Method and apparatus for using at least a portion of a one-time password as a dynamic card verification value

• US 9,501,774 B2
• Filed: 01/27/2016
• Issued: 11/22/2016
• Est. Priority Date: 11/15/2006
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Ashfield, James M.
• Primary Examiner(s): KELLY, RAFFERTY D
• Application Number:
  US15/008,066
• Publication Number:
  US 20160314472A1
• Time in Patent Office: 300 Days
• Field of Search: 235/380
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/24 Credit schemes, i.e. "pay after"
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3827 Use of message hashing
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/4018 using the card verification value [CVV] associated with the card
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

Method and apparatus for using at least a portion of a one-time password as a dynamic card verification value (CVV) are disclosed. A credit/debit card is able to generate a dynamic card verification value (CVV). Such a card may also include an indication that the dynamic CVV is to be used as a security code for purchasing or other transactions. A card-based financial transaction can be authorized in accordance with the use of a dynamic CVV by receiving a transaction authorization request for a specific credit/debit card, wherein the transaction authorization request includes a dynamic CVV. The dynamic CVV can be compared to at least a portion of a one-time password generated for the specific credit/debit card, and a transaction authorization can be sent to the merchant or vendor when the dynamic CVV matches all or a portion of the one-time password.

Claims

1. A computer program product located on a non-transitory medium, which is readable by one or more computing devices, wherein the computer program code is used for authorizing a transaction, where the transaction involves a credit/debit card,

wherein the credit/debit card comprises:

a visual display;

a speaker;

one or more input devices positioned on the credit/debit card configured to receive as an input a challenge response, wherein the one or more input devices comprise two or more buttons corresponding to a plurality of alpha-numeric characters;

a processor in communication with the one or more input devices positioned on the credit/debit card, wherein the processor is configured to;

generate a challenge;

present, via the visual display and the speaker of the credit/debit card, the challenge;

receive, via the plurality of buttons on the credit/debit card, a challenge response comprising alpha-numeric characters; and

determine whether or not the challenge response received into the credit/debit card is successful; and

a one-time password generator automatically generating a one-time password or value based at least partially on receiving the challenge response into the credit/debit card and determining that the challenge response is successful,

wherein the computer program product comprises instructions for operation by one or more computing devices to cause said one or more computing devices to;

receive a transaction authorization request associated with the transaction involving the credit/debit card, wherein the transaction authorization request comprises a prompt for a card verification value (CVV) for authenticating the transaction;

present, via the visual display and the speaker of the credit/debit card, the one-time password, wherein a portion of the one-time password comprises a dynamic card verification value (CVV) for authenticating the transaction;

receive the dynamic CVV;

comparing the dynamic CVV generated by the credit/debit card to at least a portion of an externally generated one-time password for the credit/debit card; and

authorize the transaction involving the credit/debit card if the dynamic CVV generated by the credit/debit card matches at least a portion of an externally generated one-time password for the credit/debit card.

2. The computer program product of claim 1 further comprising instructions for operation by one or more computing devices to cause said one or more computing devices to send a transaction denial when the dynamic CVV does not match the at least a portion of the one-time password.

3. The computer program product of claim 1, wherein the at least a portion of the one-time password comprises three digits of a six-digit one-time password.

4. The computer program product of claim 1 further comprising instructions for operation by one or more computing devices to cause said one or more computing devices to:

separate the dynamic CVV from credit/debit card data;

validate the credit/debit card data; and

merge the dynamic CVV with the credit/debit card data to produce the transaction authorization.

5. The computer program product of claim 1, wherein the dynamic CVV is based at least partially on the challenge response input by the user into the credit/debit card.

6. A method for authorizing a transaction, wherein the transaction involves a credit/debit card,

wherein the credit/debit card comprises:

a visual display;

a speaker;

one or more input devices positioned on the credit/debit card configured to receive as an input a challenge response, wherein the one or more input devices comprise two or more buttons corresponding to a plurality of alpha-numeric characters;

a processor in communication with the one or more input devices positioned on the credit/debit card, wherein the processor is configured to;

generate a challenge;

present, via the visual display and the speaker of the credit/debit card, the challenge;

receive, via the plurality of buttons on the credit/debit card, a challenge response comprising alpha-numeric characters; and

determine whether or not the challenge response received into the credit/debit card is successful; and

a one-time password generator automatically generating a one-time password or value based at least partially on receiving the challenge response into the credit/debit card and determining that the challenge response is successful,

wherein the method comprises;

receiving a transaction authorization request associated with the transaction involving the credit/debit card, wherein the transaction authorization request comprises a prompt for a card verification value (CVV) for authenticating the transaction;

presenting, via the visual display and the speaker of the credit/debit card, the one-time password, wherein a portion of the one-time password comprises a dynamic card verification value (CVV) for authenticating the transaction;

receiving the dynamic CVV;

comparing the dynamic CVV generated by the credit/debit card to at least a portion of an externally generated one-time password for the credit/debit card; and

authorizing the transaction involving the credit/debit card if the dynamic CVV generated by the credit/debit card matches at least a portion of an externally generated one-time password for the credit/debit card.

7. The method of claim 6 further comprising sending a transaction denial when the dynamic CVV does not match the at least a portion of the one-time password.

8. The method of claim 6 wherein the at least a portion of the one-time password comprises three digits of a six-digit one-time password.

9. The method of claim 6 further comprising:

separating the dynamic CVV from credit/debit card data;

validating the credit/debit card data; and

merging the dynamic CVV with the credit/debit card data to produce the transaction authorization.

10. The method of claim 8 wherein the comparing of the dynamic CVV to the three digits of the six-digit one-time password is accomplished using a united authentication server.

11. The method of claim 6 wherein the dynamic CVV is based at least partially on the challenge response input by the user into the credit/debit card.