Verified reviews using non-contact cards

Abstract

To provide systems, methods, articles of manufacture, and computer-readable media for reviews verified using non-contact cards.SOLUTION: An application receives an indication to generate a review. An application programming interface (API) receives, from a communications interface of a contactless card, encrypted data generated by the contactless card, and transmits the encrypted data, an indication of the application, and an identifier associated with the entity to an authentication server. The API then receives indications specifying that the authentication server decrypted the encrypted data and determined that the contactless card was used to make a purchase with the entity. The application also permits generation of the review on the basis of the indications received from the authentication server, and publishes the review to one or a plurality of review platforms associated with the application.SELECTED DRAWING: Figure 4

Description

Technical Field

[0001] Embodiments of this specification generally relate to computing platforms, and more specifically, to providing reviews verified using contactless cards.

[0002] Related Applications This application claims the benefit of priority to U.S. Patent Application No. 16 / 514,094, titled "Reviews Verified Using Contactless Cards," filed on July 17, 2019. The content of the aforementioned application is hereby incorporated by reference in its entirety.

Background Art

[0003] Users often write reviews of products, services, restaurants, etc. Such reviews are often valuable sources of user sentiment that can be used to improve the quality of the related offerings. However, due to the impact of positive reviews on sales, fake reviews are often posted to increase sales. Similarly, fake reviews can be posted to negatively impact the sales of competing companies. Therefore, users often cannot trust reviews because it is uncertain whether the review was written by someone who ate at a restaurant or used a product or service.

Summary of the Invention

[0004] Embodiments disclosed herein provide a system, method, article of manufacture, and computer-readable medium for providing reviews verified using a contactless card. According to an example, an application may receive an instruction to generate a review of an entity comprising one or more merchants and service providers. The application may output an instruction to tap a contactless card to a device. An application programming interface (API) of the application may receive encrypted data generated by the contactless card from a communication interface of the contactless card using an encryption algorithm, a customer identifier, and a private key stored in the memory of the contactless card. The API of the application may transmit to an authentication server associated with the contactless card: (i) the encrypted data, (ii) the instruction of the application, and (iii) an entity identifier associated with the entity. The API of the application may receive from the authentication server an instruction specifying that the authentication server: (i) decrypts the encrypted data using a copy of the private key stored by the server to generate a customer identifier, and (ii) determines that the contactless card was used to make a purchase at the entity based at least in part on the entity identifier and the decrypted customer identifier. The application may permit generation of the review based on the instruction received from the authentication server. The application may publish the review to one or more review platforms associated with the application.

[0005] According to another example, the authentication server may receive an instruction from the review application to specify that a review of an entity comprising one or more merchants and service providers is to be generated. The authentication server may receive, from the application programming interface (API) of the review application, encrypted data received by the review application from the contactless card, an entity identifier associated with the entity, encrypted data based on an encryption algorithm, a customer identifier, and a private key. The authentication server may decrypt the encrypted data using a copy of the private key stored by the server and generate a customer identifier. The authentication server may determine that the contactless card was used for a purchase by the entity based at least in part on the entity identifier and the decrypted customer identifier. The authentication server may generate a review and send a permission to the application to receive the review from the application. Next, the authentication server may publish the review to one or more review platforms associated with the application.

Brief Description of the Drawings

[0006]

Figure 1A

Figure 1B

Figure 2A

Figure 2B

Figure 2C

Figure 3A

Figure 3B

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9A

Figure 9B

Best Mode for Carrying Out the Invention

[0007] The embodiments disclosed herein provide secure techniques for reviews verified using contactless cards. Generally, a user may attempt to provide a review to an entity such as a restaurant, merchant, and / or service provider via a review platform. The review platform can be a website and / or a dedicated application having an application programming interface (API) that can communicate with a contactless card and a server associated with the contactless card. During the review generation and / or transmission process, the user may be requested to tap the contactless card on a computing device. The API can communicate with the contactless card and receive encrypted data generated by the contactless card using a private key and an encryption algorithm. The API can provide the encrypted data to the server along with other review data (e.g., an identifier of the entity being reviewed). The server may attempt to decrypt the encrypted data generated by the contactless card. If the server can decrypt the encrypted data, the server can verify the encrypted data. Next, the server can determine whether the card was used for payment of a transaction between the user and the entity being reviewed. For example, the server may attempt to identify a transaction record in the transaction log indicating that the contactless card was used for payment of a transaction between the user and the entity being reviewed. If the server identifies such a transaction record, the server can verify that the user actually executed a transaction with the entity.

[0008] Next, the server may notify the API that the encrypted data has been verified and the transaction record has been verified. Using the API, the user may complete the submission of a review verified using the review platform. Once submitted, the verified review is published on the review platform, indicating that the review has been verified (e.g., the user actually dined at the restaurant, paid for the service provided by the service provider, etc.). Further, the API may send the instructions of the submitted review to the contactless card, which may store the instructions in the memory of the contactless card. Thereafter, when the user accesses the entity, the entity's POS device may receive the instructions stored from the memory of the contactless card. The POS device may provide the user with a reward, discount, or other incentive when receiving the instructions from the contactless card.

[0009] Advantageously, the embodiments disclosed herein improve the validity and credibility of reviews submitted by users on an online platform by verifying that the user reviewing has actually transacted with the entity being reviewed. Further, the verification performed by the authentication server provides a safeguard to confirm that an authorized user with access to the physical card is requesting the submission of the review. Further, by providing a secure API for communicating with the contactless card and / or the server, the embodiments disclosed herein provide a secure and portable solution that can be used on any review platform.

[0010] Referring generally to the notations and nomenclatures used herein, one or more portions of the following detailed description may be presented with respect to program procedures executed on a computer or a network of computers. The descriptions and representations of these procedures are used by those skilled in the art to most effectively convey the substance of their work to those skilled in the art. The procedures are set forth herein and are generally considered to be a self-consistent series of operations leading to a desired result. These operations are operations that require physical manipulation of physical quantities. Usually, though not necessarily, these quantities take the form of electrical, magnetic, or optical signals that can be stored, transferred, combined, compared, and otherwise manipulated. For primarily reasons of common usage, it may be convenient to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, etc. However, it should be noted that all of these and similar terms are merely convenient labels associated with appropriate physical quantities and nothing more than that.

[0011] Furthermore, these operations are often referred to in terms such as addition or comparison, which are generally associated with intellectual operations performed by a human operator. However, in any of the operations described herein that form part of one or more embodiments, such capabilities of a human operator are not required or, in most cases, desirable. Rather, these operations are machine operations. Useful machines for performing the operations of the various embodiments include digital computers selectively activated or configured by a computer program stored therein, written in accordance with the teachings herein, and / or special-purpose devices or digital computers constructed for the required purposes. The various embodiments also relate to devices or systems for performing these operations. These devices may be specially constructed for the required purposes. The structures required for these various machines will become apparent from the given description.

[0012] Reference is now made to the drawings, where like reference numerals are used throughout to refer to like elements. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding. It will be evident, however, that the novel embodiments may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to simplify the description. The intention is to cover all modifications, equivalents, and alternatives within the scope of the claims.

