Method and system for securing payment transactions

• US 8,577,804 B1
• Filed: 02/20/2009
• Issued: 11/05/2013
• Est. Priority Date: 02/20/2008
• Status: Active Grant

• Current Assignee: Stripe, Inc.
• Original Assignee: Collective Dynamics LLC
• Inventors: Bacastow, Steven V.
• Primary Examiner(s): ZARE, SCOTT A
• Application Number:
  US12/390,003
• Time in Patent Office: 1,719 Days
• Field of Search: 705/44
• US Class Current: 705/44
• CPC Class Codes: G06Q 20/027 involving a payment switch or gateway
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/203 Inventory monitoring
• CPC Class Codes: G06Q 20/204 comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
• CPC Class Codes: G06Q 20/26 Debit schemes, e.g. "pay now"
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/356 Aspects of software for card payments
• CPC Class Codes: G06Q 20/36 using electronic wallets or electronic money safes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation

Abstract

A method for facilitating the widespread use of the PIN-Debit payment method for Internet “eCommerce” and mobile payments sales which requires little or no change for the cardholders, merchants, debit networks and card issuers based primarily on the introduction of a layer of middleware and wherein the Debit Networks and Issuing Banks may customize the implementation of the services based on individual strategy and cardholder preferences.

Claims

1. A method for processing a PIN-debit transaction conducted at a website operated by a merchant comprising the steps of:

receiving from a consumer in connection with a registration event, a mobile PIN and a card number associated therewith, the mobile PIN and the card number received at a PIN-debit service computing device;

in association with the registration event, receiving, at the PIN-debit service computing device from an issuer bank, an alternate PIN associated with the card number;

receiving payment data at a payment acquirer computing device, the payment data received from a server hosting the website, the payment data comprising the card number;

analyzing the payment data with the payment acquirer computing device to identify the payment data as associated with a transaction of the PIN-debit type;

upon identifying the payment data as associated with the PIN-debit type of transaction, forwarding the payment data from the payment acquirer computing device to the PIN-debit service computing device, the PIN-debit service computing device;

communicating a primary approval request to a mobile telephone of the consumer;

after receiving a primary approval response from the consumer'"'"'s mobile telephone, the PIN-debit service computing device adding the alternate PIN to the payment data, and transmitting the payment data and the alternate PIN to a debit network for processing;

transmitting a secondary confirmation request to the consumer; and

after receiving from the consumer a secondary confirmation response to the secondary confirmation request, the PIN-debit service computing device transmitting a payment confirmation to the merchant.

2. The method of claim 1, wherein the payment data further comprises an address and one or more of a name, a CVV code, and a card expiration date.

3. The method of claim 1, wherein the PIN-debit service computing device is further operable to:

determine whether the operator of the website is an approved merchant; and

determine whether the payment data exceeds a predetermined value.

4. The method of claim 3, whereby upon failure to determine that the operator of the website is an approved merchant, the PIN-debit service computing device rejects the PIN-debit transaction.

5. The method of claim 1, wherein a response code indicating whether the PIN-debit transaction has been approved or rejected by the issuer bank is transmitted from the PIN-debit service computing device to the merchant.

6. The method of claim 1, wherein the step of receiving from the consumer a confirmation response to the confirmation request, must occur within a specified time frame in order to halt the PIN-debit transaction.

7. The method of claim 6, wherein the specified time frame is five minutes.

8. The method of claim 1, wherein the approval received from the consumer'"'"'s mobile telephone by the PIN-debit service computing device is a pre-registered mobile PIN number that is only operable for use in payment transactions authenticated using a mobile telephone.

9. The method of claim 1, wherein during the registration event the consumer sets restrictions associated with the card number when used for the PIN-debit transaction approved by the mobile telephone, the restrictions comprising at least one of a transaction limit, a daily limit, and an approved merchant list.

10. The method of claim 1, wherein the payment confirmation sent to the merchant is functionally comparable to a record typically associated with a credit card and signature debit transaction type.

11. The method of claim 1, wherein the transaction record is one of an ISO 8583 payment transaction type.

12. The method of claim 1, wherein the step of receiving from the consumer the secondary confirmation response to the secondary confirmation request, must occur within a specified time frame in order for the PIN-debit transaction to be completed.

20. The method of claim 8 wherein the pre-registered mobile PIN number is generated by the PIN-debit service computing device using a proprietary algorithm.

