Distributed token-less authentication

A system comprising:

• at least one hardware processor of a region-specific interface;
• one or more software modules, stored in a memory of the region-specific interface, that, when executed by the at least one hardware processor of the region-specific interface,
• via at least one first network, receive a partially-hashed personal identification number (PIN) from a terminal, wherein the partially-hashed PIN comprises an unhashed first portion that identifies a service-specific interface associated with the user account, and a hashed second portion,
• via at least one second network, relay the partially-hashed PIN to the service-specific interface identified by the first unhashed portion of the partially-hashed PIN,
• via the at least one second network, receive a first-level confirmation or rejection from the service-specific interface, and, via the at least one first network, relay the first-level confirmation or rejection to the terminal;
• at least one hardware processor of the service-specific interface;
• and
• one or more software modules, stored in a memory of the service-specific interface, that, when executed by the at least one hardware processor of the service-specific interface, when the first-level confirmation or rejection is a first-level confirmation,
• via the at least one second network, receive a request for second-level confirmation, comprising image data of the user, from the region-specific interface,
• compare the image data of the user in the request for second-level confirmation to image data of the user stored by the service-specific interface,
• when the image data of the user in the request for second-level confirmation matches the image data of the user stored by the service-specific interface, send a second-level confirmation and user information associated with the user;
• and,
• when the image data of the user in the request for second-level confirmation does not match the image data of the user stored by the service-specific interface, send a second-level rejection.

Non-transitory computer-readable media comprising:

• a first non-transitory computer-readable medium having first instructions stored therein, wherein the first instructions, when executed by a processor of a region-specific interface, cause the processor to
• via at least one first network, receive a partially-hashed personal identification number (PIN) from a terminal, wherein the partially-hashed PIN comprises an unhashed first portion that identifies a service-specific interface associated with the user account, and a hashed second portion,
• via at least one second network, relay the partially-hashed PIN to the service-specific interface identified by the first unhashed portion of the partially-hashed PIN
• via the at least one second network, receive a first-level confirmation or rejection from the service-specific interface, and,
• via the at least one first network, relay the first-level confirmation or rejection to the terminal;
• and
• a second non-transitory computer-readable medium having second instructions stored therein, wherein the second instructions, when executed by a processor of a service-specific interface, cause the processor to, when the first-level confirmation or rejection is a first-level confirmation,
• via the at least one second network, receive a request for second-level confirmation, comprising image data of the user, from the region-specific interface,
• compare the image data of the user in the request for second-level confirmation to image data of the user stored by the service-specific interface,
• when the image data of the user in the request for second-level confirmation matches the image data of the user stored by the service-specific interface, send a second-level confirmation and user information associated with the user;
• and,
• when the image data of the user in the request for second-level confirmation does not match the image data of the user stored by the service-specific interface, send a second-level rejection.

A method comprising:

• by at least one hardware processor of a region-specific interface,
• via at least one first network, receiving a partially-hashed personal identification number (PIN) from a terminal, wherein the partially-hashed PIN comprises an unhashed first portion that identifies a service-specific interface associated with the user account, and a hashed second portion,
• via at least one second network, relaying the partially-hashed PIN to the service-specific interface identified by the first unhashed portion of the partially-hashed PIN,
• via the at least one second network, receiving a first-level confirmation or rejection from the service-specific interface, and,
• via the at least one first network, relaying the first-level confirmation or rejection to the terminal;
• and,
• by the at least one hardware processor of the terminal,
• via the at least one first network, receiving a second-level confirmation or rejection from the region-specific interface,
• when the second-level confirmation is received and no manual override is received from an operator of the terminal, authorizing a transaction at the terminal,
• when the second-level confirmation is received and the manual override is received from the operator of the terminal, rejecting the transaction at the terminal,
• when the second-level rejection is received and no manual override is received from the operator of the terminal, rejecting the transaction at the terminal, and,
• when the second-level rejection is received and the manual override is received from the operator of the terminal, authorizing the transaction at the terminal.