How to publish your review on a review platform

Abstract

To provide systems, methods, articles of manufacture, and computer-readable media for verified reviews using a contactless card.SOLUTION: In a system 100, an application 113 may receive an indication to generate a review. An API 114 may receive, from a communications interface of a contactless card, encrypted data generated by the contactless card, transmit, to an authentication server, the encrypted data, an indication of the application, and an identifier associated with an entity, and receive indications specifying that the authentication server decrypted the encrypted data and determined that the contactless card was used to make a purchase with the entity. The application 113 may permit, based on the indications received from the authentication server, generation of the review, and publish the review to one or more review platforms associated with the application.SELECTED DRAWING: Figure 1A

Description

[Technical field]

[0001] FIELD OF THE DISCLOSURE Embodiments herein relate generally to computing platforms, and more specifically to providing verified reviews using contactless cards.

[0002] Related Applications This application claims priority to U.S. patent application Ser. No. 16 / 514,094, entitled "Verified Reviews Using Contactless Cards," filed July 17, 2019, the contents of which are incorporated herein by reference in their entirety. [Background technology]

[0003] Users often write reviews of products, services, restaurants, etc. Such reviews are often a valuable source of user sentiment that can be used to improve the quality of the related offering. However, due to the impact that positive reviews have on sales, fake reviews are often posted to boost sales. Similarly, fake reviews may be posted to negatively impact competitors' sales. Thus, users often cannot trust reviews because of the uncertainty of whether the reviews are written by someone who has eaten at the restaurant or by someone who has used the product or service. Summary of the Invention

[0004] The embodiments disclosed herein provide a system, method, article of manufacture, and computer-readable medium for providing verified reviews using a contactless card. According to one example, an application may receive instructions specifying to generate a review of an entity comprising one or more merchants and service providers. The application may output instructions specifying to tap the contactless card to a device. An application programming interface (API) of the application may receive encrypted data generated by the contactless card using an encryption algorithm, a customer identifier, and a private key stored in the memory of the contactless card from a communication interface of the contactless card. The application's API may transmit (i) the encrypted data, (ii) instructions of the application, and (iii) an entity identifier associated with the entity to an authentication server associated with the contactless card. The application's API may receive instructions from the authentication server specifying that the authentication server (i) decrypted the encrypted data using a copy of the private key stored by the server to generate a customer identifier, and (ii) determined that the contactless card was used to make a purchase at the entity based at least in part on the entity identifier and the decrypted customer identifier. The application may authorize the generation of the review based on the instructions received from the authentication server. The application may publish reviews to one or more review platforms associated with the application.

[0005] According to another example, the authentication server may receive an instruction from a review application specifying to generate a review of an entity comprising one or more merchants and service providers. The authentication server may receive from an application programming interface (API) of the review application the encrypted data received by the review application from the contactless card and an entity identifier associated with the entity, the encrypted data based on an encryption algorithm, a customer identifier, and a private key. The authentication server may decrypt the encrypted data using a copy of the private key stored by the server to generate a customer identifier. The authentication server may determine that the contactless card was used to make a purchase at the entity based at least in part on the entity identifier and the decrypted customer identifier. The authentication server may send authorization to the application to generate the review and receive the review from the application. The authentication server may then publish the review to one or more review platforms associated with the application. [Brief description of the drawings]

[0006] [Figure 1A] 1 illustrates an embodiment of a system for providing verified reviews using contactless cards. [Figure 1B] 1 illustrates an embodiment of a system for providing verified reviews using contactless cards. [Figure 2A] 1 illustrates an embodiment that uses contactless cards to provide verified reviews. [Figure 2B] 1 illustrates an embodiment that uses contactless cards to provide verified reviews. [Figure 2C] 1 illustrates an embodiment that uses contactless cards to provide verified reviews. [Figure 3A] 1 illustrates an embodiment that uses contactless cards to provide verified reviews. [Figure 3B]1 illustrates an embodiment that uses contactless cards to provide verified reviews. [Figure 4] 1 illustrates an embodiment of a first logic flow. [Diagram 5] 1 illustrates a second logic flow embodiment. [Figure 6] 13 illustrates a third logic flow embodiment. [Figure 7] 13 illustrates a fourth logic flow embodiment. [Figure 8] 1 illustrates an embodiment of a computing architecture. [Figure 9A] 1 shows an example of a contactless card. [Figure 9B] 1 shows an example of a contactless card. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0007] The embodiments disclosed herein provide a secure technique for verified reviews using contactless cards. In general, a user may attempt to provide a review for an entity, such as a restaurant, a merchant, and / or a service provider, via a review platform. The review platform may be a website and / or a dedicated application having an application programming interface (API) that can communicate with the contactless card and a server associated with the contactless card. During the review generation and / or submission process, the user may be asked to tap the contactless card to a computing device. The API may communicate with the contactless card to receive encrypted data generated by the contactless card using a private key and an encryption algorithm. The API may provide the encrypted data to a server along with other review data (e.g., an identifier for the entity that is the subject of the review). The server may attempt to decrypt the encrypted data generated by the contactless card. If the server is able to decrypt the encrypted data, the server may verify the encrypted data. The server may then determine whether the card was used to pay for the transaction between the user and the reviewed entity. For example, the server may attempt to identify a transaction record in a transaction log that indicates that the contactless card was used to pay for the transaction between the user and the reviewed entity. If the server identifies such a transaction record, the server may verify that the user actually performed the transaction with the entity.

[0008] The server may then verify the encrypted data and notify the API that the transaction record has been verified. Using the API, the user may complete the submission of a verified review using the review platform. Once submitted, the verified review is published to the review platform, indicating that the review has been verified (e.g., the user actually dined at the restaurant, paid for the service provided by the service provider, etc.). Additionally, the API may send instructions of the submitted review to the contactless card, which may store the instructions in the memory of the contactless card. Thereafter, when the user visits the entity, the entity's POS device may receive the stored instructions from the memory of the contactless card. The POS device may provide a reward, discount, or other incentive to the user upon receiving the instructions from the contactless card.

[0009] Advantageously, the embodiments disclosed herein improve the validity and authenticity of reviews submitted by users on online platforms by verifying that the reviewing user has actually transacted with the entity being reviewed. Additionally, the validation performed by the authentication server provides a safeguard to ensure that an authorized user with access to the physical card is requesting the review to be submitted. Additionally, by providing a secure API for communicating with the contactless card and / or server, the embodiments disclosed herein provide a secure and portable solution that can be used with any review platform.

[0010] With general reference to the notation and nomenclature used herein, one or more portions of the following detailed description may be presented in terms of program procedures executed on a computer or network of computers. These procedure descriptions and representations are used by those skilled in the art to most effectively convey the substance of their work to others skilled in the art. A procedure is herein and is generally conceived to be a self-consistent sequence of operations leading to a desired result. These operations are operations requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical, magnetic, or optical signals that can be stored, transferred, combined, compared, and otherwise manipulated. It is sometimes convenient, primarily for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like. It should be noted, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities.

