Secured account provisioning and payments for NFC-enabled devices

A system comprising:

• a user computing device comprising a processor and a memory;
• machine-readable instructions stored in the memory that, when executed by the processor, cause the processor of the user computing device to at least:
• receive a payment request from a point of sale terminal;
• obtain, from a secure database of the user computing device, a storage encryption (ENC) key based on at least a device fingerprint of the user computing device, a keyed-hash message authentication code previously generated via a storage message authentication code (MAC) key comprising a numerical value based at least in part on the device fingerprint, and a storage root key;
• obtain an encrypted account payload from the secure database of the user computing device;
• generate a second device fingerprint of the user computing device;
• generate a second storage ENC key and a second storage MAC key based on the second device fingerprint and the storage root key;
• match the second storage ENC key to the storage ENC key;
• decrypt the encrypted account payload using the second storage ENC key based on the matching, wherein the decrypted account payload includes a payment credential;
• generate a second keyed-hash message authentication code based on the decrypted account payload and the second storage MAC key;
• verify the keyed-hash message authentication code by matching the keyed-hash message authentication code to the second keyed-hash message authentication code;
• and
• transmit the payment credential to the point of sale terminal based on the verifying.

A non-transitory computer readable storage medium having instructions stored thereon that, when executed by a processor of a user computing device, cause the processor of the user computing device to at least:

• receive a payment request from a point of sale terminal;
• obtain, from a secure database of the user computing device, a storage encryption (ENC) key based on at least a device fingerprint of the user computing device, a keyed-hash message authentication code previously generated via a storage message authentication code (MAC) key comprising a numerical value based at least in part on the device fingerprint, and a storage root key;
• obtain an encrypted account payload from the secure database of the user computing device;
• generate a second device fingerprint of the user computing device;
• generate a second storage ENC key and a second storage MAC key based on the second device fingerprint and the storage root key;
• match the second storage ENC key to the storage ENC key:
• decrypt the encrypted account payload using the second storage ENC key, based on the matching, wherein the decrypted account payload includes a payment credential;
• generate a second keyed-hash message authentication code based on the decrypted account payload and the second storage MAC key;
• verify the keyed-hash message authentication code by matching the keyed-hash message authentication code to the second keyed-hash message authentication code;
• and
• transmit the payment credential to the point of sale terminal based on the verifying.