US 11,887,124 B2
Systems, methods and computer program products for securing electronic transactions
Amit Somani, Mandsaur (IN); Padma Jadav, Vadodara (IN); Raviraj Bhatt, Vadodara (IN); Hemant Arora, Pune (IN); Jaipal Singh Kumawat, Sikar (IN); Ajay Panwar, Gurgaon (IN); Sourabh Rajput, Gwalior (IN); and Paras Rashmikant Vanjara, Ahmedabad (IN)
Assigned to MASTERCARD INTERNATIONAL INCORPORATED, Purchase, NY (US)
Filed by MASTERCARD INTERNATIONAL INCORPORATED, Purchase, NY (US)
Filed on Nov. 25, 2020, as Appl. No. 17/104,267.
Claims priority of application No. 201911048233 (IN), filed on Nov. 26, 2019.
Prior Publication US 2021/0158360 A1, May 27, 2021
Int. Cl. G06Q 20/40 (2012.01); H04L 9/40 (2022.01); G06Q 20/42 (2012.01)
CPC G06Q 20/4016 (2013.01) [G06Q 20/425 (2013.01); H04L 63/0838 (2013.01); H04L 63/1416 (2013.01); H04L 63/1483 (2013.01)] 12 Claims
OG exemplary drawing
 
1. A method for securing electronic transaction one-time-passwords (OTPs) against phishing attacks, comprising implementing at a terminal device, the steps of:
generating, modifying, and refining one or more risk scoring data models based on one or more machine learning algorithms that identify correlations between financial terms, keywords, or other content within one or more previously received data communications, and whether a prior remote entity corresponding to the one or more previously received data communications has been identified as a malicious attacker;
receiving at the terminal device, a first data communication comprising an OTP associated with a requested electronic transaction;
identifying a validity period associated with the OTP;
receiving at the terminal device, during the identified validity period associated with the OTP, a second data communication from a remote entity;
detecting that the second data communication is received during the identified validity period associated with the OTP;
in response to detecting that the second data communication is received during the identified validity period associated with the OTP, extracting content from the second data communication;
analyzing the extracted content by using the one or more risk scoring data models that have been generated, modified, or refined by the one or more machine learning algorithms;
generating a risk decision based on output of the analysis of the extracted content, wherein the risk decision determines whether the remote entity comprises, or is controlled by, the malicious attacker; and
responsive to the risk decision determining that the remote entity comprises, or is controlled by, the malicious attacker, initiating a risk mitigation process.