Account registration using contactless card

Abstract

To provide systems, methods, articles of manufacture, and computer-readable media for tapping to automatically input card data into a form on a computing device.SOLUTION: A method of account registration using a contactless card is provided. A payment application receives a request to generate a payment account using a contactless card, receives encrypted data from the contactless card and transmits the encrypted data to a server associated with the contactless card. The device receives a push notification from the server and opens an account application associated with the contactless card in response to selection of the push notification. The account application receives confirmation to generate the payment account using the contactless card and transmits the confirmation to the server. The device opens the payment application upon receiving verification of the encrypted data from the server.SELECTED DRAWING: Figure 4

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims priority to U.S. Patent Application No. 16 / 726,366, entitled "Account Registration Using Contactless Cards," filed December 24, 2019. The contents of the aforementioned application are incorporated herein by reference in their entirety. [Technical Field]

[0002] TECHNICAL FIELD Embodiments herein relate generally to computing platforms, and more particularly to using contactless cards to register accounts. [Background technology]

[0003] Third-party payment services allow users to make payments using different payment accounts. However, registering an account with a third-party payment service using a payment account may expose it to security risks. For example, a malicious user may attempt to create a fraudulent account with the third-party payment service using compromised information from the user and / or the user's payment account. As a result, the third-party payment service and / or the institution associated with the payment account may not be able to distinguish between legitimate and fraudulent attempts to create a third-party payment account. Summary of the Invention

[0004]

[0003] Embodiments disclosed herein provide systems, methods, products, and computer-readable media for tapping to automatically enter card data into a form on a computing device. According to one example, a payment application running on the device can receive instructions indicating the use of a contactless card to create a payment account in the payment application. The payment application can output instructions indicating the use of the contactless card to tap the device. The device can receive encrypted data from a communication interface of the contactless card, the encrypted data based on a customer identifier and a private key associated with the contactless card. The device can send the encrypted data to a server associated with the contactless card and receive a push notification from the server. In response to receiving a selection of the push notification, the device can open an account application associated with the contactless card. The account application can receive a confirmation input indicating the use of the contactless card to create a payment account in the payment application. The account application can send the confirmation input instruction to the server. In response to the payment application receiving verification of the encrypted data from the server, the device can open the payment application. The payment application can enter the account data received from the server, the account data for the account associated with the contactless card, into multiple form fields of a form displayed in the payment application. The payment application can generate a payment account using account data received from a server and entered into a number of form fields. [Brief explanation of the drawings]

[0005] [Figure 1A] 1 illustrates an embodiment of a system for account creation using a contactless card. [Figure 1B] 1 illustrates an embodiment of a system for account creation using a contactless card. [Figure 1C]1 illustrates an embodiment of a system for account creation using a contactless card. [Figure 1D] 1 illustrates an embodiment of a system for account creation using a contactless card. [Figure 1E] 1 illustrates an embodiment of a system for account creation using a contactless card. [Figure 2A] 1 illustrates an embodiment of account creation using a contactless card. [Figure 2B] 1 illustrates an embodiment of account creation using a contactless card. [Figure 2C] 1 illustrates an embodiment of account creation using a contactless card. [Figure 2D] 1 illustrates an embodiment of account creation using a contactless card. [Figure 2E] 1 illustrates an embodiment of account creation using a contactless card. [Figure 2F] 1 illustrates an embodiment of account creation using a contactless card. [Figure 2G] 1 illustrates an embodiment of account creation using a contactless card. [Figure 3A] 1 shows an exemplary contactless card. [Figure 3B] 1 shows an exemplary contactless card. [Figure 4] 1 illustrates a first logic flow embodiment. [Figure 5] 10 illustrates a second logic flow embodiment. [Figure 6] 1 illustrates an embodiment of a computing architecture. DETAILED DESCRIPTION OF THE INVENTION

[0006]

[0003] Embodiments disclosed herein provide secure techniques for creating an account using a contactless card. The account may be a third-party payment account for a third-party payment service that provides a third-party payment application for use on a computing device. The payment account associated with a contactless card provided by a financial institution may be used to fund transactions using the third-party payment account. When attempting to register an account with the third-party payment application, a user may select an option to securely create an account using a contactless card. In response, the third-party payment application may output instructions to tap the contactless card against a device. The user may then tap the contactless card against the device. The device may then instruct the contactless card to generate and transmit encrypted data to the device. The data generated by the contactless card may be encrypted using key diversification. The device may transmit the encrypted data received from the contactless card to a first server associated with the financial institution that provides the contactless card.

[0007] The first server can verify the encrypted data received from the contactless card by decrypting the encrypted data. The first server can then send a push notification to the device. The device can output the push notification for display on a display. An account application provided by the financial institution can open on the device in response to the user selecting the notification. The account application can then request the user to provide authentication credentials to access the account associated with the contactless card. The account application can then request the user to confirm whether the attempted account creation using the third-party payment application is valid. If the user provides input indicating that the account creation is not valid, the third-party account creation can be restricted to protect the security of the account associated with the contactless card. Otherwise, the account application can send an indication to the first server indicating that the user has confirmed the validity of the attempted account creation using the third-party payment application.

[0008] The device can output the third-party payment application for display. The third-party payment application can receive account data for an account associated with the contactless card from the first server. The account data can include one or more of a first name, a last name, an email address, an address, a contactless card account number, an expiration date of the contactless card, and a card verification value (CVV) of the contactless card. The third-party payment application can automatically enter the received account data into corresponding form fields of a form provided by the third-party payment application. In response to receiving user input indicating an account should be created, the third-party payment application can create the account using the data received from the server. A record of the created account may be stored on a second server associated with the third-party payment application. The user can then make a purchase using the underlying account associated with the third-party payment application and the contactless card.

[0009] Advantageously, doing so improves the security of all devices and associated data. For example, verifying the encrypted data by the first server provides an additional safeguard to prevent fraud by verifying that the user attempting to create an account has a contactless card. Doing so further confirms that the contactless card is not fraudulent, since a fraudulent card would likely not be able to generate encrypted data that can be verified by the server. Furthermore, conventional approaches require the user to manually enter the account data into a form. However, doing so may allow other users or devices to capture the card data when the user enters the card data into a form. Eliminating the need for the user to manually enter the card data into a form enhances the security of the account data.

[0010]

[0013] Referring generally to the notation and nomenclature used herein, one or more portions of the following detailed descriptions may be presented in terms of program procedures executed on a computer or network of computers. These procedural descriptions and representations are used by those skilled in the art to most effectively convey the substance of their work to others skilled in the art. A procedure is herein generally conceived to be a self-consistent sequence of operations leading to a desired result. These operations are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical, magnetic, or optical signals capable of being stored, transferred, combined, compared, and otherwise manipulated. It proves convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like. It should be noted, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities.

