# US 2014/0156535 A1 · System and method for requesting and processing pin data using a digit subset for subsequent pin authentication

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0156535 A1
- Document ID: US20140156535A1
- Status: Published application
- Kind: A1
- Application number: 13/906,646
- Filed: 2013-05-31
- Published: 2014-06-05
- Earliest claimed: 2012-06-01
- Inventors: Nameh Jabbour; Sinan Olcayto Akdeniz
- Web page: https://patentgrep.com/patent/US20140156535A1

## CPC

- G06Q 20/4012: {Verifying personal identification numbers [PIN]}
- G06Q 20/34: using cards, e.g. integrated circuit [IC] cards or magnetic cards
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

A system and method for authenticating a personal identification number (PIN) associated with a payment card of a cardholder, the PIN being a code having a sequence of digits, the method comprising the steps of: presenting a PIN entry request including identifying a digit subset of the code, such that the digits in the digit subset is at least one digit less than the digits of the code; receiving the digit subset in response to the PIN entry request; sending an authentication request based on the digit subset; receiving an authentication response including response data; and presenting a response to the cardholder based on the response data, the response including information representative of whether the PIN was successfully authenticated or not using the digit subset.

## Claims

### Claim 1

A method for authenticating a personal identification number (PIN) associated with a payment card of a cardholder, the PIN being a code having a sequence of digits, the method comprising the steps of:
presenting a PIN entry request including identifying a digit subset of the code, such that the digits in the digit subset is at least one digit less than the digits of the code;
receiving the digit subset in response to the PIN entry request;
sending an authentication request based on the digit subset;
receiving an authentication response including response data; and
presenting a response to the cardholder based on the response data, the response including information representative of whether the PIN was successfully authenticated or not using the digit subset.

### Claim 2 (depends on 1)

The method of claim 1, wherein the authentication request further includes the steps of: accessing by a card reader the code stored as card data in a physical memory of the payment card using the digit subset; obtaining a comparison result of a comparison between the code stored in the card data and the digit subset; and including the comparison result in the authentication request such that the authentication request is sent to a transaction processor over a communications network.

### Claim 3 (depends on 2)

The method of claim 2, wherein the code is stored in the card data as a PIN verification value (PVV).

### Claim 4 (depends on 2)

The method of claim 2, wherein the physical memory is a magnetic stripe and the card data is stored as track data recorded on the magnetic stripe.

### Claim 5 (depends on 2)

The method of claim 2, wherein the physical memory is part of an integrated circuit (IC) attached to the payment card and the card data is accessed using application protocol data units (APDU).

### Claim 6 (depends on 5)

The method of claim 5, wherein the comparison result is embodied in a cryptogram generated by a cryptogram processor of the IC such that the cryptogram is a transaction certificate (TC) in the case of offline approval or an authorization request cryptogram (ARQC) in the case of online authorization.

### Claim 7 (depends on 6)

The system of claim 6, wherein the comparison result includes the ARQC in the case of online authorization and the authentication response is received from the transaction processor, such that the response data includes a response code of an issuer of the payment card indicating either acceptance or rejection of a financial transaction associated with the PIN entry request.

### Claim 8 (depends on 1)

The system of claim 1, wherein the authentication request further includes the steps of: including transactional information of a financial transaction and question information in the authentication request along with the digit subset information based on the digit subset, such that the authentication request is sent to a transaction processor over a communications network.

### Claim 9 (depends on 8)

The method of claim 8, wherein the authentication request further includes the steps of: accessing by a card reader the code stored as card data in a physical memory of the payment card using the digit subset; obtaining a comparison result of a comparison between the code stored in the card data and the digit subset; and including the comparison result in the authentication request sent to the transaction processor.

### Claim 10 (depends on 8)

The method of claim 8, wherein the authentication response is received from the transaction processor and the response data contains confirmation information for the financial transaction including a comparison result of a comparison between the digit subset information based on the digit subset and the code stored in a code database accessible by the transaction processor using the question information.

### Claim 11 (depends on 1)

The method of claim 1, wherein the PIN entry request includes instructions detailing which digit or digits of the sequence is or are to be omitted from the digit subset.

