Authorizing payments using pre-registered customer tokens
By employing pre-registered customer tokens and multi-factor authentication using unique electronic device identifiers, the POS system addresses operational inefficiencies and security risks, ensuring secure and compliant transactions while reducing maintenance costs.
Patent Information
- Application Number
- JP2024111000
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2023-07-17
- Filing Date
- 2024-07-10
- Publication Date
- 2025-01-29
AI Technical Summary
POS systems face challenges with high operational and maintenance costs, inconvenience in handling certain transactions, and inaccuracies in processing customer-added amounts, particularly for rewards, which can lead to security risks and non-compliance with PCI DSS standards.
Utilizing pre-registered customer tokens based on unique electronic device identifiers, such as MAC addresses, for secure transaction authentication, and implementing multi-factor authentication through personal electronic devices like smartphones to verify and manage customer-added rewards, transferring the responsibility for reward accuracy to payment method issuers.
This approach reduces the need for stringent POS system security measures, enhances transaction accuracy, and lowers operational costs by allowing secure transactions without exposing customer PAN, thus maintaining compliance with PCI DSS standards.
Smart Images
Figure 2025014115000001_ABST
Abstract
Description
[Background technology]
[0001]
[0001] Within the service industry, retailers routinely use Point of Sale (POS) systems to provide a platform for customers to pay for goods or services. Modern POS systems may include a personal identification number (PIN) pad to support high volume, small value customer transactions. Customers communicate with the PIN pad by swiping, dipping, or tapping a debit card, credit card, or smart card onto the electronic components of the PIN pad. The PIN pad reads the customer's PIN during the communication and encrypts the PIN for transmission as part of the payment authorization process. [Brief description of the drawings]
[0002] [Figure 1]
[0002] FIG. 1 illustrates an example system for authorizing payments using an electronic device and a POS system, according to one or more embodiments. [Diagram 2]
[0003] FIG. 1 illustrates an example payment network, according to one or more embodiments. [Diagram 3]
[0004] 1 is a diagram of a method of using a POS system to authorize payment for a transaction, illustrating an example payment network, according to one or more embodiments. [Figure 4]
[0005] FIG. 1 is a communications diagram illustrating an example payment authorization using a pre-registered token, according to one or more embodiments. [Diagram 5]
[0006] 1 is a communications diagram illustrating an exemplary payment authorization using a single-use token, according to one or more embodiments. [Figure 6]
[0007] 1 is a communication diagram illustrating an exemplary payment authorization using a captured image, according to one or more embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
[0003]
[0008] Although the use of PIN pads is widespread, they can be costly for merchants to operate and maintain, and in some cases, they can also be inconvenient or even a hindrance to accepting certain types of transactions.
[0004]
[0009] Furthermore, some types of transactions require an initial authorization of the customer's payment method, and the customer is then prompted to add an amount to the transaction total (e.g., by writing a tip on the receipt). Some PIN pads may not be able to accommodate such transactions. In addition, the customer-added amount may be entered inaccurately into the POS system, either intentionally (e.g., another party enters an incorrectly high tip) or unintentionally (e.g., the amount is keyed in incorrectly).
[0005]
[0010] A user's personal electronic device, such as a smart phone or wearable, may be used to perform multi-factor and multi-step authentication for a transaction, eliminating any need for the merchant to operate and maintain a separate PIN pad. In this disclosure, the electronic device pre-registers with a payment method issuer (e.g., a credit card issuer), and the issuer provides a token that corresponds to the user and electronic device combination. The token may be based on a unique hardware identifier for the electronic device, such as a MAC address.
[0006]
[0011] During a transaction, the electronic device sends a communication (including the token) to the POS system, which then sends the token and an identifier of the electronic device to the payment network. In some cases, the POS system can derive the identifier of the electronic device from the communication, for example by inspecting the header information. When the POS system receives payment authorization for a transaction, this indicates that the token and the identifier of the electronic device were pre-registered with the payment method issuer. Using this token-based verification, a transaction can be authorized without using the customer's PAN (Primary Account Number). In this way, the transaction authorization process can be completed without the need for the entire POS system to comply with security standards that have more stringent requirements.
[0007]
[0012] Additionally, the personal electronic device may be used in a closed-loop authentication process to authenticate the amount added by the customer. For example, a customer receives a receipt from a merchant that includes a reward field. After writing the reward amount, the customer uses the electronic device to capture an image of the receipt. The customer uses an application or website to send the image (or text derived from the image) to a payment method issuer. When determining whether to authorize the payment, the payment method issuer determines whether the amount on the receipt matches the amount entered in the POS system. In this way, the responsibility (and any associated risk) for authorizing the reward amount may be shifted from the merchant to the payment method issuer.
[0008]
[0013] Turning now to FIG. 1 , the figure illustrates an exemplary system 100 for authorizing payments using a customer's 130 electronic device 135 and a retailer's POS system 150. The system 100 includes a retailer's public network 115 and private network 120, each containing a respective one or more electronic devices that operate to provide control and / or data to one or more customer electronic devices when the one or more customer electronic devices are connected to a respective one of the public network 115 and private network 120. As used herein, an "electronic device" generally refers to any device having electronic circuitry that provides processing or computing power, which implements logic and / or executes program code to perform various operations that collectively define the functionality of the electronic device. The functionality of the electronic device includes, for example, the ability to communicate with one or more other electronic devices when connected to the same network. The electronic devices may be implemented in any suitable form factor, whether relatively fixed in nature (e.g., mainframes, computer terminals, servers, kiosks, workstations) or mobile (e.g., laptop computers, tablets, handhelds, smart phones, wearable devices). Communication capabilities between electronic devices may be achieved using any suitable technique, such as conductive cables, wireless transmission, optical transmission, etc.