[0011] Further, these operations are often referred to in terms, such as adding or comparing, which are commonly associated with mental operations performed by a human operator. However, no such capability of a human operator is necessary, or desirable in most cases, for any of the operations described herein that form part of one or more embodiments. Rather, these operations are machine operations. Useful machines for performing the operations of the various embodiments include digital computers selectively activated or configured by a computer program written in accordance with the teachings herein, and / or specially configured apparatus or digital computers for the required purposes. Various embodiments also relate to apparatus or systems for performing these operations. These apparatus may be specially constructed for the required purposes. The required structure for a variety of these machines will be apparent from the description given.

[0012] Reference is now made to the drawings, wherein like reference numerals are used to refer to like elements throughout. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding thereof. It will be apparent, however, that novel embodiments may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form to facilitate description. The intention is to cover all modifications, equivalents, and alternatives within the scope of the claims.

[0013] FIG. 1A illustrates a schematic diagram of an exemplary system 100 consistent with disclosed embodiments. As illustrated, the system 100 includes one or more contactless cards 101, one or more mobile devices 110, a server 120, and a third-party server 140. The contactless card 101 may represent any type of payment card, such as a credit card, a debit card, an ATM card, or a gift card. The contactless card 101 may include one or more chips (not shown), such as a radio frequency identification (RFID) chip, configured to communicate with the mobile device 110 via NFC, EMV, or other short-range protocols for wireless communication. While NFC is used as an exemplary communication protocol, the present disclosure is equally applicable to other types of wireless communication, such as EMV, Bluetooth, and / or Wi-Fi. The mobile device 110 may represent any type of network-enabled computing device, such as a smartphone, a tablet computer, a wearable device, a laptop, a portable gaming device, or the like. The servers 120 and 140 may represent any type of computing device, such as a server, a workstation, a computing cluster, a cloud computing platform, a virtualized computing system, or the like.

[0014] As shown, memory 111 of mobile device 110 includes an instance of operating system (OS) 112. Exemplary operating systems 112 include Android® OS, iOS®, Linux®, and Windows® operating systems. As shown, OS 112 includes account application 113 and one or more third-party applications 115. Account application 113 allows a user to perform various account-related operations, such as viewing account balances, purchasing items, and processing payments. In some embodiments, a user may authenticate using authentication credentials to access account application 113. For example, authentication credentials may include a username and password, biometric credentials, etc.

[0015] The third-party application 115 represents any type of payment application that allows a registered user to process transactions using a payment source added by the user. For example, a user may create an account with the third-party application 115 and register to add the contactless card 101 as a payment source. Doing so allows the user to make purchases using the third-party application 115 using the contactless card 101 (and / or an account associated with the contactless card 101) as a form of payment. Examples of third-party applications 115 include, but are not limited to, PayPal®, Venmo®, Apple® Pay, Samsung® Pay, Google® Pay, etc. Advantageously, embodiments disclosed herein provide secure techniques for creating an account with the third-party application 115 with the contactless card 101 as a payment source. A third-party server 140 may be associated with a given third-party application 115. The third-party server 140 generally includes a database of account data 144 for the user account. Account data 144 may include user biographical information, address information, payment information, account numbers, account expiration dates, CVVs, login credentials, and any other type of account and / or personal data for multiple users.

[0016] As shown, memory 102 of contactless card 101 includes applet 103, counter 104, master key 105, distributed keys 106, and a unique customer identifier (ID) 107. Customer ID 107 may uniquely identify a user and / or the user's account at the financial institution providing contactless card 101. Applet 103 may execute on a processor (not shown) of contactless card 101 to perform various functions described in more detail herein.

[0017] As shown, server 120 includes a data store of account data 124 and memory 122. The account data 124 includes account-related data for multiple users and / or accounts. The account data 124 may include at least a master key 105, a counter 104, a customer ID 107, an associated contactless card 101 (including an account number, expiration date, and CVV), an account holder name, an account billing address, one or more shipping addresses, one or more virtual card numbers, and biographical information for each account. Memory 122 includes a management application 123 and instances of counters 104, master keys 105, and distributed keys 106 for one or more accounts from the account data 124.

[0018] As described above, the contactless card 101 can be used, at least in part, to create an account in the account data 144 of the third-party server 140 using the third-party application 115. Generally, a user of the third-party application 115 can indicate that they want to use the contactless card 101 to create a new account. In doing so, the third-party application 115 outputs instructions indicating that the contactless card 101 should be tapped against the device 110. In doing so, the contactless card 101 comes within communication range of the card reader 118 of the mobile device 110, causing the applet 103 to generate an encrypted customer ID 109. The applet 103 can use any number of techniques to generate the encrypted customer ID 109 based on a cryptographic algorithm and the customer ID 107.

[0019] As described above, the system 100 is configured to implement key distribution to protect data, which may be referred to herein as key distribution technology. Generally, the server 120 (or another computing device) and the contactless card 101 may be provisioned with the same master key 105 (also referred to as a master symmetric key). More specifically, each contactless card 101 is programmed with a separate master key 105, which has a corresponding pair within the server 120. For example, when the contactless card 101 is manufactured, a unique master key 105 may be programmed into the memory 102 of the contactless card 101. Similarly, the unique master key 105 may be stored in the customer record associated with the contactless card 101 within the account data 124 of the server 120 (and / or may be stored in a different secure location, such as a hardware security module (HSM) 125). The master key 105 may be kept secret from all parties other than the contactless card 101 and the server 120, thereby enhancing the security of the system 100. In some embodiments, applet 103 of contactless card 101 can encrypt and / or decrypt data (e.g., customer ID 107) using master key 105 and the data as input to a cryptographic algorithm. For example, customer ID 107 can be encrypted with master key 105 to obtain encrypted customer ID 109. Similarly, authentication server 120 can encrypt and / or decrypt data associated with contactless card 101 using the corresponding master key 105.

[0020] In other embodiments, the master keys 105 of the contactless card 101 and the server 120 can be used in conjunction with the counter 104 to enhance security using key sharing. The counter 104 includes a value synchronized between the contactless card 101 and the server 120. The counter value 104 can include a number that changes each time data is exchanged between the contactless card 101 and the server 120 (and / or the contactless card 101 and the mobile device 110). When preparing to transmit data (e.g., to the server 120 and / or the mobile device 110), the contactless card 101 can increment the counter value 104. The contactless card 101 can then provide the master key 105 and the counter value 104 as inputs to a cryptographic algorithm, which generates the shared keys 106 as output. The cryptographic algorithm can include an encryption algorithm, a hash-based message authentication code (HMAC) algorithm, a cipher-based message authentication code (CMAC) algorithm, etc. Non-limiting examples of cryptographic algorithms may include symmetric cryptographic algorithms such as 3DES or AES128, symmetric HMAC algorithms such as HMAC-SHA-256, and symmetric CMAC algorithms such as AES-CMAC. Examples of key distribution techniques are described in more detail in U.S. Patent Application No. 16 / 205,119, filed November 29, 2018. The aforementioned patent application is incorporated herein by reference in its entirety.

