ITTO20090121A1 - PROCEDURE FOR THE PROTECTION OF TRANSACTIONS CARRIED OUT WITH ELECTRONIC PAYMENT MEANS. - Google Patents

Description

TITLE

Procedure for the protection of transactions made with electronic means of payment.

<SUMMARY PROCEDURE FOR THE PROTECTION OF TRANSACTIONS MADE BY ELECTRONIC PAYMENT (EX. CREDIT CARD. DEBIT. OR ELECTRONIC CARDS IN GENERAL). THE PROCEDURE. AFTER ENTERING THE DATA OF THE MEANS OF

<OF PASSWORD), ON THE PORTABLE DEVICE DESIGNATED PREVIOUSLY BY THE HOLDER OF THE MEANS OF PAYMENT.> THIS <PASSWORD MUST BE INSERTED ON THE PAYMENT TERMINAL> (EX. <VIRTAL OR> REAL POS.) <TO PROCEED WITH THE PAYMENT. IF THE CODE. COMING FROM THE PAYMENT TERMINAL. IT IS RECOGNIZED BY THE DESIGNATED BODY TO> RECEIVE THE INFORMATION (EX. BANK OR INTERBANK SERVICES). THE TRANSACTION WILL PROCEED. OTHERWISE IT WILL BE FINISHED. THE PROCEDURE INCLUDES 3 DIFFERENT VARIATIONS.

Description of the industrial invention entitled:

PROCEDURE FOR THE PROTECTION OF TRANSACTIONS MADE WITH ELECTRONIC MEANS OF PAYMENT

DESCRIPTION

The procedure covered by this patent refers to the banking field, in order to protect the transactions carried out by means of electronic payment.

This protection is based on the principle of coexistence at the time of the transaction of the payment instrument and of the personal portable device (indicated by the holder), which integrate actions in order to allow the legitimacy of the transaction to be checked.

Glossary details.

1. The term "means of payment" here means any object that allows a transaction with transfer of funds without the use of physical paper money. Example: credit card, debit card, electronic cards in general.

2. The term "server responsible for authorizing the transaction" here means the server that is responsible for sorting the information relating to the transaction through its network and which is defined by the circuit to which it belongs. From now on called Server.

3. The term "personal portable device" here means the portable device capable of transmitting and receiving information by connecting to a network and which is uniquely identified by a number (or code) whose use is considered personal. Example: cellular devices, PDAs.

To the knowledge of the inventor, at the moment, the procedures for controlling the use of the means of payment to avoid its fraudulent use are not known. The procedures that have been patented so far are different and not very usable. The research was carried out on the European Patent Office website on a World Wide database.The procedure, for which the patent is requested, provides, after entering the data of the means of payment (for example by swiping the credit card or entering the data on the website), the sending by the Server of a unique code (random and usable only for a minimum and predefined amount of time) to a personal portable device, and which can be used as a transaction authorization password.

This password-code is sent by the Server to the portable device previously designated by the holder of the means of payment.

This password-code must be entered on the payment terminal (eg POS, virtual or real) to proceed with the transaction. If the code is recognized by the body designated to receive the information, the transaction will proceed, otherwise it will be terminated. The procedure includes 3 different variants, which differ only after the initial phase of entering the data of the means of payment:

L. Callable Input Control.

The customer enters the password received in the message on the payment terminal, virtual or real. The password is sent to the Server and, if the match is recognized, the transaction continues. See drawing l of the Drawings Annex page 1 and diagram 1 of the Drawings Annex page 2.

2. Callable Double Check.

It can be used for more complex transactions, for example above a certain amount that can be set by the bank or by the user. In this case the codes sent are 2:

L. To the customer's portable device to be inserted on the payment terminal.

2. To the payment terminal to be typed on the portable device.

The passwords are sent to the Server and, if matches are recognized, the transaction continues. See drawing 2 of the Drawings Annex on page l.

3. Callable Double Check B.

The procedure is similar to the previous one with the following variation:

- The operator who completes the payment procedures at the point of sale can have his own personal code (password) previously assigned by the bank. This code will be entered on the payment terminal. The passwords are sent to the Server and, if matches are recognized, the transaction continues. See drawing 3 of the Drawings Annex page l.

In order to make the system more secure, the code received on the portable device can be matched to a fixed code of a few digits already known by the user. Example: two digits of the fixed code plus three digits of the random code.

Example 1 of a way of carrying out the procedure which is the object of the present invention. Based on variant l of the procedure.

Setting: "Paaamento with credit card of a purchase made in a point of sale."

After the clerk has swiped the credit card, the customer receives on his mobile phone (whose number he had provided to the bank when requesting the credit card) a numeric code of up to 5 digits via a FLASH MESSAGE (a type of SMS that is not stored in the inbox). The customer enters the code received on the POS keypad. If the code matches, the transaction continues, otherwise it is terminated.

Example 2 of a way of carrying out the procedure which is the object of the present invention. Based on variant 2 of the procedure.

Setting: "Pairing by credit card of a purchase made at a point of sale, with an i m p o r t or higher than the limit chosen by the bank for the simplified procedure."

After the salesman swipes the credit card, the following events occur:

L. The customer receives a numeric code of up to 5 digits via SMS on his mobile phone (whose number he had provided to the bank at the time of requesting the credit card). The customer enters the code received on the POS keypad.

2. The salesman receives a code on the Pos to be typed on the customer's mobile phone in response to the message received. The clerk can alternatively dictate the code to the customer, or send it to the customer's mobile phone via bluetooth (or similar).

3. If both codes match, the transaction continues, otherwise it is terminated.

Claims (4)

The invention describes a procedure which has the purpose of protecting transactions carried out with electronic devices, or in any case with materiality other than cash, from fraud. L. The protection is aimed at all the parties involved as it allows the control that the possession of the payment document is in the hands of the holder (or whoever he has deputed or authorized). This is done by sending a password code on the mobile communication device whose identification has been provided by the owner of the payment document. 2. The 1 password-code must be generated uniquely, randomly and must have a defined timeto-live. 3. If the password-code is not entered on the payment device within the time-to-live, the procedure will be terminated. After a number of incorrect attempts, the control body may contact the customer or block the service. 4. The 1 patent can be implemented on the servers of banks, interbank services or whoever for them on the basis of the most appropriate technology.