes of one or more previous transactions. Based on the transaction data and the outcome data, the transaction processing system may process the transaction request according to a particular transaction process and update the outcome data. The updated outcome data may be sent to the user device and stored for use in processing a future transaction.
This Application claims priority to U.S. patent application Ser. No. 14/785,623 filed Oct. 19, 2015, which is a National Stage Entry of PCT/US2014/00505 filed May 9, 2014, which claims priority to Australia Patent Application No. 2013901648 filed May 9, 2013, which are incorporated herein by reference.
FIELDThe invention relates to a method of processing a transaction request and a transaction processing system.
BACKGROUNDBy providing the facility for consumers to purchase goods and services on-line, merchants expose themselves to the potential for fraudulent transactions through these channels.
Accordingly, there is a need for techniques that mitigate against the risk of fraud.
SUMMARYIn a first aspect, the invention provides a method of processing a transaction request, the method comprising:
-
- receiving a transaction request from a user device at a transaction processing system;
- obtaining a cookie stored in a browser application of the user device containing outcome data indicative of an outcome of at least one prior transaction;
- determining by the transaction processing system based on the outcome data, which of a plurality of transaction processes is to be applied by the transaction processing system to the transaction request; and
- processing the transaction in the transaction processing system in accordance with the determined transaction process.
In an embodiment, determining which of a plurality of transaction processes is to be applied comprises selecting between a plurality of available processes, and at least a first transaction process contains at least one additional validation process than a second transaction process.
In an embodiment, determining which of a plurality of transaction processes is to be applied comprises selecting between a plurality of available processes, and at least a first transaction process contains at least one alternative validation process to a validation process of a second transaction process.
In an embodiment, there are a plurality of available validation processes that can be formed into the plurality of transaction processes and determining which of a the plurality of transaction processes comprises selecting which of the available validation processes will form the transaction process.
In an embodiment, the outcome data comprises a transaction score and determining which of the plurality of transaction processes is to be applied comprises determining to which of the plurality of transaction processes the score corresponds.
In an embodiment, the transaction processing system has a memory storing a plurality of ranges of scores in association with respective transaction processes such that any score uniquely corresponds to a transaction process.
In an embodiment, the method comprises setting a further cookie in the browser application of the user device based on the outcome of the determined transaction process.
In a second aspect, the invention provides a transaction processing system for processing a transaction request, the transaction processing system arranged to receive a transaction request from a user device, the transaction processing system comprising:
-
- a cookie retriever arranged to obtain a cookie stored in a browser application of the user device containing outcome data indicative of an outcome of at least one prior transaction;
- a processing setter arranged to determine based on the outcome data which of a plurality of transaction processes is to be applied by the transaction processing system to the transaction request; and
- a transaction processor arranged to process the transaction in accordance with the determined transaction process.
In a third aspect, the invention provides computer program code which when executed implements the above method. The invention also provides a tangible computer readable medium comprising the computer program code.
Embodiments of the invention will now be described with reference to the accompanying drawings in which:
Referring to the drawings, there is shown an embodiment of transaction processing system 130 for implementing a method for processing a transaction request. In
The method is implemented by the transaction processing system 130 in response to a customer seeking to purchase an item from the system 130. In this respect, the transaction processing system comprises a product selector 148 implemented by processor 140 which enables a user to browse and select products from the product database 155. In one embodiment, the product selector 148 provides a web interface via which a user can browse products for selection. The product selector 148 may also incorporate known functionality for of e-commerce systems, e.g. a shopping cart application to enable a user to select multiple products to be paid for in a single purchase transaction. In another embodiment, product selection may be implemented by a separate system such that the transaction processing system 130 is employed once a user has chosen products for purchase and is seeking to pay for them. In other embodiments, the transaction may be initiated in another manner, for example by the user selecting a product from an e-mail message sent to the user.
The items in product database 155 may be physical items of some particular value, for example, a mobile handset for $500 or a virtual item such as a recharge voucher for applying credit to a pre-paid mobile phone account. That is, in exchange for payment, the user is provided with a code that they can enter in order to apply credit to a prepaid mobile account and as such, may not be provided with a physical receipt.
Assuming, cookies are enabled in the web browser application 111 on the user's device 110 and the browser 111 has been used in a prior transaction, cookie 112 will include a secured algorithmic output within it that contains outcome data indicative of the outcome of at least the previous transaction outcome. In one example, the transaction outcome can be one of a number of defined outcome statuses such as: completed successful, completed declined, completed fraud risk, completed velocity breach, abandoned, etc. In another embodiment, the transaction outcome data can be a score (for example, a secured number with a range between 0 and 100 to determine the level of risk) or both a defined outcome status and a score.