[0021] Continuing with the key sharing example, the contactless card 101 can then use the key share 106 and the data as input to a cryptographic algorithm to encrypt the customer ID 107. For example, encrypting the customer ID 107 with the key share 106 can result in an encrypted customer ID 109.

[0022] Regardless of the encryption technique used to encrypt the customer ID 107, the contactless card 101 can transmit the encrypted customer ID 109 to the mobile device 110 (e.g., via an NFC connection, a Bluetooth connection, etc.). Once received, the mobile device 110 (e.g., the OS 112 and / or the third-party application 115) can transmit the encrypted customer ID 109 to the server 120 over the network 130. In one embodiment, the encrypted customer ID 109 is transmitted via a Hypertext Transfer Protocol Secure (HTTPS) Application Programming Interface (API) call to an API provided by the management application 123.

[0023] Upon receipt, the management application 123 can authenticate the encrypted customer ID 109. For example, the management application 123 can attempt to decrypt the encrypted customer ID 109 using a copy of the master key 105 stored in the memory 122 of the authentication server 120. In another example, the management application 123 can provide the master key 105 and the counter value 104 as inputs to a cryptographic algorithm, which can generate a key share 106 as output. The resulting key share 106 can correspond to the key share 106 of the contactless card 101, which can be used to decrypt the encrypted customer ID 109.

[0024] Regardless of the decryption technique used, the management application 123 can decrypt the encrypted customer ID 109 and thereby verify the encrypted customer ID 109 (e.g., by comparing the resulting customer ID 107 to the customer ID stored in the account data 124 and / or based on an indication that decryption using the keys 105 and / or 106 was successful). Although the keys 105, 106 are shown as being stored in the memory 122, the keys 105, 106 may be stored elsewhere, such as in the secure element and / or HSM 125. In such an embodiment, the secure element and / or HSM 125 can decrypt the encrypted customer ID 109 using the keys 105 and / or 106 and the encryption function. Similarly, the secure element and / or HSM 125 can generate the distributed keys 106 based on the master key 105 and the counter value 104, as described above.

[0025] However, if the management application 123 is unable to decrypt the encrypted customer ID 109 to obtain the expected result (e.g., the customer ID 107 for the account associated with the contactless card 101), the management application 123 does not verify the encrypted customer ID 109. In such an instance, the management application 123 sends an indication to the third party application 115 that the verification failed. Thus, the third party application 115 may refrain from creating the requested account to protect the security of the account associated with the contactless card 101. In general, the management application 123 may condition any action on whether the encrypted customer ID 109 was successfully decrypted.

[0026] FIG. 1B illustrates an embodiment in which management application 123 has verified encrypted customer ID 109. More specifically, as shown, in response to verifying (e.g., decrypting) encrypted customer ID 109, management application 123 sends push notification 150 to mobile device 110. Notification 150 may generally indicate that an attempted account creation using third-party application 115 needs to be verified. OS 112 may output notification 150 for display on the display of mobile device 110. A user may tap or otherwise select notification 150, which causes account application 113 to appear on mobile device 110. The user may then provide authentication credentials to access an account associated with contactless card 101. Once authenticated, account application 113 may request user verification (or confirmation) of the requested account creation. If the user declines to verify the requested account creation, account creation is restricted to protect security.

[0027] 1C illustrates an embodiment in which a user confirms the requested account creation via account application 113. Once the user confirms the requested account creation, account application 113 can send confirmation 151 to server 120. Confirmation 151 may be sent via an HTTPS API call to an API provided by management application 123.

[0028] 1D illustrates an embodiment in which management application 123 receives confirmation 151 from mobile device 110. As shown, management application 123 sends verification 153, including account data 154, to third party application 115. Verification 153 may generally indicate to third party application 115 that the account creation has been securely verified. Management application 123 may generally send verification 153 in response to receiving confirmation 151 and based on successful decryption of encrypted customer ID 109. While decryption of encrypted customer ID 109 was described with reference to FIGS. 1A / 1B, management application 123 may attempt to decrypt encrypted customer ID 109 at any time, such as after receiving confirmation 151.

[0029] The account data 154 provided by the management application 123 generally includes data describing a user and / or account associated with the contactless card 101. For example, the account data 154 may include the user's first name, the user's last name, the user's email address, the user's address, the contactless card 101 account number, the contactless card 101 expiration date, and the contactless card 101 card verification value (CVV). The account data 154 may include fewer or more data attributes, so embodiments are not limited in this context. For example, in some embodiments, to protect security, the account data 154 may include a virtual account number rather than the contactless card 101 account number. In such embodiments, the management application 123 may send the virtual account number if the third-party application 115 and / or the third-party server 140 does not tokenize the account number (e.g., the contactless card 101 account number). However, if the account number is tokenized by the third-party application 115 and / or the third-party server 140, the management application 123 may include the contactless card 101 account number.

[0030] Once received, the third-party application 115 can automatically enter (or populate) multiple form fields of the form output by the third-party application 115 with the account data 154. For example, a first name / last name may be entered into a first name / last name field of the form, an email address may be entered into an email address field of the form, portions of an address (e.g., street address, city, state, zip code) may be entered into one or more address fields of the form, an account number may be entered into an account number field of the form, an expiration date for the account number may be entered into an expiration date field of the form, and a CVV may be entered into a CVV field of the form. The user can then review and submit the form via the third-party application 115 to complete the creation of the account. In some embodiments, the user can modify the data in the form before submitting it. In some embodiments, the third-party application 115 can obfuscate or otherwise refrain from displaying one or more elements of the account data, such as the account number.

[0031] 1E illustrates an embodiment in which a user submits a form via a third-party application 115. As shown, the third-party application 115 can send instructions for a new account 155, including account data 154, to the third-party server 140. In some embodiments, the new account 155 is created by the third-party application 115. In other embodiments, the third-party application 115 sends a request to the third-party server 140 to create the new account 155, and the third-party server 140 creates the new account 155. Regardless of the entity that creates the new account 155, one or more records for the new account 155 using the account data 154 may be created in the account database 144 of the third-party server 140.

[0032] The user can then use the new account 155 to make purchases, transfer funds, conduct transactions, and perform other financial operations using the contactless card 101 (and / or the virtual account number of the contactless card 101) via the third-party application 115. Advantageously, embodiments disclosed herein enhance security by coordinating account creation via the third-party application 115 using the contactless card 101 based, at least in part, on verification of the encrypted customer ID 109, authentication of account credentials within the account application 113, and secure communications between entities of the system 100.

[0033] 2A is a schematic diagram 200 illustrating an example embodiment of account creation using a contactless card 101. A graphical user interface (GUI) of a third-party application 115 on a mobile device 110 provides a GUI element 201 that allows a user to create an account in the third-party application 115 using a contactless card 101. When a user selects the GUI 201, the third-party application 115 can output instructions 202 specifying the user to tap the contactless card 101 against the device 110, as shown in the schematic diagram 210 of FIG. 2B.

