# US 10,373,138 B2 · System and method for securely validating transactions

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,373,138 B2
- Document ID: US10373138B2
- Status: Granted
- Kind: B2
- Application number: 13/081,871
- Filed: 2011-04-07
- Published: 2011-11-03
- Granted: 2019-08-06
- Earliest claimed: 2010-04-09
- Assignees: Visa International Service Association
- Applicants: Ayman Hammad
- Inventors: Ayman Hammad
- Web page: https://patentgrep.com/patent/US10373138B2

## CPC

- G06Q 20/12: specially adapted for electronic shopping systems
- G06Q 20/385: {using an alias or single-use codes}
- G06Q 20/4018: {using the card verification value [CVV] associated with the card}
- G06Q 20/425: {using two different networks, one for transaction and one for security confirmation}
- G06Q 30/06: Buying, selling or leasing transactions
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Systems and methods for validating and processing payment transactions are disclosed. In the embodiments of the invention a first authorization request message and a first verification value are received at a server computer. The verification value is validated and a second authorization request message with a second verification value is generated. The first verification value may be a dynamic value and the second verification value may be static value. The second verification value is associated with portable device used to perform a transaction and it is what the issuer computers of the portable device expect to receive as part of an authorization request message in a payment transaction.

## Claims

### Claim 1

A server computer comprising:
a processor; and
a non-transitory computer readable storage medium coupled to the processor having code stored thereon which is executable by the processor for implementing a method, the method comprising:
in a first transaction,
receiving a first authorization request message for the first transaction at the server computer, the first authorization request message comprising a first account identifier associated with a credit or debit account, and a first dynamic verification value;
determining, by the server computer that the first dynamic verification value is valid;
generating, by the server computer, a second authorization request message, based on the first authorization request message, comprising the first account identifier, a validation indicator indicating that the first dynamic verification value is valid, and a static verification value that replaces the first dynamic verification value;
sending the second authorization request message including the first account identifier, the static verification value, and the validation indicator to a first issuer computer operated by a first issuer of the first account identifier; and
receiving, from the first issuer computer, an authorization response message for the first transaction, the authorization response message for the first transaction generated based on the validation indicator;
in a second transaction,
receiving, at the server computer, a first authorization request message for the second transaction comprising a second account identifier and a second dynamic verification value;
determining, by the server computer, that the second dynamic verification value is not valid, the second dynamic verification value being stored in a data field reserved for static verification values of the first authorization request message for the second transaction;
in response to determining that the second dynamic verification value is not valid, sending, to a second issuer computer operated by a second issuer of the second account identifier, the second dynamic verification value in the data field reserved for static verification values of the first authorization request message for the second transaction; and
receiving, from the second issuer computer, an authorization response message for the second transaction indicating that the second transaction is denied, because the second dynamic verification value that was received by the second issuer computer was not a correct static verification value associated with the second account identifier.

### Claim 2 (depends on 1)

The server computer of claim 1, wherein the static verification value is generated based on transaction data in the first authorization request message for the first transaction.

### Claim 3 (depends on 1)

The server computer of claim 1, wherein the static verification value is associated with a portable device.

### Claim 4 (depends on 1)

The server computer of claim 1, wherein the first authorization request message for the first transaction includes data associated with a portable device.

### Claim 5 (depends on 4)

The server computer of claim 4, wherein the portable device is a payment card.

### Claim 6 (depends on 4)

The server computer of claim 4, wherein the portable device is a mobile phone.

### Claim 7 (depends on 1)

The server computer of claim 1, wherein the second authorization request message for the first transaction is in a magnetic stripe data format.

### Claim 8

A method comprising:
in a first transaction,
receiving a first authorization request message for the first transaction at a server computer, the first authorization request message comprising a first account identifier associated with a credit or debit account, and a first dynamic verification value;
determining, by the server computer that the first dynamic verification value is valid;
generating, by the server computer, a second authorization request message, based on the first authorization request message, comprising the first account identifier, a validation indicator indicating that the first dynamic verification value is valid, and a static verification value that replaces the first dynamic verification value;
sending the second authorization request message including the first account identifier, the static verification value, and the validation indicator to a first issuer computer operated by a first issuer of the first account identifier; and
receiving, from the first issuer computer, an authorization response message for the first transaction, the authorization response message for the first transaction generated based on the validation indicator;
in a second transaction,
receiving, at the server computer, a first authorization request message for the second transaction comprising a second account identifier and a second dynamic verification value;
determining, by the server computer, that the second dynamic verification value is not valid, the second dynamic verification value being stored in a data field reserved for static verification values of the first authorization request message for the second transaction;
in response to determining that the second dynamic verification value is not valid, sending, to a second issuer computer operated by a second issuer of the second account identifier, the second dynamic verification value in the data field reserved for static verification values of the first authorization request message for the second transaction; and
receiving, from the second issuer computer, an authorization response message for the second transaction indicating that the second transaction is denied, because the second dynamic verification value that was received by the second issuer computer was not a correct static verification value associated with the second account identifier.

### Claim 9 (depends on 1)

The server computer of claim 1, wherein the first authorization request message for the first transaction is received from a first communication channel.

### Claim 10 (depends on 9)

The server computer of claim 9, wherein the second authorization request message for the first transaction is sent via a second communication channel different from the first communication channel to the first issuer computer.

### Claim 11 (depends on 9)

The server computer of claim 9, wherein the first communication channel is configured to establish communication between a client computer and an IP Gateway server computer coupled to a payment processing network comprising the server computer.

### Claim 12 (depends on 10)

The server computer of claim 10, wherein the second communication channel is configured to establish communication between a payment processing network comprising the server computer and the first issuer computer.

### Claim 13 (depends on 1)

The server computer of claim 1, wherein the first dynamic verification value is placed in a field of the first authorization request message for the first transaction reserved for the static verification value.

### Claim 14 (depends on 1)

The server computer of claim 1, wherein the static verification value in the second authorization request message for the first transaction is generated in a format that can be processed by the first issuer computer.

### Claim 15 (depends on 8)

The method of claim 8 further comprising:
generating, by the server computer, the static verification value.

### Claim 16 (depends on 8)

The method of claim 8, wherein the first authorization request message for the first transaction is received from a merchant computer, which receives the first dynamic verification value and the first account identifier from a client computer operated by a user, after the client computer receives the static verification value from a portable device used by the user.

### Claim 17 (depends on 8)

The method of claim 8, wherein the first authorization request message is received from a merchant computer, which receives the first dynamic verification value and the first account identifier from a client computer operated by a user, after the client computer receives the first account identifier and the static verification value from a portable device used by the user using a verification token.

### Claim 18 (depends on 17)

The method of claim 17, wherein the client computer transmits the first account identifier and the static verification value that is received from the portable device to a gateway computer, wherein the gateway computer evaluates the static verification value and the first account identifier, generates the first dynamic verification value, and transmits the first dynamic verification value to the client computer.

### Claim 19 (depends on 8)

The method of claim 8, wherein the first dynamic verification value is a dCVV2 value and the static verification value is a CVV2 value.

### Claim 20 (depends on 8)

The method of claim 8, wherein the server computer is in a payment processing network.

### Claim 21 (depends on 8)

The method of claim 8, wherein the first authorization request message and the second authorization request message in the first transaction are ISO 8583 messages.

### Claim 22 (depends on 1)

A system comprising the server computer of claim 1; and the first issuer computer and the second issuer computer in communication with the server computer.

### Claim 23 (depends on 22)

The system of claim 22, wherein the server computer is in a payment processing network.