Secure communication of payment information to merchants using a verification token

• US 10,049,360 B2
• Filed: 09/07/2016
• Issued: 08/14/2018
• Est. Priority Date: 05/15/2009
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Hammad, Ayman
• Primary Examiner(s): HESS, DANIEL A
• Application Number:
  US15/258,258
• Publication Number:
  US 20160379217A1
• Time in Patent Office: 706 Days
• Field of Search: 235379, 235380, 235382
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/3226 Use of secure elements separate from M-devices
• CPC Class Codes: G06Q 20/3255 using mobile network messaging services for payment, e.g. SMS
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 20/4018 using the card verification value [CVV] associated with the card
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation

Abstract

Disclosed are apparatuses, systems, and methods pertaining to the secure communication of payment information from portable consumer devices, such as credit cards, to online merchants using verification tokens.

Claims

1. A method initiating a payment transaction, the method comprising:

presenting, from a merchant server comprising a data processor and a computer readable medium comprising computer code, a website portal providing various web pages that enable a user to select at least one product or service for purchase to a computer, the computer code directing the data processor in the merchant server to create an active purchase session for the user that is actively pursuing a purchase transaction;

receiving, by the merchant server, one or more messages directly from a validation entity, the one or more messages including data including data representative of at least a portion of identification information of a portable consumer device obtained from a verification token, after the validation entity has determined that one or more validation tests pertaining to the verification token are passed;

correlating, by the merchant server, the data received in the one or more messages from the validation entity to the active purchase session; and

initiating the payment transaction using at least some of the data received in the one or more messages.

2. The method of claim 1, wherein the portable consumer device is in the form of a card and the verification token comprises a card reader.

3. The method of claim 1, wherein the one or more messages comprise a merchant identifier associated with the merchant server.

4. The method of claim 3, wherein the one or more messages comprise a transaction identifier associated with the purchase transaction.

5. The method of claim 4, wherein the merchant identifier and the transaction identifier are encrypted in the one or more messages.

6. The method of claim 1, wherein the computer is a mobile phone.

7. The method of claim 1, wherein the one or more messages comprise a merchant identifier associated with the merchant server, the merchant identifier being a URL or a URID.

8. The method of claim 1 wherein the one or more messages comprise a merchant identifier associated with the merchant server, the merchant identifier being stored on the portable consumer device and being received through the verification token.

9. A merchant server comprising:

a data processor; and

a computer readable medium coupled to the processor, wherein the computer readable medium comprises code, executable by the processor, for implementing a method comprising

presenting, from the merchant server, a website portal providing various web pages that enable a user to select at least one product or service for purchase to a computer, the code directing the data processor to create an active purchase session for the user that is actively pursuing a purchase transaction;

receiving, by the merchant server, one or more messages directly from a validation entity, the one or more messages including data including data representative of at least a portion of identification information of a portable consumer device obtained from a verification token, after the validation entity has determined that one or more validation tests pertaining to the verification token are passed;

correlating, by the merchant server, the data received in the one or more messages from the validation entity to the active purchase session; and

initiating a payment transaction using at least some of the data received in the one or more messages.

10. The merchant server of claim 9, wherein the portable consumer device is in the form of a card and the verification token comprises a card reader.

11. The merchant server of claim 9, wherein the one or more messages comprise a merchant identifier associated with the merchant server.

12. The merchant server of claim 11, wherein the one or more messages comprise a transaction identifier associated with the purchase transaction.

13. The merchant server of claim 12, wherein the merchant identifier and the transaction identifier are encrypted in the one more messages.

14. The merchant server of claim 9, wherein the computer is a mobile phone.

15. The merchant server of claim 9, wherein the one or more messages comprise a merchant identifier associated with the merchant server, the merchant identifier being a URL or a URID.

16. The merchant server of claim 9, wherein the one or more messages comprise a merchant identifier associated with the merchant server, the merchant identifier being stored on the portable consumer device and being received through the verification token.

17. The merchant server of claim 9 wherein the identification information is stored in the verification token.