[0034] 2B, a user can tap contactless card 101 to device 110. When the user taps contactless card 101 to mobile device 110, applet 103 on contactless card 101 generates an encrypted customer ID 109. Applet 103 can then transmit the encrypted customer ID 109 to mobile device 110, for example, via NFC. Once received, third-party application 115 can send the encrypted customer ID 109 to management application 123, for example, via an HTTPS API call.

[0035] 2C illustrates a push notification 203 being output for display on the mobile device 110. As described above, the management application 123 may generate the push notification 203 in response to receiving and / or verifying the encrypted customer ID 109. The management application 123 may then send the push notification 203 to the mobile device 110. When the user selects the push notification 203, the account application 113 may open on the mobile device 110.

[0036] FIG. 2D is a schematic diagram 230 illustrating an embodiment in which a user selects push notification 203. As shown in FIG. 2D , account application 113 is opened on mobile device 110. Account application 113 typically notifies the user that an attempt to open an account using third-party application 115 has been detected. Account application 113 may provide GUI element 204 to allow the user to confirm (or verify) that the attempt is valid, e.g., initiated by the user associated with the account. As mentioned above, in some embodiments, the user may be required to provide authentication credentials to account application 113 before the GUI shown in FIG. 2D is output. If the user wishes to confirm, the user can select GUI element 204. Otherwise, the user can select GUI element 224, which restricts the creation of new accounts via third-party application 115. Account application 113 can send an indication of the selected GUI element 204, 224 to management application 123.

[0037] 2E is a schematic diagram 240 illustrating an embodiment in which a user selects a GUI element 204 to validate an attempted account creation via a third-party application 115. As described above, when a user selects a GUI element 204, the account application 113 can send an indication to the management application 123 that the user selected the GUI element 204. In doing so, the management application 123 sends verification to the third-party application 115 along with account data 154 associated with the contactless card 101. As described above, the account data 154 can include the user's first name, the user's last name, the user's email address, the user's address, the account number of the contactless card 101, the expiration date of the contactless card 101, and the card verification value (CVV) of the contactless card 101. In some embodiments, a virtual account number, the expiration date of the virtual account number, and the CVV of the virtual account number can be included instead of the account number, expiration date, and CVV of the contactless card 101.

[0038] As shown, the third-party application 115 may include form fields 205-209 and 211. The third-party application 115 automatically populates form fields 205-209 and 211 with account data 154 received from the management application 123. For example, as shown, first name field 205 has been populated with a first name, last name field 206 has been populated with a last name, email address field 207 has been populated with an email address, street address field 208 has been populated with a street address, and address information field 209 has been populated with additional address information. The specific values ​​shown in FIG. 2E are exemplary and should not be considered limiting of the present disclosure. In some embodiments, a user can optionally modify the values ​​entered in form fields 205-209 and 211. The user can then select the next button 212 to continue.

[0039] FIG. 2F is a schematic diagram 250 illustrating an embodiment in which a user has selected the Next button 212 of FIG. 2E. As shown, the third-party application 115 outputs form fields 213-215. The third-party application 115 enters a card number in card number field 213, an expiration date in expiration date field 214, and a CVV in CVV field 215. While shown as part of separate forms, in one embodiment, form fields 205-209, 211, and 213-215 may be part of a single form. As mentioned above, the account number may be the primary account number or virtual account number of the contactless card 101. The user may then select the Next button 216 to continue with account creation.

[0040] 2G is a schematic diagram 260 illustrating an embodiment in which a user selects the Next button 216 of FIG. 2F to complete account setup using the third-party application 115. As shown, the third-party application 115 indicates that the account was successfully created. The user can then use the third-party application 115 to make purchases, process payments, etc. using the contactless card 101 (and / or the virtual number generated for the contactless card 101).

[0041] FIG. 3A illustrates a contactless card 101, which may include a payment card such as a credit card, debit card, and / or gift card. As shown, the contactless card 101 may be issued by a service provider 305, which may display the card on the front or back of the card 101. In some examples, the contactless card 101 may be unrelated to a payment card and may include, but is not limited to, an identification card. In some examples, the payment card may include a dual-interface contactless payment card. The contactless card 101 may include a substrate 310, which may include a single layer or one or more laminates composed of plastic, metal, and other materials. Exemplary substrate materials include polyvinyl chloride, polyvinyl chloride acetate, acrylonitrile butadiene styrene, polycarbonate, polyester, anodized titanium, palladium, gold, carbon, paper, and biodegradable materials. In some examples, the contactless card 101 may have physical characteristics conforming to the ID-1 format of the ISO / IEC 7810 standard; otherwise, the contactless card may conform to the ISO / IEC 14443 standard. However, it is understood that contactless cards 101 according to the present disclosure may have different characteristics, and the present disclosure does not require that the contactless card be implemented as a payment card.

[0042] The contactless card 101 may also include identification information 315 displayed on the front and / or back of the card and a contact pad 320. The contact pad 320 may be configured to establish contact with another communication device, such as the mobile device 30, a user device, a smartphone, a laptop, a desktop, or a tablet computer. The contactless card 101 may also include processing circuitry, an antenna, and other components not shown in FIG. 3A . These components may be located behind the contact pad 320 or elsewhere on the substrate 310. The contactless card 101 may also include a magnetic strip or tape that may be located on the back of the card (not shown in FIG. 3A ).

[0043] 3B, contact pad 320 of contactless card 101 may include processing circuitry 325 for storing and processing information, including microprocessor 330 and memory 102. It is understood that processing circuitry 325 may include additional components, including processors, memory, error and parity / CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives, and tamper-proof hardware, as needed to perform the functions described herein.

[0044] The memory 102 may be read-only memory, write-once read-multiple memory, or read / write memory, such as RAM, ROM, and EEPROM, and the contactless card 101 may include one or more of these memories. Read-only memory may be factory programmable as read-only or one-time programmable. One-time programmability provides the opportunity to write once and then read multiple times. Write-once read-multiple memory may be programmed at a time after the memory chip leaves the factory. Once the memory is programmed, it cannot be rewritten but can be read multiple times. Read / write memory may be programmed and reprogrammed multiple times after leaving the factory. Read / write memory may also be read multiple times after leaving the factory.

[0045] The memory 102 can be configured to store one or more applets 103, a counter 104, a master key 105, a distributed key 106, and one or more customer (or user) IDs 107. The one or more applets 103 may include one or more software applications configured to run on one or more contactless cards, such as a Java Card applet. However, it is understood that the applet 103 is not limited to a Java Card applet and may instead be any software application capable of operating on a contactless card or other device with limited memory. The customer ID 107 can include a unique alphanumeric identifier assigned to a user of the contactless card 101, which can distinguish the contactless card user from other contactless card users. In some examples, the customer ID 107 can identify both the customer and the account assigned to that customer, and can further identify the contactless card 101 associated with the customer's account. In some embodiments, applet 103 can use customer ID 107 as input to a cryptographic algorithm with keys 105 and / or 106 to generate encrypted customer ID 109 .