[0009]
[0014] One or more electronic devices of the retailer included in the public network 115 and the private network 120 are "on-site," i.e., located on the retailer's physical premises (e.g., inside a store, restaurant, building). In some embodiments, one or more other electronic devices of the retailer are "off-site," i.e., located away from the retailer's physical premises and communicatively coupled to the on-site electronic devices. In some embodiments, the off-site electronic devices are not owned by the retailer, but are allocated, assigned, leased, etc., in whole or in part to the retailer.
[0010]
[0015] As shown, the POS system 150 includes one or more servers 155 that are communicatively coupled to a POS terminal 160 through a private network 120. The POS system 150 includes one or more processors 165, a memory 170, and a number of input / output devices that are communicatively coupled to the one or more processors 165.
[0011]
[0016] The one or more processors 165 are any electronic circuitry, including but not limited to one or a combination of a microprocessor, a microcontroller, an application specific integrated circuit (ASIC), an application specific instruction set processor (ASIP), and / or a state machine, communicatively coupled to the memory 170 and control the operation of the POS system 150. The one or more processors 165 are not limited to a single processing device, but may encompass multiple processing devices.
[0012]
[0017] The one or more processors 165 may include other hardware that runs software to control and process information. The one or more processors 165 execute software stored in memory 170 to perform any of the functions described herein. The one or more processors 165 control the operation and management of the POS system 150 by processing information (e.g., information received from input devices and / or communicatively coupled electronic devices).
[0013]
[0018] Memory 170 can store data, operating software, or other information for one or more processors 165, either permanently or temporarily. Memory 170 can include any one or combination of volatile or non-volatile local or remote devices suitable for storing information. For example, memory 170 can include random access memory (RAM), read-only memory (ROM), magnetic storage devices, optical storage devices, or any other suitable information storage devices, or combinations of these devices. Software represents any suitable set of instructions, logic, or code embodied in a computer-readable storage medium. For example, software can be embodied in memory 170, a disk, a CD, or a flash drive. In certain embodiments, software can include applications executable by one or more processors 165 to perform one or more of the functions described herein.
[0014]
[0019] In this example, memory 170 stores a payment authorization service 172 that communicates with one or more electronic devices of an external payment network and / or electronic device 135 for transactions conducted using POS system 150. Payment networks are discussed in more detail with respect to Figure 2. Payment authorization service 172 may be implemented as a software application executed by one or more processors 165.
[0015]
[0020] The input / output devices of the POS system 150 include a card reader 175, a printer, and an input device 185. The card reader 175 reads an account number (or card number) and / or other information from a debit card, credit card, or smart card using any suitable technology. For example, the card reader 175 may include a magnetic stripe reader, an EMV chip reader, and / or an NFC chip.
[0016]
[0021] The printer 180 outputs a receipt or invoice for the transaction on paper or other suitable material using any suitable printing technology. The receipt is presented to the customer. In some cases, the printer 180 generates a first receipt that includes the transaction information and prompts the customer to provide a payment method for the initial authorization. In response to the initial authorization, the printer 180 generates a second receipt that includes a field for any amounts added by the customer, such as a gratuity. The customer updated transaction information is entered into the POS system 150 for the next authorization.
[0017]
[0022] The input device 185 has any suitable implementation for receiving user input (e.g., an employee or other representative of the merchant). Some non-limiting examples of the input device 185 include keyboards, touch screens, and fingerprint sensors. In some embodiments, the input device 185 is used by an employee of the merchant to manually enter the amount added by the customer to the transaction.
[0018]
[0023] The retailer's public network 115 includes one or more access points 125 that provide wireless connectivity for customers, guests, employees, etc. at the retailer's physical premises. In another example, the access points 125 provide connectivity to an external network 105 (e.g., a public network such as the Internet). The public network 115 is typically separate from the private network 120 to accommodate customers or other guests while avoiding unnecessary exposure of various components of the POS system 150. However, in alternative embodiments, the functions of the public network 115 and the private network 120 may be combined into a single network for the retailer.
[0019]
[0024] A customer 130 operates an electronic device 135 to connect to a public network 115 through an access point 125. The electronic device 135 may have any suitable implementation and is often implemented as a mobile electronic device, such as a laptop, a smart phone, or a wearable device. The electronic device 135 comprises one or more processors 136 and a memory 140. The description of the one or more processors 136 is similar to that of the one or more processors 165, and the description of the memory 140 is similar to that of the memory 170. In this example, the memory 140 stores a merchant application 142 and an imaging / OCR service 144. The merchant application 142 comprises program code executed by the one or more processors 136 to perform one or more of the following functions: pre-registering the electronic device 135 with a payment method issuer (e.g., via communication with a payment network), receiving a token (possibly including a single-use token), and transmitting image-based updated transaction information to the payment network. Some or all of the functionality of the merchant application 142 may be implemented separately. Additionally, the merchant application 142 may have alternative functionality not discussed here.