[0011] Further, these operations are often referred to in terms such as adding or comparing, which are commonly associated with mental operations performed by a human operator. However, no such capability of a human operator is necessary, or desirable in most cases, in any of the operations described herein forming part of one or more of the embodiments. Rather, these operations are machine operations. Useful machines for performing the operations of the various embodiments include digital computers selectively activated or configured by a computer program stored therein and written in accordance with the teachings herein, and / or include apparatus or digital computers specially constructed for the required purposes. Various embodiments also relate to apparatus or systems for performing these operations. These apparatus may be specially constructed for the required purposes. The required structure for these various machines will be apparent from the description given.

[0012] Reference is now made to the drawings, wherein like reference numerals are used to refer to like elements throughout. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding thereof. However, it may be apparent that novel embodiments may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form to facilitate the description. The intention is to cover all modifications, equivalents, and alternatives within the scope of the claims.

[0013] FIG. 1A illustrates a schematic of an exemplary system 100 consistent with disclosed embodiments. As shown, the system 100 includes one or more contactless cards 101, one or more computing devices 110, an authentication server 120, and one or more review platforms 140. The contactless cards 101 are representative of any type of payment card, such as a credit card, a debit card, an ATM card, a gift card, etc. The contactless cards 101 may include one or more communication interfaces 107, such as a radio frequency identification (RFID) chip, configured to communicate with the computing device 110 via NFC, EMV standard, or other short-range protocols in wireless communication. Although NFC is used as an example of a communication protocol, the present disclosure is equally applicable to other types of wireless communication, such as EMV standard, Bluetooth, and / or Wi-Fi. The computing devices 110 are representative of any type of network-enabled computing device, such as a smartphone, a tablet computer, a wearable device, a laptop, a portable gaming device, a mobile device, a workstation, a desktop computer, a server, etc. Server 120 and review platform 140 are representative of any type of computing device, such as a server, a workstation, a computing cluster, a cloud computing platform, a virtualized computing system, and the like.

[0014] The computing device 110 may be under the control of an instance of an operating system (OS, not shown). Examples of operating systems include Android® OS, iOS®, macOS®, Linux®, and Windows® operating systems. As shown, the memory 111 of the computing device 110 includes a review application 113 that includes one or more application programming interfaces (APIs) 114. The review application 113 enables users to generate reviews 141 for publication on one or more review platforms 140. Using the APIs 114, the review application 113 may enable users to submit verified (or confirmed) reviews. In general, the APIs 114 may facilitate communication with the contactless card 101 and / or the server 120 to verify that the contactless card 101 was used to pay for a transaction with an entity that is the subject of a review, thereby providing a verified review. The entity that is the subject of a review may include, but is not limited to, a restaurant, a merchant, a service provider, or any other type of business for which one or more users wish to provide a review. As described in more detail below, the review application 113 and API 114 may be used to verify that a user has actually made a transaction with an entity, such as dining at a target restaurant, paying for services provided by a target service provider, making a purchase with a target merchant, etc.

[0015] In some embodiments, the review application 113 may be a dedicated application (e.g., a mobile OS application) provided by an entity associated with one or more review platforms 140. In other embodiments, the functionality provided by the review application 113 and / or API 114 may be integrated into other platforms, such as one or more web pages and / or services provided by the review platform 140. In such embodiments, a user may access the web pages and / or services provided by the review platform 140 using a web browser (not shown) or other application. The embodiments are not limited in these contexts.

[0016] In general, a user of the review application 113 may designate a review of an entity to be generated. For example, the user may access a page of the review application 113 for a restaurant where they recently dined and designate a new review of the restaurant to be generated using the review application 113. In response, the review application 113 may output a notification to the computing device 110 designating tapping the contactless card 101 to the computing device 110, thereby bringing the contactless card 101 close enough to the card reader 118 of the computing device 110 to enable data transfer (e.g., NFC data transfer, Bluetooth data transfer, etc.) between the communication interface 107 of the contactless card 101 and the card reader 118 of the computing device 110. The applet 103 executing on a processor (not shown) of the contactless card 101 may then generate and transmit encrypted data 105 to the computing device 110 via the communication interface 107 of the contactless card 101. For example, the applet 103 of the contactless card 101 may use an encryption algorithm to generate an encrypted payload of the encrypted data 105 based at least in part on the private key 104 stored in the memory 102 of the contactless card 101. In such an embodiment, the private key 104 and some other data (e.g., a customer identifier, an account identifier, etc.) may be provided as inputs to the encryption algorithm that outputs the encrypted data 105. In general, the applet 103 may use any type of encryption algorithm and / or system to generate the encrypted data 105, and the use of a particular encryption algorithm as an example herein should not be considered limiting of the disclosure. In some embodiments, the applet 103 may perform encryption using a key diversification technique to generate the encrypted data 105. Examples of key diversification techniques are described in U.S. Patent Application No. 16 / 205,119, filed November 29, 2018. The aforementioned patent application is incorporated herein by reference in its entirety.

[0017] In some embodiments, the API 114 of the review application 113 may send instructions to the contactless card 101 specifying generating encrypted data 105. In other embodiments, the applet 103 generates the encrypted data 105 without requiring instructions from the API 114. In some embodiments, the API 114 of the review application 113 may send an entity identifier (ID) 115 to the applet 103. The entity identifier 115 may be any identifier that uniquely identifies an entity (e.g., a restaurant that a user has selected to write a review for). In some such embodiments, the applet 103 determines whether the received entity identifier matches (or is similar to) one or more entity identifiers in the transaction log 106. The transaction log 106 may store details describing one or more recent transactions completed using the contactless card 101. If the received entity identifiers match, the applet 103 may determine that the user has completed a transaction with an entity (e.g., ate at a restaurant) and may generate encrypted data 105. If the received entity identifier does not match, applet 103 cannot verify that the user completed a transaction with the entity and may refrain from generating encrypted data 105. However, in some embodiments, applet 103 may generate encrypted data 105 even if entity ID 115 does not match any portion of transaction log 106.

[0018] Once generated, the applet 103 may transmit the encrypted data 105, e.g., via NFC, to the API 114 of the review application 113 of the computing device 110. In some embodiments, the applet 103 may also transmit data describing one or more transactions from the transaction log 106 to the review application 113. In some embodiments, the review application 113 may verify whether a match exists between the entity ID 115 of the entity being reviewed and the transaction log 106. If a match exists, the review application 113 may allow the generation of a verified review. However, in some such embodiments, the review application 113 may request confirmation (and / or verification) from the server 120 before allowing the submission of the verified review to the review platform 141. The requested confirmation and / or verification may generally enable the review application 113 to verify that the user has actually made a transaction with the entity being reviewed, e.g., dined at a restaurant, used a service, etc.

