SECURE AUTHENTICATION AND PAYMENT SYSTEM

• US 20080103972A1
• Filed: 03/28/2007
• Published: 05/01/2008
• Est. Priority Date: 10/25/2006
• Status: Active Grant

• Current Assignee: Leading Software Limited
• Original Assignee: Payfont Limited
• Inventors: Lanc, David
• Granted Patent: US 8,423,466 B2
• Time in Patent Office: Days
• US Class Current: 705/44
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/325 using wireless networks
• CPC Class Codes: G06Q 20/3255 using mobile network messaging services for payment, e.g. SMS
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/405 Establishing or using transaction specific rules
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions

Abstract

The present invention provides a service for allowing secure financial transactions to be carried out, the service involving authenticating a user'"'"'s identity and/or status as part of a financial transaction with another party and in the event that the user is authenticated arranging for the transaction to be completed without revealing the user'"'"'s financial details and/or other personal details to that other party. Authentication data and transaction data may be communicated over any suitable communications channel(s). The invention provides a trusted authentication and payment environment that protects a user'"'"'s financial details, but allows them to be securely authenticated and arranges for transactions to be fulfilled, whilst providing other parties with reassurance that transactions will be completed. In this way, fraud and theft due to misappropriation of financial details can be minimized.

Claims

1. A transaction system that is configured to authenticate at least a first user and arrange a financial transaction with at least a second user based on the first user'"'"'s authentication and without disclosing the first user'"'"'s financial details and/or personal identity to the second user.

2. A transaction system according to claim 1 that is adapted to process a transaction that is or includes payment for goods and/or services.

3. A transaction system according to claim 1 including authentication means for authenticating the users, and payment means that are functionally and/or physically separate from the authentication means, the payment means being adapted to arrange for payments.

4. A transaction system according to claim 1 that is adapted to apply the same authentication to all users that are party to a transaction.

5. A transaction system according to claim 1 that is adapted to receive transaction details from at least the first and second users;

compare the received transaction details to ensure that they are identical and arrange payment only if the transaction details match.

6. A transaction system according to claim 1 that is adapted to arrange payment directly from at least one of the first user'"'"'s account, such as a credit or debit card account or any other financial vehicle provided to allow the user to make payments.

7. A transaction system according to claim 1 that is adapted to receive payment and hold it in escrow until goods are dispatched or services provided and/or the first user acknowledges the payment is valid.

8. A transaction system according to claim 1 wherein the transaction is a cash withdrawal or cash advance.

9. A transaction system according to claim 1 that is adapted to be used with transactions over one or multiple transaction channels.

10. A transaction system according to claim 9, wherein the transaction channels include face-to-face and/or mail order and/or telephone order and/or Internet shopping and/or user-to-user transfers and/or purchase by mobile phone and/or other contactless purchase methods.

11. A transaction system according to claim 1 including a communications system for allowing users to interact with the system via the Internet or another network using an IP protocol and/or telephone and/or mobile data communications services.

12. A transaction system according to claim 1 that is adapted to apply the same authentication regardless of transaction channel, so that a consistent level of security is applied in all transactions.

13. A transaction system according to claim 1, wherein the transaction system is adapted to apply differing authentication to differing transaction channels.

14. A transaction system according to claim 1 that is adapted to receive data from a transaction device.

15. A transaction system according to claim 1 that is adapted to apply at least two authentication stages.

16. A transaction system according to claim 1 that is adapted to apply at least three authentication stages.

17. A transaction system according to claim 15, wherein each authentication stage requires input of personal identification numbers and/or code words and/or personal details and/or answers to challenge questions and/or biometric data and/or matching of a user with a list of authorized users for a transaction device and/or valid reading of an EMV compliant card or other registered identity card and/or cross referencing two or more sets of provided authentication data.

18. A transaction system according to claim 1, wherein authentication involves comparing the input data with user related data stored by the system.

19. A transaction system according to claim 1, wherein authentication involves online and/or offline authentication stages.

20. A transaction system according to claim 1 that is adapted to store user names and/or user identification codes and/or user addresses and/or user address codes and/or user payment account details and/or user operating parameters and/or user transaction histories and/or audit trails.

21. A transaction system according to claim 1 that is adapted to process orders using a user identification code and a delivery address code uniquely associated with at least one of the first users.

