Authentication of card-not-present transactions

• US 10,643,207 B2
• Filed: 07/16/2018
• Issued: 05/05/2020
• Est. Priority Date: 12/18/2009
• Status: Active Grant

• Current Assignee: First Data Corporation (Fiserv Incorporated)
• Original Assignee: First Data Corporation (Fiserv Incorporated)
• Inventors: Royyuru, Vijay K.
• Primary Examiner(s): Boveja, Namrata
• Assistant Examiner(s): See, Carol A
• Application Number:
  US16/036,335
• Publication Number:
  US 20180322493A1
• Time in Patent Office: 659 Days
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Methods, systems, and machine-readable media are disclosed for processing a card-not-present transaction. According to one embodiment, processing a card-not-present transaction can comprise receiving a request for a card-not-present transaction involving an enrolled consumer. The request can include information identifying the enrolled consumer. A record of information related to the enrolled consumer can be read and the enrolled consumer can be authenticated based at least in part on the information of the request and the record of information related to the enrolled consumer. In response to authenticating the enrolled consumer, a set of single-use payment information can be generated which can include a one-time password and a dynamic Primary Account Number (PAN) which is valid for a single transaction. The single-use payment information can be provided to the enrolled consumer or the merchant to complete the transaction in place of the true PAN.

Claims

1. A method, comprising:

receiving, by a payment processor system, a request for a card-not-present transaction by a consumer, the request including information identifying the consumer;

authenticating the consumer, by the payment processor system, based at least in part on the information identifying the consumer;

in response to authenticating the consumer, generating, by the payment processor system, single-use payment information, the single-use payment information including at least both a one-time password and a separate dynamic Primary Account Number (PAN), wherein the dynamic PAN is valid for a single transaction and does not reveal a true PAN of the consumer;

providing, by the payment processor system, a first portion of the single-use payment information to one of a merchant system and the consumer, and providing a second portion of the single-use payment information to the other of the merchant system and the consumer, wherein the one of the first portion and the second portion provided to the consumer is for the consumer to provide to a merchant associated with the merchant system, with the one-time password for use in place of true cardholder verification information and the dynamic PAN for use in place of a true PAN and;

receiving, by the payment processor system, from the merchant system a request to process payment of the card-not-present transaction, the request including the dynamic PAN in place of a true PAN and the one-time password in place of true cardholder verification information;

authenticating, by the payment processor system, the request to process payment of the card-not-present transaction based on the dynamic PAN and the one-time password from the request to process payment of the card-not-present transaction;

in response to authenticating the request to process payment of the card-not-present transaction, determining, by the payment processor system, the true PAN for the consumer; and

processing, by the payment processor system, payment of the card-not-present transaction using the true PAN for the consumer.

2. The method of claim 1, wherein the first portion of the single-use payment information is provided directly to the merchant system and comprises the dynamic PAN and wherein the second portion of the single-use payment information is provided to the consumer and comprises the one-time password.

3. The method of claim 2, wherein the consumer is an enrolled consumer for which a record of information related to the enrolled consumer is registered at the payment processor system, wherein the payment processor system reads the record of information related to the enrolled consumer, and wherein authenticating the consumer is further based on the record of information related to the enrolled consumer.

4. The method of claim 3, wherein the record of information related to the enrolled consumer includes the true PAN and information selected from a group consisting of a phone number of the enrolled consumer and an email address of the enrolled consumer.

5. The method of claim 4, wherein providing the second portion of the single-use payment information from the payment processor system to the consumer comprises sending an email message to the email address of the enrolled consumer.

6. The method of claim 4, wherein the phone number of the enrolled consumer comprises a phone number of a mobile phone and wherein providing the second portion of the single-use payment information from the payment processor system to the consumer comprises sending a Short Message Service (SMS) message to the phone number of the enrolled consumer.