[0019] In general, the API 114 of the review application 113 may transmit the encrypted data 105, the entity ID 115, and the application ID 116 to the authentication application 123 of the authentication server 120 over the network 130. The application ID 116 may uniquely identify the review application 113 and / or the associated review platform 140. Doing so may facilitate a lookup using the entity ID 115 associated with the review application 113 and the entity ID in the entity data 125, which may be used in the transaction data 126. The authentication server 120 may then attempt to decrypt the encrypted data 105 and determine whether the transaction data 126 reflects that the contactless card 101 was used to pay for a transaction with the target entity.

[0020] FIG. 1B illustrates an embodiment in which the authentication application 123 of the authentication server 120 processes data received from the review application 113. As mentioned, the authentication application 123 may attempt to verify the encrypted data 105. For example, the authentication application 123 may attempt to decrypt the encrypted data 105 using a copy of the private key 104 stored in the memory 122 of the authentication server 120. The private key 104 may be identical to the private key 104 stored in the memory 102 of the contactless card 101. Each contactless card 101 is manufactured to include a unique private key 104 (and the authentication server 120 stores a corresponding copy of each unique private key 104). Thus, the authentication application 123 may successfully decrypt the encrypted data 105, thereby verifying the encrypted data 105. Although the private key 104 is shown stored in the memory 122, the private key 104 may be stored elsewhere, such as in a secure element and / or a hardware security module (HSM). In such an embodiment, the secure element and / or HSM may use the private key 104 and the encryption function to decrypt the encrypted data 105.

[0021] For example, a customer identifier associated with contactless card 101 may be used to generate encrypted data 105. In such an example, authentication application 123 may decrypt encrypted data 105 using private key 104 of authentication server 120. If the result of the decryption yields the customer identifier associated with contactless card 101 in account data 124, authentication application 123 verifies encrypted data 105. If authentication application 123 cannot decrypt the encrypted data to obtain the expected result (e.g., the customer identifier for the account associated with contactless card 101), authentication application 123 does not verify encrypted data 105.

[0022] Once the authentication application 123 successfully decrypts the encrypted data 105, the authentication application 123 may determine whether the transaction data 126 includes a record indicating that the contactless card 101 was used to pay for a transaction with the entity that the user selected to review. For example, the authentication application 123 may determine whether a transaction record in the transaction data 126 includes the contactless card's account number and the entity ID 115 of the entity (e.g., the restaurant being reviewed). If such a transaction record exists, the authentication application 123 may send a confirmation instruction 127 to the computing device 110. The confirmation 127 may generally reflect that the authentication application 123 has verified the encrypted data 105 (by decrypting the encrypted data 105) and verified that the contactless card 101 was used to make a purchase with the entity being reviewed. The confirmation 127 may further serve as an authorization to generate and / or publish a review. However, if the encrypted data 105 is not decrypted and / or the record in the transaction data 126 is not identified, the authentication application 123 may refrain from generating a confirmation and / or send a failure status to the review application 113. In some embodiments, the confirmation 127 may be stored in the account data 124 of the account associated with the contactless card 101. In some embodiments, the confirmation 127 includes metadata attributes such as the time of the confirmation, the time of the identified transaction, the entity ID 115, the application ID 116, etc.

[0023] In some embodiments, the authentication application 123 may determine whether the date of the transaction record in the transaction data 126 is within a time threshold before generating the confirmation 127. For example, if the transaction date is 100 days old and the time threshold is one week, the authentication application 123 may determine that the transaction record is invalid against the threshold and refrain from sending the confirmation 127 to the computing device 110. In some embodiments, the authentication application 123 may resolve the entity ID 115 against the entity data 125 to determine a transaction identifier used to identify the associated entity in the transaction data 126. Similarly, in some embodiments, the authentication application 123 may receive the transaction log 106 from the computing device 110 and verify that the transaction log 106 of the contactless card 101 reflects the transaction of the entity ID 115 before generating the confirmation 127. Additionally, in some embodiments, the authentication application 123 may maintain a counter associated with the contactless card 101. The counter may reflect the number of reviews that a user associated with the contactless card 101 has attempted to submit. If the counter exceeds a threshold, the authentication application 123 may refrain from verifying the encrypted data 105 and / or retrieving the transaction data 126, thereby preventing the user from submitting an excessive number of reviews and / or submitting programmatically generated reviews.

[0024] The API 114 of the review application 113 may receive a confirmation 127 from the server 120 indicating that the user has made a transaction with the entity associated with the entity ID 115. In response, the review application 113 may allow the user to create and / or submit to the review platform 140 a verified review 141-1 for the entity associated with the entity ID 115. If the server 120 does not send the confirmation 127 (and / or the API 114 receives an indication of a denial and / or failure status from the server 120), the review application 113 may restrict the user from submitting a verified review. In some such embodiments, the review application 113 may allow the user to submit a general review that is not labeled as a verified review. The review platform 140 and / or the review application 113 may distinguish general and / or verified reviews in the reviews 141 using any suitable method, such as with graphics, text, images, etc. The review application 113 may further send an indication of the review 141-1 to the server 120, which may store an indication of the published review in the review user's account data 124.

[0025] When the review 141-1 is submitted to the review platform, the review application 113 may output instructions specifying tapping the contactless card 101 to the computing device 110. When the contactless card 101 is brought within communication range of the computing device 110, the API 114 may send a review confirmation 108 to the contactless card 101, which may store the review confirmation 108 in the memory 102. In some embodiments, the review confirmation 108 is the same as the confirmation 127 received from the server 120. In other embodiments, the review confirmation 108 is different from the confirmation 127 received from the server. For example, the review confirmation 108 may include additional metadata describing the review 141-1, such as a timestamp when the review was published, an identifier for the associated user, an entity ID 115 for the entity that is the subject of the review, any metadata for the confirmation 127, whether the review is favorable or unfavorable, etc.

[0026] The review application 113 and / or the merchant device may later receive the review confirmation 108 from the contactless card 101. Doing so may enable the review application 113 and / or the merchant device to provide the user rewards, discounts, and / or other incentives for publishing a review associated with the review confirmation. In some embodiments, the review application 113 may output instructions specifying the submission of an additional review. In some such embodiments, the review application 113 may identify other entities in the transaction log 106 and output a notification requesting the user to submit a verified review of the entities identified in the transaction log 106.

[0027] In one embodiment, the review application 113 may send the review 141-1 to the authentication application 123 in response to receiving the confirmation 127. The authentication application 113 may then send the review 141-1 to the review platform 140 for publication.