[0013] FIG. 1A shows an overview of an exemplary system 100 that is consistent with the disclosed embodiments. As shown, system 100 includes one or more contactless cards 101, one or more computing devices 110, an authentication server 120, and one or more review platforms 140. The contactless cards 101 represent any type of payment card such as a credit card, debit card, ATM card, gift card, etc. The contactless cards 101 may include one or more communication interfaces 107, such as a radio frequency identification (RFID) chip, configured to communicate with the computing device 110 via NFC, EMV standards, or other short-range protocols in wireless communication. Although NFC is used as an example of a communication protocol, the present disclosure is equally applicable to other types of wireless communication such as EMV standards, Bluetooth®, and / or Wi-Fi. The computing device 110 represents any type of network-enabled computing device such as a smartphone, tablet computer, wearable device, laptop, portable game device, mobile device, workstation, desktop computer, server, etc. The server 120 and the review platform 140 represent any type of computing device such as a server, workstation, computing cluster, cloud computing platform, virtualized computing system, etc.

[0014] Computing device 110 may be under the control of an instance of an operating system (OS, not shown). Examples of operating systems include the Android® OS, iOS®, macOS®, Linux®, and Windows® operating systems. As shown, the memory 111 of computing device 110 includes a review application 113 that includes one or more application programming interfaces (APIs) 114. The review application 113 enables a user to generate a review 141 for publication on one or more review platforms 140. Using the API 114, the review application 113 may enable the user to submit a verified (or confirmed) review. Generally, the API 114 facilitates communication with the contactless card 101 and / or the server 120 to confirm that the contactless card 101 was used for payment of a transaction with an entity that is the subject of the review, thereby providing a verified review. Entities that may be the subject of a review include, but are not limited to, restaurants, merchants, service providers, or other types of businesses for which one or more users wish to provide a review. As will be described in more detail below, the review application 113 and the API 114 may be used to confirm that the user has actually transacted with an entity, e.g., has eaten at a target restaurant, has made a payment for a service provided by a target service provider, has made a purchase with a target merchant, etc.

[0015] In some embodiments, the review application 113 can be a dedicated application (e.g., a mobile OS application) provided by an entity associated with one or more review platforms 140. In other embodiments, the functionality provided by the review application 113 and / or API 114 can be integrated into other platforms such as one or more web pages and / or services provided by the review platform 140. In such embodiments, a user can access the web pages and / or services provided by the review platform 140 using a web browser (not shown) or other application. Embodiments are not limited to these contexts.

[0016] Generally, a user of the review application 113 may specify to generate a review of an entity. For example, the user may access a page of the review application 113 for a restaurant where the user recently had a meal and specify to use the review application 113 to generate a new review of that restaurant. In response, the review application 113 may output a notification to the computing device 110 specifying to tap the contactless card 101 on the computing device 110, thereby bringing the contactless card 101 close enough to the card reader 118 of the computing device 110 to enable data transfer (e.g., NFC data transfer, Bluetooth® data transfer, etc.) between the communication interface 107 of the contactless card 101 and the card reader 118 of the computing device 110. Next, an applet 103 executed on a processor (not shown) of the contactless card 101 may generate encrypted data 105 and transmit it to the computing device 110 via the communication interface 107 of the contactless card 101. For example, the applet 103 of the contactless card 101 may use an encryption algorithm to generate an encrypted payload of the encrypted data 105 based at least in part on a secret key 104 stored in the memory 102 of the contactless card 101. In such an embodiment, the secret key 104 and some other data (e.g., customer identifier, account identifier, etc.) may be provided as inputs to the encryption algorithm that outputs the encrypted data 105. Generally, the applet 103 may use any type of encryption algorithm and / or system to generate the encrypted data 105, and the use of a particular encryption algorithm as an example in this specification should not be considered as limiting the disclosure. In some embodiments, the applet 103 may perform encryption using a key diversification technique to generate the encrypted data 105. An example of a key diversification technique is described in U.S. Patent Application No. 16 / 205,119, filed on November 29, 2018. The foregoing patent application is hereby incorporated by reference in its entirety into this specification.

[0017] In some embodiments, the API 114 of the review application 113 may send an instruction to the contactless card 101 specifying to generate the encrypted data 105. In other embodiments, the applet 103 generates the encrypted data 105 without requiring an instruction from the API 114. In some embodiments, the API 114 of the review application 113 may send an entity identifier (ID) 115 to the applet 103. The entity identifier 115 can be any identifier that uniquely identifies an entity (e.g., a restaurant selected by the user to write a review). In some such embodiments, the applet 103 determines whether the received entity identifier matches (or is similar to) one or more entity identifiers within the transaction log 106. The transaction log 106 may store details explaining one or more recent transactions completed using the contactless card 101. If the received entity identifier matches, the applet 103 may determine that the user has completed a transaction with the entity (e.g., eaten at the restaurant) and generate the encrypted data 105. If the received entity identifier does not match, the applet 103 may refrain from generating the encrypted data 105 because it cannot verify that the user has completed a transaction with the entity. However, in some embodiments, even if the entity ID 115 does not match any part of the transaction log 106, the applet 103 may generate the encrypted data 105.

[0018] Once generated, applet 103 may send the encrypted data 105 to the API 114 of the review application 113 of the computing device 110 via, for example, NFC. In some embodiments, applet 103 may also send data explaining one or more transactions from the transaction log 106 to the review application 113. In some embodiments, the review application 113 may check whether there is a match between the entity ID 115 of the entity to be reviewed and the transaction log 106. If a match exists, the review application 113 may permit the generation of a verified review. However, in some such embodiments, the review application 113 may request confirmation (and / or verification) from the server 120 before permitting the submission of the verified review to the review platform 141. The requested confirmation and / or verification may generally enable the review application 113 to confirm that the user has transacted with the entity actually being reviewed, e.g., had a meal at a restaurant, used a service, etc.

[0019] Generally, the API 114 of the review application 113 may send the encrypted data 105, the entity ID 115, and the application ID 116 to the authentication application 123 of the authentication server 120 via the network 130. The application ID 116 may uniquely identify the review application 113 and / or the associated review platform 140. By doing so, it may facilitate a lookup using the entity ID 115 associated with the review application 113 and the entity ID within the entity data 125, and the entity ID within the entity data 125 may be used within the transaction data 126. Next, the authentication server 120 may attempt to decrypt the encrypted data 105 and determine whether the transaction data 126 reflects that the contactless card 101 was used for payment of a transaction with the target entity.

[0020] Figure 1B shows an embodiment in which the authentication application 123 of the authentication server 120 processes data received from the review application 113. As described, the authentication application 123 may attempt to verify the encrypted data 105. For example, the authentication application 123 may attempt to decrypt the encrypted data 105 using a copy of the secret key 104 stored in the memory 122 of the authentication server 120. The secret key 104 may be the same as the secret key 104 stored in the memory 102 of the contactless card 101. Each contactless card 101 is manufactured to include a unique secret key 104 (and the authentication server 120 stores a corresponding copy of each unique secret key 104). Thus, the authentication application 123 may successfully decrypt the encrypted data 105, thereby verifying the encrypted data 105. Although the secret key 104 is shown as being stored in the memory 122, the secret key 104 may be stored in other locations such as a secure element and / or a hardware security module (HSM). In such embodiments, the secure element and / or HSM may decrypt the encrypted data 105 using the secret key 104 and the encryption function.

[0021] For example, the encrypted data 105 may be generated using a customer identifier associated with the contactless card 101. In such an example, the authentication application 123 may decrypt the encrypted data 105 using the secret key 104 of the authentication server 120. If the result of the decryption yields the customer identifier associated with the contactless card 101 within the account data 124, the authentication application 123 verifies the encrypted data 105. If the authentication application 123 is unable to decrypt the encrypted data to obtain the expected result (e.g., the customer identifier of the account associated with the contactless card 101), the authentication application 123 does not verify the encrypted data 105.

