System and method for secure credit and debit card transactions

#The present invention relates to a system and method for improving security in relation to credit and debit card transactions and the like.

#Credit and debit card fraud (hereinafter referred to together as “card fraud”) is a growing problem, especially in on-line (“e-commerce”) transactions. The banking industry has responded to this with a short-term solution to combat fraud until more sophisticated approaches can be developed. This short-term solution is known as “CVV2” approach, and is relatively simple. The CVV2 code is a three digit decimal number, generally printed on the back of a credit or debit card by the card issuer, which is separate from the card number (“PAN” or “payer account number”) and not electronically coded onto the card by way of its magnetic strip or embedded chip (this helps to prevent the CVV2 code from being “skimmed” by a fraudster). The CVV2 code is printed on the card but not readable from the magnetic stripe. Verification is achieved by obtaining the card number from an online source and then checking it to see if the CVV2 code supplied is correct. A merchant conducting a non-cardholder-present transaction (e.g. an on-line or telephone transaction) requests a CVV2 code from the cardholder, as well as the PAN, card expiry date and a delivery address. The merchant then makes an on-line check to verify that the CVV2 code and the given cardholder delivery address correspond with the details held by the card issuer in connection with the card associated with the given PAN. Thus, a person attempting to make a fraudulent transaction requires the PAN, the cardholder address, the card expiry date and the CVV2 code, and the CVV2 approach therefore assumes that a fraudster will not initially know how to steal this information. The drawback is that the CVV2 approach is relatively easily overcome, since many techniques for stealing a PAN may be trivially extended to steal the CVV2 code and the cardholder address. At best, CVV2 is a temporary measure to slow down the growth in fraud. The infrastructure needed to support the CVV2 approach is already installed and in operation. This means that merchants' equipment (e.g. EPOS and EFTPOS terminals and the like) and computer (“IT”) systems are already designed and adapted to request a three digit decimal number as an additional security measure. Embodiments of the present invention are adapted to make use of this existing infrastructure to provide a level of anti-fraud security that is higher even than the new smartcard-based approaches.

#An improved method and system for verifying an identity of a person, for example a credit or debit card holder, is disclosed in the present applicant's co-pending UK patent applications no. 0021964.2, International patent application no. PCT/GB01/04024 and U.S. patent applications Ser. Nos. 09/663,281 and 09/915,271. The method and system involves transmission of a pseudo-random string to a person's mobile telephone or the like prior to making a card transaction. The person then applies a mask code in the form of a personal identification number (“PIN”) to the pseudorandom string in a predetermined manner so as to generate a volatile one-time transaction identification code that is passed to the merchant and then on to an authentication server where it is checked against an independently calculated volatile one-time identification code so as to verify the identity of the cardholder.

#For a better understanding of the present invention and to show how it may be carried into effect, reference will now be made by way of example to the accompanying drawing, in which:

#FIGURE 1 shows a schematic outline of the infrastructure of an embodiment of the present invention.

#In FIGURE 1, there is shown a host computer 10 which acts as an authorisation server. When a card is issued to a customer by a card issuer, the customer must first register the card with the host computer 10, giving details of a customer account number (card number), a PIN, a mobile telephone number or the like and any other useful information, such as a customer name and address. Once this has been done, the host computer 10 generates at least one pseudorandom security string and transmits this via step 1 to a mobile communications device 11 operated by the customer, which device 11 may be a mobile telephone, PDA, pager or the like. The transmission 1 may be by way of an SMS message, e-mail or the like. The host computer 10 associates the at least one pseudorandom security string in its memory with the customer account number and the PIN.

#When the customer wishes to make a transaction with a merchant 13, the customer enters a transaction amount and the PIN into the mobile communications device 11 by way of a keypad or the like. An applet running in a SIM card or the like provided in the device 11 and programmed with a one-way cryptographic hashing algorithm 12 takes the user-input transaction amount and PIN, together with the pseudorandom security string supplied via step 2, and hashes these together so as to generate a 3 digit response code that is passed to the merchant 13 by way of step 3. The response code may be given to the merchant 13 verbally in a face-to-face or telephone transaction, or by way of a merchant website when conducting an e-commerce transaction.

#Meanwhile, the merchant 13 takes the customer account number and the transaction amount, possibly by way of swiping the card through an EPOS or EFTPOS terminal, or by any other appropriate means, and then passes this information, together with the response code, to a Card Acquirer Network Server (CANS) 14 in a known manner by way of step 4. The merchant 13 also transmits merchant identity information to the CANS 14 by way of step 4, thereby enabling the CANS 14 to associate the transaction with the merchant 13 as well as with the customer (by way of the customer account number).