Secure authentication and payment system

• US 8,423,466 B2
• Filed: 03/28/2007
• Issued: 04/16/2013
• Est. Priority Date: 10/25/2006
• Status: Active Grant

• Current Assignee: Leading Software Limited
• Original Assignee: Payfont Limited
• Inventors: Lanc, David
• Primary Examiner(s): Robinson, Kito R
• Application Number:
  US11/692,656
• Publication Number:
  US 20080103972A1
• Time in Patent Office: 2,211 Days
• Field of Search: 705/44, 705/35
• US Class Current: 705/44
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/325 using wireless networks
• CPC Class Codes: G06Q 20/3255 using mobile network messaging services for payment, e.g. SMS
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/405 Establishing or using transaction specific rules
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions

Abstract

The present invention provides a service for allowing secure financial transactions to be carried out, the service involving authenticating a user'"'"'s identity and/or status as part of a financial transaction with another party and in the event that the user is authenticated arranging for the transaction to be completed without revealing the user'"'"'s financial details and/or other personal details to that other party. Authentication data and transaction data may be communicated over any suitable communications channel(s). The invention provides a trusted authentication and payment environment that protects a user'"'"'s financial details, but allows them to be securely authenticated and arranges for transactions to be fulfilled, while providing other parties with reassurance that transactions will be completed. In this way, fraud and theft due to misappropriation of financial details can be minimized.

Claims

1. A combined identity protection and secure transaction routing system for facilitating a financial transaction between a first user and a second user comprising:

a computer based authentication system for authenticating at least the first user, the authentication system being configured to implement a plurality of established and user-defined authentication methods that are dynamically controllable and selectable by the first user at various transaction stages of the financial transaction and conform to standards set by relevant payment organisation'"'"'s rules, wherein upon the first user dynamically selecting one or more particular authentication methods from the plurality of established and user-defined authentication methods during a particular transaction stage, the authentication system is configured to combine the one or more selected authentication methods, and one or more interaction methods, and one or more communication media to become user-specific dynamic authentication components so as to authenticate at least the first user in a non-predictable manner;

one or more computer, electronic or physically based payment encryption and transaction routing systems, dynamically selectable and arrangable by the first user in combination with the first user'"'"'s independent dynamically selected authentication methods, for arranging and securely routing one or more particular payment methods during the financial transaction or a particular transaction stage between the first user and at least the second user after the first user is authenticated by the authentication system, wherein upon the first user selecting the one or more particular payment methods during the financial transaction or the particular transaction stage, the one or more particular payment methods are routed between the first user and at least the second user in a non-predictable manner and without disclosing the one or more payment methods used for the financial transaction or the particular transaction stage or the first user'"'"'s financial details and personal identity to the second user; and

the one or more communication media and the one or more interaction methods, dynamically controllable and selectable by the first user, wherein upon the first user selecting one or more of at least the one or more communication media or the one or more interactions methods during the financial transaction or at a particular transaction stage, each decomposed transaction element of the financial transaction or the particular transaction stage is routed and transmitted in a non-predictable manner.

2. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to process a transaction that is or includes payment for goods or services.

3. A combined identity protection and secure transaction routing system according to claim 1, in which payment methods are functionally or physically separate from the authentication methods.

4. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to apply the same authentication methods to all users that are party to a transaction.

5. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to receive transaction details from at least the first and second users;

compare the received transaction details to ensure that they are identical and arrange payment only if the transaction details match.

6. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to arrange payment directly from at least one of the first user'"'"'s account, such as a credit or debit card account or any other financial payment method provided to allow the user to make payments.

7. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to receive payment and hold it in escrow until goods are dispatched or services provided or the first user acknowledges the payment is valid.

8. A combined identity protection and secure transaction routing system according to claim 1 wherein the transaction is a cash withdrawal or cash advance.

9. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to be used with transactions over one or multiple transaction channels.

10. A combined identity protection and secure transaction routing system according to claim 9, wherein the transaction channels include face-to-face or mail order or telephone order or Internet shopping or user-to-user transfers or purchase by mobile phone or other contactless purchase methods.

