Secure method and system for communicating a list of credit card numbers over a non-secure network

• US 5,715,399 A
• Filed: 05/30/1995
• Issued: 02/03/1998
• Est. Priority Date: 03/30/1995
• Status: Expired due to Term

• Current Assignee: Amazon.com, Inc.
• Original Assignee: Amazon.com, Inc.
• Inventors: Bezos, Jeffrey P.
• Primary Examiner(s): Chin, Wellington
• Assistant Examiner(s): Carman, Melissa Kay
• Application Number:
  US08/453,273
• Time in Patent Office: 980 Days
• Field of Search: 235/379, 235/380, 235/487, 235/381, 902/24, 364/401 R, 340/827, 340/825.33, 340/825.34, 340/825.35, 395/239, 395/240, 395/227
• US Class Current: 705/26.1
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/14 specially adapted for billing systems
• CPC Class Codes: G06Q 20/24 Credit schemes, i.e. "pay after"
• CPC Class Codes: G06Q 20/3827 Use of message hashing
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/4037 Remote solvency checks
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: G07F 7/08 by coded identity card or credit card or other personal identification means without personal verification means G07F7/02

Abstract

A method and system for securely indicating to a customer one or more credit card numbers that a merchant has on file for the customer when communicating with the customer over a non-secure network. The merchant sends a message to the customer that contains only a portion of each of the credit card numbers that are on file with the merchant. The message may also contain a notation explaining which portion of each of the credit card numbers has been extracted. A computer (38) retrieves the credit card numbers on file for the customer in a database (40), constructs the message, and transits the message to a customer location (10) over the Internet network (30) or other non-secure network. The customer can then confirm in a return message that a specific one of the credit card numbers on file with the merchant should be used in charging a transaction. Since only a portion of the credit card number(s) are included in any message transmitted, a third party cannot discover the customer'"'"'s complete credit card number(s).

Claims

1. A method enabling a merchant to indicate to a customer by a communication over a non-secure network, a credit card number of the customer that is maintained in a database by the merchant, said method comprising the steps of:

(a) retrieving the credit card number of the customer from the database;

(b) extracting a portion of the credit card number, said portion being substantially smaller than the complete credit card number;

,

(c) constructing a message containing the portion of the credit card number; and

(d) transmitting the message to the customer over the non-secure network.

2. The method of claim 1, wherein the message also includes a notation indicating the portion of the credit card number that has been included in the message.

3. The method of claim 1, wherein the portion comprises the last N digits of the credit card number, where N is an integer.

4. The method of claim 1, wherein the message comprises an E-mail message addressed to the customer.

5. The method of claim 1, wherein the message comprises a World Wide Web page.

6. The method of claim 1, wherein the merchant maintains a plurality of credit card numbers of the customer in the database, further comprising the steps of repeating steps (a) and (b) for each of the plurality of the credit card numbers of the customer that are in the database to obtain portions of each of the plurality of credit card numbers of the customer;

and constructing the message so that the message contains the portions of each of the plurality of the credit card numbers of the customer.

7. The method of claim 6, further comprising the steps of determining if the portions of the plurality of the credit card numbers of the customer all differ from each other, and if not, successively increasing a size of the portion of each of said plurality of the credit card numbers extracted to form a larger portion, until said larger portions all differ from each other;

and then constructing the message to include the larger portions of said plurality of the credit card numbers.

8. The method of claim 7, further comprising the step of indicating in the message a type of credit card for each of the portions of the credit card numbers listed, wherein the portions of two credit card numbers differ from each other f the portions of said two credit card numbers are from different types of credit cards, even though the portions of said two credit card numbers are numerically equal.

9. The method of claim 7, further comprising the step of indicating in the message a credit card expiration date associated with each of the portions of the credit card numbers listed, wherein the portions of two credit card numbers differ from each other if the credit card expiration dates associated with the portions of said two credit card numbers are different, even though the portions of said two credit card numbers are numerically equal.

10. The method of claim 7, further comprising the step of requesting the customer to indicate a specific one of the plurality of the credit card numbers of the customer that should be used in a transaction with the merchant in a return message.

11. A system for constructing and transmitting a message from a merchant to a customer using a non-secure transmission method, said message indicating a credit card number of the customer that is maintained by the merchant in a database, comprising:

(a) a computer for use in constructing and transmitting said messages, said computer having a central processor that executes instructions, a memory for storing the instructions to be executed, and non-volatile storage for storing the database and the messages; and

(b) said instructions stored in the memory of the computer causing the central processor to;

(i) retrieve the credit card number of the customer from the database stored in the non-volatile storage;

(ii) extract a portion of said credit card number, said portion being substantially smaller than the complete credit card number;

(iii) construct a message including the portion of the credit card number; and

(iv) transmit the message to the customer using the nonsecure transmission method.

12. The system of claim 11, wherein the instructions cause the central processor to include in the message a notation indicating the portion of the credit card number that has been included in the message.

13. The system of claim 11, wherein the instructions cause the central processor to extract the last N digits of the credit card number for use as said portion, where N is an integer.

14. The system of claim 11, wherein the instructions cause the central processor to construct the message as an E-mail message.

15. The system of claim 11, wherein the instructions cause the central processor to construct the message as a World Wide Web page.

16. The system of claim 11, wherein the merchant maintains a plurality of credit card numbers for the customer in the database, and wherein the instructions cause the central processor to:

(a) retrieve all of said plurality of the credit card numbers from the database;

(b) extract portions of the plurality of the credit card numbers; and

(c) construct the message so that the message includes said portions of said plurality of credit card numbers.

17. The system of claim 16, wherein the instructions further cause the central processor to:

determine if the portions of the plurality of the credit card numbers of the customer that are extracted all differ from each other, and if not;

(a) successively increase a size of said portions to form larger portions of said plurality of credit card numbers until said larger portions all differ from each other; and

(b) construct the message so that the message includes the larger portions.

18. The system of claim 17, wherein the instructions cause the central processor to indicate in the message a type of credit card associated with each portion of the credit card numbers listed;

and to determine that the portions of the credit card numbers differ from each other if the portions of said two credit card numbers are for different types of credit cards, although the portions of said two credit card numbers are numerically equal.

19. The system of claim 17, wherein the instructions cause the central processor to indicate in the message a credit expiration date associated with each of the portions of the credit card numbers listed;

and to determine that the portions of two credit card numbers differ from each other if the portions of said two credit card numbers are associated with different credit card expiration dates, although the portions of said two credit card numbers are numerically equal.

20. The system of claim 11, wherein the instructions cause the central processor to construct the message to include a request that the customer indicate a specific one of the plurality of the credit card numbers of the customer that should be used in a transaction with the merchant, in a return message.