Methods and systems to securely load / reload acontactless payment device

• US 9,454,865 B2
• Filed: 08/06/2009
• Issued: 09/27/2016
• Est. Priority Date: 08/06/2008
• Status: Active Grant

• Current Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Original Assignee: Intel Corporation
• Inventors: Kranzley, Arthur D., Wankmueller, John R., Garrett, Duncan
• Primary Examiner(s): CASEY, ALEXIS M
• Application Number:
  US12/537,084
• Publication Number:
  US 20100131413A1
• Time in Patent Office: 2,609 Days
• Field of Search: 705/73
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/349 Rechargeable cards
• CPC Class Codes: G06Q 20/352 Contactless payments by cards
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G07F 7/08 by coded identity card or credit card or other personal identification means without personal verification means G07F7/02

Abstract

Embodiments allow loading and reloading contactless payment devices using only a contactless terminal interface, while providing user authentication. The contactless terminal interface could be at a merchant POS location, kiosk, or embedded or attached to a personal computing device with contactless read/write capability such as a personal computer or mobile phone or Internet device.

Claims

1. A method for operating a terminal device, comprising:

receiving, by the terminal device, a request for a load transaction for loading value onto a contactless payment device, the request including a requested load amount, the contactless payment device including a card-shaped body, an integrated circuit mounted on the card-shaped body, and an antenna mounted on the card-shaped body and coupled to the integrated circuit;

prompting a user, by the terminal device, to present the contactless payment device to a contactless reader operatively coupled to the terminal device;

presenting the contactless payment device to the contactless reader;

establishing a wireless data communication channel between the contactless payment device and the contactless reader in connection with the load transaction;

transmitting an authorization request from the contactless payment device to the contactless reader over the wireless data communication channel, said authorization request for requesting authorization from a remote server computer for said load transaction, said authorization request different from said request for a load transaction;

receiving, by the contactless reader from said contactless payment device over the wireless data communication channel, the authorization request;

transmitting, by the terminal device, said authorization request electronically over a communication channel to the remote server computer, the remote server computer associated with a destination address, the remote server computer operated by or on behalf of an issuer of said contactless payment device for authorization processing;

receiving, by the terminal device, a signed authorization response from said remote server computer indicating approval of the authorization request;

after the terminal device receives the signed authorization response, prompting the user, by the terminal device, to present the contactless payment device to the contactless reader;

second presenting the contactless payment device to the contactless reader;

establishing the wireless data communication channel for a second time in connection with said load transaction;

transmitting, by the contactless reader to the contactless payment device over the wireless data communication channel, the signed authorization response for authentication by the contactless payment device;

transmitting a transaction certificate from the contactless payment device to the contactless reader over the wireless data communication channel;

receiving, by the contactless reader over the wireless data communication channel, the transaction certificate from the contactless payment device indicating authentication of the issuer;

displaying, by the contactless reader, a prompt to enter a personal identification number (PIN);

receiving, by the terminal device via an input device, the PIN from the user;

after the terminal device receives the PIN from the user, prompting the user, by the terminal device, to present the contactless payment device to the contactless reader;

third presenting the contactless payment device to the contactless reader;

establishing the wireless data communication channel for a third time in connection with said load transaction;

transmitting, by the contactless reader over the wireless data communication channel, an encrypted version of the PIN to the contactless payment device;

verifying of the encrypted version of the PIN by the contactless payment device to verify the user; and

accepting said request for the load transaction by the contactless payment device;

wherein said authorization request includes a cryptogram signed by said contactless payment device using a key associated with said contactless payment device.

2. The method of claim 1, wherein said teed authorization request includes said requested load amount.

3. The method of claim 1, wherein said transmitting said authorization request is performed over a payment network.

4. The method of claim 1, wherein said issuer is at least one of:

the issuer of said contactless payment device, and an agent of said issuer.

5. The method of claim 1, wherein said authorization processing includes verifying the cryptogram and determining whether funds are available to be loaded onto said contactless payment device.

6. The method of claim 5, wherein said determining whether funds are available includes verifying a funding source associated with the user of said contactless payment device.

7. The method of claim 1, wherein the request for the load transaction is received at a data entry device associated with said terminal.