11. A combined identity protection and secure transaction routing system according to claim 1 including a communications system for allowing at least one of the first or second user to interact with the system via the Internet or another network using an IP protocol or telephone or mobile data communications services.

12. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to apply the same authentication regardless of transaction channel, so that a consistent level of security is applied in all transactions.

13. A combined identity protection and secure transaction routing system according to claim 1, wherein the transaction system is adapted to apply differing authentication to differing transaction channels.

14. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to receive data from a transaction device.

15. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to apply at least two authentication stages.

16. A combined identity protection and secure transaction routing system according to claim 15, wherein each authentication stage requires at least one of:

(1) input of personal identification numbers or code words or personal details or answers to challenge questions or biometric data or matching of a user with a list of authorized users for a transaction device or valid reading of an EMV compliant card or other registered identity card or cross referencing two or more sets of provided authentication data;

or (2) selection of one or more communication media and one or more interaction methods.

17. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to apply at least three authentication stages.

18. A combined identity protection and secure transaction routing system according to claim 1, wherein authentication involves comparing the input data with user related data stored by the system.

19. A combined identity protection and secure transaction routing system according to claim 1, wherein authentication involves online or offline authentication stages.

20. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to store user names or user identification codes or user addresses or user address codes or user payment account details or user operating parameters or user transaction histories or audit trails.

21. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to process orders using a user identification code and a delivery address code uniquely associated with at least the first user.

22. A combined identity protection and secure transaction routing system according to claim 21 that is adapted to receive the delivery address code of at least the first user, determine an address corresponding to the delivery address code and to provide the address to the second user only when the second user has been authenticated and has confirmed that it is in a position to fulfill the financial transaction.

23. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to have more than one payment method associated with at least one of the first or second user.

24. A combined identity protection and secure transaction routing system according to claim 23 that is adapted such that at least one of the payment methods is assignable for use in specified transactions.

25. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to use a payment method to carry out a payment after authenticating at least one of the first or second user and when provided with an identification code of at least one of the first or second user rather than details of the payment method to be used.

26. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to send a notification to at least one of the first or second user to confirm events.

27. A combined identity protection and secure transaction routing system according to claim 26, wherein the events of which the at least one of the first or second user is notified include authentication failures or mismatch of order details supplied by the first and second users or an order is available for dispatch or an order is only partially fulfilled or a payment is to be made or a payment is refused or the financial transaction has been referred or at least one of the first or second user has, or is close to, breach of their operating parameters.

28. A combined identity protection and secure transaction routing system according to claim 26, wherein the notification is a short message service (SMS) message or e-mail or telephone call or message sent to a transaction device.

29. A combined identity protection and secure transaction routing system according to claim 26, wherein the notification is via a different communication media to the placing of an order.

30. A combined identity protection and secure transaction routing system according to claim 26 that is adapted to obtain authentication of at least one of the first or second user before providing access to the notification.

31. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to assign at least one identity code to at least the first user, whereby the authentication methods are adapted to validate an identity or status of the first user to the second user upon provision of the first user'"'"'s identity code to the system by the second user.

32. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to validate whether or not at least one of the first or second user is a registered user of the system or the at least one of the first or second user is transacting within specified criteria or a user account has permission for carrying out the financial transaction.

33. A combined identity protection and secure transaction routing system according to claim 32, wherein the specified criteria include that transactions values or transaction velocities are within a set limit or that the transaction is of a specified type.

34. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to allow at least one sub user to operate on behalf of at least one of the first or second user.

35. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to require re-authentication by at least one of the first or second user if the financial transaction has not been completed within a specified time-scale or require at least one of the first or second user to review or accept the financial transaction if the financial transaction has not been completed within a specified time-scale.

36. A combined identity protection and secure transaction routing system according to claim 1 that is adapted to allow at least one of the first or second user to make or receive payments in a currency of choice and convert the currency of the payments such that the currency in which the payments are made is different to the currency in which the payments are received.

