System and method for securing sensitive information during completion of a transaction

• US 7,542,942 B2
• Filed: 03/11/2004
• Issued: 06/02/2009
• Est. Priority Date: 07/10/2001
• Status: Expired due to Fees

• Current Assignee: Liberty Peak Ventures, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: American Express Travel Related Services Company, Inc. (American Express Company)
• Inventors: Saunders, Peter D., Peart, Lee J.
• Primary Examiner(s): Kazimi, Hani
• Assistant Examiner(s): Akintola, Olabode
• Application Number:
  US10/708,569
• Publication Number:
  US 20050033686A1
• Time in Patent Office: 1,909 Days
• Field of Search: None
• US Class Current: 705/39
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/14 specially adapted for billing systems
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G07C 9/28 the pass enabling tracking or indicating presence
• CPC Class Codes: G07C 9/29 the pass containing active electronic elements, e.g. smartcards

Abstract

A system and method for securing a Radio Frequency (RF) transaction using a proxy code, which is permanently assigned to the RF identification device (RFID) transaction account number. An account issuer permanently assigns the proxy code to a transaction account correlated to the RFID transaction device. The proxy code is uploaded onto the transaction device for later use in completing a transaction request. During transaction completion, the proxy code is provided to a merchant system in lieu of any sensitive transaction account information. Since the proxy code is permanently assigned, the number need not be changed or updated once uploaded into a payment device or merchant system. Since the proxy code contains no sensitive information, the sensitive information related to the transaction account is secured from theft where the merchant system internal security measures may fail.

Claims

1. A system for completing a transaction using a transaction device comprising:

a transaction device associated with a transaction account and a transaction account identifier identifying the transaction account, said transaction device including a transaction device database for storing said transaction account identifier;

a transaction device reader system in communication with said transaction device and configured to receive the transaction account identifier from said transaction device, wherein, after receiving said transaction account identifier, said transaction device reader system generates a transaction device proxy code, deletes the transaction account identifier, and does not communicate the transaction account identifier for use in further transaction processing; and

a transaction device account issuer system configured to;

maintain the transaction account associated with the transaction device,

receive the transaction device proxy code,

correlate the transaction device proxy code with the transaction account, and

process the transaction using the transaction account.

2. A system according to claim 1, further comprising a merchant system in communication said transaction device account issuer system, said merchant system including a merchant system database and said transaction device reader system, wherein said transaction device reader system is a point of interaction (POI) device in communication with said transaction device for transmitting and receiving data from said transaction device in a contactless environment, the POI being in RF communication with said transaction device.

3. A system according to claim 2, said merchant system associating said transaction device proxy code to a transaction request.

4. A system according to claim 3, wherein said merchant system provides at least said transaction device proxy code and said transaction request to said issuer system.

5. A system according to claim 4, wherein said transaction device account issuer system correlates said transaction device proxy code to said transaction account identifier and then to said transaction account, said transaction device account issuer system satisfying said transaction request relative to said transaction account.

6. A system according to claim 5, wherein said transaction account identifier is encrypted prior to providing said transaction account identifier to said merchant system.

7. A system according to claim 6, wherein said transaction device proxy code is decrypted by said transaction device account issuer system prior to said transaction device account issuer system correlating said transaction device proxy code to said transaction account.

8. A system according to claim 7, wherein said proxy code is unique to said transaction account.

9. A system according to claim 7, wherein said transaction device proxy code is unique to said transaction device account issuer system.

10. A method for completing a transaction in a contactless environment said method including:

providing a transaction account identifier to a radio frequency identification (RFID) transaction device;

transmitting said transaction account identifier from said RFID transaction device to a transaction device reader system;

receiving, at the transaction device reader system, the transaction account identifier, wherein after receiving the transaction account identifier, the transaction device reader system generates a transaction device proxy code, deletes the transaction account identifier, and does not communicate the transaction account identifier for use in further transaction processing;

receiving said transaction device proxy code at a transaction device issuer system, said transaction device issuer system maintaining a transaction account correlative to the transaction account identifier, wherein said transaction device issuer system correlates the transaction device proxy code with the transaction account; and

facilitating the completion of a transaction request correlative to the transaction account.

11. A method according to claim 10, further including correlating the proxy code to a distinct transaction device.

12. A method according to claim 10, further including correlating the proxy code to a distinct transaction account issuer system.