Secure process to avoid storing payment credentials
AssigneeBank of America Corporation
InventorsVijay Kumar Yarabolu, Ravi Prasad Challagulla, Durga Prasad Patro
Life of this patent
Estimating the term…
Abstract
A credential security tool may avoid storing payment credentials at online services. Generally, the credential security tool issues authorization tokens to merchants when users attempt to store payment credentials with the merchants. The merchants store these authorization tokens rather than the payment credentials. When a user initiates a transaction with a merchant, the merchant can present the authorization token to receive a masked card that can be used to complete the transaction. When the merchant presents the masked card for payment, the credential security tool can use the actual card information to complete the transaction.
Claims20
A credential security apparatus comprising:
- a memory;
- and
- a hardware processor communicatively coupled to the memory, the hardware processor configured to:
- receive, from a merchant, customer data comprising information about a user, the information about the user communicated in response to the user attempting to store payment credentials with the merchant;
- determine an identity of the user using the information about the user;
- after determining the identity of the user, send a widget to a device of the user;
- after sending the widget to the device of the user, receive authentication information from the user, wherein the authentication information is provided through user interaction with the widget at the device of the user;
- determine using the authentication information, that the user is authenticated;
- and
- after determining that the user is authenticated, send an authorization token to the merchant, wherein the merchant stores the authorization token rather than the payment credentials, thereby improving security of the payment credentials.
A method comprising:
- receiving, by a hardware processor communicatively coupled to a memory and from a merchant, customer data comprising information about a user, the information about the user communicated in response to the user attempting to store payment credentials with the merchant;
- determine, by the hardware processor, an identity of the user using the information about the user;
- after determining the identity of the user, sending, by the hardware processor, a widget to a device of the user;
- after sending the widget to the device of the user, receiving, by the hardware processor, authentication information from the user, wherein the authentication information is provided through user interaction with the widget at the device of the user;
- determining, by the hardware processor, that the user is authenticated using the authentication information;
- and
- after determining that the user is authenticated, sending, by the hardware processor, an authorization token to the merchant, wherein the merchant stores the authorization token rather than the payment credentials, thereby improving security of the payment credentials.
A system comprising:
- a merchant device;
- and
- a credential security tool comprising a memory and a hardware processor communicatively coupled to the memory, the hardware processor configured to:
- receive, from the merchant device, customer data comprising information about a user, the information about the user communicated in response to the user attempting to store payment credentials with the merchant device;
- determine an identity of the user using the information about the user;
- after determining the identity of the user, send a widget to a device of the user;
- after sending the widget to the device of the user, receive authentication information from the user, wherein the authentication information is provided through user interaction with the widget at the device of the user;
- determine, using the authentication information, that the user is authenticated;
- and
- after determining that the user is authenticated, communicate send an authorization token to the merchant device, wherein the merchant device stores the authorization token rather than the payment credentials, thereby improving security of the payment credentials.
Dependencies are inferred from the claim text.