Methods and systems for using physical payment cards in secure E-commerce transactions

• US 8,965,811 B2
• Filed: 10/05/2009
• Issued: 02/24/2015
• Est. Priority Date: 10/04/2008
• Status: Active Grant

• Current Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Original Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Inventors: Wankmueller, John R.
• Primary Examiner(s): OBEID, MAMON A
• Application Number:
  US12/573,567
• Publication Number:
  US 20100088237A1
• Time in Patent Office: 1,968 Days
• Field of Search: 705/65, 705/66, 705/67, 705/72, 705/74, 705/78, 705/79, 235/379, 235/380
• US Class Current: 705/79
• CPC Class Codes: G06Q 20/027 involving a payment switch or gateway
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/14 specially adapted for billing systems
• CPC Class Codes: G06Q 20/34 using cards, e.g. integrated circuit [IC] cards or magnetic cards
• CPC Class Codes: G06Q 20/351 Virtual cards
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]

Abstract

Pursuant to some embodiments, methods, systems, apparatus, computer program code and means for conducting an online transaction by a user operating a computer are provided which include identifying, at the computer, that the user has selected a secure payment option during a transaction with a merchant. The computer is caused to enter a private session. During the private session, payment card data from a physical payment card held by the user is received, and the payment card data is forwarded to a payment provider to cause the payment provider to provide substitute payment card details to the merchant to complete the transaction.

Claims

1. A method for conducting an online transaction by a user operating a computer, comprising:

receiving, by a payment provider computer, an electronic wallet request message that includes payment card data read from a physical payment card and merchant information, the payment card data including a primary account number (PAN) and card specific data, the payment card data received from a remote user computer;

identifying and automatically logging, by the payment provider computer, a user into an electronic wallet associated with said payment card data, to authenticate said user;

identifying, by the payment provider computer, a virtual primary account number (VPAN) associated with said PAN;

creating, by the payment provider computer, dynamic data unique to the online transaction;

creating a purchase request containing said VPAN and the dynamic data;

transmitting said purchase request, by said payment provider computer using the merchant information, to a merchant associated with said online transaction;

receiving an authorization request from the merchant containing said VPAN, the dynamic data, and transaction data;

creating, by the payment provider computer, a replacement authorization request containing said PAN, the dynamic data, and said transaction data;

transmitting the replacement authorization request to an issuer of the physical payment card associated with said PAN for authorization processing;

receiving an authorization response including the PAN and payment related data from said issuer;

replacing, by the payment provider computer, the PAN and the payment related data with the VPAN and VPAN related data to create a replacement authorization response; and

completing, by said payment provider computer, the transaction by providing the replacement authorization response that includes the VPAN and the dynamic data to said merchant.

2. The method of claim 1, wherein said receiving said payment card data is performed over a secure channel with said computer.

3. The method of claim 1, wherein said authenticating the user comprises receiving a password from said user and verifying that said password is associated with said electronic wallet.

4. A payment provider apparatus, comprising:

a processor coupled to a communication device; and

a storage device in communication with said processor and storing instructions adapted to be executed by said processor to process information received from a remote user device to;

identify payment data associated with a physical payment device, said payment data including a primary account number (“

PAN”

) and an expiry date of a payment account associate with said PAN and merchant information;

identify an electronic wallet associated with a remote user operating said remote user device by comparing said payment data with information associated with said electronic wallet;

log the remote user into the electronic wallet;

authenticate an identity of said remote user by comparing information received from said remote user with information stored in said electronic wallet;

create dynamic data unique to an online transaction;

create a purchase request message containing a virtual PAN (VPAN) and the dynamic data;

transmit the purchase request message to a merchant based on the merchant information, said purchase request message including the VPAN and the dynamic data;

receive an authorization request message from said merchant, said authorization request message including said VPAN, the dynamic data, and transaction details;

create a replacement authorization request message including said PAN, the dynamic data, and said transaction details;

transmit the replacement authorization request message to an issuer associated with said PAN;

receive an authorization response message including the PAN and payment related data from said issuer;

replace the PAN and the payment related data with the VPAN and VPAN related data to create a replacement authorization response; and

complete the transaction by transmitting the replacement authorization response message to said merchant, said updated authorization response message including said VPAN and the dynamic data.

5. The apparatus of claim 4, further comprising instructions adapted to be executed by said processor to identify a merchant posting address associated with a transaction between said remote user and said merchant wherein said purchase request message is transmitted to said merchant using said merchant posting address.

6. The apparatus of claim 4, wherein said instructions to identify an electronic wallet further include instructions to verify an identity of said remote user.

7. The apparatus of claim 4, further comprising instructions adapted to be executed by said processor to establish a secure communications session with said remote user device, said secure communications session used to receive said information from said remote user device.

8. The apparatus of claim 4, wherein said VPAN includes a bank identification number identifying an entity associated with said server as the issuer of said VPAN.

9. The apparatus of claim 4, wherein said storage device further stores at least one of an electronic wallet database and a transaction database.

10. The apparatus of claim 4, wherein the communication device coupled to said processor is further adapted to communicate with at least one of:

(i) said remote user device, (ii) a merchant device, and (iii) an issuer device.