[0020]
[0025] The imaging / OCR service 144 comprises program code executed by the one or more processors 136 to capture an image of a physical receipt, including updated customer-provided transaction information, using the electronic device's camera 145. In some embodiments, OCR processing is performed on the image and the customer-provided updated transaction information is transmitted to a payment network. In other embodiments, the image is transmitted to the payment network and OCR processing occurs within the payment network. The imaging / OCR service 144 may be included within the merchant application 142 or may be included separately therefrom (e.g., included in another application or included within the operating system of the electronic device 135).
[0021]
[0026] In some embodiments, the electronic device 135 operates the camera 145 or one or more other input devices (not shown) to authenticate the customer. The electronic device 135 can prompt the customer to authenticate in response to one or more conditions, i.e., periodically (e.g., after a period of time), upon transition from a sleep or low power state, upon loading of the merchant application 142, etc. In one example, the camera 145 captures an image of the customer and a facial recognition process is performed on the image to authenticate the customer. In another example, a touch screen of the electronic device 135 receives a password or passcode from the customer. In another example, a fingerprint sensor of the electronic device 135 receives a fingerprint from the customer. In some embodiments, the electronic device 135 forwarding the token to the payment network indicates to the payment network that the customer has been authenticated, for example, within a recent period of time. In other words, the electronic device 135 can refuse to send the token when the customer has not been (recently) authenticated.
[0022]
[0027] The retailer's public network 115 and private network 120 are communicatively coupled to one or more external networks 105. In some embodiments, the external network 105 is a public network (e.g., the Internet). The external network 105 encompasses a large number of electronic devices and may provide network connectivity over a wide geographic area as compared to the retailer's relatively limited public network 115 and private network 120.
[0023]
[0028] The payment network is implemented using a number of electronic devices, such as server computers 110-1, 110-2, ..., 110-N, communicatively coupled through an external network 105. The various electronic devices of the payment network may be owned or operated by different entities, which may be distinct from the merchants.
[0024]
[0029] Turning now to Figure 2, which is a diagram 200 illustrating an example payment network 210. Diagram 200 illustrates an example sequence of a payment authentication process for a transaction from a POS system 150. The features illustrated in diagram 200 may be used in combination with other embodiments.
[0025]
[0030] In some embodiments, the POS system 150 receives a payment method (e.g., card account information) from the customer 130 and performs a first (initial) authorization for the transaction. In some embodiments, the POS system 150 transmits the transaction information (e.g., card account information, transaction amount) to a payment gateway 215 of the payment network 210. The payment gateway 215 facilitates the transfer of information between a payment portal and a payment processor 220. The payment portal may be a "card-present" payment environment, such as the POS system 150, or a "card-not-present" payment environment, such as the e-commerce store 205. The payment gateway 215 encrypts the card information and other sensitive information to ensure the security of the transaction.
[0026]
[0031] In some embodiments, the customer 130 pre-registers the electronic device 135 with the card issuer 230 and receives a token 240 corresponding to the combination of the customer 130 and the electronic device 135. The token 240 may have any suitable length and shape. In some embodiments, a hash function may be applied to the unique (hardware) identifier 245 (such as a MAC address) of the electronic device 135 and the identifier of the customer 130 to generate a unique hash value for the combination. In other embodiments, the unique identifier 245 of the electronic device 135 and the identifier of the customer 130 may be combined using one or more arithmetic or logical functions. In one simplified example, the unique identifier 245 of the electronic device 135 and the identifier of the customer 130 may be concatenated in the token 240. In another simplified example, the identifier of the customer 130 and the unique identifier 245 of the electronic device 135 are multiplied and the result is included in the token 240. The identifier of the customer 130 may be derived downstream by dividing the result in the token 240 by the unique identifier 245 of the electronic device 135. Other techniques for generating the token 240 are also contemplated.
[0027]
[0032] During the payment authorization process, the electronic device 135 sends a communication including the token 240 to the POS system 150. The POS system 150 sends the token 240 to the payment network 210, as well as an identifier 245 of the electronic device 135. The identifier 245 of the electronic device 135 is derived from the communication. In some embodiments, the POS system 150 extracts the identifier 245 (e.g., a MAC address of the electronic device 135) from header information of the communication. In other embodiments, the identifier 245 may be included in payload information of the communication.
[0028]
[0033] In some embodiments, the POS system 150 transmits the token 240 and the identifier 245 of the electronic device 135 along with the transaction information to the payment gateway 215. The transaction information (along with the token 240 and identifier 245) is sent from the payment gateway 215 to the payment processor 220, which transmits an authorization request (along with the token 240 and identifier 245) to the card network 225. In alternative embodiments, the payment gateway 215 may be omitted such that the POS system 150 communicates directly with the payment processor 220.
[0029]
[0034] The payment processor 220 maintains compliance with the Payment Card Industry Data Security Standard (PCI DSS). In some cases, the payment processor 220 provides its own payment gateway 215. In other cases, the payment processor 220 has a reseller arrangement to provide the payment gateway 215.