### Claim 12 (depends on 11)

The method of claim 11, wherein the authentication request further includes the step: including information on which digit or digits of the sequence is or are to be omitted from the digit subset.

### Claim 13 (depends on 1)

The method of claim 1, wherein the PIN entry request includes instructions detailing which digit or digits of the sequence is or are to be included in the digit subset.

### Claim 14 (depends on 13)

The method of claim 13, wherein the authentication request further includes the step: including information on which digit or digits of the sequence is or are to be included in the digit subset.

### Claim 15 (depends on 12)

The method of claim 12, wherein the digits of the digit subset are in the same order as said digits are in the sequence.

### Claim 16 (depends on 1)

The method of claim 1, wherein the number of digits of the code is at least six and the number of digits in the digit subset is at least two.

### Claim 17 (depends on 1)

The method of claim 1, wherein the code is stored as card data in a physical memory of the payment card, such that the card data also includes which digit or digits of the sequence of digits was or were not included in the digits of the digit subset in a previous PIN entry request.

### Claim 18 (depends on 17)

The method of claim 17 further including the step of querying the card data to determine which digit or digits of the sequence of digits was or were not included in the digits of the digit subset in the previous PIN entry request and generating the PIN entry request to identify a different digit subset to that of the digit subset of the previous PIN entry request.

### Claim 19 (depends on 1)

The method of claim 1, wherein the code is stored in a code database accessible by a transaction processor, such that card data associated with the payment card is also stored in the code database and includes which digit or digits of the sequence of digits was or were not included in the digits of the digit subset in a previous PIN entry request.

### Claim 20 (depends on 19)

The method of claim 19 further including the step of querying the code database to determine which digit or digits of the sequence of digits was or were not included in the digits of the digit subset in the previous PIN entry request and generating the PIN entry request to identify a different digit subset to that of the digit subset of the previous PIN entry request.

### Claim 21 (depends on 2)

The method of claim 2, wherein the card reader is a component of a computer device selected from the group comprising: a point of sale (POS) terminal and an automated teller machine (ATM).

### Claim 22 (depends on 21)

The method of claim 21, wherein the PIN entry request is displayed on a display component of the computer device and the digit subset is received by a keypad component of the computer device.

### Claim 23

A system for authenticating a personal identification number (PIN) associated with a payment card of a cardholder, the PIN being a code having a sequence of digits, the system comprising:
a computer processor coupled to a physical memory, wherein the computer processor is programmed by instructions to coordinate the authenticating of the PIN by:
presenting a PIN entry request to the cardholder including identifying a digit subset of the code, such that the digits in the digit subset is at least one digit less than the digits of the code;
receiving the digit subset in response to the PIN entry request;
sending an authentication request based on the digit subset;
receiving an authentication response including response data; and
presenting a response to the cardholder based on the response data, the response including information representative of whether the PIN was successfully authenticated or not using the digit subset.

### Claim 24 (depends on 23)

The system of claim 23, wherein the number of digits in the digit subset is less than the number of digits in the code.

### Claim 25 (depends on 23)

The system of claim 23, wherein the PIN entry request is selected from a set of available questions.

### Claim 26 (depends on 23)

The system of claim 23, wherein the selection is a random selection.

### Claim 27 (depends on 23)

The system of claim 23 further comprising the instruction of detecting whether a plurality of the authentication responses result in PIN authentication failure being over a predefined failure threshold within a predefined period of time and limiting the operation of the number of subsequent PIN entry requests presented to one or more of the cardholders.

### Claim 27

A non-transitory computer readable storage medium with an executable program application stored thereon, the program application for authenticating a personal identification number (PIN) associated with a payment card of a cardholder, the PIN being a code having a sequence of digits, wherein the program application is configured to instruct a computer processor to perform the following steps of:
presenting a PIN entry request to the cardholder including identifying a digit subset of the code, such that the digits in the digit subset is at least one digit more than the digits of the code;
receiving the digit subset in response to the PIN entry request;
sending an authentication request based on the digit subset;
receiving an authentication response including response data; and
presenting a response to the cardholder based on the response data, the response including information representative of whether the PIN was successfully authenticated or not using the digit subset.