During a transaction, the cookie retriever 141 of system 130 looks to the user's browser 111 to see if any previous cookies exist. If a cookie exists, then the outcome data is obtained and deciphered by the cooked retriever 141 to obtain the transaction outcome status. In one embodiment, the outcome status is then employed by the processing setter 142 to determine what rules sets and processing may be applied to the in-situ transaction. For example, the processing setter may be arranged to choose between a first set 153 and a second set 154 of transaction processing rules 152.
Thus, for example, in a high volume processing environment the processing setter 142 and processing rules 152 can be arranged so that a transaction outcome with the status “completed fraud risk” undergoes a higher detail of scrutiny than a transaction with a transaction outcome of “completed successful”.
During processing of the transaction, the transaction scorer scores the current transaction based on transaction scoring rules 151 and the cookie setter 141 sets an updated cookie 112 in the browser.
In another embodiment, each successful transaction outcome contains a transaction state and a transaction score which is stored as outcome data in the cookie 112. The transaction state is a statement as to the end outcome of the transaction, such as completed successful, declined, abandoned, insufficient funds, attempted fraud, velocity breach etc. A three digit number is used to define the transaction state. For example, an approved transaction may hold a transaction state number of 167.
In one embodiment, the transaction score is a number in a defined range which may be, for example between theoretical minus infinity and infinity. In one embodiment of system 130, when the transaction processor 143 processes a transaction, any score over 99 will see that transaction fail. In one embodiment, the transaction score stored in the cookie, scores are restricted to the range to between 0000 and 9999. Scores below zero generate an automatic 0000 score and above 9999 generate a 9999 rating.
A cookie is then issued with the transaction state and transaction score tied together as a masked 7 digit number as part of the cookie's credentials. For example, an approved transaction that had an initial transaction score of 65 may have a smart cookie containing the following string:
878df76536531670065328768768543askh32234sr1kh312h8, with the underlined portion encoding the transaction data where the “167” identifies the transaction state (Approved) and the “0065” identifies the transaction score.
The above example indicates to the system 130 that the device having this cookie is a device on which a potentially acceptable user was going to perform a transaction and select transaction processing rules 152 accordingly.
However, if the embedded code were “2290970”, this would indicate that the last transaction was an attempted fraud (where the device was used in previous fraud activities and the transaction score was 970). In this case, certain other defence mechanisms for the system may slow the transaction processing down. For example, the system may implement additional Device ID checking rules, rainbow forms and the like during the transaction processing.
If the device used for the transaction has cookies turned off, or there is no cookie, or the format of the cookie has been tampered with then the processing setter 142 is arranged such that additional measures for transaction processing are automatically enabled.
In this respect,
The first set 153 and the second set 154 may differ from each other in that the second set 154 contains additional transaction validation processing steps that are undertaken based on the processing score. In another example, alternative transaction validation processing steps may be undertaken, for example the second set 154 may replace a processing step from the first set 153 with an alternative set.
Persons skilled in the art will also appreciate that the presence of two sets of rules in
Further, in one embodiment, the rules may not be established as separate sets but rather a series of different processing modules that are assembled based on the transaction outcome data that is set.
Referring to
If it is determined 220 that the transaction request contains a cookie (in the sense that a cookie can be retrieved from the browser) it is determined whether the cookie is indicative of the prior approved transaction 235. If it is not indicative of a prior approved transaction, the request is processed with additional transaction rules 260 and the cookie is updated 270 and the process ends 280. If the cookie is indicative of a prior transaction that has been approved, it is processed in accordance with base transaction rules 240 and the cookie is updated 250.
ScoringIn one example, scoring is based on data obtained by the processing system 130 from the user's device. For example, the transaction may involve a customer placing a request to purchase a physical product on a web site managed by the transaction processing system 130. The device “appearing” to be presented by the customer is an Apple iPhone 4S with iOS 6.1 software installed. Also derived from the device are other ID markings such as:
-
- name of the device (e.g. the user's iTunes user name)
- telecommunication network provider (the entity that provides the phone service to the user)
- network carrier (the entity that provides the physical infrastructure used by the telecommunication network provider (which may be the same or different)
- serial number of the device
- capacity of the device
- network carrier's operating system version
- WiFi address used for the transaction (if used)
- Bluetooth address of the device (if turned on)
- IMEI (International Mobile Station Equipment Identity) number
- ICCID number (a SIM (subscriber identification module) card serial number
- modem firmware version
The above list is specifically for an Apple iPhone. However, as discussed above, the list would vary based on the device.