[0028] FIG. 2A is a schematic 200 illustrating an example embodiment of tapping a contactless card 101 to provide a verified review via a review application 113. As shown, the review application 113 outputs a graphical user interface (GUI) for submitting a verified review of an example entity "Entity ABC." The GUI includes a rating field 201 for providing a rating. The rating may be a numerical rating, a star rating, a text-based rating, or other type of rating. The GUI further includes a comment field 202 that allows the user to provide comments related to the rating. The GUI may further include additional elements such as fields for providing images, videos, etc. The particular type and format of the verified review example should not be considered limiting of the disclosure, as the disclosure is equally applicable to all types of reviews.

[0029] In one embodiment, a user may provide inputs to the fields 201-202 and select the submit button 203 to submit a review to the review platform 140. In response, the review application 113 may output a notification 204 specifying tapping the contactless card 101 to the computing device 110. When the contactless card 101 is tapped to the computing device 110, the applet 103 of the contactless card 101 may generate encrypted data 105. In some embodiments, the applet 103 may represent multiple applets stored on the contactless card 101. In such an embodiment, the contactless card 101 may select an applet 103 associated with facilitating a verified review. The selected applet 103 may then generate data necessary to facilitate the verified review (e.g., encrypted data 105) and / or provide additional data necessary to facilitate the verified review (e.g., transaction log 106).

[0030] Once generated, the applet 103 may transmit the encrypted data 105 to the computing device 110 via the communication interface 107. In some embodiments, the applet 103 may transmit the transaction log 106 along with the encrypted data 105 to the computing device 110. As mentioned, in some embodiments, the applet 103 may receive the entity ID 115 from the API 114. In such embodiments, the applet 103 may determine whether the transaction log 106 includes a record reflecting that the contactless card 101 was used as part of a transaction with an entity associated with the entity ID 115 prior to generating the encrypted data 105. The API 114 of the review application 113 may transmit the encrypted data 105, the transaction log 106, the entity ID 115, and / or the application ID 116 to the authentication server 120. In some embodiments, receipt of the application ID 116 instructs the authentication server 120 to perform an operation associated with the verified review (e.g., verifying the encrypted data 105 and searching for a matching transaction in the transaction data 126).

[0031] The authentication application 123 may then attempt to decrypt the encrypted data 105 using the private key 104 associated with the contactless card 101. If the authentication application 123 is unable to decrypt the encrypted data to obtain the expected result (e.g., a customer identifier for the account associated with the contactless card 101, etc.), the authentication application 123 does not verify the encrypted data 105 and does not verify whether the transaction in the transaction data 126 is. If the authentication application 123 is able to decrypt the encrypted data to obtain the expected result (e.g., a customer identifier for the account associated with the contactless card 101), the authentication application 123 verifies the encrypted data 105 and determines whether the transaction in the transaction data 126 reflects that the contactless card 101 was used to pay for (at least in part) the transaction with the entity associated with the entity ID 115. If the transaction is identified and the encrypted data 105 is verified, the authentication application 123 may generate a confirmation and send it to the API 114 of the review application 113. In some embodiments, when the authentication application 123 identifies a transaction in the transaction data 126, the authentication application 123 may determine whether the date of the identified transaction is within a threshold for use in generating a verified review before generating a confirmation.

[0032] 2B is a schematic 210 illustrating an embodiment in which the authentication application 123 verifies the encrypted data 105 and sends a confirmation to the API 114 of the review application 113. The review application 113 may then allow the user to create and / or submit a verified review. The user may then submit the verified review, which may be stored as a review 141 on the review platform 140. The user may then edit the review 141 as needed. Other users may also view the verified review in the review 141 via the review application 113 and / or other applications.

[0033] 2C is a schematic 220 illustrating an embodiment in which a verified review is published to reviews 141 on a review platform 140. As shown, the review application 113 may provide a link 205 that allows a user to view the verified review. The review application 113 may also output instructions specifying tapping the contactless card 101 to the device 110. By doing so, the API 114 may send a review confirmation 108 to the contactless card 101. The contactless card 101 may store the review confirmation 108 in memory 102 and may later use the review confirmation 108 for rewards, incentives, etc.

[0034] 3A is a schematic 300 illustrating an example of using a contactless card 101 with an entity's point of sale (POS) device 310. The POS device 302 is representative of any type of computing device, such as a card reader device, a smart phone, a tablet computer, a desktop computer, a POS terminal, a server, a workstation, a laptop computer, and the like. As shown, the POS device 301 prompts the user to tap the contactless card 101 against the POS device 301. The user can bring the contactless card 101 within communication range of the POS device 301, which can cause the applet 103 to transmit a review confirmation 108 to the POS device 301. In some embodiments, the contactless card 101 is inserted into a card reader of the POS device 302, and the review confirmation 108 is transmitted via the card reader.

[0035] In response, the POS device 301 may analyze the review confirmation 108 to determine whether the associated review qualifies the user to receive a reward or other incentive. For example, the POS device 301 may determine whether the entity ID 115 associated with the review confirmation 108 matches an entity ID associated with the entity providing the POS device 301. As another example, the POS device 301 may determine whether a timestamp associated with the review confirmation 108 indicates that the review confirmation 108 is within a time threshold for providing a reward for the review. More generally, the POS device 301 may verify, based at least in part on the review confirmation 108, that the user has published a verified review 141 for an entity on the review platform 140.

[0036] FIG. 3B is a schematic 310 illustrating an embodiment in which the POS device 301 identifies that a user has published a verified review 141 for an entity on the review platform 140 based at least in part on a review confirmation 108 received from the memory 102 of the contactless card 101. As shown, the POS device 301 outputs one or more rewards to the customer based on the identified review confirmation 108. The user may then select a desired reward. Once selected, the POS device 301 may process the selected reward. If the selected reward is applicable to a previous transaction (e.g., a refund for a previous purchase), the POS device 301 may send instructions for the refund to an appropriate server (e.g., server 120). If the selected reward is for a future transaction, the POS device 301 may store an indication of the selected reward in the user profile of the user. In some embodiments, the POS device 301 stores an indication of the selected reward in the memory 102 of the contactless card 101 and / or the memory 111 of the computing device 110. By doing so, the POS device 301 can later identify the reward in the memory 102 of the contactless card 101 and / or the memory 111 of the computing device 110 and automatically provide the reward to the user at that time.