7. The method of claim 2, wherein providing the second portion of the single-use payment information by the payment processor system to the consumer comprises providing the second portion of the single-use payment information to a client device or a mobile device of the consumer.

8. The method of claim 1, wherein receiving the request for the card-not-present transaction comprises one of receiving the request from a client device of the consumer, receiving the request from a mobile device of the consumer, and receiving the request from the merchant.

9. The method of claim 1, wherein the information identifying the consumer comprises one of a phone number of the consumer, an email address of the consumer, and the last four digits of the true PAN.

10. The method of claim 1, wherein the dynamic PAN retains a portion of the true PAN for routing of the request to process payment of the card-not-present transaction to the payment processor system via a payment network.

11. The method of claim 1, wherein the dynamic PAN retains the right-most 4 digits of the true PAN.

12. A system for conducting a card-not-present transaction, wherein the transaction is processed with a primary account number and cardholder verification information, comprising:

a merchant system configured to provide an e-commerce website;

a client device adapted to access the e-commerce website; and

a payment processor system communicatively coupled with the merchant system and the client device, wherein the payment processor system maintains enrollment information for a user of the client device,

wherein the client device initiates a card-not-present transaction with the merchant system through the c-commerce website and requests single-use payment information from the payment processor system,

wherein the payment processor system receives the request for the card-not-present transaction, the request including information identifying the user of the client device, authenticates the user of the client device based at least in part on the information of the request identifying the user of the client device, and in response to authenticating the user of the client device, generates the single-use payment information, the single-use payment information including at least both a one-time password for use in place of true cardholder verification information and a separate dynamic Primary Account Number (PAN) for use in place of a true PAN, wherein the dynamic PAN is valid for a single transaction and does not reveal a true PAN of the user of the client device, wherein the payment processor system provides a first portion of the single-use payment information to one of a merchant associated with the merchant system and the user and provides a second portion of the single-use payment information to the other of the merchant and the user, and wherein the one of the first and second portion of the single-use payment information provided to the user is for the user to provide to the merchant,

wherein the merchant system receives the dynamic PAN and one-time password and sends a request to process payment of the card-not-present transaction to the payment processor system, the request including the dynamic PAN and one-time password, and

wherein the payment processor system receives the request to process payment of the card-not-present transaction from a merchant system, including the dynamic PAN and the one-time password, authenticates the request to process payment of the card-not-present transaction based on the dynamic PAN and the one-time password from the request to process payment of the card-not-present transaction, and in response to authenticating the request to process payment of the card-not-present transaction, determines the true PAN for the user of the client device and processes payment of the card-not-present transaction using the true PAN for the user of the client device.

13. The system of claim 12, wherein the first portion of the single use payment information is provided directly to the merchant system and comprises the dynamic PAN and wherein the second portion of the single use payment information is provided to the user and comprises the one-time password.

14. The system of claim 13, wherein the user of the client device is an enrolled consumer for which a record of information related to the enrolled consumer is registered, wherein the payment processor system reads the record of information related to the enrolled consumer, and wherein authenticating the user of the client device is further based on the record of information related to the enrolled consumer.

15. The system of claim 14, wherein the record of information related to the enrolled consumer includes the true PAN and information selected from a group consisting of a phone number and an email address.

16. The system of claim 15, wherein providing the second portion of the single-use payment information from the payment processor system to the user comprises sending an email message to the email address.

17. The system of claim 15, wherein the phone number comprises a phone number of a mobile phone and wherein providing the second portion of the single-use payment information from the payment processor system to the user comprises sending a Short Message Service (SMS) message to the phone number.

18. The system of claim 12, wherein the information identifying the user of the client device comprises one or more of a phone number, an email address, and a last four digits of the true PAN.

19. The system of claim 12, wherein the dynamic PAN retains a portion of the true PAN for routing of the request to process payment of the card-not-present transaction to the payment processor system via a payment network.

20. The system of claim 12, wherein the dynamic PAN retains the right-most 4 digits of the true PAN.