[0030]
[0035] The card network 225 sends the authorization request to a card issuer 230 (also called the "cardholder's bank" or "consumer bank," which represents the issuer of the payment method presented by the customer for the transaction). In some embodiments, the authorization request to the card issuer 230 includes the token 240 and the identifier 245. The card network 225 is operated by the "brand" of the customer's card, such as American Express, Visa, MasterCard, or Discover. The card network 225 is typically responsible for setting interchange and assessment fees, as well as setting standards for PCI DSS compliance.
[0031]
[0036] The card issuer 230 determines whether to authorize the payment. In some embodiments, the card issuer 230 determines whether the payment method (e.g., the cardholder's account) has sufficient funds or credit for the transaction amount. In some embodiments, the card issuer 230 also determines whether the token 240 and identifier 245 received with the authorization request match the token and identifier issued by the card issuer 230 during registration of the electronic device 135. In some embodiments, the card issuer 230 also performs a fraud analysis on the transaction. The card issuer 230 sends a verification to the originating POS system 150 (or e-commerce store 206) through the payment network 210.
[0032]
[0037] In some embodiments, after verifying the first (initial) authorization, the POS system 150 receives customer updated transaction information and performs a second authorization thereon with the payment network 210. If the second authorization is verified, the card issuer 230 further communicates with the merchant bank 235 (also called the "acquiring bank") to release funds for settlement of the transaction.
[0033]
[0038] Although the payment network 210 is depicted as including a payment gateway 215, a payment processor 220, a card network 225, a card issuer 230, and a merchant bank 235, alternative implementations of the payment network 210 may have a different number and / or configuration of elements. For example, in alternative implementations, there may be fewer intermediate elements before the authorization request reaches the payment method issuer (e.g., the card issuer 230) and the merchant bank 235.
[0034]
[0039] 3 is a method 300 of using a POS system to authorize payment for a transaction, illustrating an exemplary payment network, according to one or more embodiments. Method 300 may be used in combination with other embodiments, for example, using POS system 150 and various elements of payment network 210.
[0035]
[0040] Method 300 begins at block 305, where POS system 150 receives payment information, possibly indicating a payment method submitted by a user (e.g., customer 130) for a transaction. In some embodiments, the payment method comprises the user's credit card, debit card, or smart card.
[0036]
[0041] At block 310, the POS system 150 requests initial authorization from the payment network 210, possibly for a payment method for the transaction. In some embodiments, the initial authorization corresponds to the transaction amount not including any additional amounts by the customer, such as a gratuity.
[0037]
[0042] At block 315, the POS system 150 receives initial authorization from the payment network 210. At block 320, the POS system 150 presents the transaction information to the user. In some embodiments, presenting the transaction information comprises printing a receipt that includes a field for amounts added by the customer, such as a gratuity.
[0038]
[0043] At block 325, the POS system 150 receives a communication from the user's electronic device 135, the communication comprising a token 240 corresponding to the combination of the user and the electronic device 135. In some embodiments, at block 330, the POS system 150 extracts an identifier 245 of the electronic device 135 from the header information of the communication. In other words, the electronic device 135 does not include the identifier 245 in the payload information of the communication, allowing for more secure authorization as well as smaller and relatively faster communications. In other embodiments, the POS system 150 extracts the identifier 245 from the payload information of the communication.
[0039]
[0044] At block 335 , the POS system 150 receives updated transaction information, including the reward, via user input at the input device 185 of the POS system 150 .
[0040]
[0045] At block 340, the POS system 150 transmits the token 240 and an identifier 245 of the electronic device 135 derived from the communication to a payment processor 220 of the payment network 210. In some embodiments, the token 240 is a single-use token that is linked to the transaction amount, or alternatively to a maximum allowed amount for the transaction. In some embodiments, the token 240 and identifier 245 are transmitted through one or more intermediate elements of the payment network 210 (e.g., the payment gateway 215) before reaching the payment processor 220. In some embodiments, the token 240 and identifier 245 are transmitted further through one or more other elements of the payment network 210.
[0041]
[0046] At block 350, the POS system 150 receives a payment authorization from the payment network 210, possibly for the transaction, indicating that the token 240 and identifier 245 were previously registered with an issuer (e.g., a payment method issuer) corresponding to the payment information. In some embodiments, receiving the payment authorization further indicates that the amount of the updated transaction information is less than or equal to the authorization amount for the transaction included in the single-use token. The method 300 ends after completion of block 350.
[0042]
[0047] 4 is an example communication diagram 400 illustrating payment authorization using a pre-registered token, according to one or more embodiments. Features of communication diagram 400 may be used in combination with other embodiments, for example, as part of implementing method 300 of FIG.
[0043]
[0048] During the registration phase, the electronic device 135 transmits the customer's 130 account information and an identifier 245 of the electronic device 135 as a first communication 405 to the payment network 210. In some embodiments, the identifier 245 comprises a MAC address of a Wi-Fi network interface card or of an NFC chip of the electronic device 135. In some embodiments, the first communication 405 is transmitted directly between the electronic device 135 and a payment method issuer (e.g., a card issuer 230 of the payment network 210). The payment network 210 returns to the electronic device 135 a token corresponding to the combination of the customer and the electronic device 135 as a second communication 410. In some embodiments, the payment method issuer transmits the token to the electronic device 135 with a time to live (TTL) value such that the token expires after a predefined time. The TTL value limits the possibility of fraudulent use by another person who has fraudulently obtained the token. In some embodiments, the information in the first communication 405 is transmitted between the card issuer 230 and one or more other elements of the payment network 210, such as the payment processor 220.
