System and Method for Authenticating a Payment Transaction

• US 20130226800A1
• Filed: 11/06/2012
• Published: 08/29/2013
• Est. Priority Date: 02/28/2012
• Status: Active Grant

• Current Assignee: Barclays Execution Services Ltd. (Barclays PLC)
• Original Assignee: Barclays Bank PLC (Barclays PLC)
• Inventors: Patel, Pratik, Gardiner, James
• Granted Patent: US 10,332,110 B2
• Time in Patent Office: Days
• US Class Current: 705/44
• CPC Class Codes: G06Q 20/3224 Transactions dependent on location of M-devices
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

A system and method of authenticating a payment transaction between a merchant and a customer in an electronic payment system are described. Transaction details presented by the merchant are received at a mobile electronic device, the customer is authenticated by means of an authentication token presented by the customer at an authentication terminal, and the geo-location of the mobile electronic device and the authentication terminal are compared to verify that the device and terminal are within a predefined geographical distance at the time the payment transaction is processed.

Claims

1. A computer-implemented method of authenticating a payment transaction between a merchant and a customer in an electronic payment system, comprising the steps of:

receiving, by an authentication system, transaction details presented by the merchant at a mobile electronic device;

initiating an authentication process between a merchant authentication terminal and the authentication system;

verifying, by the authentication system, that the mobile electronic device and the merchant authentication terminal are within a predefined geographical distance at substantially a time the transaction details are received by the authentication system; and

authenticating the customer by an authentication token presented by the customer at the authentication terminal.

2. The method of claim 1, wherein the step of authenticating the customer is performed after verifying that the mobile electronic device and the merchant authentication terminal are within the predefined geographical distance at substantially the time the transaction details are received.

3. The method of claim 1, further comprising the step of transmitting a transaction authorization request after the authentication token is authenticated.

4. The method of claim 1, wherein the step of authenticating the customer further includes verifying a code entered by the customer to the merchant authentication terminal.

5. The method of claim 1, further comprising the step of receiving, by the authentication system, data indicating a geographical location of the merchant authentication terminal and a geographic location of the mobile electronic device, and calculating the distance between the geographical location of the merchant authentication terminal and the geographical location of the mobile electronic device.

6. The method of claim 5, wherein the mobile electronic device and the merchant authentication terminal are mutually authenticated when the geographical location of the merchant authentication terminal and the geographical location of the mobile electronic device are within a predefined distance and a time stamp of the geographical location of the merchant authentication terminal and the geographical location of the mobile electronic device is within a predefined time window from the time the transaction details are received by the merchant authentication system.

7. The method of claim 5, wherein the geographical location of the mobile electronic device and the geographical location of the merchant authentication terminal are determined by geo-location modules.

8. The method of claim 7, wherein the geo-location modules determine the geographical location of the merchant authentication terminal and the geographical location of the mobile electronic device using GPS or a network data based location technique.

9. The method of claim 5, wherein the geographical location of the merchant authentication terminal and the geographical location of the mobile electronic device are tracked at predefined intervals.

10. The method of claim 1, wherein the step of verifying that the mobile electronic device and the merchant authentication terminal are within a predefined geographical distance is performed by an authentication system of a merchant acquirer or a trusted third party associated with the merchant acquirer.

11. The method of claim 10, further comprising the step of storing data of associated mobile electronic devices and merchant authentication terminals in a database of the authentication system.

12. The method of claim 1, wherein the transaction details provided by the merchant at the mobile electronic device are provided via a secure application running on the mobile electronic device.

13. The method of claim 12, wherein the secure application is secured by means of a passcode.

14. A payment transaction system, comprising:

a mobile electronic device including a geo-location module;

a merchant authentication terminal including a geo-location module, the merchant authentication terminal in communication with the mobile electronic device;

an authentication system in communication with both the mobile electronic device and the merchant authentication terminal, the authentication system verifying that the mobile electronic device and an merchant authentication terminal are within a predefined geographical distance;

15. The payment transaction system according to claim 15, wherein an authentication token is presented by a customer at the merchant authentication terminal and the customer is authenticated by the authentication system.

16. The payment transaction system according to claim 15, wherein the mobile electronic device includes a merchant application that identifies goods or services, applies discounts or vouchers, determines an amount due for payment, and initiates authentication of a customer'"'"'s payment instrument.

17. The payment transaction system according to claim 15, wherein the merchant authentication terminal includes a token authenticator.

18. The payment transaction system according to claim 17, wherein the token authenticator is a card reader for receiving and verifying the card holder'"'"'s PIN, passcode or CV2.

19. The payment transaction system according to claim 15, wherein the mobile electronic device is a mobile smartphone, tablet computer or portable computing device.

20. The payment transaction system according to claim 15, wherein the mobile electronic device and the merchant authentication terminal communicate data over a data network.