Biocatch Ltd.

Ironvest, Inc.

Other

Avi Turgeman

Itai Novick

Oren Kedem

Yaron Lehmann

Uri Rivner

Edo Dekel

Yaron Azizi

Lev Kadyshevitch

Leonid Karabchevsky

Erez Zohar

Kfir Yeshayahu

Alexander Basil Zaloum

Ron Uriel Maor

Shira Mintz

Alesis Novik

William Herlands

Tal Moyal

Yaron Dror

Ziv Levin

Guy Bauman

Yehuda Sabag

A user interacts with a remote server via an end-user device, and enters transaction data. A user-facing camera of the end-user device captures a live video feed of the interacting user; which is displayed in real time on the screen of the end-user device while the user is filling-out fields and entering transaction data. The concurrent, real-time, video-feed display of the interacting user, near—or as a background layer behind—the fillable fields of the transaction data, deters at least some cyber-attacks or prevents fraud attempts. Optionally, the screen of the end-user device is also continuously shared, over a secure communication channel, via a locally-installed Screen Sharing Module, with a trusted remote server; which performs continuous biometric authentication of the user, and continuously verifies the integrity of user-provided transaction data against locally-collected data and user interactions. Optionally, a server-side generated QR code or barcode or visual representation, is sent by the trusted remote server and is also displayed on the screen of the end-user device, which is then Screen-Shared back towards the trusted remote server, as an additional security measure.

User authentication and transaction verification via a shared video stream

Systems, and methods of protecting users against cyber-attacks that utilize SIM Swap or Email Hijacking. A method includes: (a) detecting that a user is requested to input his genuine email address into an email address field of an account profile page or an account settings page of a computerized service; (b) inserting, into that email address field of that page, a replacement email address that replaces a genuine email address of the genuine user at that computerized service; and later, (c) automatically monitoring and handling, continuously at a remote server or a remote service, incoming email messages that arrive to that replacement email address of that genuine user and that request the genuine user to perform an elevated-security operation or to reset his credentials for accessing that computerized service.

System, device, and method of protecting users and online accounts against attacks that utilize SIM swap scams

Method, device, and system of detecting a mule bank account, or a bank account used for terror funding or money laundering. A method includes: monitoring interactions of a user with a computing device during online access with a bank account; and based on the monitoring, determining that the bank account is utilized as a mule bank account to illegally receive and transfer money, or is used for money laundering or terror funding. The method takes into account one or more indicators, such as, utilization of a remote access channel, utilization of a virtual machine or a proxy server, unique behavior across multiple different accounts, temporal correlation among operations, detection of a set of operations that follow a pre-defined mule account playbook, detection of multiple incoming fund transfers from multiple countries that are followed by a single outgoing fund transfer to a different country, and other indicators.

Method, device, and system of detecting mule accounts and accounts used for money laundering

System, device, and method of privacy-preserving user-identity verification and re-proofing. A system includes a Tokenization Unit, that is configured to receive from a user a user-submitted biometric data-item of the user; to receive from the user one or more user-submitted data-items of Personally Identifiable Information (PII); to generate an aggregated data-item that includes (i) at least a portion of the user-submitted biometric data-item and (ii) at least a portion of the one or more user-submitted data-items of Personally Identifiable Information (PII); and to perform irreversible one-way cryptographic hashing of the aggregated data-item into an irreversible tokenized data-item that enables user authentication based on biometric data and PII data.

System, device, and method of privacy-preserving user-identity verification and re-proofing

Dynamic multi-party computation for securely utilizing and storing a secret data-item. A method includes: (a) receiving or generating a secret data-item (S); (b) dividing the secret data-item (S) into shares; (c) at a first electronic device, locally encrypting a first share (S-) into a first encrypted share (ES-), by using a private encryption key of the first electronic device as encryption key; (d) at a second, different, electronic device, locally encrypting a second share (S-) into a second encrypted share (ES-), by using a private encryption key of the second electronic device as encryption key; (e) storing the first encrypted share (ES-) and the second encrypted share (ES-) on one or more storage devices; (f) subsequently, dynamically replacing the first encrypted share (ES-) with a replacement encrypted share (ES-B) that is the first share (S-) of the secret data-item encrypted by using a private encryption key of a third electronic device as encryption key.