37. A combined identity protection and secure transaction routing system according to claim 1, wherein the computer based authentication system is arranged to communicate with the first user to receive first authentication data, communicate with the second user to receive second authentication data and authenticate the first and second users using the respective first and second authentication data.

38. A combined identity protection and secure transaction routing system according to claim 1, wherein the computer based authentication system is arranged to receive authentication data over a plurality of communications channels.

39. A combined identity protection and secure transaction routing system according to claim 1, wherein the computer based authentication system is adapted to authenticate the identity of at least the first and second user.

40. A combined identity protection and secure transaction routing system according to claim 1, wherein the first user dynamically selects and arranges the one or more payment methods during the financial transaction or a particular transaction stage in combination with but independent of the selected one or more authentication methods, and the first user dynamically selects a particular combination of the one or more communication media during the financial transaction or the particular transaction stage independent of the selected one or more authentication methods and the selected one or more payment methods.

41. An authentication and secure transaction device for use, in single or multiple component transaction parts, as part of a multi-device, multi-input method, multi-communication media, multi-interaction method, user-controlled and defined configuration, with a secure transaction routing system, comprising:

a processor that is configured to;

allow at least one of a first or second user to register centrally, or maintain locally, a plurality of user configured, dynamic, independent authentication methods that are dynamically controllable and selectable by the first user or the second user at various transaction stages of a financial transaction being conducted between the first user and at least the second user and to select the authentication methods at the various transaction stages of the financial transaction to be used to authenticate at least one of the first or second user in a non-predictable manner; and

authenticate at least a first user'"'"'s identity or status as a precursor to facilitating the financial transaction or particular transaction stage with at least the second user and in an event that at least the first user is authenticated, arranging for the financial transaction or the particular transaction stage to be completed using, under user or centrally-directed dynamic selection, a predefined or user-selected combination of independent, decoupled payment methods during the financial transaction or the particular transaction stage, in a non-predictable manner, the payment methods comprising at least one payment authentication method for further identity authentication related to the specific transaction, followed by a predefined or user-selected payment method, secured at least in accordance with payment organization rules associated with that payment method or combination of payment methods, without revealing the payment methods, the first user'"'"'s financial details, or other personal identity details to the second user, wherein;

as appropriate under valid transaction combinations, the authentication and secure transaction device is associated with the first user and operable to communicate with the secure transaction routing system in order to authenticate the first user using one or more communication media and one or more interaction methods selected by the first user during the financial transaction or at a particular transaction stage so that each decomposed transaction element of the financial transaction or the particular transaction stage is routed and transmitted in a non-predictable manner.

42. An authentication and secure transaction device according to claim 41 comprising means for inputting data and means for communicating data to the secure transaction routing system.

43. An authentication and secure transaction device according to claim 42, wherein the means for inputting data is a keypad or a trackball or a joystick or a biometric feature reader or a reader.

44. An authentication and secure transaction device according to claim 43, wherein the biometric feature reader includes a fingerprint reader or a retinal scanner or a voice analyzer.

45. An authentication and secure transaction device according to any of claim 43, wherein the reader is a chip card reader or a magnetic strip card reader or a radio frequency identification (RFID) card reader.

46. An authentication and secure transaction device according to claim 42, wherein the means for communicating data includes wireless or mobile telecommunications apparatus or bluetooth communications apparatus or WiFi communications apparatus, such as WiFi 802.11a/b/g communications apparatus or infrared communications apparatus or RFID communications apparatus or NFC communications apparatus or a USB port or a firewire port.

47. An authentication and secure transaction device according to claim 46 wherein the mobile telecommunications apparatus is adapted to operate over GPRS or 3G or GSM or CDMA networks.

48. An authentication and secure transaction device according to claim 41 that is adapted to implement at least two authentication stages.

49. An authentication and secure transaction device according to claim 41, wherein the transaction device is adapted to apply at least three authentication stages.

50. An authentication and secure transaction device according to claim 49, wherein each authentication stage requires input of personal identification numbers or code words or personal details or answers to challenge questions or biometric data or matching of a user with a list of authorized users for the transaction device or valid reading of an EMV compliant card or other registered identity card or cross referencing two or more sets of provided authentication data.