[0046] While the processor and memory elements of the above exemplary embodiments are described with reference to contact pads, the present disclosure is not limited thereto, and it is understood that these elements may be implemented outside of the pads 320, may be completely separate from the pads, or may be implemented as additional elements in addition to the processor 330 and memory 102 elements disposed within the contact pads 320.

[0047] In some examples, the contactless card 101 may include one or more antennas 355. The one or more antennas 355 may be disposed within the contactless card 101 and around the processing circuit 325 of the contact pad 320. For example, the one or more antennas 355 may be integral with the processing circuit 325, or the one or more antennas 355 may be used with an external booster coil. As another example, the one or more antennas 355 may be external to the contact pad 320 and the processing circuit 325.

[0048] In one embodiment, the coil of the contactless card 101 can function as the secondary of an air-core transformer. The terminal can communicate with the contactless card 101 by disconnecting power or amplitude modulation. The contactless card 101 can infer data transmitted from the terminal using a gap in the contactless card's power connection, which can be maintained functionally via one or more capacitors. The contactless card 101 can return communication by switching the load or load modulation of the contactless card's coil. Load modulation can be detected by interference in the terminal's coil. More generally, using the antenna 355, processing circuitry 325, and / or memory 102, the contactless card 101 provides a communication interface for communicating via NFC, Bluetooth, and / or Wi-Fi communications.

[0049] As described above, the contactless card 101 can be built on a software platform capable of running on a smart card or other device with limited memory, such as a JavaCard, and can securely execute one or more applications or applets. An applet can be added to the contactless card to provide one-time passwords (OTPs) for multi-factor authentication (MFA) in various mobile app-based use cases. The applet can be configured to respond to one or more requests, such as a near-field wireless data exchange request, from a reader, such as a mobile NFC reader (e.g., card reader 118 of device 110), and generate an NDEF message containing a cryptographically secure OTP encoded as an NDEF text tag.

[0050] The operation of the disclosed embodiments can be further described with reference to the following figures. Some of the figures may include logic flows. While such diagrams presented herein may include specific logic flows, it will be understood that the logic flows merely provide examples of how the general functionality described herein may be implemented. Furthermore, unless otherwise indicated, a given logic flow does not necessarily have to be executed in the order presented. Furthermore, a given logic flow may be implemented by a hardware element, a software element executed by a processor, or any combination thereof. The embodiments are not limited in this context.

[0051] 4 illustrates an embodiment of a logic flow 400. The logic flow 400 may represent some or all of the operations performed by one or more embodiments described herein. For example, the logic flow 400 may include some or all of the operations for securely creating an account with a third-party application 115 using a contactless card 101. The embodiments are not limited in this context.

[0052] As shown, the logic flow 400 begins at block 405, where the third-party application 115 receives an instruction indicating to create a payment account using the contactless card 101. For example, a user may select GUI element 201 of FIG. 2A indicating to create an account in the third-party application 115 using the contactless card 101. At block 410, the user may tap the contactless card 101 against the device 110, causing the contactless card 101 to generate and transmit encrypted data (e.g., an encrypted customer ID 109). The user may tap the contactless card 101 in response to a notification output by the third-party application 115 indicating to tap the contactless card 101 against the device 110. At block 415, the applet 103 may generate the encrypted customer ID 109. The applet 103 may transmit the encrypted customer ID 109 to the mobile device 110 at block 420.

[0053] At block 425, the mobile device 110 (e.g., the OS 112 and / or the third party application 115) may send the encrypted customer ID 109 to the management application 123 of the server 120. The third party application 115 may further send instructions specifying that the encrypted customer ID 109 is part of an attempt to create an account with the third party application 115. At block 430, the mobile device 110 may receive a push notification from the management application 123. As described above, in some embodiments, the management application 123 may decrypt the encrypted customer ID 109 before sending the push notification to the mobile device 110. At block 435, in response to the user selecting the push notification, the account application 113 is opened. As described above, in some embodiments, the user may provide credentials to access their account via the account application 113. The account application 113 may then request input confirming whether the attempted account creation via the third party application 115 is valid.

[0054] At block 440, the third party application 115 may receive input indicating that the attempted account creation is valid. For example, the user may select GUI element 204 in FIG. 2D . At block 445, the third party application 115 may send a confirmation instruction to the management application 123. At block 450, the OS 112, the account application 113, and / or the third party application 115 may receive an instruction from the management application 123 indicating that the encrypted customer ID 109 has been verified and the account creation has been approved. As described above, the management application 123 may decrypt the encrypted customer ID 109 in response to initial receipt of the encrypted customer ID 109 (e.g., at block 425) and / or at a different time. For example, the management application 123 may decrypt the encrypted customer ID 109 in response to receiving the confirmation at block 450. Further, the verification may include account data 154 for the user account associated with the contactless card 101.

[0055] At block 455, the third party application 115 is opened (if not already presented on the display of the mobile device 110). At block 460, the third party application 115 enters the account data 154 received from the management application 123 into a number of form fields. The user can optionally edit the information automatically entered into the form fields by the third party application 115. At block 465, the third party application 115 creates an account for the user using the account data 154 received from the management application 123. For example, the third party application 115 can have a record for the new account created in the account data 144 of the third party server 140.

[0056] 5 illustrates an embodiment of a logic flow 500. The logic flow 500 may represent some or all of the operations performed by one or more embodiments described herein. For example, the logic flow 500 may include some or all of the operations for securely and automatically populating a form with data associated with a contactless card 101. The embodiments are not limited in this context.

[0057] As shown, logic flow 500 begins at block 510, where third party application 115 receives account data 154 from management application 123. At block 520, third party application 115 enters the first name received in account data 154 into a first name field of a form. At block 530, third party application 115 enters the last name in the received account data 154 into a last name field of the form. At block 535, third party application 115 enters the email address in the received account data 154 into an email address field of the form. At block 540, third party application 115 enters the address in the received account data 154 into an address field of the form.

[0058] At block 550, the third party application 115 enters the account number from the received account data 154 into the account number field of the form. The account number may be the account number of the contactless card 101 and / or a virtual account number generated by the server 120. At block 560, the third party application 115 enters the expiration date from the received account data 154 into the expiration date field of the form. The expiration date may be for the contactless card 101 and / or the virtual account number. At block 570, the third party application 115 enters the CVV from the received account data 154 into the CVV field of the form. The CVV may be for the contactless card 101 and / or the virtual account number.

[0059] In some examples, the present disclosure refers to tapping a contactless card, however, it is understood that the present disclosure is not limited to tapping and includes other gestures (e.g., shaking the card or other movements).