The above information is recorded to the extent that it is complete. Some fields for each device ID list are mandatory and some are not and this may differs for different devices. For example, the WiFi address and Bluetooth address of an iPhone device are not mandatory as, in order to collect them, both services need to be turned on. Where these fields are completed, this adds positively (in the sense of improving) an initial score for the first identification data.
For example, the transaction scorer 144 of processing system 130 may initially score an iPhone 5 with all of the above fields with a score of 0 points if the total device information possible is retrieved. (A lower score being treated as more indicative that the device is trustworthy). If the WiFi field was not populated but an IP address was received along with the incoming details then the device may be treated as suspicious and granted a score of 25 points.
In one example, the device details are matched internally against existing device details. In one example, the score may be decreased based on the number of transactions previously presented where that particular device was used and the transactions either failed or were considered of a fraudulent nature. Alternatively, a device ID may have been presented previously and have been used in multiple successful transactions. Over time, those individual transactions begin to garner their own score weighting to the initial score. A successful transaction using a particular device ID that was performed 9 months ago and has not had a chargeback or refund against it has a negative score against it (say −5), whereas a successful transaction performed on the current date may only receive −1 points. The reason for the different scores is that, although a transaction today is successful, a bank may apply a chargeback against the transaction anywhere (generally) up to 180 days past the date of the transaction. In this way a score can reflect more than one transaction outcome.
Points are also allocated based on the outcome of the transaction itself. In this respect transactions can be allocated into different categories with associated point scores such as completed successful, completed declined, completed fraud risk, completed with velocity breach, abandoned, etc.
In an alternative embodiment, these categories can be the outcome data. That is, instead of the transaction being scored, a category can be allocated to it and stored in the cookie as the outcome data.
Persons skilled in the art will appreciate that in accordance with known techniques, functionality at the server side of the network may be distributed over a plurality of different computers, for example for load balancing or security.
Further aspects of the method will be apparent from the above description of the system. It will be appreciated that at least part of the method will be implemented electronically, for example, digitally by a processor executing program code. In this respect, in the above description certain steps are described as being carried out by the system, it will be appreciated that such steps will often require a number of sub-steps to be carried out for the steps to be implemented electronically, for example due to hardware or programming limitations. For example, to carry out a step such as evaluating, determining or selecting, a processor may need to compute several values and compare those values.
As indicated above, the method may be embodied in program code. The program code could be supplied in a number of ways, for example on a tangible computer readable storage medium, such as a disc or a memory device, e.g. an EEPROM, (for example, that could replace part of memory 103) or as a data signal (for example, by transmitting it from a server). Further different parts of the program code can be executed by different devices, for example in a client server relationship. Persons skilled in the art will appreciate that program code provides a series of instructions executable by a processor.
Herein the term “processor” is used to refer generically to any device that can process game play instructions in accordance with game play rules and may include: a microprocessor, microcontroller, programmable logic device or other computational device, a general purpose computer (e.g. a PC) or a server. That is a processor may be provided by any suitable logic circuitry for receiving inputs, processing them in accordance with instructions stored in memory and generating outputs (for example on the display). Such processors are sometimes also referred to as central processing units (CPUs). Most processors are general purpose units, however, it is also know to provide a specific purpose processor, for example, an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).
It will be understood to persons skilled in the art of the invention that many modifications may be made without departing from the spirit and scope of the invention, in particular it will be apparent that certain features of embodiments of the invention can be employed to form further embodiments.
It is to be understood that, if any prior art is referred to herein, such reference does not constitute an admission that the prior art forms a part of the common general knowledge in the art in any country.
In the claims which follow and in the preceding description of the invention, except where the context requires otherwise due to express language or necessary implication, the word “comprise” or variations such as “comprises” or “comprising” is used in an inclusive sense, i.e. to specify the presence of the stated features but not to preclude the presence or addition of further features in various embodiments of the invention.
Claims
1-15. (canceled)
16. A method comprising:
- determining, from a user device, (i) transaction data associated with a first transaction and (ii) outcome data associated with outcomes of one or more previous transactions;
- based at least in part on the transaction data and the outcome data, processing the first transaction according to a transaction process of a plurality of transaction processes;
- based at least in part on processing the first transaction according to the transaction process, generating updated outcome data; and
- sending the updated outcome data to the user device, wherein the updated outcome data is stored on the user device for processing a second transaction.