[0044]
[0049] During the payment authorization phase, the POS system 150 provides the transaction information to the customer as a third communication 415. In some embodiments, providing the transaction information comprises printing a first receipt including the transaction information and prompting the customer to submit the payment information as a fourth communication 420 to the POS system 150 (e.g., a payment method for the initial authorization).
[0045]
[0050] The POS system 150 sends a request for initial authorization to the payment network 210 in a fifth communication 425. The POS system 150 receives the initial authorization from the payment network 210 in a sixth communication 430.
[0046]
[0051] In response to the initial authorization, the POS system 150 provides the transaction information to the customer as seventh communication 435. In some embodiments, providing the transaction information comprises printing a second receipt that includes a field for an amount added by the customer, such as a gratuity.
[0047]
[0052] The POS system 150 receives updated transaction information, possibly including the reward, as an eighth communication 440. The POS system 150 receives the token and an identifier of the electronic device 135 from the electronic device 135 as a ninth communication 445. In some embodiments, receiving the ninth communication 445 indicates that the customer has been locally authenticated by the electronic device using a password or biometric authentication. In some embodiments, the POS system 150 extracts the identifier of the electronic device 135 from the protocol used for communication.
[0048]
[0053] The POS system 150 sends the updated transaction information, the token, and the electronic device identifier to the payment network 210 for further authorization as a tenth communication 450. The POS system 150 receives payment authorization for the transaction from the payment network 210 as an eleventh communication 455. In some embodiments, receiving the eleventh communication 455 indicates that the token and the electronic device identifier were previously registered with the payment method issuer.
[0049]
[0054] In some embodiments, the payment processor 220 of the payment network 210 validates the updated transaction information and the token and identifier using information contained in the first registration phase communication 405. Using token-based validation, a transaction may be authorized without using the customer's primary account number (PAN). In this manner, transaction authorization may be completed without requiring the POS system 150 to remain within the scope of PCI DSS.
[0050]
[0055] 5 is an example communication diagram 500 illustrating payment authorization using a single-use token, according to one or more embodiments. Features of the communication diagram 500 may be used in combination with other embodiments, for example, as part of implementing the method 300 of FIG.
[0051]
[0056] During the registration phase, the electronic device 135 transmits the customer's 130 account information and the identifier 245 of the electronic device 135 as a first communication 505 to the payment network 210. In some embodiments, the identifier 245 comprises a MAC address of a Wi-Fi network interface card or of an NFC chip of the electronic device 135. In some embodiments, the first communication 505 is transmitted directly between the electronic device 135 and a payment method issuer (e.g., a card issuer 230 of the payment network 210). The payment network 210 returns to the electronic device 135 a token corresponding to the combination of the customer and the electronic device 135 as a second communication 510. In some embodiments, the payment method issuer transmits the token to the electronic device 135 with a time to live (TTL) value such that the token expires after a predefined time. The TTL value limits the possibility of fraudulent use by another person who has fraudulently obtained the token. In some embodiments, the information in the first communication 405 is transmitted between the card issuer 230 and one or more other elements of the payment network 210, such as the payment processor 220.
[0052]
[0057] During the payment authorization phase, the POS system 150 provides the transaction information to the customer as a third communication 515. In some embodiments, providing the transaction information comprises printing a first receipt including the transaction information and prompting the customer to submit the payment information as a fourth communication 520 to the POS system 150 (e.g., a payment method for the initial authorization).
[0053]
[0058] The POS system 150 sends a request for initial authorization to the payment network 210 in a fifth communication 525. The POS system 150 receives the initial authorization from the payment network 210 in a sixth communication 530.
[0054]
[0059] The electronic device 135 transmits the account information, the electronic device identifier, and the transaction amount as a seventh communication 535 to the payment network 210. In some embodiments, the electronic device 135 communicates with an element of the payment network 210 (e.g., the card issuer 230) using a communication path different from the communication path used by the electronic device 135 (e.g., an electronic device 135 communicatively coupled to the payment gateway 215) for payment authorization.
[0055]
[0060] In some embodiments, the transaction amount is submitted via user input on an input device of the electronic device (e.g., a virtual numeric keypad displayed on a touch screen). In other embodiments, the transaction amount is obtained from an image captured by a camera of the electronic device, and the electronic device performs OCR on the image to determine the transaction amount. The payment network 210 returns a one-time use token as an eighth communication 540 to the electronic device 135 for the transaction. In some embodiments, the one-time use token is linked to the transaction amount, or alternatively to a maximum allowed amount for the transaction.
[0056]
[0061] In response to the initial authorization, the POS system 150 provides the transaction information to the customer as a ninth communication 545. In some embodiments, providing the transaction information comprises printing a second receipt that includes a field for an amount added by the customer, such as a gratuity.
[0057]
[0062] The POS system 150 receives updated transaction information, possibly including the reward, as a tenth communication 550. The POS system 150 receives the one-time token and the electronic device identifier from the electronic device 135 as an eleventh communication 555. In some embodiments, receiving the eleventh communication 555 indicates that the customer has been locally authenticated by the electronic device using a password or biometric authentication.