51. An authentication and secure transaction device according to claim 41 that is configured to apply online or offline authentication stages.

52. An authentication and secure transaction device according to claim 41, wherein the transaction device is arranged to communicate authentication data to the transaction routing system over a plurality of communications channels.

53. A computer implemented method for allowing a secure financial transaction to be carried out between a first user and a second user, the method involving:

registering centrally or maintaining locally or through access to a plurality of independent, secure third parties, user-selected, dynamic, independent authentication methods that are dynamically controllable and selectable by the first user or the second user at various transaction stages of the financial transaction;

receiving a dynamic selection of one or more of the authentication methods used to authenticate the first user or accepting one or more of the authentication methods mandated by the relevant payment organization'"'"'s rules so as to authenticate at least the first user in a non-predictable manner;

authenticating at least a first user'"'"'s identity or status using a computer based authentication as a precursor to facilitating the financial transaction or a particular transaction stage with at least the second user; and

in an event that at least the first user is authenticated, arranging for the financial transaction or the particular transaction stage to be completed using, under user dynamic selection, a predefined or user-selected combination of independent, decoupled payment methods during the financial transaction or the particular transaction stage, in a non-predictable manner, the payment methods comprising at least one computer based payment authentication method for further identity authentication related to each specific transaction, followed by a predefined or user-selected payment method, secured at least in accordance with rules associated with that payment method, without revealing the payment methods, the first user'"'"'s financial details, or other personal details to the second user;

wherein

authentication data and transaction data are communicated over different communications channels, the communications channels being selected by the first user during the financial transaction or at a particular transaction stage so that the authentication data and transaction data are routed and transmitted in a non-predictable manner.

54. A method according to claim 53, wherein authenticating the first user involves receiving authentication data input by the first user via at least one communications channel.

55. A method according to claim 53, wherein the communications channel is a wireless telecommunications network or the Internet or e-mail or any other suitable communications channel.

56. A method according to claim 54, wherein different communications channels are selectable for different transaction types.

57. A method according to claim 54 comprising sending communications to the first user via a wireless telecommunications network or the Internet or e-mail.

58. A method according to claim 54 comprising sending communications to the first user via a different channel to those from the first user.

59. A method according to claim 53, including notifying at least one of the first or second user of events, including at least one of authentication failures or mismatch of order details supplied by the first and second users or an order is available for dispatch or an order is only partially fulfilled or a payment is refused or the financial transaction has been referred or at least one of the first or second user has, or is close to, breach of their operating parameters.

60. A method according to claim 59, wherein the least one of the first or second user being notified may have to be authenticated before access is given to the notification.

61. A method according to claim 53, wherein the authentication involves two-stage authentication.

62. A method according to claim 53, wherein the authentication involves at least three-stage authentication.

63. A method according to claim 61, wherein each authentication stage involves input of personal identification numbers or code words or personal details or answers to challenge questions or matching of at least one of the first or the second user with a list of authorized users for a transaction device or cross referencing two or more sets of input authentication data.

64. A method according to claim 53, wherein authentication involves comparing the input data with user related data stored by the system.

65. A method according to claim 53, wherein authentication involves online or offline authentication stages.

66. A method according to claim 53, wherein the service allows at least one of the first or second user to register one or more payment methods.

67. A method according to claim 53, wherein a particular payment method is assignable for use in specified transactions.

68. A method according to claim 67, wherein at least one of the first or second user may specify that a particular payment method may be used for transactions only with a particular organization.

69. A method according to claim 53, wherein a payment is made when the first user'"'"'s authentication/identification code is provided rather than details of the payment method to be used.

70. A method according to claim 53, wherein at least one of the first user'"'"'s payment methods may be used in the step of authenticating the first user.

71. A method according to claim 70, wherein the payment method used for authentication is different from the payment method used to complete the financial transaction.

72. A method according to claim 53, wherein the financial transaction is a purchase or a cash withdrawal or money transfer.