Dynamic multi-party computation for securely utilizing and storing a secret data-item

Devices, systems, and methods of detecting a vishing attack, in which an attacker provides to a victim step-by-step over-the-phone instructions that command the victim to log-in to his bank account and to perform a dictated banking transaction. The system monitors transactions, online operations, user interactions, gestures performed via input units, speed and timing of data entry, and user engagement with User Interface elements. The system detects that the operations performed by the victim, follow a pre-defined playbook of a vishing attack. The system detects that the victim operates under duress or under dictated instructions, as exhibited in irregular doodling activity, data entry rhythm, typographical error introduction rhythm, unique posture of the user, alternating pattern of listening to phone instructions and performing online operations via a computer, and device orientation changes or spatial changes that characterize a device being used to perform an online transaction while also talking on the phone.

Device, system, and method of detecting vishing attacks

Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a cyber-attacker. A user utilizes a desktop computer, a laptop computer, a smartphone, a tablet, or other electronic device, to interact with a banking website or application, a retailer website or application, or other computerized service. Input-unit interactions are monitored, logged, and analyzed. Based on several types of analysis of the input-unit interactions, a score is generated to reflect fraud-relatedness or attack-relatedness of the input-unit interactions. Based on the score, the system estimates or determines whether the user is an attacker, and initiates attack-mitigation operations or fraud-mitigation operations.

Method, device, and system of differentiating between a cyber-attacker and a legitimate user

Devices, systems, and methods of detecting user identity, authenticating a user to a computerized service or to an electronic device, differentiating between users of a computerized service, and detecting possible attackers or possible fraudulent transactions. A method includes: generating a user authentication session that requires a user to enter a secret by performing a task; monitoring the user interactions during task performance; extracting a user-specific behavioral characteristic, and utilizing it as a factor in user authentication. The task requires the user to perform on-screen operations via a touch-screen or touchpad or mouse or other input unit of the electronic device, or to move in space or tilt in space the entirety of the electronic device in a way that causes inputting of the secret data-item.

Device, system, and method of user authentication based on user-specific characteristics of task performance

System, device, and method of generating and utilizing one-time passwords. A method generates a particular One-Time Password (OTP) string that is based on pre-defined OTP string construction rules. The particular OTP string is not a purely-random string; rather, the particular non-purely-random OTP string provides to a behavioral monitoring unit a capability to extract user-specific behavioral typing patterns from a way in which a user types characters of the particular OTP via a keyboard of an electronic device. The method sends the particular OTP string to the user; monitors the way that the user types the OTP string; extracts from the user interactions, that were performed while the user entered the OTP string, a user-specific behavioral typing characteristic; and based on that user-specific characteristic, determines whether that user is authenticated or non-authenticated, and optionally activates fraud mitigation operations or transaction blocking operations if the user is non-authenticated.

System, device, and method of generating and utilizing one-time passwords

Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a cyber-attacker. A user utilizes a desktop computer, a laptop computer, a smartphone, a tablet, or other electronic device, to interact with a banking website or application, a retailer website or application, or other computerized service. Input-unit interactions are monitored, logged, and analyzed. Based on several types of analysis of the input-unit interactions, a score is generated to reflect fraud-relatedness or attack-relatedness of the input-unit interactions. Based on the score, the system estimates or determines whether the user is an attacker, and initiates attach-mitigation operations or fraud-mitigation operations.

System, method, and device of detecting identity of a user and authenticating a user; as well as detecting a possible attacker or impostor, and differentiating among users of an electronic device or of a computerized service. A mobile or portable electronic device is utilized to capture a self-taken image or video of a user, which is utilized as a user-authentication factor. The accelerometer and gyroscope or device-orientation sensor of the mobile device, sense and measure spatial and physical device properties during, before or after the submission of the self-taken image or video. Based on such spatial and physical device properties, in combination with computer-vision analysis of the content shown in the self-taken image or video, the system determines liveness of the user and freshness of the submitted self-taken image or video, and differentiates between a legitimate user and an attacker.

System, method, and device of authenticating a user based on selfie image or selfie video

Devices, systems, and methods of detecting whether an electronic device or computerized device or computer, is communicating with a computerized service or a trusted server directly and without an intermediary web-proxy, or indirectly by utilizing a proxy server or web-proxy. The system searches for particular characteristics or attributes, that characterize a proxy-based communication session or channel and that do not characterize a direct non-proxy-based communication session or channel; or conversely, the system searches for particular characteristics or attributes, that characterize a direct non-proxy-based communication session or channel and that do not characterize a proxy-based communication session or channel; and based on these characteristics, determines whether or not a proxy server exists and operates.

Growing community of inventors

Cambridge, MA, United States of America

Avi Turgeman