[0058]
[0063] The POS system 150 transmits the updated transaction information, the one-time token, and the electronic device identifier in a twelfth communication 560 to the payment network 210 for further authorization. The POS system 150 receives payment authorization for the transaction from the payment network 210 in a thirteenth communication 565. In some embodiments, receiving the thirteenth communication 565 indicates that the one-time token and the electronic device identifier were previously registered. In some embodiments, receiving the thirteenth communication 565 indicates that the amount of the updated transaction information is less than or equal to the authorized amount for the transaction.
[0059]
[0064] In some embodiments, the payment processor 220 of the payment network 210 uses the information contained in the first communication 405 of the registration phase to verify the updated transaction information and the one-time token and identifier. Using token-based verification, the transaction may be authorized without using the customer's PAN (primary account number). In this manner, transaction authorization may be completed without requiring the POS system 150 to remain within the scope of PCI DSS.
[0060]
[0065] 6 is an example communication diagram 600 illustrating payment authorization using a captured image, according to one or more embodiments. Features of the communication diagram 600 may be used in combination with other embodiments, for example, as part of implementing the method 300 of FIG.
[0061]
[0066] During the registration phase, the electronic device 135 transmits the customer's 130 account information and the identifier 245 of the electronic device 135 as a first communication 605 to the payment network 210. In some embodiments, the identifier 245 comprises a MAC address of a Wi-Fi network interface card or of an NFC chip of the electronic device 135. In some embodiments, the first communication 605 is transmitted directly between the electronic device 135 and a payment method issuer (e.g., a card issuer 230 of the payment network 210). The payment network 210 returns to the electronic device 135 a token corresponding to the combination of the customer and the electronic device 135 as a second communication 610. In some embodiments, the payment method issuer transmits the token to the electronic device 135 with a time to live (TTL) value such that the token expires after a predefined time. The TTL value limits the possibility of fraudulent use by another person who has fraudulently obtained the token. In some embodiments, the information in the first communication 605 is transmitted between the card issuer 230 and one or more other elements of the payment network 210, such as the payment processor 220.
[0062]
[0067] During the payment authorization phase, the POS system 150 provides the transaction information to the customer as a third communication 615. In some embodiments, providing the transaction information comprises printing a first receipt including the transaction information and prompting the customer to submit the payment information as a fourth communication 620 to the POS system 150 (e.g., a payment method for the initial authorization).
[0063]
[0068] The POS system 150 sends a request for initial authorization to the payment network 210 in a fifth communication 625. The POS system 150 receives the initial authorization from the payment network 210 in a sixth communication 630.
[0064]
[0069] In response to the initial authorization, the POS system 150 provides the transaction information to the customer as seventh communication 635. In some embodiments, providing the transaction information comprises printing a second receipt that includes a field for an amount added by the customer, such as a gratuity.
[0065]
[0070] The POS system 150 receives the updated transaction information, possibly including the reward, as an eighth communication 640 .
[0066]
[0071] In some embodiments, the electronic device 135 transmits the image-based updated transaction information (and optionally the location information) as a ninth communication 645 to the payment network 210. In some embodiments, the electronic device 135 captures an image of the physical receipt including the customer-provided updated transaction information. In some embodiments, OCR processing is performed on the image and the customer-provided updated transaction information is transmitted to the payment network 210. In other embodiments, the image is transmitted by the electronic device 135 to the payment network 210 and the OCR processing is performed within the payment network 210.
[0067]
[0072] The POS system 150 receives the token and an identifier of the electronic device 135 from the electronic device 135 as a tenth communication 650. In some embodiments, receiving the ninth communication 645 indicates that the customer has been locally authenticated by the electronic device 135 using a password or biometric authentication. In some embodiments, the POS system 150 extracts the identifier of the electronic device 135 from the protocol used for communication.
[0068]
[0073] The POS system 150 transmits the updated transaction information, the token, and the electronic device identifier in an eleventh communication 655 to the payment network 210 for further authorization. The POS system 150 receives payment authorization for the transaction from the payment network 210 in a twelfth communication 660. In some embodiments, receiving the twelfth communication 660 indicates that the amount of the updated transaction information provided by the customer in the ninth communication 645 matches the amount of the updated transaction information received in the eleventh communication 655. In some embodiments, receiving the twelfth communication 660 further indicates that the token and the electronic device identifier have been previously registered with the payment method issuer.
[0069]
[0074] In alternative embodiments, the payment authorization sequencing illustrated in communication diagram 600 may be performed without electronic device 135 obtaining and / or transmitting a token. In one non-limiting example, a customer receives a first receipt from a merchant that includes an initial transaction amount. The customer presents a payment method (e.g., a credit card) to the merchant and the payment information is provided to the POS system. Upon authorization of the initial amount using the payment method, the customer receives a second receipt from the merchant that includes a field for an amount added by the customer (e.g., a gratuity).
[0070]
[0075] The customer captures an image of the second receipt using the camera of the electronic device. In some embodiments, the second receipt includes a field for the customer-added amount (e.g., written by the customer). In other embodiments, the second receipt does not include the customer-added amount. The image-based updated transaction information (whether an image or OCR-provided text) is sent to the payment method issuer (e.g., card issuer 230). In some cases, the image-based updated transaction information is sent through an application provided by the payment method issuer or through the issuer's website.