17. The method as claim 16 recites, wherein the transaction data comprises first transaction data, the transaction process comprises a first transaction process, the updated outcome data comprises first updated outcome data, and the method further comprising:
- determining, from the user device, (i) second transaction data associated with the second transaction and (ii) the updated outcome data;
- based at least in part on the second transaction data and the updated outcome data, processing the second transaction according to the first transaction process or a second transaction process of the plurality of transaction processes;
- based at least in part on processing the second transaction, generating second updated outcome data; and
- sending the second updated outcome data to the user device, wherein the second updated outcome data is stored on the user device for processing a future transaction.
18. The method as claim 16 recites, wherein the outcome data is stored in a cookie in a browser application executing on the user device.
19. The method as claim 16 recites wherein the outcome data is associated with a score, of a plurality of scores, corresponding to a level of risk associated with the first transaction.
20. The method as claim 19 recites, wherein individual transaction processes of the plurality of transaction processes are associated with unique scores of the plurality of scores.
21. The method as claim 19 recites, wherein the score comprises a first score, and the updated outcome data is associated with a second score.
22. The method as claim 16 recites, wherein a first transaction process of the plurality of transaction processes contains an additional validation process relative to a second transaction process of the plurality of transaction processes.
23. The method as claim 16 recites, wherein a first transaction process of the plurality of transaction processes contains an alternative validation process relative to a second transaction process of the plurality of transaction processes.
24. The method as claim 16 recites, wherein an outcome of the outcomes comprises at least one of completed fraud risk, completed successful, completed declined, completed velocity breach, or abandoned.
25. A system comprising:
- one or more processors; and
- one or more non-transitory computer-readable media storing instructions executable by the one or more processors, wherein the instructions cause the one or more processors to perform acts comprising: determining, from a user device, (i) transaction data associated with a first transaction and (ii) outcome data associated with outcomes of one or more previous transactions; based at least in part on the transaction data and the outcome data, processing the first transaction according to a transaction process of a plurality of transaction processes; based at least in part on processing the first transaction according to the transaction process, generating updated outcome data; and sending the updated outcome data to the user device, wherein the updated outcome data is stored on the user device for processing a second transaction.
26. The system as claim 25 recites, wherein the transaction data comprises first transaction data, the transaction process comprises a first transaction process, the updated outcome data comprises first updated outcome data, and the acts further comprising:
- determining, from the user device, (i) second transaction data associated with the second transaction and (ii) the updated outcome data;
- based at least in part on the second transaction data and the updated outcome data, processing the second transaction according to the first transaction process or a second transaction process of the plurality of transaction processes;
- based at least in part on processing the second transaction, generating second updated outcome data; and
- sending the second updated outcome data to the user device, wherein the second updated outcome data is stored on the user device for processing a future transaction.
27. The system as claim 25 recites, wherein the outcome data is stored in a cookie in a browser application executing on the user device.
28. The system as claim 25 recites, wherein a first transaction process of the plurality of transaction processes contains an additional validation process relative to a second transaction process of the plurality of transaction processes.
29. The system as claim 25 recites, wherein a first transaction process of the plurality of transaction processes contains an alternative validation process relative to a second transaction process of the plurality of transaction processes.
30. The system as claim 25 recites, wherein an outcome of the outcomes comprises at least one of completed fraud risk, completed successful, completed declined, completed velocity breach, or abandoned.
31. One or more non-transitory computer-readable media storing instructions executable by one or more processors that, when executed by the one or more processors, cause the one or more processors to perform acts comprising:
- determining, from a user device, (i) transaction data associated with a first transaction and (ii) outcome data associated with outcomes of one or more previous transactions;
- based at least in part on the transaction data and the outcome data, processing the first transaction according to a transaction process of a plurality of transaction processes;
- based at least in part on processing the first transaction according to the transaction process, generating updated outcome data; and
- sending the updated outcome data to the user device, wherein the updated outcome data is stored on the user device for processing a second transaction.
32. The one or more non-transitory computer-readable media as claim 31 recites, wherein the outcome data is associated with on a score, of a plurality of scores, corresponding to a level of risk associated with the first transaction.
33. The one or more non-transitory computer-readable media as claim 32 recites, wherein individual transaction processes of the plurality of transaction processes are associated with unique scores of the plurality of scores.
34. The one or more non-transitory computer-readable media as claim 32 recites, wherein the score comprises a first score, and the updated outcome data is associated with a second score.
35. The one or more non-transitory computer-readable media as claim 31 recites, wherein an outcome of the outcomes comprises at least one of completed fraud risk, completed successful, completed declined, completed velocity breach, or abandoned.
Type: Application
Filed: Aug 24, 2022
Publication Date: Feb 16, 2023
Inventor: Jason Andrew Van (Melbourne)
Application Number: 17/894,666