[0060] 6 illustrates an embodiment of an exemplary computing architecture 600 including a computing system 602 that may be suitable for implementing various embodiments as described above. In various embodiments, computing architecture 600 may include or be implemented as part of an electronic device. In some embodiments, computing architecture 600 may represent, for example, a system that implements one or more components of system 100. In some embodiments, computing system 602 may represent, for example, mobile device 110 and server 120 of system 100. The embodiments are not limited in this context. More generally, computing architecture 600 is configured to implement all logic, applications, systems, methods, apparatus, and functions described herein with reference to FIGS. 1-5.

[0061] As used herein, the terms “system,” “component,” and “module” are intended to refer to any computer-related entity: hardware, a combination of hardware and software, software, or software in execution, an example of which is provided by exemplary computing architecture 600. For example, a component may be, but is not limited to, a process running on a computer processor, a computer processor, a hard disk drive, multiple storage drives (optical and / or magnetic storage media), an object, an executable file, a thread of execution, a program, and / or a computer. By way of example, both an application running on a server and the server may be a component. One or more components may reside within a process and / or thread of execution, and components may be localized on one computer and / or distributed among two or more computers. Furthermore, components may be communicatively coupled to each other by various types of communication media to coordinate operations. Coordination may include unidirectional or bidirectional exchange of information. For example, components may communicate information in the form of signals communicated over the communication media. Information may be implemented as signals assigned to various signal lines. In such assignments, each message is a signal. However, further embodiments may alternatively use data messages. Such data messages may be transmitted over a variety of connections, example connections including parallel interfaces, serial interfaces, and bus interfaces.

[0062] Computing system 602 includes various typical computing elements, such as one or more processors, multi-core processors, co-processors, memory units, chipsets, controllers, peripherals, interfaces, oscillators, timing devices, video cards, audio cards, multimedia input / output (I / O) components, power supplies, etc. However, embodiments are not limited to implementation by computing system 602.

[0063] 6, computing system 602 includes a processor 604, a system memory 606, and a system bus 608. Processor 604 can be any of a variety of commercially available computer processors, including, but not limited to, AMD® Athlon®, Duron®, and Opteron® processors, ARM® application, embedded, and secure processors, IBM® and Motorola® DragonBall® and PowerPC® processors, IBM and Sony® Cell processors, Intel® Celeron®, Core®, Core(2) Duo®, Itanium®, Pentium®, Xeon®, and XScale® processors, and similar processors. Dual microprocessors, multi-core processors, and other multi-processor architectures can also be employed as processor 604.

[0064] The system bus 608 provides the processor 604 with an interface for system components, including, but not limited to, the system memory 606. The system bus 608 can be any of several types of bus structures that can be further interconnected to a memory bus (with or without a memory controller), a peripheral bus, and a local bus using any of a variety of commercially available bus architectures. Interface adapters can be connected to the system bus 608 via a slot architecture. Exemplary slot architectures can include, but are not limited to, Accelerated Graphics Port (AGP), CardBus, (Extended) Industry Standard Architecture ((E)ISA), Micro Channel Architecture (MCA), NuBus, Peripheral Component Interconnect (Expansion) (PCI(X)), PCI Express, Personal Computer Memory Card International Association (PCMCIA), etc.

[0065] The system memory 606 may be any memory type, including read only memory (ROM), random access memory (RAM), dynamic RAM (DRAM), double data rate DRAM (DDRAM), synchronous DRAM (SDRAM), static RAM (SRAM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory (e.g., one or more flash arrays), polymer memory such as ferroelectric polymer memory, ovonic memory, phase change or ferroelectric memory, silicon-oxide-nitride-oxide-silicon (SON), and the like. The system memory 606 may include various types of computer-readable storage media in the form of one or more high-speed memory units, such as non-volatile memory 610 and / or volatile memory 612. The system memory 606 may include various types of computer-readable storage media, such as non-volatile memory (OS) memory, magnetic or optical cards, arrays of devices such as redundant array of independent disks (RAID) drives, solid-state memory devices (e.g., USB memory, solid-state drives (SSDs), and any other type of storage medium suitable for storing information. In the exemplary embodiment shown in FIG. 6, the system memory 606 may include non-volatile memory 610 and / or volatile memory 612. A basic input / output system (BIOS) may be stored in the non-volatile memory 610.

[0066] Computing system 602 may include various types of computer-readable storage media in the form of one or more low-speed memory units, including an internal (or external) hard disk drive (HDD) 614, a magnetic floppy disk drive (FDD) 616 that reads from and writes to a removable magnetic disk 618, and an optical disk drive 620 that reads from and writes to a removable optical disk 622 (e.g., a CD-ROM or DVD). HDD 614, FDD 616, and optical disk drive 620 may be connected to system bus 608 by HDD interface 624, FDD interface 626, and optical drive interface 628, respectively. HDD interface 624 for external drive implementations may include at least one or both of Universal Serial Bus (USB) and IEEE 1394 interface technologies. Computing system 602 is generally configured to implement all of the logic, systems, methods, apparatus, and functions described herein with reference to FIGS. 1-5.

[0067] The drives and associated computer-readable media provide volatile and / or nonvolatile storage of data, data structures, computer-executable instructions, etc. A number of program modules may be stored on the drives and memory units 610, 612, including, for example, an operating system 630, one or more application programs 632, other program modules 634, and program data 636. In one embodiment, the one or more application programs 632, other program modules 634, and program data 636 may include, for example, various applications and / or components of system 100, such as operating system 112, account application 113, third-party application 115, third-party server 140, account data 124, account data 144, and management application 123.

[0068] A user can enter commands and information into the computing system 602 through one or more wired / wireless input devices, such as a keyboard 638 and a pointing device such as a mouse 640. Other input devices can include a microphone, an infrared (IR) remote control, a radio frequency (RF) remote control, a game pad, a stylus pen, a card reader, a dongle, a fingerprint reader, gloves, a graphics tablet, a joystick, a keyboard, a retina reader, a touch screen (e.g., capacitive, resistive, etc.), a trackball, a trackpad, a sensor, a stylus, etc. These and other input devices are often connected to the processor 604 through an input device interface 642 coupled to the system bus 608, but can be connected by other interfaces, such as a parallel port, an IEEE 1394 serial port, a game port, a USB port, an IR interface, etc.

[0069] A monitor 644 or other type of display device is also connected to the system bus 608 via an interface, such as a video adapter 646. The monitor 644 may be internal or external to the computing system 602. In addition to the monitor 644, computers typically include other peripheral output devices, such as speakers, printers, etc.

[0070] Computing system 602 can operate in a networked environment using logical connections via wired and / or wireless communications to one or more remote computers, such as remote computer 648. Remote computer 648 can be a workstation, a server computer, a router, a personal computer, a portable computer, a microprocessor-based entertainment appliance, a peer device, or other common network node and typically includes many or all of the elements described relative to computing system 602, although for simplicity, only memory / storage device 650 is shown. The logical connections shown include wired / wireless connections to a local area network (LAN) 652 and / or larger networks, e.g., a wide area network (WAN) 654. Such LAN and WAN networking environments are commonplace in offices and businesses and facilitate enterprise-wide computer networks, such as intranets, all of which can connect to a global communications network, e.g., the Internet. In an embodiment, network 130 of FIG. 1 is one or more of LAN 652 and WAN 654.

