WO2014051469A1

WO2014051469A1 - System for confirming a payment card holder's intention to carry out a payment

Info

Publication number: WO2014051469A1
Application number: PCT/RU2013/000838
Authority: WO
Inventors: Петр Федорович КУТИС; Роман Рафикович ХАФИЗОВ
Original assignee: Пэйче Лтд
Priority date: 2012-09-26
Filing date: 2013-09-26
Publication date: 2014-04-03

Abstract

The invention relates to the art of acquiring. The system can be used by an acquirer during the provision of merchant acquiring services in the event of an attempt to carry out payment using a payment card without the physical presence of the cardholder. In such an event, the system makes it possible to confirm the cardholder's intention to effect a debit of funds (payment) from the card. Confirmation is carried out in real time prior to execution of payment by means of interaction with the cardholder using a USSD mobile communication service. In the event of a payment attempt, a USSD request is sent to the cardholder's mobile telephone, said request containing text notifying of the payment attempt and verifying the cardholder's consent to the payment. The cardholder sends their decision to the acquirer by pressing a button. On the basis of the decision received, the acquirer executes or declines the payment. A prerequisite for the functioning of the system is the reliable preliminary authentication of the cardholder during the card registration process that is required to link a mobile telephone number to a payment card in the hardware-software system of the acquirer.

Description

Payment card holder confirmation system

make a payment

The invention relates to the field of acquiring, and in particular to the field of security of cashless payments using payment cards of international payment systems, such as Visa, MasterCard, JCB International, AmericanExpress and others (hereinafter - MPS).

The invention can be applied to verify the intention to make a payment (debiting funds from a payment card) by a payment card holder when making a payment remotely, without a personal presence. In this case, we mean recent online payments on the websites of stores and payment systems, or payments when ordering a service or product by phone or mail.

It is known that remote acceptance of cards for payment is carried out by the payer transferring the main parameters of the cards to the acquirer (hereinafter, the acquirer refers to a bank providing acquiring services, as well as other third parties providing intermediary services to the acquiring bank as part of the latter's provision of acquiring services) through trade and service company (hereinafter - TSP), an intermediary or directly. Card parameters are displayed (in some cases embossed) on the card itself, namely: card number, card expiration date, special verification code, and sometimes the name of the card holder. To make a payment, it’s enough to know the parameters of the card, which makes it easy to apply various fraud schemes when the payer is not the holder of the card, but knows its parameters (looked, photographed or just temporarily took hold of the card). Along with the spread of online payments using bank cards, the fight against fraud is becoming increasingly widespread.

To prevent fraud, various schemes and methods are applied, which basically come down either to complicating the theft of cards and their data, or to additional checks of the payer regarding the fact that he is the cardholder, otherwise - that it is the cardholder who makes the payment.

The invention is aimed at checking the intention of the cardholder to make a payment, and is based on the still not used interactive interaction of the acquirer with the cardholder.

A well-known system for implementing multi-factorial strong authentication of a client using a mobile phone in a mobile communication environment when conducting a financial transaction in an international payment system according to the 3-D Secure specification protocol contains a domain for ensuring interoperability of an international payment system that provides individuals with services using bank cards as a payment funds, hereinafter referred to as the collateral domain and the payment system, the domain of the issuing banks of the payment system , the domain of acquirer banks of the payment system, and the domains of acquirer banks and issuing banks are connected to the provision domain through computer networks, at least one ACS component - access control server - 3-D Secure payment system specifications in the domain of issuing banks at least one MPI component — a store server plug-in — specifications of a 3-D Secure payment system in the domain of acquiring banks, the system further comprises at least one GSM standard cellular mobile communication network provided by a GSM operator, at least one GSM mobile phone connected to a GSM operator’s network, with a SIM card on which standard GSM operator information is recorded, and at least one computer applet that implements the functionality of a banking application and is a component issuing bank, interbank and mobile data exchange support unit - MID unit connected via a computer communication network to at least one GSM operator network, at least one issuing bank unit - i-MAP unit providing exchange messaging 8

3 signals between the ACS server and the MID unit, connected via computer communication networks to the MID unit and at least one ACS server, at least one acquiring bank unit - an a-MAP unit, which provides message-signal exchange between the server MPI and a MID unit connected via computer communication networks to a MID unit and at least one MPI server, at least one payee server connected via a computer communication network to an MPI server, each MPI server being connected via a computer network from ides, at least one server payee (RU 2301449, G06Q20 / 00, publ. 20.06.2007). This decision was made in the rocking of the prototype.

At present, only a rare similar practice is known, when a special person-operator of a TSP or an acquirer manually tries to contact the card holder either by phone or by e-mail to personally confirm the latter's desire to make a payment. However, for such a connection between the operator and the card holder, it is necessary to know his contacts, which is not always possible, because for payment you need to provide only the card data. In addition, requesting these parameters during payment does not guarantee that the entered contacts are genuine, i.e. belong exactly to the card holder. When making a payment, the fraudster may enter his own contacts, posing as a true card holder. In this case, the operators offer to transfer a copy of the card and / or other documents to the e-mail address of the TSP or the acquirer (operator) for further verification.

