Systems and methods for payment authentication

A payment authentication system, the payment authentication system comprising:

• a memory storing instructions;
• and
• one or more processors configured to execute the instructions to cause the payment authentication system to perform operations including:
• receiving, from a user device associated with a user, a request to associate a first device fingerprint with a token representing a primary account number and with a specified merchant to which usage of the token is to be limited, the first device fingerprint having been generated by the user device and being derived from a device attribute of the user device including a unique hardware identifier of a hardware component of the user device and behavioral biometric data derived from a behavioral pattern of the user in using the user device;
• generating the token;
• storing the first device fingerprint in association with the token and providing the token to the user device, wherein the token is identified by the user device and submitted to a merchant system to make a payment to a merchant;
• receiving, from a payment processing system, a transaction authorization request associated with a transaction between the merchant and a customer using the token, the transaction authorization request being derived from the token and a second device fingerprint generated by a customer device associated with the customer;
• determining conditions for authentication are satisfied, the conditions including a match between the second device fingerprint and the first device fingerprint indicating the customer device is the user device authorized to use the token to make the payment to the merchant to complete the transaction, and a match between the specified merchant and the merchant;
• and
• upon determining that the conditions for authentication are satisfied, generating and transmitting an authentication message to the payment processing system, the authentication message indicating that the transaction has been authenticated so that the token is used to make the payment to the merchant.

A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a user device, cause the user device to perform operations for providing data for payment authentication, the operations including:

• generating, by the user device, an original device fingerprint based on a device attribute of the user device and behavioral biometric data, the device attribute including a unique hardware identifier of a hardware component of the user device, the behavioral biometric data being derived from a behavioral pattern of a user in using the user device;
• transmitting, by the user device, a token request including the original device fingerprint to a payment authentication system, wherein the original device fingerprint is stored by the payment authentication system in association with a token representing a primary account number of the user that is generated by the payment authentication system responsive to the token request;
• receiving, by the user device, the token from the payment authentication system;
• detecting, by the user device, a user operation identifying the token for submission to a merchant system via an electronic commerce application for making a payment to a merchant associated with the merchant system;
• generating, by the user device, a subsequent device fingerprint based on the device attribute of the user device and the behavioral biometric data;
• and
• transmitting, by the user device to the merchant system, the subsequent device fingerprint and the token so that the token is used to make the payment, wherein the subsequent device fingerprint and the token is further received by the payment authentication system for verifying a match of the subsequent device fingerprint and the original device fingerprint to authenticate the payment.