[0037] 3A-3C depict an embodiment in which the contactless card 101 is tapped to the POS device 301, the embodiment is not limited in this context. For example, in some embodiments, the contactless card 101 may be tapped to the computing device 110 instead of the POS device 301 of FIG. 3A. In such an embodiment, the contactless card 101 may send a review confirmation 108 to the computing device 110. The review application 113 may then send the review confirmation 108 to the POS device 301. The POS device 301 may then analyze the review confirmation 108 to determine whether the associated review is eligible for the user to receive a reward or other incentive. Any rewards are sent by the POS device 301 to the computing device 110 and / or the review application 113 for display (e.g., via a GUI similar to that of FIG. 3B). Once selected, an indication of the reward may be stored in the memory 111 of the computing device 110. Similarly, the computing device 110 may transmit an indication of the selected reward to the POS device 301, which may store the indication of the selected reward in the user's user profile.

[0038] 4 illustrates an embodiment of a logic flow 400. The logic flow 400 may represent some or all of the operations performed by one or more embodiments described herein. For example, the logic flow 400 may include some or all of the operations for using a contactless card to provide a verified review. In this context, the embodiments are not limited.

[0039] As shown, logic flow 400 begins at block 405 with a user of a review application 113 running on a computing device 110 attempting to provide a review for an entity. As noted, the entity may be any type of merchant and / or service provider. For example, the user may attempt to provide a review for a taxi service. At block 410, review application 113 may output a notification specifying tapping contactless card 101 to computing device 110 to provide a verified review. At block 415, contactless card 101 is tapped to computing device 110, which may cause applet 103 of contactless card 101 to generate encrypted data 105. As noted, applet 103 may generate encrypted data 105 using private key 104, an encryption algorithm, and some other data (e.g., customer ID). In some embodiments, before generating the encrypted data 105, the applet 103 determines whether a transaction in the transaction log 106 reflects that the contactless card 101 was used to pay for a transaction with an entity associated with the entity ID 115 received from the review application 113. At block 420, the applet 103 sends the encrypted data 105 to the API 114 of the device 110. The applet 103 may optionally send the transaction log 106 along with the encrypted data 105 to the device 110.

[0040] At block 425, the API 114 of the review application 113 may receive the encrypted data 105 and / or the transaction log 106 from the contactless card 101. At block 430, the review application 113 may provide the entity ID 115 of the entity and the application ID 116 of the review application 113 to the API 114 of the review application 113. At block 435, one or more of the APIs 114 of the review application 113 may send the encrypted data, the entity ID 115, and the application ID 116 to the authentication server 120. At block 440, the authentication application 123 may attempt to decrypt the encrypted data 105 using the private key 104 associated with the contactless card 101 stored by the server 120. If the authentication application 123 decrypts the encrypted data 105 to produce an expected result (e.g., a customer identifier associated with the contactless card 101 stored in the account data 124), the authentication application 123 may verify the encrypted data.

[0041] At block 445, the authentication application 123 may identify a previous transaction between the contactless card 101 and the entity ID 115 in the transaction data 126. By doing so, the authentication application 123 may verify that the user did in fact transact with the entity for which the user wishes to submit a review. For example, by identifying a record in the transaction data 126 indicating that the contactless card 101 was used to pay for taxi services provided by a taxi service entity, the authentication application 123 may verify that the user was in fact a paying customer of the taxi service. At block 450, the authentication application 123 may send a confirmation indication to the device 110. The confirmation may generally indicate that the encrypted data has been verified and / or that a valid transaction has been identified in the transaction data 126.

[0042] Once the review application 113 receives confirmation from the server 120, the review application 113 may allow the publication of the verified review. In some embodiments, the review application 113 may disable certain GUI components to restrict the creation and / or submission of a review until confirmation is received from the server 120. For example, the review application 113 may disable the submit button 203 of FIGS. 2A-2B until confirmation is received. As another example, the review application 113 may not allow a user to provide input in fields 201-202 until confirmation is received. At block 455, the review application 113 receives an input specifying that the verified review should be published to the review platform. The review application 113 may then send the review to the review platform 140 with an indication that the review is a verified review. The review platform 140 may then store the verified review (including the verified review indication) in the review 141. The user may then view the verified review using, for example, the review application 113.

[0043] At block 460, the one or more APIs 114 of the review application 113 may send an indication of the published review to the contactless card 101, which may store the indication in the memory 102. For example, a review confirmation 108 may be sent to the contactless card 101 specifying that the user has written a verified review about tax services. At block 465, the contactless card 101 may store the indication of the published review in the memory 102 of the contactless card 101.

[0044] 5 illustrates an embodiment of a logic flow 500. The logic flow 500 may represent some or all of the operations performed by one or more embodiments described herein. For example, the logic flow 500 may include some or all of the operations for validating a review based at least in part on data generated by a contactless card. In this context, the embodiments are not limited.

[0045] As shown, the logic flow 500 begins at block 505, where the authentication application 123 receives data from one or more APIs 114 of the review application 113. For example, the authentication application 123 may receive encrypted data 105 generated by the contactless card 101, the transaction log 106 of the contactless card 101, the entity ID 115, and / or the application ID 116 as part of a request to confirm a verified review. At block 510, the authentication application 123 attempts to decrypt the encrypted data 105 using the private key 104 of the server 120 to generate a customer ID associated with the contactless card. At block 515, the authentication application 123 may search the transaction data 126 to identify a transaction between the contactless card 101 and the entity ID. For example, if the entity ID 115 is associated with a restaurant, the authentication application 123 may identify a record in the transaction data 126 indicating that the contactless card 101 was used to pay for a meal at the restaurant.

[0046] At block 520, the authentication application 123 determines whether the time associated with the transaction identified at block 515 exceeds a time limit (or threshold). For example, the authentication application 123 may have a 10-day threshold for transactions. If the identified transaction occurred within 10 days, the authentication application 123 may confirm the transaction for verified review. Otherwise, the authentication application 123 may refuse to confirm the transaction for verified review. At block 525, the authentication application 123 determines whether a review limit has been exceeded by the current review. As mentioned, the authentication application 123 may maintain a review counter associated with the contactless card 101. By incrementing the review counter based on the current review, if the counter exceeds the limit, the authentication application 123 may refuse to confirm the transaction for verified review. Otherwise, the authentication application 123 may confirm the transaction for verified review.

[0047] At block 530, the authentication application 123 may reject the verified review and / or refrain from sending a confirmation to the review application 113. For example, the authentication application 123 may reject the verified review based on a determination that the encrypted data 105 was not decrypted, that a transaction was not identified in the transaction data 126, or that a time and / or review limit was exceeded. By doing so, the review application 113 restricts the user from publishing the verified review. Additionally and / or alternatively, the review application 113 may allow the user to publish the review but not provide the review with a verified status. At block 535, the authentication application 123 may send an indication of approval, e.g., a confirmation, for the verified review requested by the review application 113. For example, the authentication application 123 may successfully decrypt the encrypted data 105, identify one or more transactions in the transaction data 126, and determine that the identified transaction does not exceed a time limit and / or review limit. As another example, the authentication application 123 may further determine that the transaction is present in the received transaction log 106 of the contactless card 101. By doing so, the authentication application 123 can verify that the requested review is not fraudulent based on decrypting the encrypted data and identifying recent transactions between the user and the entity.

