METHOD AND APPARATUS FOR USING AT LEAST A PORTION OF A ONE-TIME PASSWORD AS A DYNAMIC CARD VERIFICATION VALUE

• US 20080110983A1
• Filed: 11/15/2006
• Published: 05/15/2008
• Est. Priority Date: 11/15/2006
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Ashfield, James M.
• Granted Patent: US 9,251,637 B2
• Time in Patent Office: Days
• US Class Current: 235/382
• CPC Class Codes: G06Q 20/24 Credit schemes, i.e. "pay after"
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3827 Use of message hashing
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/4018 using the card verification value [CVV] associated with the card
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

Method and apparatus for using at least a portion of a one-time password as a dynamic card verification value (CVV) are disclosed. A credit/debit card is able to generate a dynamic card verification value (CVV). Such a card may also include an indication that the dynamic CVV is to be used as a security code for purchasing or other transactions. A card-based financial transaction can be authorized in accordance with the use of a dynamic CVV by receiving a transaction authorization request for a specific credit/debit card, wherein the transaction authorization request includes a dynamic CVV. The dynamic CVV can be compared to at least a portion of a one-time password generated for the specific credit/debit card, and a transaction authorization can be sent to the merchant or vendor when the dynamic CVV matches all or a portion of the one-time password.

Claims

1. A credit/debit card able to generate a dynamic card verification value (CVV), the credit/debit card comprising:

a body the size and shape of a credit/debit card;

a one-time password generator disposed within the body to generate the dynamic CVV;

a display disposed within the body to display the dynamic CVV;

a validation device to authenticate the use of the card as a credit/debit card; and

an indication that the dynamic CVV is to be used as a security code.

2. The credit/debit card of claim 1 wherein the one-time password generator generates a one-time password and the dynamic CVV comprises a portion of the one-time password.

3. The credit/debit card of claim 2 wherein the indication comprises highlighting of a portion of the one-time password.

4. The credit/debit card of claim 2 wherein the indication comprises instructions printed on the body.

5. The credit/debit card of claim 2 wherein the indication comprises highlighting of a portion of the one-time password and instructions printed on the body.

6. The credit/debit card of claim 1 where the validation device comprises a magnetic stripe.

7. The credit/debit card of claim 1 wherein the indication comprises instructions printed on the body.

8. The credit/debit card of claim 7 where the validation device comprises a magnetic stripe.

9. A method of authorizing a card-based financial transaction comprising:

receiving a transaction authorization request for a specific credit/debit card, the transaction authorization request including a dynamic card verification value (CVV);

comparing the dynamic CVV to at least a portion of a one-time password generated for the specific credit/debit card; and

sending a transaction authorization when the dynamic CVV matches the at least a portion of the one-time password.

10. The method of claim 9 further comprising sending a transaction denial when the dynamic CVV does not match the at least a portion of the one-time password.

11. The method of claim 9 wherein the at least a portion of a one-time password comprises three digits of a six-digit one-time password.

12. The method of claim 9 further comprising:

separating the dynamic CVV from credit/debit card data;

validating the credit/debit card data; and

merging the CVV with the credit/debit card data to produce the transaction authorization.

13. The method of claim 10 further comprising:

separating the dynamic CVV from credit/debit card data;

validating the credit/debit card data; and

merging the CVV with the credit/debit card data to produce one of the transaction authorization and the transaction denial.

14. The method of claim 11 further comprising:

separating the dynamic CVV from credit/debit card data;

validating the credit/debit card data; and

merging the CVV with the credit/debit card data to produce the transaction authorization.

15. The method of claim 14 wherein the comparing of the CVV to the three digits of the six-digit one-time password is accomplished using a united authentication server.

16. A computer program product comprising a computer-readable medium having computer program code instructions for performing the method of claim 9.

17. A computer program product comprising a computer-readable medium having computer program code instructions for performing the method of claim 11.

18. A computer program product comprising a computer-readable medium having computer program code instructions for performing the method of claim 12.

19. A computer program product comprising a computer-readable medium having computer program code instructions for performing the method of claim 15.

20. Apparatus for authorizing a card-based financial transaction comprising:

means for receiving a transaction authorization request for a specific credit/debit card, the transaction authorization request including a dynamic card verification value (CVV);

means for comparing the dynamic CVV to at least a portion of a one-time password generated for the specific credit/debit card; and

means for sending a transaction authorization when the dynamic CVV matches the at least a portion of the one-time password.

21. The apparatus of claim 20 further comprising means for sending a transaction denial when the dynamic CVV does not match the at least a portion of the one-time password.

22. The apparatus of claim 20 further comprising:

means for separating the dynamic CVV from credit/debit card data;

means for validating the credit/debit card data; and

means for merging the CVV with the credit/debit card data to produce the transaction authorization.

23. The apparatus of claim 21 further comprising:

means for separating the dynamic CVV from credit/debit card data;

means for validating the credit/debit card data; and

means for merging the CVV with the credit/debit card data to produce one of the transaction authorization and the transaction denial.

24. A system for authorizing card-based financial transactions comprising:

a card approval server to receive transaction authorization requests, each for a specific credit/debit card, each including a dynamic card verification value (CVV);

an intermediate server to identify the dynamic CVV from a static CVV and to separate the dynamic CVV from credit/debit card data;

a database interconnected with the card approval server and the intermediate server to validate the credit/debit card data; and

an authentication server interconnected with the intermediate server to compare the dynamic CVV with at least a portion of a one-time password to authenticate the dynamic CVV.

25. The system of claim 24 wherein the database further comprises:

a credit card database; and

a debit card database.

26. The system of claim 24 wherein the intermediate server is disposed within a middleware layer.

27. The system of claim 24 wherein the at least a portion of a one-time password comprises three digits of a six-digit one-time password.

28. The system of claim 25 wherein the intermediate server is disposed within a middleware layer.

29. The system of claim 25 wherein the at least a portion of a one-time password comprises three digits of a six-digit one-time password.

30. The system of claim 28 wherein the at least a portion of a one-time password comprises three digits of a six-digit one-time password.