[0071] When used in a LAN networking environment, the computing system 602 is connected to the LAN 652 through a wired and / or wireless communication network interface or adapter 656. The adapter 656 can facilitate wired and / or wireless communication to the LAN 652, which can also include a wireless access point disposed thereon for communicating with the wireless capabilities of the adapter 656.

[0072] When used in a WAN networking environment, the computing system 602 may include a modem 658, or be connected to a communications server on the WAN 654, or have other means for establishing communications over the WAN 654, such as via the Internet. The modem 658, which may be internal or external and a wired and / or wireless device, connects to the system bus 608 via the input device interface 642. In a networked environment, program modules depicted relative to the computing system 602, or portions thereof, may be stored in a remote memory / storage device 650. It will be appreciated that the network connections shown are exemplary and other means of establishing a communications link between computers may be used.

[0073] The computing system 602 is operable to communicate with wired and wireless devices or entities using the IEEE 802 family of standards, such as wireless devices operatively arranged for wireless communication (e.g., IEEE 802.16 wireless modulation technology). This includes at least Wi-Fi (or Wireless Fidelity), WiMax, and Bluetooth™ wireless technologies, among others. Thus, communication can be in a predefined structure, similar to a traditional network, or simply ad hoc communication between at least two devices. Wi-Fi networks use radio technologies called IEEE 802.11x (a, b, g, n, etc.) to provide secure, reliable, and high-speed wireless connectivity. Wi-Fi networks can be used to connect computers to each other, to the Internet, and to wired networks (which use IEEE 802.3-related media and functions).

[0074] Various embodiments may be implemented using hardware elements, software elements, or a combination of both. Examples of hardware elements may include a processor, a microprocessor, a circuit, a circuit element (e.g., a transistor, a resistor, a capacitor, an inductor, etc.), an integrated circuit, an application specific integrated circuit (ASIC), a programmable logic device (PLD), a digital signal processor (DSP), a field programmable gate array (FPGA), a logic gate, a register, a semiconductor device, a chip, a microchip, a chipset, etc. Examples of software may include a software component, a program, an application, a computer program, an application program, a system program, a machine program, an operating system software, a middleware, a firmware, a software module, a routine, a subroutine, a function, a method, a procedure, a software interface, an application program interface (API), an instruction set, computing code, computer code, a code segment, a computer code segment, a word, a value, a symbol, or any combination thereof. The decision whether an embodiment is implemented using hardware and / or software elements may vary according to any number of factors, such as desired computational speed, power level, thermal tolerance, processing cycle budget, input data rate, output data rate, memory resources, data bus speed, and other design or performance constraints.

[0075] One or more aspects of at least one embodiment may be implemented by representative instructions stored on a machine-readable medium that represent various logic within a processor, which, when read by a machine, causes the machine to create logic for performing the techniques described herein. Such representations, known as “IP cores,” may be stored on tangible machine-readable media and supplied to various customers or manufacturing facilities for loading into manufacturing machines that create the logic or processors. Some embodiments may be implemented using, for example, a machine-readable medium or article that may store instructions or sets of instructions that, when executed by the machine, cause the machine to perform methods and / or operations according to the embodiments. Such a machine may include, for example, any suitable processing platform, computing platform, computing device, processing device, computing system, processing system, computer, processor, etc., and may be implemented using any suitable combination of hardware and / or software. A machine-readable medium or article may include, for example, any suitable type of memory unit, memory device, memory article, memory medium, storage device, storage article, storage medium, and / or storage unit, e.g., memory, removable or non-removable medium, erasable or non-erasable medium, writable or rewritable medium, digital or analog medium, hard disk, floppy disk, compact disk read-only memory (CD-ROM), recordable compact disk (CD-R), rewritable compact disk (CD-RW), optical disk, magnetic medium, magneto-optical medium, removable memory card or disk, various types of digital versatile disks (DVD), tape, cassette, etc. The instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, encrypted code, etc., implemented using any suitable high-level, low-level, object-oriented, visual, compiled and / or interpreted programming language.

[0076] The foregoing description of exemplary embodiments has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the disclosure to the precise form disclosed. Many modifications and variations are possible in light of this disclosure. It is intended that the scope of the disclosure be limited not by this detailed description, but rather by the appended claims. Future applications claiming priority to this application may claim the disclosed subject matter in a different manner and may generally include any set of one or more limitations variously disclosed or otherwise demonstrated herein.

Claims

1. 1. A system comprising: a processor; and a memory storing instructions that, when executed by the processor, cause the processor to: receiving, by a payment application executing on said processor, instructions specifying the use of a contactless card to create a payment account with said payment application; outputting instructions by the payment application explicitly indicating to tap the contactless card to the system; receiving encrypted data from a communication interface of the contactless card, the encrypted data being based on a customer identifier and a private key associated with the contactless card; In response to receiving the encrypted data, transmitting the encrypted data to a server associated with the contactless card; receiving a push notification from the server; In response to receiving a selection of the push notification, opening an account application associated with the contactless card; receiving, by the account application, a confirmation input indicating that the contactless card should be used to create the payment account in the payment application; sending, by the account application, an instruction to input the confirmation to the server; opening the payment application in response to the payment application receiving verification of the encrypted data from the server; inputting, by the payment application, account data received from the server into a plurality of form fields of a form displayed by the payment application, the account data being account data for an account associated with the contactless card; generating, by the payment application, the payment account using the account data received from the server and entered into the plurality of form fields.

2. The memory stores instructions that, when executed by the processor, cause the processor to: submitting, by the payment application, the form with the account data entered into the plurality of form fields to a payment application account server; receiving, by the payment application, an indication from the payment application account server indicating that a record for the payment account has been created and stored in a payment application account database.

3. 2. The system of claim 1, wherein the received account data for the account includes (i) first name, (ii) last name, (iii) email address, (iv) address, (v) account number of the contactless card, (vi) expiration date of the contactless card, and (vii) card verification value (CVV) of the contactless card.

4. The memory stores instructions that, when executed by the processor, cause the processor to: entering, via the payment application, the name into a name form field of the plurality of form fields; entering, via the payment application, the last name into a last name form field of the plurality of form fields; entering, via the payment application, the email address into an email address form field of the plurality of form fields; entering, via the payment application, the address into an address form field of the plurality of form fields; entering, via the payment application, the account number into an account number form field of the plurality of form fields; entering, by the payment application, the expiration date into an expiration date form field of the plurality of form fields; and inputting the CVV into a CVV form field of the plurality of form fields by the payment application.