22. A transaction system according to claim 1 that is adapted to receive the delivery address code of at least one of the first users, determine the address corresponding to the delivery address code and to provide the address to at least one of the second users only when the second user has authenticated themselves and has confirmed that it is in a position to fulfill the transaction.

23. A transaction system according to claim 1 that is adapted to have more than one payment means associated with each user.

24. A transaction system according to claim 23 that is adapted such that at least one of the payment means is assignable for use in specified transactions.

25. A transaction system according to claim 1 that is adapted to use a payment means to carry out a payment after authenticating both users and when provided with the paying user'"'"'s identification code rather than details of the payment means to be used.

26. A transaction system according to claim 1 that adapted to send a notification to users to confirm events.

27. A transaction system according to claim 26, wherein the events of which the user is notified include authentication failures and/or mismatch of order details supplied by differing users and/or the order is available for dispatch and/or the order is only partially fulfilled and/or a payment is to be made and/or a payment is refused and/or a transaction has been referred and/or the consumer has, or is close to, breach of their operating parameters.

28. A transaction system according to claim 26, wherein the notification is a short message service (SMS) message and/or e-mail and/or telephone call and/or message sent to a transaction device.

29. A transaction system according to claim 26, wherein the notification is via a different communication method to the placing of the order.

30. A transaction system according to claim 26 that is adapted to obtain identification information from the user before providing access to the notification.

31. A transaction system according to claim 1 that is adapted to assign at least one user identity code to at least a first user, whereby the authentication means are adapted to validate the identity and/or status of the first user to a second user upon provision of the first user'"'"'s identity code to the system by the second user.

32. A transaction system according to claim 1 that is adapted to validate whether or not a user is a registered user of the system and/or the user is transacting within specified criteria and/or the user account has permission for carrying out that transaction.

33. A transaction system according to claim 32, wherein the specified criteria include that transactions values and/or transaction velocities are within a set limit or that the transaction is of a specified type.

34. A transaction system according to claim 1 that is adapted to allow at least one sub user to operate on behalf of at least one of the users.

35. A transaction system according to claim 1 that is adapted to require re-authentication by at least one user if a transaction has not been completed within a specified time-scale and/or require at least one user to review and/or accept a transaction if the transaction has not been completed within a specified time-scale.

36. A transaction system according to claim 1 that is adapted to allow each user to make or receive payments in a currency of choice and convert the currency of the payment such that the currency in which the payment is made is different to the currency in which the payment is received.

77. A computer program, or a storage means containing a computer program or a server programmed with a computer program for implementing at least one of the features of the system of claim 1.

37. A transaction device for use with a transaction system that is configured to authenticate at least a first user and arrange a financial transaction with at least a second user based on the first user'"'"'s authentication and without disclosing the first user'"'"'s financial details and/or personal identity to the second user, the transaction device being associated with the first user and being operable to communicate with the transaction system in order to authenticate the first user.

38. A transaction device according to claim 37 comprising means for inputting data and means for communicating data to the transaction system.

39. A transaction device according to claim 38, wherein the means for inputting data is a keypad and/or a trackball and/or a joystick and/or a biometric feature reader and/or a reader.

40. A transaction device according to claim 39, wherein the biometric feature reader includes a fingerprint reader and/or a retinal scanner and/or a voice analyzer.

41. A transaction device according to any of claim 39, wherein the reader is a chip card reader and/or a magnetic strip card reader and/or a radio frequency identification (RFID) card reader.

42. A transaction device according to claim 38, wherein the means for communicating data includes wireless or mobile telecommunications apparatus and/or bluetooth communications apparatus and/or WiFi communications apparatus, such as WiFi 802.11 a/b/g communications apparatus and/or infrared communications apparatus and/or RFID communications apparatus and/or NFC communications apparatus and/or a USB port and/or a firewire port.

43. A transaction device according to claim 42 wherein the mobile telecommunications apparatus is adapted to operate over GPRS or 3G or GSM or CDMA networks.

44. A transaction device according to claim 37 that is adapted to implement at least two authentication stages.

45. A transaction device according to claim 37, wherein the transaction device is adapted to apply at least three authentication stages.