[0022] When the authentication application 123 successfully decrypts the encrypted data 105, the authentication application 123 can determine whether the transaction data 126 includes a record indicating that the contactless card 101 was used for the payment of a transaction with an entity selected by the user for review. For example, the authentication application 123 can determine whether the transaction record within the transaction data 126 includes the account number of the contactless card and the entity ID 115 of the entity (e.g., the restaurant being reviewed). If such a transaction record exists, the authentication application 123 can send a confirmation instruction 127 to the computing device 110. The confirmation 127 can generally reflect that the authentication application 123 verified the encrypted data 105 (by decrypting the encrypted data 105) and verified that the contactless card 101 was used for a purchase with the entity being reviewed. The confirmation 127 can further serve as permission to generate and / or publish a review. However, if the encrypted data 105 is not decrypted and / or no record within the transaction data 126 is identified, the authentication application 123 can refrain from generating a confirmation and / or send a failure status to the review application 113. In some embodiments, the confirmation 127 can be stored in the account data 124 of the account associated with the contactless card 101. In some embodiments, the confirmation 127 includes metadata attributes such as the time of confirmation, the time of the identified transaction, the entity ID 115, the application ID 116, and the like.

[0023] In some embodiments, the authentication application 123 may determine whether the date of the transaction record in the transaction data 126 is within the time threshold before generating the confirmation 127. For example, if the transaction date has passed 100 days and the time threshold is one week, the authentication application 123 may determine that the transaction record is invalid in light of the threshold and refrain from sending the confirmation 127 to the computing device 110. In some embodiments, the authentication application 123 may resolve the entity ID 115 against the entity data 125 to determine the transaction identifier used to identify the relevant entity within the transaction data 126. Similarly, in some embodiments, the authentication application 123 may receive the transaction log 106 from the computing device 110 and confirm that the transaction log 106 of the contactless card 101 reflects the transactions of the entity ID 115 before generating the confirmation 127. Further, in some embodiments, the authentication application 123 may maintain a counter associated with the contactless card 101. The counter may reflect the number of reviews that the user associated with the contactless card 101 has attempted to submit. If the counter exceeds the threshold, the authentication application 123 may refrain from verifying the encrypted data 105 and / or searching the transaction data 126, thereby preventing the user from submitting an excessive number of reviews and / or submitting reviews generated by a program.

[0024] The API 114 of the review application 113 may receive a confirmation 127 from the server 120 indicating that the user has transacted with an entity associated with the entity ID 115. In response, the review application 113 may enable the user to create and / or submit a review 141-1 that has been verified for the entity associated with the entity ID 115 to the review platform 140. If the server 120 does not send the confirmation 127 (and / or if the API 114 receives a rejection and / or failure status indication from the server 120), the review application 113 may restrict the user from submitting a verified review. In some such embodiments, the review application 113 may enable the user to submit a general review that is not labeled as a verified review. The review platform 140 and / or the review application 113 may distinguish the general review and / or the verified review in the review 141 using any suitable method, such as using graphics, text, images, etc. The review application 113 may further send an indication of the review 141-1 to the server 120, which may store the indication of the published review in the review user's account data 124.

[0025] When review 141-1 is submitted to the review platform, review application 113 may output an instruction specifying that the contactless card 101 be tapped on computing device 110. When the contactless card 101 is brought within the communication range of the computing device 110, API 114 may send review confirmation 108 to the contactless card 101, which may store the review confirmation 108 in memory 102. In some embodiments, review confirmation 108 is the same as confirmation 127 received from server 120. In other embodiments, review confirmation 108 is different from confirmation 127 received from the server. For example, review confirmation 108 may include additional metadata describing review 141-1, such as a timestamp when the review was published, an identifier of the associated user, an entity ID 115 of the entity being reviewed, any metadata of confirmation 127, whether the review is favorable or unfavorable, etc.

[0026] Review application 113 and / or the merchant device may later receive review confirmation 108 from the contactless card 101. By doing so, review application 113 and / or the merchant device may be able to provide user rewards, discounts, and / or other incentives for publishing reviews associated with the review confirmation. In some embodiments, review application 113 may output an instruction specifying that an additional review be submitted. In some such embodiments, review application 113 may identify other entities within transaction log 106 and output a notification requesting that the user submit a verified review of the entity identified within transaction log 106.

[0027] In one embodiment, review application 113 may send review 141-1 to authentication application 123 in response to receiving confirmation 127. Next, authentication application 113 may send review 141-1 to review platform 140 for publication.

[0028] FIG. 2A is a schematic 200 showing an exemplary embodiment of tapping a contactless card 101 to provide a review verified via a review application 113. As shown, the review application 113 outputs a graphical user interface (GUI) for submitting a verified review of an exemplary entity "Entity ABC". The GUI includes a rating field 201 for providing a rating. The rating can be a numerical rating, a star rating, a text-based rating, or other types of ratings. The GUI further includes a comment field 202 that enables a user to provide comments related to the rating. The GUI may further include additional elements such as fields for providing images, videos, etc. Since the disclosure is equally applicable to all types of reviews, a specific type and format of an example of a verified review should not be considered as limiting the disclosure.

[0029] In one embodiment, a user may provide an input to fields 201-202 and select a submit button 203 to submit the review to a review platform 140. In response, the review application 113 may output a notification 204 specifying to tap the contactless card 101 on the computing device 110. When the contactless card 101 is tapped on the computing device 110, an applet 103 of the contactless card 101 may generate encrypted data 105. In some embodiments, the applet 103 may represent a plurality of applets stored on the contactless card 101. In such embodiments, the contactless card 101 may select an applet 103 associated with facilitating the verified review. Next, the selected applet 103 may generate data (e.g., encrypted data 105) necessary to facilitate the verified review and / or provide additional data (e.g., transaction log 106) necessary to facilitate the verified review.

[0030] Once generated, applet 103 may send the encrypted data 105 to the computing device 110 via the communication interface 107. In some embodiments, applet 103 may send the transaction log 106 to the computing device 110 along with the encrypted data 105. As described, in some embodiments, applet 103 may receive the entity ID 115 from the API 114. In such embodiments, applet 103 may determine whether the transaction log 106 includes a record reflecting that the contactless card 101 was used as part of a transaction with the entity associated with the entity ID 115 before generating the encrypted data 105. The API 114 of the review application 113 may send the encrypted data 105, the transaction log 106, the entity ID 115, and / or the application ID 116 to the authentication server 120. In some embodiments, the receipt of the application ID 116 instructs the authentication server 120 to perform operations associated with the verified review (e.g., verify the encrypted data 105 and search for matching transactions within the transaction data 126).

[0031] Next, the authentication application 123 may attempt to decrypt the encrypted data 105 using the private key 104 associated with the contactless card 101. If the authentication application 123 cannot decrypt the encrypted data to obtain the expected result (e.g., the customer identifier of the account associated with the contactless card 101). The authentication application 123 does not verify the encrypted data 105 and does not check whether it is a transaction within the transaction data 126. If the authentication application 123 can decrypt the encrypted data to obtain the expected result (e.g., the customer identifier of the account associated with the contactless card 101), the authentication application 123 verifies the encrypted data 105 and determines whether the transaction within the transaction data 126 reflects that the contactless card 101 was used (at least in part) for a payment in a transaction with an entity associated with the entity ID 115. If the transaction is identified and the encrypted data 105 is verified, the authentication application 123 may generate a confirmation and send it to the API 114 of the review application 113. In some embodiments, if the authentication application 123 identifies a transaction within the transaction data 126, the authentication application 123 may determine whether the date of the identified transaction is within a threshold for use in generating a review that was verified prior to generating the confirmation.