5. the received account data for the account includes a virtual account number generated for the account associated with the contactless card, an expiration date for the virtual account number, and a card verification value (CVV) for the virtual account number, and the memory storing instructions that, when executed by the processor, cause the processor to: entering, via the payment application, the virtual account number into an account number form field of the plurality of form fields; entering, by the payment application, the expiration date into an expiration date form field of the plurality of form fields; and inputting the CVV into a CVV form field of the plurality of form fields by the payment application.

6. The encrypted data is sent via a Hypertext Transfer Protocol Secure (HTTPS) Application Programming Interface (API) call to an API of the server associated with the contactless card, the memory storing instructions that, when executed by the processor, cause the processor to: The system of claim 1 , further comprising receiving, by the payment application, input indicating submission of the form to create the payment account.

7. 10. The system of claim 1, wherein the encrypted data is received from the contactless card upon the contactless card coming within communication range of a card reader of the system.

8. A non-transitory computer-readable storage medium storing computer-readable program code executable by a processor, the computer-readable program code causing the processor to: receiving, by a payment application executing on said processor, instructions specifying the use of a contactless card to create a payment account with said payment application; outputting instructions by the payment application indicating to tap the contactless card against a device including the processor; receiving encrypted data from a communication interface of the contactless card, the encrypted data being based on a customer identifier and a private key associated with the contactless card; In response to receiving the encrypted data, transmitting the encrypted data to a server associated with the contactless card; receiving a push notification from the server; In response to receiving a selection of the push notification, opening an account application associated with the contactless card; receiving, by the account application, a confirmation input indicating that the contactless card should be used to create the payment account in the payment application; sending, by the account application, an instruction to input the confirmation to the server; opening the payment application in response to the payment application receiving verification of the encrypted data from the server; inputting, by the payment application, account data received from the server into a plurality of form fields of a form displayed on the payment application, wherein the account data is account data for an account associated with the contactless card; and generating, by the payment application, the payment account using the account data received from the server and entered into the plurality of form fields.

9. storing computer-readable program code executable by the processor, the computer-readable program code causing the processor to: submitting, by the payment application, the form with the account data entered into the plurality of form fields to a payment application account server; and receiving, by the payment application, an indication from the payment application account server indicating that a record for the payment account has been created and stored in a payment application account database.

10. 9. The non-transitory computer-readable storage medium of claim 8, wherein the received account data for the account includes (i) a first name, (ii) a last name, (iii) an email address, (iv) an address, (v) an account number for the contactless card, (vi) an expiration date for the contactless card, and (vii) a card verification value (CVV) for the contactless card.

11. storing computer-readable program code executable by the processor, the computer-readable program code causing the processor to: entering, via the payment application, the name into a name form field of the plurality of form fields; entering, via the payment application, the last name into a last name form field of the plurality of form fields; entering, via the payment application, the email address into an email address form field of the plurality of form fields; entering, via the payment application, the address into an address form field of the plurality of form fields; entering, via the payment application, the account number into an account number form field of the plurality of form fields; entering, by the payment application, the expiration date into an expiration date form field of the plurality of form fields; and inputting, by the payment application, the CVV into a CVV form field of the plurality of form fields.

12. the received account data for the account includes a virtual account number generated for the account associated with the contactless card, an expiration date for the virtual account number, and a card verification value (CVV) for the virtual account number, the medium storing computer readable program code executable by the processor, the computer readable program code causing the processor to: entering, via the payment application, the virtual account number into an account number form field of the plurality of form fields; entering, by the payment application, the expiration date into an expiration date form field of the plurality of form fields; and inputting, by the payment application, the CVV into a CVV form field of the plurality of form fields.

13. The encrypted data is transmitted via a HyperText Transfer Protocol Secure (HTTPS) Application Programming Interface (API) call to an API of the server associated with the contactless card, the medium storing computer readable program code executable by the processor, the computer readable program code causing the processor to:

10. The non-transitory computer-readable storage medium of claim 8, further comprising causing the payment application to receive input indicating submission of the form to create the payment account.

14. The non-transitory computer-readable storage medium of claim 8 , wherein the encrypted data is received from the contactless card upon the contactless card coming within communication range of a card reader of the device.

15. 1. A method comprising: receiving, by a payment application executing on a processor of the device, instructions specifying the use of the contactless card to create a payment account with said payment application; outputting, by the payment application, explicit instructions to tap the contactless card against the device; receiving encrypted data from a communication interface of the contactless card, the encrypted data being based on a customer identifier and a private key associated with the contactless card; In response to receiving the encrypted data, transmitting the encrypted data to a server associated with the contactless card; receiving a push notification from the server; In response to receiving a selection of the push notification, opening an account application associated with the contactless card; receiving, by the account application, a confirmation input indicating that the contactless card should be used to create the payment account in the payment application; sending, by the account application, an instruction to input the confirmation to the server; opening the payment application in response to the payment application receiving verification of the encrypted data from the server; inputting, by the payment application, account data received from the server into a plurality of form fields of a form displayed by the payment application, the account data being account data for an account associated with the contactless card; and generating, by the payment application, the payment account using the account data received from the server and entered into the plurality of form fields.

16. submitting, by the payment application, the form with the account data entered into the plurality of form fields to a payment application account server; receiving, by the payment application, an indication from the payment application account server indicating that a record for the payment account has been created and stored in a payment account database; 16. The method of claim 15.

17. 16. The method of claim 15, wherein the received account data for the account includes (i) first name, (ii) last name, (iii) email address, (iv) address, (v) account number of the contactless card, (vi) expiration date of the contactless card, and (vii) card verification value (CVV) of the contactless card.

18. entering, via the payment application, the name into a name form field of the plurality of form fields; entering, via the payment application, the last name into a last name form field of the plurality of form fields; entering, via the payment application, the email address into an email address form field of the plurality of form fields; entering, via the payment application, the address into an address form field of the plurality of form fields; entering, via the payment application, the account number into an account number form field of the plurality of form fields; entering, by the payment application, the expiration date into an expiration date form field of the plurality of form fields; entering, by the payment application, the CVV into a CVV form field of the plurality of form fields.

18. The method of claim 17.

19. wherein the received account data for the account includes a virtual account number generated for the account associated with the contactless card, an expiration date for the virtual account number, and a card verification value (CVV) for the virtual account number, and the method further comprises: entering, via the payment application, the virtual account number into an account number form field of the plurality of form fields; entering, by the payment application, the expiration date into an expiration date form field of the plurality of form fields; 16. The method of claim 15, further comprising: entering, by the payment application, the CVV into a CVV form field of the plurality of form fields.

20. The encrypted data is sent via a Hypertext Transfer Protocol Secure (HTTPS) Application Programming Interface (API) call to an API of the server associated with the contactless card, and the encrypted data is received from the contactless card upon the contactless card coming within communication range of a card reader of the device, the method comprising:

16. The method of claim 15, further comprising receiving, by the payment application, input indicating to submit the form to create the payment account.

Images