[0048] 6 illustrates an embodiment of a logic flow 600. The logic flow 600 may represent some or all of the operations performed by one or more embodiments described herein. For example, the logic flow 600 may include some or all of the operations for using a contactless card for a verified review. In this context, the embodiments are not limited.

[0049] As shown, the logic flow 600 begins at block 605, where the review application 113 identifies one or more transactions in the transaction log 106 received from the contactless card 101. At block 610, the review application 113 may determine that the transaction in the transaction log 106 indicates that the contactless card 101 was used to pay for a transaction with an entity for which the user is attempting to publish a verified review. For example, an entity ID of the entity may be specified in the transaction log 106. At block 615, the review application 113 may determine that the transaction identified at block 610 is within a time threshold. For example, the review application 113 may determine that the transaction has a timestamp indicating that the transaction is three days old and the time threshold is 30 days. The review application 113 may make the determination at blocks 610-615 before transmitting at least the encrypted data 105 to the server 120 for verification. Verification may occur as described above, and the user may optionally submit a verified review based on confirmation received by the review application 113 from the server 120.

[0050] At block 620, the review application 113 may identify a transaction with the second entity in the transaction log 106 received from the contactless card 101. At block 625, the review application 113 may output a notification requesting the user to write a review of the second entity. The user may then decide to write a review of the second entity, which may be verified using the contactless card 101 as described herein.

[0051] 7 illustrates an embodiment of a logic flow 700. The logic flow 700 may represent some or all of the operations performed by one or more embodiments described herein. For example, the logic flow 700 may include some or all of the operations for providing rewards based on indications of published reviews stored on a contactless card. In this context, the embodiments are not limited.

[0052] As shown, logic flow 700 begins at block 705, where a merchant device, such as the POS device 301, outputs instructions to tap the contactless card 101 to the POS device 301 and / or insert the contactless card 101 into the POS device 301. At block 710, the POS device 301 receives data from the contactless card 101. For example, the applet 103 may send one or more review confirmations 108 stored in the memory 102 to the POS device 301. At block 715, the merchant device identifies an indication that a user has submitted a verified review for an entity associated with the POS device 301. For example, the POS device 301 may compare the entity ID 115 in the received review confirmation 108 and determine that the entity ID 115 is associated with the entity providing the POS device 301.

[0053] At block 720, the POS device 301 outputs one or more rewards, discounts, and / or incentives for display. For example, the POS device 301 may provide a discount for a future purchase, an upgrade for a future purchase, and / or a refund for a previous purchase. At block 725, the POS device 301 receives the selection of the one or more rewards output at block 720. For example, the user may select an upgraded hotel room for a next stay. At block 730, the POS device 301 may apply the selected reward to the user's account. For example, the POS device 301 may store instructions for upgrading the user's room during the next hotel stay. At block 735, if the POS device 301 determines that the reward selected at block 725 is a refund for a previous purchase, it transmits instructions for a refund for the previous purchase. For example, if the user selected a 5% discount on a last purchase totaling $100, the POS device 301 may transmit instructions for a refund of $5 to the account associated with the contactless card 101 to the server 120.

[0054] FIG. 8 illustrates an embodiment of an exemplary computing architecture 800 comprising a computing system 802 that may be suitable for implementing various embodiments as described above. In various embodiments, the computing architecture 800 may comprise or be implemented as part of an electronic device. In some embodiments, the computing architecture 800 may represent, for example, a system implementing one or more components of the system 100. In some embodiments, the computing system 802 may represent, for example, the contactless card 101, the computing device 110, the authentication server 120, and / or the review platform 140 of the system 100. Similarly, the computing system 802 may represent the POS device 301. The embodiments are not limited in this context. More generally, the computing architecture 800 is configured to implement all logic, applications, systems, methods, apparatus, and functions described herein with reference to FIGS. 1-9.

[0055] The terms "system" and "component" and "module" as used in this application are intended to refer to any computer-related entity, either hardware, a combination of hardware and software, software, or software in execution, examples of which are provided by the exemplary computing architecture 800. For example, a component may be, but is not limited to, a process running on a computer processor, a computer processor, a hard disk drive, multiple storage drives (of optical and / or magnetic storage media), an object, an executable, a thread of execution, a program, and / or a computer. As an example, both an application running on a server and the server may be a component. One or more components may reside within a process and / or thread of execution, and a component may be localized on one computer and / or distributed among two or more computers. Furthermore, components may be communicatively coupled to one another by various types of communication media to coordinate operations. Coordination may include unidirectional or bidirectional exchange of information. For example, components may communicate information in the form of signals communicated over the communication media. The information may be embodied as signals assigned to various signal lines. In such an assignment, each message is a signal. However, further embodiments may use data messages as an alternative. Such data messages may be transmitted over a variety of connections, examples of which include parallel interfaces, serial interfaces, and bus interfaces.

[0056] Computing system 802 includes various typical computing elements, such as one or more processors, multi-core processors, co-processors, memory units, chipsets, controllers, peripherals, interfaces, oscillators, timing devices, video cards, audio cards, multimedia input / output (I / O) components, power supplies, etc. However, embodiments are not limited to implementation by computing system 802.

[0057] As shown in Figure 8, computing system 802 includes a processor 804, a system memory 806, and a system bus 808. Processor 804 may be any of a variety of commercially available computer processors, including, but not limited to, AMD Athlon, Duron, and Opteron processors, ARM applications, embedded and secure processors, IBM and Motorola DragonBall and PowerPC processors, IBM and Sony Cell processors, Intel Celeron, Core, Core(2) Duo, Itanium, Pentium, Xeon, and XScale processors and similar processors. Dual microprocessors, multi-core processors, and other multi-processor architectures may also be used as processor 804.

[0058] The system bus 808 provides an interface from the system memory 806 to system components including, but not limited to, the processor 804. The system bus 808 may be any of several types of bus structures that may further interconnect to a memory bus (with or without a memory controller), a peripheral bus, and a local bus using any of a variety of commercially available bus architectures. Interface adapters may connect to the system bus 808 through a slot architecture. Examples of slot architectures include, but are not limited to, Accelerated Graphics Port (AGP), CardBus, (Enhanced) Industry Standard Architecture ((E)ISA), MicroChannel Architecture (MCA), NuBus, Peripheral Component Interconnect (Enhanced) (PCI(X)), PCI Express, Personal Computer Memory Card International Association (PCMCIA), and the like.