[0032] Figure 2B is a schematic 210 showing one embodiment where the authentication application 123 verifies the encrypted data 105 and sends a confirmation to the API 114 of the review application 113. Next, the review application 113 may permit the user to create and / or submit a verified review. Next, the user may submit the verified review, which may be stored as a review 141 on the review platform 140. Next, the user may edit the review 141 as needed. Other users may also view the verified review within the review 141 via the review application 113 and / or other applications.

[0033] Figure 2C is a schematic 220 showing an embodiment where the verified review is published as a review 141 on the review platform 140. As shown, the review application 113 may provide a link 205 that enables the user to view the verified review. The review application 113 may also output an instruction specifying to tap the contactless card 101 on the device 110. By doing so, the API 114 can send a review confirmation 108 to the contactless card 101. The contactless card 101 may store the review confirmation 108 in the memory 102 and may use the review confirmation 108 later for rewards, incentives, etc.

[0034] Figure 3A is a schematic 300 showing an example of using the contactless card 101 in an entity's point-of-sale (POS) device 310 for information management at the time of sale. The POS device 302 represents any type of computing device such as a card reader device, smartphone, tablet computer, desktop computer, POS terminal, server, workstation, laptop computer, etc. As shown, the POS device 301 instructs the user to tap the contactless card 101 on the POS device 301. The user can bring the contactless card 101 within the communication range of the POS device 301, whereby the applet 103 can send a review confirmation 108 to the POS device 301. In some embodiments, the contactless card 101 is inserted into the card reader of the POS device 302 and the review confirmation 108 is sent via the card reader.

[0035] Accordingly, the POS device 301 may analyze the review confirmation 108 to determine whether the associated review qualifies the user to receive a reward or other incentive. For example, the POS device 301 may determine whether the entity ID 115 associated with the review confirmation 108 matches the entity ID associated with the entity providing the POS device 301. As another example, the POS device 301 may determine whether the timestamp associated with the review confirmation 108 indicates that the review confirmation 108 is within a time threshold for providing a reward for the review. More generally, the POS device 301 confirms that the user has published a verified review 141 of an entity on the review platform 140, at least partially based on the review confirmation 108.

[0036] FIG. 3B is a schematic 310 showing an embodiment in which a POS device 301 confirms that a user has published a review 141 verified against an entity on a review platform 140 based at least in part on a review confirmation 108 received from a memory 102 of a contactless card 101. As shown, the POS device 301 outputs one or more rewards to a customer based on the identified review confirmation 108. Next, the user may select a desired reward. When selected, the POS device 301 may process the selected reward. If the selected reward is applicable to a previous transaction (e.g., a refund for a previous purchase), the POS device 301 may send an instruction for the refund to an appropriate server (e.g., server 120). If the selected reward is for a future transaction, the POS device 301 may store an instruction for the selected reward in the user's user profile. In some embodiments, the POS device 301 stores an instruction for the selected reward in the memory 102 of the contactless card 101 and / or the memory 111 of the computing device 110. By doing so, the POS device 301 can later identify the rewards in the memory 102 of the contactless card 101 and / or the memory 111 of the computing device 110 and automatically provide the rewards to the user at that time.

[0037] Figures 3A-3C depict an embodiment in which the contactless card 101 is tapped on the POS device 301, but the embodiments are not limited to this context. For example, in some embodiments, the contactless card 101 can be tapped on the computing device 110 instead of the POS device 301 of FIG. 3A. In such embodiments, the contactless card 101 can send the review confirmation 108 to the computing device 110. Next, the review application 113 can send the review confirmation 108 to the POS device 301. Next, the POS device 301 can analyze the review confirmation 108 to determine whether the associated review qualifies the user to receive a reward or other incentive. Any reward can be sent and displayed by the POS device 301 to the computing device 110 and / or the review application 113 (e.g., via a GUI similar to the GUI of FIG. 3B). When selected, the indication of the reward can be stored in the memory 111 of the computing device 110. Similarly, the computing device 110 can send the indication of the selected reward to the POS device 301, which can store the indication of the selected reward in the user's user profile.

[0038] FIG. 4 shows an embodiment of a logical flow 400. The logical flow 400 can represent some or all of the operations performed by one or more of the embodiments described herein. For example, the logical flow 400 can include some or all of the operations for using a contactless card to provide a verified review. In this context, the embodiments are not limited.

[0039] As shown, logic flow 400 begins at block 405 where a user of review application 113 running on computing device 110 attempts to provide a review for an entity. As described, the entity can be any type of merchant and / or service provider. For example, the user may attempt to provide a review of a taxi service. At block 410, review application 113 may output a notification specifying that the user tap contactless card 101 on computing device 110 to provide a verified review. At block 415, contactless card 101 is tapped on computing device 110, whereby applet 103 of contactless card 101 may generate encrypted data 105. As described, applet 103 may use private key 104, an encryption algorithm, and some other data (e.g., customer ID) to generate encrypted data 105. In some embodiments, prior to generating encrypted data 105, applet 103 determines whether the transaction in transaction log 106 reflects that contactless card 101 was used for payment of a transaction with an entity associated with entity ID 115 received from review application 113. At block 420, applet 103 sends encrypted data 105 to API 114 of device 110. Optionally, applet 103 may send transaction log 106 to device 110 along with encrypted data 105.

[0040] At block 425, the API 114 of the review application 113 may receive encrypted data 105 and / or transaction log 106 from the contactless card 101. At block 430, the review application 113 may provide the entity ID 115 of the entity and the application ID 116 of the review application 113 to the API 114 of the review application 113. At block 435, one or more of the APIs 114 of the review application 113 may send the encrypted data, entity ID 115, and application ID 116 to the authentication server 120. At block 440, the authentication application 123 may attempt to decrypt the encrypted data 105 using the secret key 104 associated with the contactless card 101 stored by the server 120. If the authentication application 123 decrypts the encrypted data 105 to generate an expected result (e.g., a customer identifier associated with the contactless card 101 stored in the account data 124), the authentication application 123 may verify the encrypted data.

[0041] At block 445, the authentication application 123 may identify previous transactions between the contactless card 101 and the entity ID 115 in the transaction data 126. By doing so, the authentication application 123 can confirm that the user has actually transacted with the entity that the user wishes to submit a review for. For example, by identifying a record in the transaction data 126 indicating that the contactless card 101 was used for payment of a taxi service provided by a taxi service entity, the authentication application 123 can confirm that the user was actually a paying customer of the taxi service. At block 450, the authentication application 123 may send an indication of confirmation to the device 110. The confirmation may generally indicate that the encrypted data has been verified and / or a valid transaction has been identified in the transaction data 126.

[0042] When the review application 113 receives confirmation from the server 120, the review application 113 may permit the publication of the verified review. In some embodiments, the review application 113 may disable certain GUI components to restrict the generation and / or submission of reviews until confirmation is received from the server 120. For example, the review application 113 may disable the submission button 203 in FIGS. 2A-2B until confirmation is received. As another example, the review application 113 may not permit the user to provide input in fields 201-202 until confirmation is received. At block 455, the review application 113 receives an input specifying to publish the verified review to the review platform. Next, the review application 113 may indicate that the review is a verified review and transmit the review to the review platform 140. Next, the review platform 140 may store the verified review (including the verified review instruction) in the review 141. Next, the user may, for example, use the review application 113 to view the verified review.

[0043] At block 460, one or more APIs 114 of the review application 113 may transmit an instruction of the published review to the contactless card 101, which may store the instruction in the memory 102. For example, the review confirmation 108 may be transmitted to a contactless card 101 specifying that the user has written a verified review about the tax service. At block 465, the contactless card 101 may store the instruction of the published review in the memory 102 of the contactless card 101.

