Dynamic Card Validation Value

• US 20090173782A1
• Filed: 01/02/2009
• Published: 07/09/2009
• Est. Priority Date: 01/04/2008
• Status: Active Grant

• Current Assignee: M2 International Limited
• Original Assignee: M2 International Limited
• Inventors: Muscato, Michael A.
• Granted Patent: US 7,922,082 B2
• Time in Patent Office: Days
• US Class Current: 235/379
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4018 using the card verification value [CVV] associated with the card
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

As described herein, a card services provider dynamically generates a card verification value (CVV) for a transaction card and sends the dynamically-generated CVV to a cardholder. The card services provider generates the dynamically-generated CVV such that the dynamically-generated CVV is substantially unpredictable based on other dynamically-generated CVVs for the transaction card. The dynamically-generated CVV is only valid for a limited period of time and/or for a limited number of economic transactions. The cardholder uses the dynamically-generated CVV as part of an economic transaction with a merchant. Because the dynamically-generated CVV is only valid for a limited number of economic transactions and/or for a limited period of time, it may be difficult for a thief to repeatedly use the transaction card to make economic transactions.

Claims

1. A method for performing an economic transaction using a transaction card, the method comprising:

using a cardholder device to receive from a card services provider a first set of data, the first set of data indicating a dynamically-generated card verification value (CVV) for the transaction card,

wherein the dynamically-generated CVV is a sequence of characters based on a card number of the transaction card, an expiry date of the transaction card, and a dynamic service code, and

wherein the dynamic service code is selected by the card services provider such that the dynamically-generated CVV is substantially unpredictable based on previously generated dynamically-generated CVVs for the transaction card,

wherein the transaction card includes a magnetic stripe that stores the card number, the expiry date, and a first statically-generated CVV, and

wherein the card number, the expiry date, and a second statically-generated CVV are physically printed on the transaction card; and

after receiving the dynamically-generated CVV from the card services provider, using the card number of the transaction card, the expiry date of the transaction card, and the dynamically-generated CVV to initiate the economic transaction.

2. The method of claim 1, wherein using the cardholder device to receive the first set of data comprises configuring the cardholder device to automatically receive the first set of data without sending a request for the dynamically-generated CVV to the card services provider.

3. The method of claim 1, wherein using the cardholder device to receive the first set of data comprises configuring the cardholder device to automatically receive, on a periodic basis, additional sets of data, each of the additional sets of data indicating an additional dynamically-generated CVV for the transaction card,

wherein each of the additional dynamically-generated CVVs is a sequence of characters based on the card number of the transaction card, the expiry date of the transaction card, and additional dynamic service codes, and

wherein the card services provider selects the additional dynamic service codes such that the additional dynamically-generated CVVs are substantially unpredictable based on previously generated dynamically-generated CVVs for the transaction card.

4. The method of claim 1, further comprising using the cardholder device to send to the card services provider a request for the dynamically-generated CVV.

5. The method of claim 1, wherein the dynamically-generated CVV is only valid for use in a single economic transaction.

6. A computer-readable medium comprising instructions that, when executed by a processor, cause an electronic computing system to:

automatically select a dynamic service code such that the dynamic service code is substantially unpredictable based on previously requested dynamically-generated card verification values (CVVs) for a transaction card;

automatically generate a dynamically-generated CVV for the transaction card, wherein the dynamically-generated CVV is based on a card number of the transaction card, an expiry date of the transaction card, and the dynamic service code;

automatically send, from the card processing server to a cardholder device, a first set of data, the first set of data indicating the dynamically-generated CVV;

in response to receiving a transaction request, automatically determine whether a provided CVV corresponds to the dynamically-generated CVV, the transaction request is a request for an economic transaction, the transaction request specifying the provided CVV and a card number of the transaction card; and

record a charge against an account of a cardholder of the transaction card when it is determined that the provided CVV corresponds to the dynamically-generated CVV.

7. The computer-readable medium of claim 6, wherein the instructions cause the card processing server to send the first set of data comprise instructions that cause the card processing server to automatically sending the first set of data without first receiving a request for the dynamically-generated CVV.

8. The computer-readable medium of claim 7, wherein the instructions further cause the card processing server to:

automatically select additional service codes for the transaction card, wherein additional dynamically-generated CVVs for the transaction card are substantially unpredictable based on other dynamically-generated CVVs for the transaction card, each of the additional dynamically-generated CVVs being a sequence of characters based on the card number of the transaction card, the expiry date of the transaction card, and the additional service codes for the transaction card; and

automatically send, on a periodic basis, additional sets of data from the card processing server to the cardholder device, each of the additional sets of data indicating one of the additional dynamically-generated CVVs.

9. The computer-readable medium of claim 6,

wherein the instructions further cause the card processing server to, in response to receiving the transaction request, determine whether a transaction limit has been exceeded, the transaction limit indicating how many economic transactions are permitted to specify the CVV specified in the transaction request;

and

wherein the instructions that cause the card processing server to record the charge comprises instructions that cause the card processing server to record the charge against the account of the cardholder when it is determined that the provided CVV corresponds to the dynamically-generated CVV and the transaction limit has not been exceeded.

10. The computer-readable medium of claim 6, wherein the instructions that cause the card processing server to select the dynamic service code comprise instructions that cause the card processing server to use a pseudo-random process to select the dynamic service code.