Thus, the existing practice of verifying the intention of a cardholder to make a payment has crucial drawbacks:

1. A TSP or an acquirer may not always know in advance the true contacts of the card holder and thus cannot be guaranteed to contact the latter. 2. Additional verification of the card holder takes a long time and does not allow verification in real time. Those. the payment must either be made and then the card holder is checked, or the payment is rejected and after checking the holder the latter is invited to make the payment again.

3. Verification is possible only in selective cases, because contacting the cardholder when making each payment is actually wasteful. To do this, several operators must work continuously in the TSP around the clock, which introduces an insurmountable burden on the business. As a way out, it is necessary to introduce selectivity and classify operations by risks. This approach forces additional analytics, which again leads to costs and the inability to conduct checks in real time.

The present invention is aimed at achieving a technical result, which consists in increasing the security of payment transactions using a card.

The specified technical result is achieved by the fact that in the confirmation system of the payment card holder’s intention to make a payment, USSD signals are exchanged between the hardware and software complex (AIC) of the acquirer and a mobile phone using a previously known and verified number belonging to the card holder, which is stored in conjunction with the number cards in the APK of the acquirer, while the mobile phone number in advance guarantees communication with the true card holder, which can confirm the desire of the card holder to make a payment rer; that confirmation is made in real time during the payment; that additional human resources to support the operation of the invention are not required, that changes in the AIC of the acquirer are minimal and are necessary only at the stage of the invention; that the invention works for any card holder in any country, with any currency, card of any issuer; that invention automation; that the IPC holder is required to carry out minimal actions in the form of a simple press of a phone button.

The present invention is illustrated by an example of a specific system shown in the drawings, where:

FIG. 1 is a block diagram of a system for confirming an intention of a payment card holder to make a payment;

FIG. 2 - presents the algorithm of the system of FIG. 1 upon one-time registration of the card;

FIG. 3 - presents the algorithm of the system of FIG. 1 for subsequent payments.

The invention implements a system for verifying the intent of a cardholder to make a payment in real time. A prerequisite for the operation of the system is the authentication of the card holder, carried out only once - during the first payment. This procedure is called “Card Registration” and allows you to fix in the APK 1 acquirer the mobile phone number 2 of the card holder. The system assumes that during subsequent payments to the cardholder’s phone 2, the card number entered will automatically send the USSD request 3 through the mobile operator 4, containing a question about the desire to make a payment. This method of verifying the payment, or rather the intention of the cardholder to make a payment, has not yet been used by anyone, despite the fact that it is quite simple and fast.

USSD (Unstructured Supplementary Service Data) is a standard service in GSM networks, which allows organizing interactive interaction between a network subscriber and a service application in the mode of sending short messages.

The USSD service is supported in GSM Phase 1 and Phase 2 (session initiation by the USSD application). The USSD service is very similar to SMS, both services use the short message format for data transfer. However, the USSD service is primarily for messaging. 13 000 838

between the subscriber and additional services, in the proposed case, the service of the auto-informer of the acquirer, while SMS is mainly used to exchange short messages between subscribers.

USSD, unlike SMS, does not have an intermediate database and does not guarantee re-delivery of messages, which makes messaging instant. USSD is a session-oriented technology, the entire dialogue between the subscriber and the application is carried out within the same session. There are no voice connections in USSD, only the signaling channel is used. Data exchange in the USSD session is more visual and efficient. USSD works on all existing GSM phones, with the exception of the earliest 1998-1999 models.

The cardholder within the USSD session can in real time select one of the answer options on his phone (for example, “yes” or “no”) by pressing only one button of the phone corresponding to the selected answer. Further, the acquiring APK acquires and processes the response to the USSD request, according to which it makes a decision on the payment.

This invention allows in real time to automatically check the intention of each cardholder to make each online payment through his payment card, subject to a one-time online card registration procedure.

The technical result is the solution of tasks:

1. Verification is performed in real time, including the procedure for registering a card, which can be several

2. All payments are verified.

3. Verification is done automatically.

4. The implementation of the invention requires only changes to the AIC of the acquirer and the conclusion of a contractual relationship with the mobile operator for the transfer of USSD requests, which is significantly the cost of verification. The confirmation system of the payment card holder’s intention to make a payment contains an acquirer hardware and software complex configured to display a web page for registering a payment card holder in remote access mode, a trade and transport company server configured to receive a payment card and enter a mobile phone number of the holder of this card and transferring data on the numbers of the payment card and mobile phone to the receiving unit of the hardware and software complex acquire and made a comparison of the data with the function of the data corresponding to this payment card and mobile phone numbers that are in the database, and the direction of mobile network on the mobile phone number of cardholders reporting Confirmation of payment. In some cases, the page for entering a bank card is shown to the user by the acquirer server. To do this, the TSP server only redirects the user to the acquirer's website, and already there the user enters the card data.