73. A method according to claim 53 involving defining operating parameters for at least one of the first or second user and checking that the financial transaction does not breach those operating parameters before making payment.

74. A method according to claim 53, wherein the service further involves allocating a user identification code to at least the first user, the first user providing the first user'"'"'s identification code to at least the second user, the service authenticating the second user, the second user providing the first user'"'"'s identification code to the service and the service comparing the first user'"'"'s identification code with data stored in user records to confirm that the first user is a registered user of the system.

75. A method according to claim 53, wherein payment is held in escrow until goods have been dispatched.

76. A method according to claim 53, wherein a same level of authentication is applied to the first and second users.

77. A method according to claim 53, comprising communicating with the first user to receive first authentication data, communicating with the second user to receive second authentication data and authenticating the first and second users using the respective first and second authentication data.

78. A method according to claim 53, comprising communicating authentication data over a plurality of communications channels.

79. A method according to claim 53, comprising authenticating the identity of at least the first and second user.

80. A computer-executable program tangibly embodied on a non-transitory computer readable medium for:

implementing at least one of the features of a combined identity protection and secure transaction system for facilitating a financial transaction between a first user and a second user, the system comprising;

a computer based authentication system for authenticating at least the first user, the authentication system configured to implement a plurality of established and user-defined authentication methods that are dynamically controllable and selectable by the first user at various transaction stages of the financial transaction or mandated by a relevant payment organization'"'"'s rules, wherein upon the first user dynamically selecting one or more particular authentication methods from the plurality of established and user-defined authentication methods or acceptance of one or more of the authentication methods mandated by the relevant payment organization'"'"'s rules during a particular transaction stage, the authentication system is configured to combine the one or more selected authentication methods, one or more interaction methods, and one or more communication media to become user-specific dynamic authentication components so as to authenticate at least the first user in a non-predictable manner;

one or more computer, electronic or physically based payment encryption and transaction routing systems, dynamically selectable and arrangable by the first user in combination with the first user'"'"'s independent dynamically selected authentication methods, for arranging and securely routing one or more particular payment methods during the financial transaction or a particular transaction stage between the first user and at least the second user after the first user is authenticated by the authentication system, wherein upon the first user selecting the one or more particular payment methods during the financial transaction or the particular transaction stage, the one or more particular payment methods are routed between the first user and at least the second user in a non-predictable manner and without disclosing the one or more payment methods used for the financial transaction or the particular transaction stage or the first user'"'"'s financial details and personal identity to the second user; and

the one or more communication media and the one or more interaction methods, dynamically controllable and selectable by the first user, wherein upon the first user selecting one or more of at least the one or more communication media or the one or more interactions methods during the financial transaction or at a particular transaction stage, each decomposed transaction element of the financial transaction or the particular transaction stage is routed and transmitted in a non-predictable manner.

81. A computer-executable program tangibly embodied on a non-transitory computer readable medium for implementing at least one of the features of an authentication and secure transaction device for use, in single or multiple component transaction parts, as part of a multi-device, multi-input, multi-communication media, multi-interaction method, user-controlled and defined configuration, with a secure transaction routing system that is configured to:

allow at least one of a first or second user to register centrally, or maintain locally, a plurality of user configured, dynamic, independent authentication methods that are dynamically controllable and selectable by the first user or the second user at various transaction stages of a financial transaction being conducted between the first user and at least the second user and to select the authentication methods at the various transaction stages of the financial transaction to be used to authenticate at least one of the first or second user in a non-predictable manner; and

authenticate at least a first user'"'"'s identity or status as a precursor to facilitating the financial transaction or a particular transaction stage with at least the second user and in an event that at least the first user is authenticated, arranging for the financial transaction or the particular transaction stage to be completed using, under user or centrally-directed dynamic selection, a predefined or user-selected combination of independent, decoupled payment methods during the financial transaction or the particular transaction stage, in a non-predictable manner, the payment methods comprising at least one payment authentication method for further identity authentication related to the specific transaction, followed by a predefined or user-selected payment method, secured at least in accordance with payment organization rules associated with that payment method or combination of payment methods, without revealing the payment methods, the first user'"'"'s financial details, or other personal identity details to the second user, wherein

as appropriate under valid transaction combinations, the authentication and secure transaction device is associated with the first user and operable to communicate with the transaction routing system in order to authenticate the first user using one or more communication media and one or more interaction methods selected by the first user during the financial transaction or at a particular transaction stage so that each decomposed transaction element of the financial transaction or the particular transaction stage is routed and transmitted in a non-predictable manner.