11. The computer-readable medium of claim 6, wherein the instructions that cause the card processing server to automatically generate the dynamically-generated CVV comprise instructions that cause the card processing server to:

concatenate the card number of the transaction card, the expiry date of the transaction card, and the dynamic service code, thereby generating a first value;

pad the first value with zeroes such that the first value includes 128 bits, thereby generating a second value;

split the second value into a first 64-bit block and a second 64-bit block;

encrypt the first 64-bit block with a first encryption key, thereby generating a third value;

perform an “

exclusive or”

operation on the third value and the second 64-bit block, thereby generating a fourth value;

encrypt the fourth value with the first encryption key, thereby generating a fifth value;

decrypt the fifth value with a second encryption key, thereby generating a sixth value;

encrypt the sixth value with the first encryption key, thereby generating a seventh value;

extract all numeric digits in the seventh value, thereby generating an eighth value;

extract all alphabetical digits in the seventh value, thereby generating a ninth value;

convert the ninth value into numeric digits, thereby generating a tenth value;

concatenate the eighth value and the tenth value, thereby generating an eleventh value; and

select leftmost three digits of the eleventh value as the dynamically-generated CVV.

12. The computer-readable medium of claim 6, further comprising instructions that cause the card processing server to:

when it is determined that the provided CVV does not correspond to the dynamically-generated CVV, automatically send a transaction rejection message from the card processing server to a merchant who sent the transaction request; and

when it is determined that the provided CVV corresponds to the dynamically-generated CVV, automatically send a transaction acceptance message from the card processing server to the merchant.

13. The computer-readable medium of claim 6, further comprising instructions that cause the card processing server to:

determine whether the CVV specified in the transaction request corresponds to a statically-generated CVV for the transaction card; and

record the charge against the account of the cardholder of the transaction card when it is determined that the CVV specified in the transaction request corresponds to the statically-generated CVV for the transaction card.

14. The computer-readable medium of claim 6,

wherein the computer-readable medium further comprises instructions that enable the card processing server to receive, at the card processing server, a CVV request from the cardholder device, the CVV request indicating that the cardholder device is requesting a dynamically generated CVV for the transaction card;

and

wherein the instructions that cause the card processing server to send the first set of data comprise instructions that cause the card processing server to send the first set of data in response to the CVV request.

15. The computer-readable medium of claim 6, wherein the instructions that cause the card processing server to send the first set of data comprise instructions that cause the card processing server to automatically send a text message from the card processing server to the cardholder device, the text message containing the first set of data.

16. The computer-readable medium of claim 6, wherein the instructions that cause the card processing server to send the first set of data comprise instructions that cause the card processing server to automatically output signals that represent a vocalization of the dynamically-generated CVV.

17. The computer-readable medium of claim 6,

wherein the computer-readable medium further comprises instructions that cause the card processing server to automatically determine, in response to receiving the transaction request, whether a time period associated with the dynamically-generated CVV has expired;

and

wherein the instructions that cause the card processing server to record the charge comprises instructions that cause the card processing server to automatically record the charge against the account of the cardholder only when it is further determined that the time period associated with the dynamically-generated CVV has not expired.

18. The computer-readable medium of claim 6, wherein the computer-readable medium further comprises instructions that cause the card processing server to:

in response to receiving the transaction request, automatically determine whether the economic transaction is occurring in a situation in which a dynamically-generated CVV is required to successfully complete economic transactions using the transaction card;

determine whether the provided CVV is a dynamically-generated CVV; and

reject the economic transaction when it is determined that the economic transaction is occurring in a situation in which a dynamically-generated CVV is required to successfully complete the economic transaction using the transaction card and when it is determined that the provided CVV is not a dynamically-generated CVV.

19. The computer-readable medium of claim 18,

wherein the computer-readable medium further comprises instructions that enable the card processing server to receive user preference input that indicates the situation;

and

wherein the instructions that enable the card processing server to receive the user preference input comprises instructions that enable the card processing server to receive user preference input that specifies one or more of types of user preference input selected from a group consisting of;

a currency amount for an economic transaction above which a dynamically-generated CVV for the transaction card is required to successfully complete an economic transaction using the transaction card,

a currency amount for a time period above which a dynamically-generated CVV for the transaction card is required to successfully complete an economic transaction using the transaction card,

a type of merchant for which a dynamically-generated CVV for the transaction card is required to successfully complete an economic transaction using the transaction card with a merchant belonging to the type of merchant,

a geographic location for which a dynamically-generated CVV for the transaction card is required to successfully complete an economic transaction using the transaction card with a merchant in the geographic location, and

a number of economic transactions for which a dynamically-generated CVV for the transaction card is required to successfully complete an economic transaction using the transaction card when the transaction card is used more than the number of economic transactions during a given time period.

20. A card processing server comprising:

a processor;

a network interface; and

a data storage system storing instructions that, when executed by the processor, cause the card processing server to;

use a pseudo-random process to select a dynamic service code;

generate a dynamically-generated CVV based on a card number of a transaction card, an expiry date of the transaction card, and the dynamic service code;

use the network interface to send to a cardholder device a first set of data, the first set of data indicating the dynamically-generated CVV;

determine, in response to receiving a transaction request from a merchant, whether a provided CVV corresponds to the dynamically-generated CVV,

wherein the transaction request specifies the provided CVV, the card number of the transaction card, the expiry date of the transaction card, the merchant, and an amount of an economic transaction;

automatically determine, when it is determined that the provided CVV corresponds to the dynamically-generated CVV, whether the dynamically-generated CVV is valid;

automatically record a charge against an account of a cardholder of the transaction card when it is determined that the provided CVV corresponds to the dynamically-generated CVV and the dynamically-generated CVV is valid.