[0044] Figure 5 shows an embodiment of a logic flow 500. The logic flow 500 may represent some or all of the operations performed by one or more embodiments described herein. For example, the logic flow 500 may include some or all of the operations for verifying a review based at least in part on data generated by a contactless card. In this context, embodiments are not limited.

[0045] As shown, the logic flow 500 begins at block 505, where the authentication application 123 receives data from one or more APIs 114 of the review application 113. For example, the authentication application 123 may receive encrypted data 105 generated by the contactless card 101, the transaction log 106 of the contactless card 101, the entity ID 115, and / or the application ID 116 as part of a request to confirm a verified review. At block 510, the authentication application 123 attempts to decrypt the encrypted data 105 using the private key 104 of the server 120 and generates a customer ID associated with the contactless card. At block 515, the authentication application 123 may search the transaction data 126 to identify a transaction between the contactless card 101 and the entity ID. For example, if the entity ID 115 is associated with a restaurant, the authentication application 123 may identify a record in the transaction data 126 indicating that the contactless card 101 was used to pay for a meal at the restaurant.

[0046] At block 520, the authentication application 123 determines whether the time associated with the transaction identified at block 515 exceeds a limit time (or threshold). For example, the authentication application 123 may have a 10-day threshold for a transaction. If the identified transaction occurred within 10 days, the authentication application 123 may confirm the transaction for a verified review. Otherwise, the authentication application 123 may reject the confirmation of the transaction for a verified review. At block 525, the authentication application 123 determines whether the review limit has been exceeded by the current review. As described, the authentication application 123 may maintain a review counter associated with the contactless card 101. By incrementing the review counter based on the current review, if the counter exceeds the limit, the authentication application 123 may reject the confirmation of the transaction for a verified review. Otherwise, the authentication application 123 may confirm the transaction for a verified review.

[0047] In block 530, the authentication application 123 may reject the verified review and / or refrain from sending a confirmation to the review application 113. For example, the authentication application 123 may reject a verified review based on a determination that the encrypted data 105 was not decrypted, the transaction was not identified in the transaction data 126, or the time and / or review limits were exceeded. By doing so, the review application 113 is restricted from publishing the verified review by the user. Additionally and / or alternatively, the review application 113 may permit the user to publish the review but may not be able to provide a verified status to the review. In block 535, the authentication application 123 may send an approval instruction, such as a confirmation, for the verified review requested by the review application 113. For example, the authentication application 123 may successfully decrypt the encrypted data 105, identify one or more transactions within the transaction data 126, and determine that the identified transactions do not exceed the time limit and / or review limits. As another example, the authentication application 123 may further determine that the transaction exists in the received transaction log 106 of the contactless card 101. By doing so, the authentication application 123 can confirm that the requested review is not fraudulent based on the decryption of the encrypted data and the identification of the most recent transactions between the user and the entity.

[0048] Figure 6 shows an embodiment of a logical flow 600. The logical flow 600 may represent some or all of the operations performed by one or more embodiments described herein. For example, the logical flow 600 may include some or all of the operations for using a contactless card for a verified review. In this context, the embodiments are not limited.

[0049] As shown, the logical flow 600 begins at block 605, where the review application 113 identifies one or more transactions within the transaction log 106 received from the contactless card 101. At block 610, the review application 113 may determine that the contactless card 101 was used for payment of a transaction with an entity for which the user is attempting to publish a verified review within the transaction log 106. For example, the entity ID of the entity may be specified in the transaction log 106. At block 615, the review application 113 determines that the transaction identified at block 610 is within a time threshold. For example, the review application 113 may determine that the transaction has a timestamp indicating that three days have passed, and that the time threshold is 30 days. The review application 113 may make the determinations at blocks 610 - 615 before sending at least the encrypted data 105 to the server 120 for verification. The verification may be performed as described above, and the user may optionally submit the verified review based on the confirmation received by the review application 113 from the server 120.

[0050] At block 620, the review application 113 may identify a transaction with a second entity in the transaction log 106 received from the contactless card 101. At block 625, the review application 113 may output a notification requesting that the user write a review of the second entity. The user may then decide to write a review of the second entity, which may be verified using the contactless card 101 as described herein.

[0051] FIG. 7 shows an embodiment of a logic flow 700. The logic flow 700 may represent some or all of the operations performed by one or more embodiments described herein. For example, the logic flow 700 may include some or all of the operations for providing a reward based on a published review instruction stored on a contactless card. In this context, the embodiments are not limited.

[0052] As shown, the logic flow 700 begins at block 705, where a merchant device, such as the POS device 301, outputs an instruction to tap and / or insert the contactless card 101 into the POS device 301. At block 710, the POS device 301 receives data from the contactless card 101. For example, the applet 103 may send one or more review confirmations 108 stored in the memory 102 to the POS device 301. At block 715, the merchant device identifies an instruction that the user has submitted a verified review for an entity associated with the POS device 301. For example, the POS device 301 may compare the entity ID 115 within the received review confirmation 108 and determine that the entity ID 115 is associated with the entity providing the POS device 301.

[0053] At block 720, the POS device 301 outputs one or more rewards, discounts, and / or incentives for display. For example, the POS device 301 may offer a discount for a future purchase, an upgrade for a future purchase, and / or a refund for a previous purchase. At block 725, the POS device 301 receives a selection of one or more rewards output at block 720. For example, the user may select an upgraded hotel room for a next stay. At block 730, the POS device 301 may apply the selected reward to the user's account. For example, the POS device 301 may store instructions to upgrade the user's room during a next hotel stay. At block 735, when the POS device 301 determines that the reward selected at block 725 is a refund for a previous purchase, the POS device 301 sends an instruction for the refund for the previous purchase. For example, if the user selects a 5% discount on a last purchase totaling $100, the POS device 301 may send an instruction for a $5 refund to the server 120 to an account associated with the contactless card 101.

[0054] FIG. 8 shows an embodiment of an exemplary computing architecture 800 that includes a computing system 802 that may be suitable for implementing the various embodiments as described above. In various embodiments, the computing architecture 800 may comprise an electronic device or be implemented as part of one. In some embodiments, the computing architecture 800 may represent, for example, a system that implements one or more components of system 100. In some embodiments, the computing system 802 may represent, for example, the contactless card 101, the computing device 110, the authentication server 120, and / or the review platform 140 of system 100. Similarly, the computing system 802 may represent the POS device 301. The embodiments are not limited to this context. More generally, the computing architecture 800 is configured to implement all of the logic, applications, systems, methods, devices, and functions described herein with reference to FIGS. 1-9.

[0055] The terms "system" and "component" and "module" as used in this application are intended to refer to any computer-related entity, whether hardware, a combination of hardware and software, software, or software in execution, examples of which are provided by the exemplary computing architecture 800. For example, a component can be a process running on a computer processor, a computer processor, a hard disk drive, a plurality of storage drives (of optical and / or magnetic storage media), an object, an executable, an execution thread, a program, and / or a computer, but is not limited thereto. As an example, both an application running on a server and the server can be components. One or more components can reside within a process and / or an execution thread, and a component can be localized on one computer and / or distributed between two or more computers. Further, components can be communicatively coupled to each other by various types of communication media and can coordinate their operations. The coordination can include the one-way or two-way exchange of information. For example, a component can communicate information in the form of signals communicated through a communication medium. The information can be implemented as signals assigned to various signal lines. In such an assignment, each message is a signal. However, further embodiments can alternatively use data messages. Such data messages can be transmitted through various connections. Examples of connections include parallel interfaces, serial interfaces, and bus interfaces.