13. A system operable for processing a PIN-debit transaction conducted at a website operated by a merchant comprising:

a PIN-debit service computing device operable for receiving, in connection with a registration, a mobile PIN and a card number associated therewith;

the PIN-debit service computing device further operable for receiving from an issuer bank, in association with the registration, an alternate PIN associated with the card number;

the PIN-debit service computing device further operable for receiving from a customer, in association with the registration, a secondary confirmation rule associated with the card number, the secondary confirmation rule stored as a time setting;

an acquirer computing device operable for receiving a transaction record from the merchant, the transaction record comprising the card number, and operable for determining that the transaction record represents a PIN-debit transaction; and

the PIN-debit service computing device further operable for receiving the transaction record from the acquirer computing device, the transaction record representing a PIN-debit transaction, the PIN-debit service computing device further operable for

communicating with a mobile telephone of the customer to obtain a primary approval for the transaction record,

after receiving the primary approval from the customer mobile telephone, adding the alternate PIN to the transaction record,

forwarding the transaction record with the alternate PIN to a debit network for processing;

transmitting a secondary confirmation request to the customer; and

after receiving from the customer a secondary confirmation response to the secondary confirmation request, the PIN-debit service computing device transmitting a merchant confirmation to the merchant.

14. The system of claim 13 further comprising an issuer computing device coupled to the debit network wherein the issuer computing device decides whether the transaction record is approved or denied.

15. The system of claim 13, wherein the PIN-debit service computing device is further operable to:

determine whether the operator of the website is an approved merchant; and

determine whether the payment data exceeds a predetermined value.

16. The system of claim 13, wherein the mobile PIN received by the PIN-debit service computing device during the registration is received from a customer.

17. The system of claim 13, wherein the step of receiving from the customer a secondary confirmation response to the secondary confirmation request, must occur within the time setting set by the secondary confirmation rule in order to halt the PIN-debit transaction.

18. The system of claim 13, wherein the approval received from the customer'"'"'s mobile telephone by the PIN-debit service computing device is a pre-registered mobile PIN number that is only operable for use in payment transactions authenticated using a mobile telephone.

19. The system of claim 18 wherein the pre-registered mobile PIN number is generated by the PIN-debit service computing device using a proprietary algorithm.

21. The system of claim 13, wherein during the registration event the customer sets restrictions associated with the card number when used for the PIN-debit transaction approved by the mobile telephone, the restrictions comprising at least one of a transaction limit, a daily limit, and an approved merchant list.

22. The system of claim 13, wherein the payment confirmation sent to the merchant is functionally comparable to a record typically associated with a credit card and signature debit transaction type.

23. The system of claim 13, wherein the transaction record is one of an ISO 8583 payment transaction type.

24. The system of claim 13, wherein the step of receiving from the customer the secondary confirmation response to the secondary confirmation request, must occur within the time setting set by the secondary confirmation rule in order for the PIN-debit transaction to be completed.

25. The system of claim 13, whereby upon a failure to receive the secondary confirmation response from the customer, the PIN-debit service computing device transmits a payment reversal to the debit network.

26. A method for processing a PIN-debit transaction conducted at a website operated by a merchant comprising the steps of:

receiving from a consumer in connection with a registration event, a mobile PIN and a card number associated therewith, the mobile PIN and the card number received at a PIN-debit service computing device;

in association with the registration event, receiving, at the PIN-debit service computing device from an issuer bank, an alternate PIN associated with the card number;

receiving payment data at a payment acquirer computing device, the payment data received from a server hosting the website, the payment data comprising the card number;

analyzing the payment data with the payment acquirer computing device to identify the payment data as associated with a transaction of the PIN-debit type;

upon identifying the payment data as associated with the PIN-debit type of transaction, forwarding the payment data from the payment acquirer computing device to the PIN-debit service computing device, the PIN-debit service computing device;

communicating an approval request to a mobile telephone of the consumer;

after receiving an approval response from the consumer'"'"'s mobile telephone, the PIN-debit service computing device adding the alternate PIN to the payment data, and transmitting the payment data and the alternate PIN to a debit network for processing; and

after transmitting the payment data and the alternate PIN to the debit network for processing, the PIN-debit service computing device transmitting a payment confirmation to the merchant.

27. The method of claim 26, further comprising the step of the PIN-debit service computing device receiving a consumer approved merchant list, an issuer approved merchant list, and a debit network approved merchant list.