# US 8,328,095 B2 · Secure payment card transactions

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,328,095 B2
- Document ID: US8328095B2
- Status: Granted
- Kind: B2
- Application number: 13/014,604
- Filed: 2011-01-26
- Published: 2011-05-26
- Granted: 2012-12-11
- Earliest claimed: 2007-05-17
- Assignees: Shift4 Corporation
- Inventors: John David Oder, II; John David Oder; Kevin James Cronic; Steven Mark Sommers; Dennis William Warner
- Web page: https://patentgrep.com/patent/US8328095B2

## CPC

- G06Q 20/401: {Transaction verification}
- G06Q 20/20: Point-of-sale [POS] network systems
- G06Q 20/202: {Interconnection or interaction of plural electronic cash registers [ECR] or to host computer, e.g. network details, transfer of information from host to ECR or from ECR to ECR}
- G06Q 20/3278: {RFID or NFC payments by means of M-devices}
- G06Q 20/34: using cards, e.g. integrated circuit [IC] cards or magnetic cards
- G06Q 20/382: {insuring higher security of transaction}
- G06Q 20/3821: {Electronic credentials}
- G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q 20/409: {Device specific authentication in transaction processing}
- G06Q 40/00: Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G07F 7/088: {the card reader being part of the point of sale [POS] terminal or electronic cash register [ECR] itself}
- G06Q 2220/00: Business processing using cryptography
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G07F: COIN-FREED OR LIKE APPARATUS (coin sorting G07D3/00; coin testing G07D5/00; {handling coins or paper currencies apart from payment activated apparatus G07D; payment architectures, schemes or protocols G06Q20/00})

## Abstract

Payment card transactions at a point of sale (POS) are secured in certain embodiments by intercepting, with a POS security layer installed on a POS terminal, payment data from the POS terminal, transmitting the payment data from the POS security layer to a server security application installed on a POS server, and providing false payment data from the POS security layer to a POS terminal application installed on the POS terminal. The false payment data in various embodiments is processed as if it were the payment data, such that the POS terminal transmits an authorization request to the POS server using the false payment data. In addition, the authorization request may be transmitted from the POS server to a payment gateway.

## Claims

### Claim 1

A non-transitory computer-readable medium having stored thereon a point-of-sale (POS) security layer configured to communicate with a POS application and a POS server, the POS security layer comprising executable instructions that instruct a computing system to at least:
intercept actual payment data supplied by a user for performing a payment card transaction, such that the actual payment data is not made available to the POS application;
pass false payment data to the POS application for use in place of the actual payment data, thereby causing the POS application to transmit the false payment data to the POS server in place of the actual payment data; and
transmit the actual payment data to the POS server.

### Claim 2 (depends on 1)

The computer-readable medium of claim 1, wherein the POS application comprises a shopping cart program of an online store.

### Claim 3 (depends on 1)

The computer-readable medium of claim 1, wherein the POS security layer is configured to obtain at least a portion of the false payment data from a security application that runs on the POS server.

### Claim 4 (depends on 1)

The computer-readable medium of claim 1, wherein the false payment data comprises a portion of the actual payment data.

### Claim 5 (depends on 1)

The computer-readable medium of claim 1, wherein the POS security layer is further configured to encrypt the actual payment data.

### Claim 6 (depends on 1)

The computer-readable medium of claim 1, wherein the POS security layer is capable of being invoked indirectly by entry of the payment data into the POS application.

### Claim 7 (depends on 1)

The computer-readable medium of claim 1, wherein the POS security layer is capable of being invoked programmatically.

### Claim 8 (depends on 1)

The computer-readable medium of claim 1, wherein the actual payment data is transmitted to the POS server over a secure channel.

### Claim 9 (depends on 1)

The computer-readable medium of claim 1, in combination with a computing device that is configured to execute the POS security layer.

### Claim 10

A method of securing payment transactions, the method comprising:
by a computing system comprising computer hardware:
intercepting payment data supplied by a user for performing a payment card transaction, the payment data comprising actual payment data from a payment medium;
accessing false payment data that does not represent valid card data; and
providing the false payment data to a POS application, the false payment data configured to be processed as if it were the actual payment data, thereby causing the POS application to transmit an authorization request using the false payment data in place of the actual payment data.

### Claim 11 (depends on 10)

The method of claim 10, further comprising displaying a substitute payment display configured to facilitate the intercepting of the payment data.

### Claim 12 (depends on 10)

The method of claim 10, further comprising encrypting the payment data.

### Claim 13 (depends on 10)

The method of claim 10, wherein the false payment data has a card-swipe compatible format.

### Claim 14 (depends on 13)

The method of claim 13, wherein at least a portion of the false payment data is derived from a range of card numbers regarded as invalid by one or more card associations.

### Claim 15

A system for securing payment transactions, the system comprising:
a computing device programmed to implement a POS security layer configured to:
capture payment data being sent to a POS application, the payment data comprising actual card data from a payment card;
obtain false payment data that does not represent valid card data; and
provide the false payment data to the POS application to thereby cause the POS application to transmit an authorization request using the false payment data in place of the actual card data.

### Claim 16 (depends on 15)

The system of claim 15, wherein the POS security layer is further configured to provide a substitute payment display configured to facilitate the intercepting of the payment data.

### Claim 17 (depends on 15)

The system of claim 15, wherein the POS security layer is further configured to encrypt the payment data.

### Claim 18 (depends on 15)

The system of claim 15, wherein the false payment data has a card-swipe compatible format.