[0071]
[0076] If the image-based updated transaction information does not include the customer-added amount, the issuer's application or website prompts the customer whether to add a reward. The customer can add a reward using an input device on the electronic device and authorize payment for the transaction using a payment method.
[0072]
[0077] The payment method issuer compares the amount of the image-based updated transaction information to the original transaction amount (e.g., used for the initial authorization). If the different amounts balance (or the difference does not indicate an excessive excise duty), the payment method issuer authorizes the payment and transmits a verification to the POS system 150 via the payment network 210. In some embodiments, the payment method issuer may further compare the customer's location information (e.g., contained in the metadata of the captured image or the network connection information of the electronic device) to the location of the merchant when determining whether to authorize the payment. In this manner, the responsibility (and associated risk) of authorizing the excise duty amount may be shifted from the merchant to the payment method issuer.
[0073]
[0078] In some embodiments, the payment processor 220 of the payment network 210 validates the updated transaction information and the token and identifier using information contained in the first registration phase communication 605. Using token-based validation, a transaction may be authorized without using the customer's primary account number (PAN). In this manner, transaction authorization may be completed without requiring the POS system 150 to remain within the scope of PCI DSS.
[0074]
[0079] The description of various embodiments of the present disclosure is presented for the purpose of explanation, but is not exhaustive or limited to the disclosed embodiments. Many modifications and variations that do not depart from the scope and spirit of the described embodiments will be apparent to those skilled in the art. The terms used in this specification have been selected so as to best explain the principles of the embodiments, practical applications or technical improvements of the technology found in the market, or to allow other skilled in the art to understand the embodiments disclosed herein.
[0075]
[0080] In the following, reference is made to the embodiments presented in the present disclosure. However, the scope of the present disclosure is not limited to the specific embodiments described. Instead, any combination of the following features and elements, whether related to different embodiments or not, is contemplated for implementing and practicing the contemplated embodiments. Furthermore, the embodiments disclosed herein may achieve other possible solutions or advantages over the prior art, but whether a particular advantage is achieved by a given embodiment does not limit the scope of the present disclosure. Thus, the following aspects, features, embodiments, and advantages are merely exemplary and are not considered elements or limitations of the appended claims unless expressly recited in the claims. Similarly, reference to "the present disclosure" is not to be construed as a generalization of any inventive subject matter disclosed herein, and is not to be considered elements or limitations of the appended claims unless expressly recited in the claims.
[0076]
[0081] Aspects of the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, microcode, etc.), or an embodiment combining software and hardware aspects, all of which may be referred to generally herein as a "circuit," "module," or "system."
[0077]
[0082] The present disclosure may be a system, a method, and / or a computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions for causing a processor to perform aspects of the present disclosure.
[0078]
[0083] A computer-readable storage medium may be a tangible device capable of holding and storing instructions for use by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: portable computer diskettes, hard disks, random access memories (RAMs), read-only memories (ROMs), erasable programmable read-only memories (EPROMs or flash memories), static random access memories (SRAMs), portable compact disk read-only memories (CD-ROMs), digital versatile disks (DVDs), memory sticks, floppy disks, mechanically encoded devices such as punch cards or raised structures in the form of grooves with instructions recorded thereon, and any suitable combinations of the above. As used herein, a computer-readable storage medium should not, in itself, be construed as a transitory signal, such as an electric wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse passing through a fiber optic cable), or an electrical signal transmitted over an electrical wire.
[0079]
[0084] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to each computing device / processing device or to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may comprise copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface of each computing device / processing device receives the computer-readable program instructions from the network and transfers the computer-readable program instructions to a computer-readable storage medium within the respective computing device / processing device for storage.
[0080]
[0085] The computer readable program instructions for performing the operations of the present disclosure may be either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state setting data, or source or object code written in any combination of one or more programming languages, including object oriented programming languages such as Smalltalk, C++, and traditional procedural programming languages such as the "C" programming language or similar programming languages. The computer readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or wide area network (WAN), or the connection may be to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) can execute computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry to implement aspects of the present disclosure.
[0081]
[0086] Aspects of the present disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the present disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer readable program instructions.
[0082]
[0087] These computer-readable program instructions may be supplied to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine such that the instructions, executed by the processor of the computer, special purpose computer, or other programmable data processing apparatus, produce means for implementing the functions / operations specified in the flowchart and / or block diagram blocks. These computer-readable program instructions may also be stored on a computer-readable storage medium, such that the computer-readable storage medium on which the instructions are stored comprises an article of manufacture containing instructions that implement aspects of the functions / operations specified in the flowchart and / or block diagram blocks, and may direct a computer, programmable data processing apparatus, and / or other device to function in a particular manner.
[0083]
[0088] The computer readable program instructions may also be loaded into a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, such that the instructions, executing on the computer, other programmable apparatus, or other device, implement the functions / acts specified in the flowchart and / or block diagram blocks.
[0084]
[0089] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions shown in the blocks may occur out of the order shown in the figures. For example, two blocks shown in succession may in fact be executed substantially simultaneously, or in some cases the blocks may be executed in the reverse order depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by a dedicated hardware-based system that performs a specified function or operation, or executes a combination of dedicated hardware and computer instructions.
