Card-not-present transactions with cardholder-chosen CVV

A method of performing a card-not-present transaction, the method comprising:

• entering, by a user, a user-defined first card verification value (CVV) and payment card information in a merchant system connected to a payment system, to initiate a transaction, the user-defined first card verification value (CVV) satisfying one or more conditions;
• in response to determining that the one or more conditions is fulfilled, generating a first digital signature based on a card-payment token at the cardholder device;
• subsequently entering a user transaction confirmation on a cardholder device connected to the payment system, the user transaction confirmation including a second CVV, and generating a transaction authorization response including the first digital signature and the second CVV provided by the user on the cardholder device;
• validating, by a cardholder bank, the received payment card information and the first digital signature;
• comparing, by the cardholder bank, the second CVV to an expected value of the user-defined first CVV;
• and
• receiving, through the merchant system, a transaction authorization decision that approves the transaction based on determining that the second CVV equals the expected value of the user-defined first CVV, and successful validation of the payment card information and the first digital signature, the transaction authorization decision being determined by:
• computing a second digital signature based on the user-defined first CVV and a locally-generated card-based payment token for the cardholder, and
• comparing the first and second digital signatures.

A payment system processing a card-not-present transaction, the payment system comprising:

• a transaction receiving server configured to receive, from a merchant system,
• transaction information including payment card information entered by a user in the merchant system, and
• a user-defined first card verification value (CVV) entered by the user in the merchant system, the user-defined first card verification value (CVV) satisfying one or more conditions;
• a cardholder device configured to generate and transmit a transaction authorization response including a second CVV provided by the user on the cardholder device;
• and
• an authorization server configured to
• subsequently receive, from the cardholder device, the transaction authorization response including the second CVV provided by the user on the cardholder device, and a first digital signature being generated based on a card-payment token at the cardholder device,
• validate the received payment card information and the first digital signature,
• compare the second CVV to an expected value of the user-defined first CVV, and
• determine a transaction authorization decision that approves the transaction based on determining that the second CVV equals the expected value of the user-defined first CVV, and successful validation of the payment card information and the first digital signature, the transaction authorization decision being determined by:
• computing a second digital signature based on the user-defined first CVV and a locally-generated card-based payment token for the cardholder, and
• comparing the first and second digital signatures.

A method of performing a card-not-present transaction, the method comprising, at a payment system:

• tokenizing payment card information to obtain a card-payment token;
• receiving, from a merchant system,
• transaction information including said token, and
• a user-defined first card verification value (CVV) entered by the user in the merchant system, the user-defined first card verification value (CVV) satisfying one or more conditions;
• upon receiving the transaction information,
• checking that the one or more conditions is fulfilled, and
• automatically sending a transaction authorization request to a cardholder device;
• generating a first digital signature based on the card-payment token at the cardholder device;
• subsequently receiving, from the cardholder device, a transaction authorization response including the first digital signature and a second CVV provided by the user on the cardholder device;
• validating, by a cardholder bank, the tokenized payment card information and the first digital signature;
• comparing, by the cardholder bank, the second CVV to an expected value of the user-defined first CVV;
• and
• determining, by the cardholder bank, a transaction authorization decision that approves the transaction based on determining that the second CVV equals to the expected value of the user-defined first CVV, and successfully validating validation of the tokenized payment card information and the first digital signature, the validating the tokenized payment card information and the first digital signature including
• computing a second digital signature based on the user-defined first CVV and a locally-generated card-based payment token for the cardholder, and
• comparing the first and second digital signatures.