[0059] The system memory 806 may include various types of computer-readable storage media in the form of one or more high-speed memory units, such as read-only memory (ROM), random access memory (RAM), dynamic RAM (DRAM), double data rate DRAM (DDRAM), synchronous DRAM (SDRAM), static RAM (SRAM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory (e.g., one or more flash arrays), polymer memory such as ferroelectric polymer memory, ovonic memory, phase change or ferroelectric memory, silicon oxide nitride oxide silicon (SONOS) memory, magnetic or optical cards, arrays of devices such as redundant array of independent disks (RAID) drives, solid-state memory devices (e.g., USB memory, solid-state drive (SSD)), and other types of storage media suitable for storing information. In the illustrated embodiment shown in FIG. 8, the system memory 806 may include non-volatile memory 810 and / or volatile memory 812. The non-volatile memory 810 may store a basic input / output system (BIOS).

[0060] The computing system 802 may include various types of computer-readable storage media in the form of one or more low-speed memory units, including an internal (or external) hard disk drive (HDD) 814, a magnetic floppy disk drive (FDD) 816 that reads from or writes to a removable magnetic disk 818, and an optical disk drive 820 that reads from or writes to a removable optical disk 822 (e.g., a CD-ROM or DVD). The HDD 814, FDD 816, and optical disk drive 820 may be connected to the system bus 808 by a HDD interface 824, a FDD interface 826, and an optical drive interface 828, respectively. The HDD interface 824 for an external drive implementation may include at least one or both of Universal Serial Bus (USB) and IEEE 1394 interface technologies. The computing system 802 is generally configured to implement all of the logic, systems, methods, apparatus, and functions described herein with reference to FIGS. 1-9.

[0061] The drives and associated computer-readable media provide volatile and / or nonvolatile storage of data, data structures, computer-executable instructions, and the like. For example, a number of program modules may be stored on the drives and memory units 810, 812, including an operating system 830, one or more application programs 832, other program modules 834, and program data 836. In one embodiment, the one or more application programs 832, other program modules 834, and program data 836 may include, for example, various applications and / or components of the system 100, such as applets 103, private keys 104, encrypted data 105, transaction logs 106, review applications 113, APIs 114, authentication applications 123, account data 124, entity data 125, transaction data 126, review platform 140, and / or reviews 141.

[0062] A user may enter commands and information into the computing system 802 through one or more wired / wireless input devices, for example, a keyboard 838 and a pointing device such as a mouse 840. Other input devices may include a microphone, infrared (IR) remote control, radio frequency (RF) remote control, game pad, stylus pen, card reader, dongle, fingerprint reader, grab, graphic tablet, joystick, keyboard, retina reader, touch screen (e.g., capacitive, resistive, etc.), track ball, track pad, sensor, stylus, etc. These and other input devices are often connected to the processor 804 through an input device interface 842 coupled to the system bus 808, but may be connected by other interfaces, such as a parallel port, an IEEE 1394 serial port, a game port, a USB port, an IR interface, etc.

[0063] A monitor 844 or other type of display device is also connected to the system bus 808 via an interface, such as a video adapter 846. The monitor 844 can be internal or external to the computing system 802. In addition to the monitor 844, computers typically include other peripheral output devices, such as speakers, printers, etc.

[0064] The computing system 802 may operate in a networked environment using logical connections via wired and / or wireless communications to one or more remote computers, such as a remote computer 848. The remote computer 848 may be a workstation, a server computer, a router, a personal computer, a portable computer, a microprocessor-based entertainment device, a peer device, or other common network node, and typically includes many or all of the elements described in connection with the computing system 802, although for simplicity, only a memory / storage device 850 is shown. The logical connections shown include wired / wireless connections to a local area network (LAN) 852 and / or larger networks, e.g., a wide area network (WAN) 854. Such LAN and WAN networking environments are common in offices and businesses, facilitating enterprise-wide computer networks, such as an intranet. All of these may connect to a global communications network, e.g., the Internet. In an embodiment, the network 130 of FIG. 1 is one or more of the LAN 852 and the WAN 854.

[0065] When used in a LAN networking environment, the computing system 802 is connected to the LAN 852 via a wired and / or wireless communication network interface or adapter 856. The adapter 856 may facilitate wired and / or wireless communication to the LAN 852, which may include a wireless access point disposed thereon for communicating with the wireless functionality of the adapter 856.

[0066] When used in a WAN networking environment, the computing system 802 may include a modem 858 or have other means for establishing communications over the WAN 854, such as connected to a communications server on the WAN 854 or via the Internet. The modem 858 may be internal or external, a wired and / or wireless device, and connects to the system bus 808 via the input device interface 842. In a networked environment, program modules depicted relative to the computing system 802, or portions thereof, may be stored in the remote memory / storage device 850. It will be appreciated that the network connections shown are exemplary and other means of establishing a communications link between the computers may be used.

[0067] The computing system 802 is operable to communicate with wired and wireless devices or entities using the IEEE 802 family of standards, such as wireless devices operatively arranged for wireless communication (e.g., IEEE 802.16 wireless modulation technology). This includes at least Wi-Fi (or Wireless Fidelity), WiMax, Bluetooth wireless technologies, and the like. Thus, communication can be a predefined structure, as with traditional networks, or simply ad-hoc communication between at least two devices. Wi-Fi networks provide secure, reliable, and fast wireless connectivity using radio technologies called IEEE 802.11x (a, b, g, n, etc.). Wi-Fi networks can be used to connect computers to each other, to the Internet, and to wired networks (using IEEE 802.3 related media and functions).

[0068] FIG. 9A illustrates a contactless card 101 that may comprise a payment card, such as a credit card, a debit card, and / or a gift card. As shown, the contactless card 101 may be issued by a service provider 902 that is displayed on the front or back of the card 101. In some examples, the contactless card 101 may comprise, but is not limited to, an identification card unrelated to a payment card. In some examples, the payment card may comprise a dual interface contactless payment card. The contactless card 101 may comprise a substrate 910 that may include a single layer or one or more laminated layers composed of plastic, metal, and other materials. Exemplary substrate materials include polyvinyl chloride, polyvinyl chloride acetate, acrylonitrile butadiene styrene, polycarbonate, polyester, anodized titanium, palladium, gold, carbon, paper, and biodegradable materials. In some examples, the contactless card 101 may have physical characteristics that conform to the ID-1 format of the ISO / IEC 7810 standard, otherwise the contactless card may conform to the ISO / IEC 14443 standard. However, it should be understood that contactless cards 101 according to the present disclosure may have different characteristics and the present disclosure does not require that contactless cards be implemented as payment cards.

[0069] The contactless card 101 may also include identification information 915 displayed on the front and / or back of the card, and a contact pad 920. The contact pad 920 may be configured to establish contact with other communication devices, such as the mobile device 90, a user device, a smartphone, a laptop, desktop, or a tablet computer. The contactless card 101 may also include processing circuitry, an antenna, and other components not shown in FIG. 9A. These components may be located behind the contact pad 920 or elsewhere on the substrate 910. The contactless card 101 may also include a magnetic strip or tape that may be located on the back of the card (not shown in FIG. 9A).