[0056] Computing system 802 includes various general computing elements such as one or more processors, multi-core processors, coprocessors, memory units, chip sets, controllers, peripheral devices, interfaces, oscillators, timing devices, video cards, audio cards, multimedia input / output (I / O) components, power supplies, etc. However, embodiments are not limited to implementation by computing system 802.

[0057] As shown in FIG. 8, computing system 802 includes a processor 804, a system memory 806, and a system bus 808. Processor 804 can be any of a variety of commercially available computer processors, including but not limited to AMD (R) Athlon (R), Duron (R), and Opteron (R) processors, ARM (R) application, embedded, and secure processors, IBM (R) and Motorola (R) DragonBall (R) and PowerPC (R) processors, IBM and Sony (R) Cell processors, Intel (R) Celeron (R), Core (R), Core (TM) 2 Duo (R), Itanium (R), Pentium (R), Xeon (R), and XScale (R) processors and similar processors. Dual microprocessors, multi-core processors, and other multiprocessor architectures can also be used as processor 804.

[0058] System bus 808 provides an interface to system components including, but not limited to, processor 804 from system memory 806. System bus 808 can be any of several types of bus structures that can further interconnect to a memory bus (with or without a memory controller), a peripheral bus, and a local bus, using any of a variety of commercially available bus architectures. Interface adapters can connect to system bus 808 via a slot architecture. Examples of slot architectures include, but are not limited to, Accelerated Graphics Port (AGP), CardBus, (Extended) Industry Standard Architecture ((E)ISA), Micro Channel Architecture (MCA), NuBus, Peripheral Component Interconnect (Extended) (PCI(X)), PCI Express, Personal Computer Memory Card International Association (PCMCIA), and the like.

[0059] System memory 806 can include various types of computer-readable storage media in the form of one or more high-speed memory units, such as read-only memory (ROM), random access memory (RAM), dynamic RAM (DRAM), double data rate DRAM (DDRAM), synchronous DRAM (SDRAM), static RAM (SRAM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory (e.g., one or more flash arrays), ferroelectric polymer memory, ovonic memory, polymer memory such as phase change or ferroelectric memory, silicon oxide nitride oxide silicon (SONOS) memory, magnetic or optical cards, arrays of devices such as redundant arrays of independent disks (RAID) drives, solid-state memory devices (e.g., USB memory, solid-state drives (SSD)), and other types of storage media suitable for storing information. In the illustrated embodiment shown in FIG. 8, system memory 806 can include non-volatile memory 810 and / or volatile memory 812. The basic input / output system (BIOS) can be stored in non-volatile memory 810.

[0060] Computing system 802 may include various types of computer-readable storage media in the form of one or more low-speed memory units, including an internal (or external) hard disk drive (HDD) 814, a magnetic floppy disk drive (FDD) 816 that reads from or writes to a removable magnetic disk 818, and an optical disk drive 820 that reads from or writes to a removable optical disk 822 (e.g., CD-ROM or DVD). HDD 814, FDD 816, and optical disk drive 820 may each be connected to system bus 808 by an HDD interface 824, an FDD interface 826, and an optical drive interface 828, respectively. HDD interface 824 for external drive use may include at least one or both of universal serial bus (USB) and IEEE 1394 interface technologies. Computing system 802 is generally configured to implement all of the logic, systems, methods, apparatuses, and functions described herein with reference to FIGS. 1-9.

[0061] The drive and associated computer-readable media provide volatile and / or non-volatile storage of data, data structures, computer-executable instructions, and the like. For example, a number of program modules may be stored in drive and memory units 810, 812, including operating system 830, one or more application programs 832, other program modules 834, and program data 836. In one embodiment, one or more application programs 832, other program modules 834, and program data 836 may include, for example, various applications and / or components of system 100, such as applet 103, private key 104, encrypted data 105, transaction log 106, review application 113, API 114, authentication application 123, account data 124, entity data 125, transaction data 126, review platform 140, and / or review 141.

[0062] The user may input commands and information into computing system 802 via one or more wired / wireless input devices, such as a pointing device, e.g., keyboard 838 and mouse 840. Other input devices may include a microphone, infrared (IR) remote control, radio frequency (RF) remote control, game pad, stylus pen, card reader, dongle, fingerprint reader, grab, graphic tablet, joystick, keyboard, retina reader, touch screen (e.g., capacitive, resistive, etc.), trackball, track pad, sensor, stylus, and the like. These and other input devices are often connected to processor 804 via input device interface 842 coupled to system bus 808, but may be connected by other interfaces such as a parallel port, IEEE 1394 serial port, game port, USB port, IR interface, and the like.

[0063] Monitor 844 or other types of display devices are also connected to system bus 808 via an interface such as video adapter 846. Monitor 844 can be inside or outside the computing system 802. In addition to monitor 844, a computer typically includes other peripheral output devices such as speakers, printers, etc.

[0064] Computing system 802 can operate in a network environment using logical connections via wired and / or wireless communication to one or more remote computers such as remote computer 848. Remote computer 848 can be a workstation, server computer, router, personal computer, portable computer, microprocessor-based entertainment device, peer device, or other common network node, and typically includes many or all of the elements described in relation to computing system 802, but for simplicity, only memory / storage device 850 is shown. The logical connections shown include a wired / wireless connection to a local area network (LAN) 852 and / or a larger network, such as a wide area network (WAN) 854. Such LAN and WAN network environments are common in offices and enterprises and facilitate enterprise-scale computer networks such as intranets. All of these can be connected to a global communication network such as the Internet, for example. In an embodiment, network 130 of FIG. 1 is one or more of LAN 852 and WAN 854.

[0065] When used in a LAN networking environment, computing system 802 is connected to LAN 852 via a wired and / or wireless communication network interface or adapter 856. Adapter 856 can facilitate wired and / or wireless communication to LAN 852, which can include a wireless access point disposed thereon to communicate with the wireless function of adapter 856.

[0066] When used in a WAN networking environment, computing system 802 may include a modem 858, or be connected to a communication server on WAN 854, or have other means for establishing communication on WAN 854, such as via the Internet. Modem 858 can be internal or external, a wired and / or wireless device, and is connected to system bus 808 via input device interface 842. In a network environment, program modules shown with respect to computing system 802, or portions thereof, may be stored in remote memory / storage device 850. The network connections shown are exemplary, and it will be understood that other means of establishing communication links between computers can be used.

[0067] Computing system 802 is operable to communicate with wired and wireless devices or entities using the IEEE 802 standard family, such as a wireless device operably arranged to operate in wireless communication (e.g., IEEE 802.16 wireless modulation technology). This includes at least Wi-Fi (or Wireless Fidelity), WiMax, Bluetooth® wireless technology, etc. Thus, communication can be in a pre-defined structure similar to a conventional network, or merely ad-hoc communication between at least two devices. A Wi-Fi network provides a secure, reliable, high-speed wireless connection using wireless technology called IEEE 802.11x (a, b, g, n, etc.). Wi-Fi networks can be used to connect computers to each other, to the Internet, or to a wired network (using media and functions related to IEEE 802.3).