[0085]
[0090] While the forgoing is directed to embodiments of the present disclosure, other and further embodiments of the present disclosure may be devised without departing from the basic scope of the disclosure, which scope is determined by the appended claims.
Claims
1. Receiving payment information; receiving a communication from the electronic device comprising a token corresponding to a combination of a user and the user's electronic device; transmitting the token and an identifier of the electronic device derived from the communication to a payment processor of a payment network; receiving a payment authorization from the payment network indicating that the token and the identifier of the electronic device were previously registered with an issuer corresponding to the payment information; A method comprising:
2. The method of claim 1 , wherein the payment information comprises a payment method submitted by the user during a transaction, and wherein the issuer is an issuer of the payment method.
3. The method of claim 1 , further comprising extracting the identifier of the electronic device from header information of the communication.
4. The method of claim 3 , wherein the identifier of the electronic device is a MAC address of the electronic device.
5. The method is implemented using a POS system to authorize payment for a transaction, the method comprising: receiving updated transaction information, including a reward, via user input at an input device of the POS system; 2. The method of claim 1, wherein receiving the payment authorization for the transaction further indicates that an amount of the updated transaction information is less than or equal to an authorized amount for the transaction.
6. Receiving the payment authorization, the issuer: receiving, from the electronic device, updated customer-provided transaction information based on a captured image of a physical receipt; and 6. The method of claim 5, further indicating that an amount of the updated transaction information provided by the customer is determined to match an amount of the updated transaction information.
7. The token is a one-time use token issued by the issuer to the electronic device, wherein the one-time use token is requested by the electronic device with at least an initial transaction amount, and the method further comprises: receiving updated transaction information, including a reward, via user input at an input device of the POS system; 2. The method of claim 1, wherein receiving the payment authorization for the transaction further indicates that an amount of the updated transaction information is less than or equal to an authorization amount for the transaction included in the one-time token.
8. 1. A computer program product comprising a computer readable storage medium having computer readable program code embodied therein, the computer readable program code being operable by one or more computer processors to: Receiving payment information; receiving a communication from a user's electronic device, the communication comprising a token corresponding to a combination of the user and the electronic device; transmitting the token and an identifier of the electronic device derived from the communication to a payment processor of a payment network; receiving a payment authorization from the payment network indicating that the token and the identifier of the electronic device were previously registered with an issuer corresponding to the payment information; A computer program product executable to perform the steps of:
9. 10. The computer program product of claim 8, wherein the payment information comprises a payment method submitted by the user during a transaction, and wherein the issuer is an issuer of the payment method.
10. The computer readable program code comprises: The computer program product of claim 8 , further executable to extract the identifier of the electronic device from header information of the communication.
11. The computer program product of claim 10 , wherein the identifier of the electronic device is a MAC address of the electronic device.
12. The computer program product is for authorizing a payment transaction, the computer readable program code comprising: and further operable to receive updated transaction information, including the reward, via user input at the input device; 9. The computer program product of claim 8, wherein receiving the payment authorization for the transaction further indicates that an amount of the updated transaction information is less than or equal to an authorized amount for the transaction.
13. Receiving the payment authorization, the issuer: receiving, from the electronic device, updated customer-provided transaction information based on a captured image of a physical receipt; and 13. The computer program product of claim 12, further indicating that an amount of the updated transaction information provided by the customer is determined to match an amount of the updated transaction information.
14. the token is a one-time token issued by the issuer to the electronic device, wherein the one-time token is requested by the electronic device with at least an initial transaction amount, and the computer readable program code further comprises: and further operable to receive updated transaction information, including the reward, via user input at the input device; 9. The computer program product of claim 8, wherein receiving the payment authorization for the transaction further indicates that an amount of the updated transaction information is less than or equal to an authorization amount for the transaction included in the one-time token.
15. one or more computer processors; and a memory storing program code executable by the one or more computer processors to implement a payment authorization service, the payment authorization service comprising: Receiving payment information; receiving a communication from a user's electronic device, the communication comprising a token corresponding to a combination of the user and the electronic device; transmitting the token and an identifier of the electronic device derived from the communication to a payment processor of a payment network; receiving a payment authorization from the payment network indicating that the token and the identifier of the electronic device were previously registered with an issuer corresponding to the payment information; A system comprising:
16. 16. The system of claim 15, wherein the payment information comprises a payment method submitted by the user during a transaction, and wherein the issuer is an issuer of the payment method.
17. The payment authorization service includes: The system of claim 15 , further comprising extracting the identifier of the electronic device from header information of the communication.
18. The payment authorization service authorizes payment for a transaction, and the system includes: an input device communicatively coupled to the one or more processors; The payment authorization service includes: receiving updated transaction information, including a reward, via user input on the input device; 16. The system of claim 15, wherein receiving the payment authorization for the transaction further indicates that an amount of the updated transaction information is less than or equal to an authorized amount for the transaction.
19. Receiving the payment authorization, the issuer: receiving, from the electronic device, updated customer-provided transaction information based on a captured image of a physical receipt; and 20. The system of claim 18, further indicating that an amount of the updated transaction information provided by the customer is determined to match an amount of the updated transaction information.
20. 16. The system of claim 15, wherein the token is a single-use token issued to the electronic device by the issuer, and wherein the single-use token is claimed by the electronic device with at least an initial transaction amount.