82. A server when programmed with a computer-executable program for:

implementing at least one of the features of a combined identity protection and secure transaction routing system for facilitating a financial transaction between a first user and a second user, the system comprising;

a computer based authentication system for authenticating at least the first user, the authentication system configured to implement a plurality of established and user-defined authentication methods that are dynamically controllable and selectable by the first user at various transaction stages of the financial transaction or mandated by a relevant payment organisation'"'"'s rules, wherein upon the first user dynamically selecting one or more particular authentication methods from the plurality of established and user-defined authentication methods or acceptance of one or more of the authentication methods mandated by the relevant payment organisation'"'"'s rules during a particular transaction stage, the authentication system is configured to combine the one or more selected authentication methods, one or more interaction methods, and one or more communication media to become user-specific dynamic authentication components so as to authenticate at least the first user in a non-predictable manner;

one or more computer, electronic or physically based payment encryption and transaction routing systems, dynamically selectable and arrangable by the first user in combination with the first user'"'"'s independent dynamically selected authentication methods, for arranging and securely routing one or more particular payment methods during the financial transaction or a particular transaction stage between the first user and at least the second user after the first user is authenticated by the authentication system, wherein upon the first user selecting the one or more particular payment methods during the financial transaction or the particular transaction stage, the one or more particular payment methods are routed between the first user and at least the second user in a non-predictable manner and without disclosing the one or more payment methods used for the financial transaction or the particular transaction stage or the first user'"'"'s financial details and personal identity to the second user; and

the one or more communication media and the one or more interaction methods, dynamically controllable and selectable by the first user, wherein upon the first user selecting one or more of at least the one or more communication media or the one or more interactions methods during the financial transaction or at a particular transaction stage, each decomposed transaction element of the financial transaction or the particular transaction stage is routed and transmitted in a non-predictable manner.

83. A server when programmed with a computer-executable program for implementing at least one of the features of an authentication and secure transaction device for use, in single or multiple component transaction parts, as part of a multi-device, multi-input, multi-communication media, multi-interaction method, user-controlled and defined configuration, with a secure transaction routing system that is configured to:

allow at least one of a first or second user to register centrally, or maintain locally, a plurality of user configured, dynamic, independent authentication methods that are dynamically controllable and selectable by the first user or the second user at various transaction stages of a financial transaction being conducted between the first user and at least the second user and to select the authentication methods at the various transaction stages of the financial transaction to be used to authenticate at least one of the first or second user in a non-predictable manner; and

authenticate at least a first user'"'"'s identity or status as a precursor to facilitating the financial transaction or a particular transaction stage with at least the second user and in an event that at least the first user is authenticated, arranging for the financial transaction or the particular transaction stage to be completed using, under user or centrally-directed dynamic selection, a predefined or user-selected combination of independent, decoupled payment methods during the financial transaction or the particular transaction stage, in a non-predictable manner, the payment methods comprising at least one payment authentication method for further identity authentication related to the specific transaction, followed by a predefined or user-selected payment method, secured at least in accordance with payment organisation rules associated with that payment method or combination of payment methods, without revealing the payment methods, the first user'"'"'s financial details, or other personal identity details to the second user, wherein

as appropriate under valid transaction combinations, the authentication and secure transaction device is associated with the first user and operable to communicate with the transaction routing system in order to authenticate the first user using one or more communication media and one or more interaction methods selected by the first user during the financial transaction or at a particular transaction stage so that each decomposed transaction element of the financial transaction or the particular transaction stage is routed and transmitted in a non-predictable manner.