[0068] FIG. 9A shows a contactless card 101 that may include a payment card such as a credit card, debit card, and / or gift card. As shown, the contactless card 101 may be issued by a service provider 902 displayed on the front or back of the card 101. In some examples, the contactless card 101 may include an identification card and is not limited thereto, having no relation to a payment card. In some examples, the payment card may include a dual interface contactless payment card. The contactless card 101 may include a substrate 910 that may include a single layer or one or more laminated layers composed of plastic, metal, and other materials. Exemplary substrate materials include polyvinyl chloride, polyvinyl acetate, acrylonitrile butadiene styrene, polycarbonate, polyester, anodized titanium, palladium, gold, carbon, paper, and biodegradable materials. In some examples, the contactless card 101 may have physical characteristics compliant with the ID-1 format of the ISO / IEC 7810 standard; otherwise, the contactless card may be compliant with the ISO / IEC 14443 standard. However, it should be understood that the contactless card 101 according to the present disclosure may have different characteristics, and the present disclosure does not require implementing a contactless card for a payment card.

[0069] The contactless card 101 may also include identification information 915 displayed on the front and / or back of the card, and contact pads 920. The contact pads 920 may be configured to establish contact with other communication devices such as a mobile device 90, a user device, a smartphone, a laptop, a desktop, or a tablet computer. The contactless card 101 may also include a processing circuit, an antenna, and other components not shown in FIG. 9A. These components may be disposed behind the contact pads 920 or at other locations on the substrate 910. The contactless card 101 may also include a magnetic strip or tape (not shown in FIG. 9A) that may be located on the back of the card.

[0070] As shown in FIG. 9B, the contact pad 920 of the contactless card 101 may include a processing circuit 925 for storing and processing information, including a microprocessor 930 and a memory 102. The processing circuit 925 may include additional components such as a processor, a memory, an error and parity / CRC checker, a data encoder, a collision prevention algorithm, a controller, a command decoder, a security primitive, and anti-counterfeiting hardware, as needed to perform the functions described herein.

[0071] The memory 102 may be a read-only memory, a write-once / read-multiple memory, or a read / write memory, such as RAM, ROM, and EEPROM, and the contactless card 101 may include one or more of these memories. The read-only memory may be read-only or once-programmable at the time of factory shipment. With a one-time program, it can be written once and read many times. The write-once / read-multiple memory may be programmed at some point after the memory chip is shipped from the factory. The memory may not be rewritable once programmed, but can be read many times. The read / write memory may be programmed and reprogrammed many times after factory shipment. The read / write memory can be read many times after factory shipment.

[0072] Memory 102 may be configured to store one or more applets 103, a private key 104, encrypted data 105, a transaction log 106, one or more review confirmations 108, and one or more customer (or user) identifiers (IDs) 907. The one or more applets 103 may comprise one or more software applications configured to execute on one or more contactless cards, such as Java (registered trademark) card applets. However, it is understood that the applet 103 is not limited to a Java card applet and may instead be any software application operable on a contactless card or other device having limited memory. The customer ID 907 may comprise a unique alphanumeric identifier assigned to a user of the contactless card 101, which can distinguish the user of the contactless card from users of other contactless cards. In some examples, the customer ID 907 may identify both the customer and the account assigned to that customer, and may further identify the contactless card associated with the customer's account. In some embodiments, the applet 103 may use the customer ID 907 as an input to an encryption algorithm using the private key 104 to generate the encrypted data 105.

[0073] Although the processor and memory elements of the foregoing exemplary embodiments have been described with reference to contact pads, the present disclosure is not so limited. It is understood that these elements may be implemented as additional elements in addition to the processor 930 and memory 102 elements located external to, or completely separate from, or within the contact pad 920.

[0074] In some examples, the contactless card 101 may include one or more antennas 955. The one or more antennas 955 may be disposed within the contactless card 101 and around the processing circuitry 925 of the contact pad 920. For example, the one or more antennas 955 may be integrated with the processing circuitry 925, and the one or more antennas 955 may be used with an external booster coil. As another example, the one or more antennas 955 may be external to the contact pad 920 and the processing circuitry 925.

[0075] In one embodiment, the coil of the contactless card 101 may function as the secondary side of an air-core transformer. The terminal may communicate with the contactless card 101 by interrupting power or amplitude modulation. The contactless card 101 may infer data transmitted from the terminal using a gap in the power connection of the contactless card that may be functionally maintained via one or more capacitors. The contactless card 101 may return communication by switching the load of the coil or load modulation of the contactless card. The load modulation may be detected by the coil of the terminal due to interference. More generally, using the antenna 955, the processing circuitry 925, and / or the memory 102, the contactless card 101 provides a communication interface for communicating via NFC, Bluetooth®, and / or Wi-Fi communication.

[0076] As described above, the contactless card 101 may be built on a software platform operable on a memory-constrained smart card such as a Java card or other device, and one or more applications or applets may be securely executed. The applet may be added to the contactless card and may provide one-time passwords (OTPs) for multi-factor authentication (MFA) in various mobile application-based use cases. The applet may respond to one or more requests, such as a near-field data exchange request from a reader such as a mobile NFC reader (e.g., the card reader 118 of the device 110), and may be configured to generate an NDEF message with an encrypted and secure OTP encoded as an NDEF text tag.

[0077] Various embodiments may be implemented using hardware elements, software elements, or a combination of both. Examples of hardware elements can include processors, microprocessors, circuits, circuit elements (such as transistors, resistors, capacitors, inductors, etc.), integrated circuits, application specific integrated circuits (ASICs), programmable logic devices (PLDs), digital signal processors (DSPs), field programmable gate arrays (FPGAs), logic gates, registers, semiconductor devices, chips, microchips, chip sets, and the like. Examples of software can include software components, programs, applications, computer programs, application programs, system programs, machine programs, operating system software, middleware, firmware, software modules, routines, subroutines, functions, methods, procedures, software interfaces, application program interfaces (APIs), instruction sets, computing code, computer code, code segments, computer code segments, words, values, symbols, or any combination thereof. The determination of whether an embodiment is implemented using hardware elements and / or software elements can vary according to any number of factors such as desired computational speed, power level, heat tolerance, processing cycle budget, input data rate, output data rate, memory resources, data bus speed, and other design or performance constraints.

[0078] One or more aspects of at least one embodiment can be implemented by representative instructions stored on a machine-readable medium that represents various logic within a processor, which, when read by a machine, causes the machine to fabricate the logic for performing the techniques described herein. Such representations, known as “IP cores,” are stored on a tangible machine-readable medium and provided to various customers or manufacturing facilities for loading onto a manufacturing machine that creates the logic or processor. Some embodiments can be implemented using a machine-readable medium or article that can store, for example, instructions or instruction sets that, when executed by a machine, can cause the machine to perform methods and / or operations in accordance with the embodiments. Such machines can include, for example, any suitable processing platform, computing platform, computing device, processing device, computing system, processing system, computer, processor, etc., and can be implemented using any suitable combination of hardware and / or software. The machine-readable medium or article can include, for example, any suitable type of memory unit, memory device, memory article, memory medium, storage device, storage article, storage medium, and / or storage unit, such as memory, removable or non-removable media, erasable or non-erasable media, writable or rewritable media, digital or analog media, hard disk, floppy disk, compact disc read only memory (CD-ROM), compact disc recordable (CD-R), compact disc rewritable (CD-RW), optical disc, magnetic media, magneto-optical media, removable memory card or disk, various digital versatile discs (DVD), tape, cassette, etc. The instructions can include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, encrypted code, etc., and can be implemented using any suitable high-level, low-level, object-oriented, visual, compiled and / or interpreted programming language.

[0079] The foregoing description of the exemplary embodiments has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the disclosure to the exact form disclosed. Many modifications and variations are possible in light of this disclosure. The scope of this disclosure is intended to be limited not by this detailed description, but rather by the claims appended hereto. Future applications claiming the priority of this application may claim the disclosed subject matter in a different manner and may generally include any set of one or more limitations as variously disclosed or demonstrated herein.