The condition for the operation of such a system is to store in the database 5 of the APK 1 acquirer of the mobile phone number 2 of the card holder, while this number is tied to the card number. The system allows real-time exchange of signals with the cardholder’s mobile phone and, thereby, verifies that the cardholder intends to make a payment - confirm the payment. Verification is carried out by sending a request 3, receiving a response of “YES” or “NO”, sending a response of “YES” to block 6 of outputting from the database 5 information about the mobile phone number and the corresponding card number and transferring this data to control and comparison unit 7 data. Where does the corresponding signal from the results of the comparison go to the agro-industrial complex for permission to make a payment or a ban on it. As a request, a written message is used, transmitted through the system of the mobile operator 4 with the question of confirmation of the desire to make a payment, indicating the amount and part of the card number. As a response, a signal is used which means the subscriber agrees or disagrees with the payment.

The invention operates in two stages.

Stage 1 - one-time card registration (system operation condition). Registration of a card implies saving the card number and the corresponding mobile phone number of the card holder in the acquiring APK. For example, for this, the payer is given the opportunity, using a personal computer 8 via the Internet 9, to enter the phone number and additional authentication data on the web page of the TSP 10 (if the user is directly in the trade and service company) or the acquirer (APK 1), which then arrive over a secure communication line 11 are transferred to the APK 1 of the acquirer and stored. For authentication, you can use the parameters reported to the cardholder through the bank that issued his card. For example, a verification code or a test deposit amount, which is then canceled. It is possible to use any existing technology, including 3D-Secure. The system only requires compliance with the authentication conditions of the card holder when registering his card.

In FIG. 2 shows an algorithm for implementing step 1 of the system of the invention.

Step 1. On the first payment, the user is asked to register a card for subsequent payments and exclude fraudsters from using the card. When entering the necessary payment data, the user enters another mobile phone number, transmits this information via the selected channel 12 to APK 1 and passes additional authentication,

guaranteeing the authenticity of the card holder. Step 2. The TSP transmits the data entered by the user to the acquirer in the form of a request “Register a card” on a secure communication channel 11.

Step 3. The acquirer checks the authentication data and safely saves the bundle of the card number and mobile phone in his APK 1.

Step 4. The acquirer returns the results of user verification and processing the request "Card Registration"

Step 5.TSP informs the user about the success of the operation. If the result is positive, the user will be able to receive confirmation requests for any payment using his card, which are conducted through the TSP, the acquiring service of which is provided by this acquirer.

Stage 2. Exchange of USSD messages in subsequent payments. The system works in the following order:

1. The payer, when trying to make a payment, enters the card details, which are then reported in the online payment request in the APK 1 of the acquirer.

2. The APC of the acquirer, through the interface of the mobile operator 4, initiates a USSD session with a telephone number corresponding to the card number entered by the payer. During the session, request 13 is sent to the mobile phone, including a text message, for example: “Confirm the payment for the amount A using card B. To make the payment, select the answer“ I confirm ”, to cancel,“ Cancel ”, where A is the amount payment, B - this is the first 6 digits and the last 4 digits of the card number. The mobile phone device automatically sets up the session and receives the signal.

3. The subscriber views the message transmitted in the signal and selects the answer “Confirm” or “Cancel” by pressing one button.

A real-time mobile phone sends a response to the acquiring APK through the infrastructure of a mobile operator.

4. The APK of the acquirer, upon receipt of a positive response, for example, “I confirm”, carries out the payment with the indicated parameters. Upon receipt of a negative response, such as "Reject", the acquirer does not make a payment.

In FIG. 3 shows an algorithm for implementing the system of step 2.

Step 1. The user enters the card data on the TSP web page.

Step 2. The TSP transmits the data entered by the user to the acquirer in the form of a request "Write-off of funds" via a secure communication channel.

Step Z. The Acquirer checks for the presence of a registered bundle of card number and mobile phone in his APK.

Step 4. The acquirer sends a USSD request to the mobile phone number corresponding to the entered card number. The request contains a signal in the form of a message requiring a response - confirmation of payment or refusal.

Step b. The user within the session confirms or rejects the payment.

The step B. Acquirer, based on the result of the response of the cardholder, makes a decision on processing the request “Write-off of funds”.

Step 7. The acquirer reports to the TSP the result of processing the request "Write-off of funds".

TSP informs the user (payer) of the result of the operation (success or failure).

Claims

Claim

A system for confirming the intention of a payment card holder to make a payment, containing the hardware and software complex of the acquirer, configured to display its web page or web page of the acquirer server for registering the holder of the payment card in remote access mode, a server of a trade and transport company, configured to receiving a payment card and entering the mobile phone number of the holder of this card and transmitting data on the payment card and mobile phone numbers to the receiving unit and the hardware and software complex of the acquirer, which was performed with the function of comparing the received data with the data corresponding to the payment card and mobile phone number in the database, and sending a confirmation message about the payment made via the mobile phone network to the mobile phone number of the payment card holder.