46. A transaction device according to claim 45, wherein each authentication stage requires input of personal identification numbers and/or code words and/or personal details and/or answers to challenge questions and/or biometric data and/or matching of a user with a list of authorized users for the transaction device and/or valid reading of an EMV compliant card or other registered identity card and/or cross referencing two or more sets of provided authentication data.

47. A transaction device according to claim 37 that is configured to apply online and/or offline authentication stages.

49. A method for authenticating a merchant as claimed in claim 49, wherein the authentication means is a transaction device according to claim 37.

50. A method for authenticating a merchant as claimed in claim 49, wherein the method further involves arranging payment from the consumer to the authenticated merchant using the consumer'"'"'s authentication means.

78. A computer program, or a storage means containing a computer program or a server programmed with a computer program for implementing at least one of the features of the device of claim 37.

48. A method for authenticating a merchant involving using an authentication means associated with a consumer to authenticate the merchant.

79. A computer program, or a storage means containing a computer program or a server programmed with a computer program for implementing at least one of the features of the method of claim 48.

51. A method for allowing secure financial transactions to be carried out, the service involving authenticating at least a first user'"'"'s identity and/or status as part of a financial transaction with at least a second user and in the event that at least the first user is authenticated, arranging for the transaction to be completed without revealing the first user'"'"'s financial details and/or other personal details to the second user.

52. A method according to claim 51, wherein authentication data and transaction data are communicated over different communications channels.

53. A method according to claim 51, wherein authenticating the user involves receiving authentication data input by the user via at least one communications channel.

54. A method according to claim 52, wherein the communications channel is a wireless telecommunications network and/or the Internet and/or e-mail and/or any other suitable communications channel.

55. A method according to claim 53 wherein the communications channel is selectable by the user.

56. A method according to claim 53, wherein different communications channels are selectable for different transaction types.

57. A method according to claim 53 comprising sending communications to the user via a wireless telecommunications network and/or the Internet and/or e-mail.

58. A method according to claim 53 comprising sending communications to the user via a different channel to those from the user.

59. A method according to claim 51, including notifying the user of events, including at least one of authentication failures and/or mismatch of order details supplied by differing users and/or the order is available for dispatch and/or the order is only partially fulfilled and/or a payment is refused and/or a transaction has been referred and/or the consumer has, or is close to, breach of their operating parameters.

60. A method according to claim 59, wherein the user being notified may have to provide identification information before access is given to the notification.

61. A method according to claim 51, wherein the authentication involves two-stage authentication.

62. A method according to claim 51, wherein the authentication involves at least three-stage authentication.

63. A method according to claim 61, wherein each authentication stage involves input of personal identification numbers and/or code words and/or personal details and/or answers to challenge questions and/or matching of a user with a list of authorized users for a transaction device and/or cross referencing two or more sets of input authentication data.

64. A method according to claim 51, wherein authentication involves comparing the input data with user related data stored by the system.

65. A method according to claim 51, wherein authentication involves online and/or offline authentication stages.

66. A method according to claim 51, wherein the service allows the user(s) to register one or more payment means.

67. A method according to claim 51, wherein a particular payment means is assignable for use in specified transactions.

68. A method according to claim 67, wherein the user may specify that a particular payment means may be used for transactions only with a particular organization.

69. A method according to claim 51, wherein a payment is made when the first user'"'"'s authentication/identification code is provided rather than details of the payment means to be used.

70. A method according to claim 51, wherein at least one of the user'"'"'s payment means may be used in the step of authenticating the user.

71. A method according to claim 70, wherein the payment means used for authentication is different from the payment means used to complete the transaction.

72. A method according to claim 51, wherein the transaction is a purchase or a cash withdrawal or money transfer.

73. A method according to claim 51 involving defining operating parameters for at least one user and checking that transactions do not breach those operating parameters before making payment.

74. A method according to claim 51, wherein the service further involves allocating a user identification code to at least one of the first users, the first user providing the first user'"'"'s identification code to at least one of the second users, the service authenticating the second user, the second user providing the first user'"'"'s identification code to the service and the service comparing the first user'"'"'s identification code with data stored in user records to confirm that the first user is a registered user of the system.

75. A method according to claim 51, wherein payment is held in escrow until goods have been dispatched.

76. A method according to claim 51, wherein the same level of authentication is applied to all first and second users.

80. A computer program, or a storage means containing a computer program or a server programmed with a computer program for implementing at least one of the features of the service of claim 51.