Claims

1. Processor and and a memory storing instructions that, when executed by the processor, cause the processor to: receiving instructions specifying an application executing on the processor to generate reviews of entities comprising one or more of merchants and service providers; the application outputting instructions specifying tapping a contactless card to the system; an application programming interface (API) of the application receiving encrypted data from a communication interface of the contactless card, the encrypted data based on an encryption algorithm, a customer identifier, and a private key; The API of the application sending to an authentication server associated with the contactless card (i) the encrypted data, (ii) instructions for the application, and (iii) an entity identifier associated with the entity; the API of the application receiving instructions from the authentication server specifying that the authentication server (i) decrypted the encrypted data using a copy of the private key stored by the server to generate the customer identifier, and (ii) determined that the contactless card was used to make a purchase at the entity based at least in part on the entity identifier and the decrypted customer identifier; authorizing, by the application, the generation of the review based on the instructions received from the authentication server; the application publishing the reviews on one or more review platforms associated with the application; A system that executes the above.

2. The API of the application, before the application allows the review to be generated, receiving transaction data from the contactless card for one or more previous transactions; determining that the entity identifier is specified in the transaction data of the one or more previous transactions; The system of claim 1 , further comprising:

3. The memory stores instructions that, when executed by the processor, cause the processor to: the application identifying an entity identifier of a second entity within the transaction data of the one or more previous transactions; the application outputting instructions for generating a review of the second entity; The system of claim 2 , further comprising:

4. The memory stores instructions that, when executed by the processor, cause the processor to: the API of the application sending to the contactless card an indication that the review has been published to the one or more review platforms; The system of claim 1 ,

5. The memory stores instructions that, when executed by the processor, cause the processor to: the application sending to a point of sale device associated with the entity an indication that the review has been published to the one or more review platforms; receiving, from the point of sale device, an indication of a reward for at least one of (i) the purchase, and (ii) a subsequent purchase, based on the transmitted indication that the review was published; The system of claim 1 ,

6. The memory stores instructions that, when executed by the processor, cause the processor to: the API of the application receiving an indication of a time of the purchase; the application determining that the time that has elapsed since the time of the purchase does not exceed a threshold time; The system of claim 1 ,

7. The memory stores instructions that, when executed by the processor, cause the processor to: the application restricting the publication of the review based on at least one of: (i) receiving an indication that the authentication server was unable to successfully decrypt the encrypted data; and (ii) receiving an indication that the authentication server determined that the contactless card was not used for a purchase at the entity; The system of claim 1 ,

8. A non-transitory computer-readable storage medium storing instructions that, when executed by a processor, cause the processor to: receiving instructions specifying that an application executing on the processor is to submit a review of an entity comprising one or more of a merchant and a service provider; the application outputting an instruction specifying tapping a contactless card to a device; an application programming interface (API) of the application receiving encrypted data from a communication interface of the contactless card, the encrypted data based on an encryption algorithm, a customer identifier, and a private key; The API of the application sending to an authentication server associated with the contactless card (i) the encrypted data, (ii) instructions for the application, and (iii) an entity identifier associated with the entity; the API of the application receiving instructions from the authentication server specifying that the authentication server (i) decrypted the encrypted data using a copy of the private key stored by the server to generate the customer identifier, and (ii) determined that the contactless card was used to make a purchase at the entity based at least in part on the entity identifier and the decrypted customer identifier; authorizing, by the application, the submission of the review based on the instruction received from the authentication server; the application publishing the reviews on one or more review platforms associated with the application; A non-transitory computer-readable storage medium for causing the computer to execute

9. The API of the application, before the application allows the review to be generated, receiving transaction data from the contactless card for one or more previous transactions; determining that the entity identifier is specified in the transaction data of the one or more previous transactions; The non-transitory computer-readable storage medium of claim 8 , further comprising:

10. The non-transitory computer-readable storage medium stores instructions that, when executed by the processor, cause the processor to: the application identifying an entity identifier of a second entity within the transaction data of the one or more previous transactions; the application outputting instructions for generating a review of the second entity; 10. The non-transitory computer-readable storage medium of claim 9,

11. The non-transitory computer-readable storage medium stores instructions that, when executed by the processor, cause the processor to: the API of the application sending to the contactless card an indication that the review has been published to the one or more review platforms; 10. The non-transitory computer-readable storage medium of claim 8,

12. The non-transitory computer-readable storage medium stores instructions that, when executed by the processor, cause the processor to: the application sending to a point of sale device associated with the entity an indication that the review has been published to the one or more review platforms; receiving, from the point of sale device, an indication of a reward for at least one of (i) the purchase, and (ii) a subsequent purchase, based on the transmitted indication that the review was published; 10. The non-transitory computer-readable storage medium of claim 8,

13. The non-transitory computer-readable storage medium stores instructions that, when executed by the processor, cause the processor to: the API of the application receiving an indication of a time of the purchase; the application determining that the time that has elapsed since the time of the purchase does not exceed a threshold time; 10. The non-transitory computer-readable storage medium of claim 8,

14. The non-transitory computer-readable storage medium stores instructions that, when executed by the processor, cause the processor to: the application restricting the publication of the review based on at least one of: (i) receiving an indication that the authentication server was unable to successfully decrypt the encrypted data; and (ii) receiving an indication that the authentication server determined that the contactless card was not used for a purchase at the entity; 10. The non-transitory computer-readable storage medium of claim 8,

15. receiving instructions specifying an application executing on a processor of the device to generate reviews of entities comprising one or more of merchants and service providers; the application outputting an instruction specifying tapping a contactless card to the device; an application programming interface (API) of the application receiving from a communication interface of the contactless card encrypted data generated by the contactless card based on an encryption algorithm, a customer identifier, and a private key stored in a memory of the contactless card; The API of the application sending to an authentication server associated with the contactless card (i) the encrypted data, (ii) instructions for the application, and (iii) an entity identifier associated with the entity; the API of the application receiving instructions from the authentication server specifying that the authentication server (i) decrypted the encrypted data using a copy of the private key stored by the server to generate the customer identifier, and (ii) determined that the contactless card was used to make a purchase at the entity based at least in part on the entity identifier and the decrypted customer identifier; authorizing, by the application, the generation of the review based on the instructions received from the authentication server; the application publishing the reviews on one or more review platforms associated with the application; The method includes:

16. The memory of the contactless card stores transaction data of one or more previous transactions, and the method further comprises, prior to the application enabling the generation of the review: the API of the application receiving the transaction data of the one or more previous transactions from the contactless card; The API of the application determining that the entity identifier is specified in the transaction data of the one or more previous transactions; The method of claim 15 further comprising:

17. The method comprises: the application identifying an entity identifier of a second entity within the transaction data of the one or more previous transactions; the application outputting instructions for generating a review of the second entity; 20. The method of claim 16, further comprising:

18. The method comprises: the API of the application sending to the contactless card an indication that the review has been published to the one or more review platforms; The method of claim 15 further comprising:

19. The method comprises: the application sending to a point of sale device associated with the entity an indication that the review has been published to the one or more review platforms; receiving, from the entity's point of sale device, a reward for at least one of (i) the purchase and (ii) a subsequent purchase; The method of claim 15 further comprising:

20. The method comprises: the application restricting the publication of the review based on at least one of: (i) receiving an indication that the authentication server was unable to successfully decrypt the encrypted data; and (ii) receiving an indication that the authentication server determined that the contactless card was not used for a purchase at the entity; The method of claim 15 further comprising:

Images