[0070] 9B, the contact pad 920 of the contactless card 101 may include processing circuitry 925 for storing and processing information, including a microprocessor 930 and memory 102. It will be understood that the processing circuitry 925 may include additional components including processors, memory, error and parity / CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives, and anti-tamper hardware as necessary to perform the functions described herein.

[0071] The memory 102 may be a read-only memory, a write-once read-multiple memory, or a read / write memory, e.g., RAM, ROM, and EEPROM, and the contactless card 101 may include one or more of these memories. Read-only memory may be read-only or one-time programmable at the factory. One-time programming allows it to be written once and read many times. Write-once / read-multiple memory may be programmed at some point after the memory chip leaves the factory. Once programmed, the memory may not be rewritten, but it may be read many times. Read / write memory may be programmed and reprogrammed many times after leaving the factory. Read / write memory may be read many times after leaving the factory.

[0072] The memory 102 may be configured to store one or more applets 103, private keys 104, encrypted data 105, transaction logs 106, one or more review confirmations 108, and one or more customer (or user) identifiers (IDs) 907. The one or more applets 103 may comprise one or more software applications configured to run on one or more contactless cards, such as a Java Card applet. However, it is understood that the applet 103 is not limited to a Java Card applet, but may instead be any software application operable on a contactless card or other device having limited memory. The customer ID 907 may comprise a unique alphanumeric identifier assigned to a user of the contactless card 101, the identifier may distinguish a user of a contactless card from users of other contactless cards. In some examples, the customer ID 907 may identify both the customer and an account assigned to that customer, and further identify the contactless card associated with the customer's account. In some embodiments, the applet 103 may use the customer ID 907 as an input to an encryption algorithm using the private key 104 to generate the encrypted data 105 .

[0073] Although the processor and memory elements of the foregoing exemplary embodiments are described with reference to contact pads, the present disclosure is not limited thereto, and it will be understood that these elements may be implemented outside of the pads 920, completely separate therefrom, or as additional elements in addition to the processor 930 and memory 102 elements located within the contact pads 920.

[0074] In some examples, the contactless card 101 may include one or more antennas 955. The one or more antennas 955 may be disposed within the contactless card 101 and around the processing circuit 925 of the contact pad 920. For example, the one or more antennas 955 may be integrated with the processing circuit 925, the one or more antennas 955 may be used with an external booster coil. As another example, the one or more antennas 955 may be external to the contact pad 920 and the processing circuit 925.

[0075] In one embodiment, the coil of the contactless card 101 may function as the secondary of an air-core transformer. The terminal may communicate with the contactless card 101 by disconnecting the power or amplitude modulation. The contactless card 101 may infer data transmitted from the terminal using a gap in the power connection of the contactless card, which may be maintained functionally via one or more capacitors. The contactless card 101 may return communication by switching the load of the coil of the contactless card or load modulation. Load modulation may be detected at the coil of the terminal by interference. More generally, using the antenna 955, the processing circuitry 925, and / or the memory 102, the contactless card 101 provides a communication interface for communicating via NFC, Bluetooth, and / or Wi-Fi communications.

[0076] As described above, the contactless card 101 may be built on a software platform operable on a memory-limited smart card or other device, such as a Java Card, and one or more applications or applets may be securely executed. The applet may be added to the contactless card to provide a one-time password (OTP) for multi-factor authentication (MFA) in various mobile application-based use cases. The applet may be configured to respond to one or more requests, such as a near-field data exchange request, from a reader, such as a mobile NFC reader (e.g., card reader 118 of device 110), and generate an NDEF message comprising the cryptographically secure OTP encoded as an NDEF text tag.

[0077] Various embodiments may be implemented using hardware elements, software elements, or a combination of both. Examples of hardware elements may include a processor, a microprocessor, a circuit, a circuit element (e.g., a transistor, a resistor, a capacitor, an inductor, etc.), an integrated circuit, an application specific integrated circuit (ASIC), a programmable logic device (PLD), a digital signal processor (DSP), a field programmable gate array (FPGA), a logic gate, a register, a semiconductor device, a chip, a microchip, a chipset, etc. Examples of software may include a software component, a program, an application, a computer program, an application program, a system program, a machine program, an operating system software, a middleware, a firmware, a software module, a routine, a subroutine, a function, a method, a procedure, a software interface, an application program interface (API), an instruction set, a computing code, a computer code, a code segment, a computer code segment, a word, a value, a symbol, or any combination thereof. The decision whether an embodiment is implemented using hardware and / or software elements may vary according to any number of factors, such as desired computational speed, power levels, thermal tolerance, processing cycle budget, input data rates, output data rates, memory resources, data bus speeds and other design or performance constraints.

[0078] One or more aspects of at least one embodiment may be implemented by representative instructions stored on a machine-readable medium that represent various logic in a processor, and when read by a machine, the machine manufactures logic that performs the techniques described herein. Such representations, known as "IP cores," are stored on tangible machine-readable media and provided to various customers or manufacturing facilities for loading into manufacturing machines that create the logic or processors. Some embodiments may be implemented using a machine-readable medium or article that may store, for example, instructions or sets of instructions that, when executed by the machine, cause the machine to perform methods and / or operations in accordance with the embodiments. Such machines may include, for example, any suitable processing platform, computing platform, computing device, processing device, computing system, processing system, computer, processor, etc., and may be implemented using any suitable combination of hardware and / or software. A machine-readable medium or article may include, for example, any suitable type of memory unit, memory device, memory article, memory medium, storage device, storage article, storage medium and / or storage unit, such as memory, removable or non-removable media, erasable or non-erasable media, writable or rewritable media, digital or analog media, hard disk, floppy disk, compact disk read only memory (CD-ROM), compact disk recordable (CD-R), compact disk rewriteable (CD-RW), optical disk, magnetic media, magneto-optical media, removable memory cards or disks, various digital versatile disks (DVDs), tapes, cassettes, etc. The instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, encrypted code, etc., and may be implemented using any suitable high-level, low-level, object-oriented, visual, compiled and / or interpreted programming language.

[0079] The foregoing description of exemplary embodiments has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the disclosure to the precise form disclosed. Many modifications and variations are possible in light of this disclosure. It is intended that the scope of the disclosure be limited not by this detailed description, but by the appended claims. Future applications claiming priority to this application may claim the disclosed subject matter in a different manner and may generally include any set of one or more limitations as variously disclosed or demonstrated herein.

Claims

1. A processor; and a memory storing instructions that, when executed by the processor, cause the processor to: receiving a request to publish a review of a merchant and / or service provider entity to a review platform; receiving encrypted data from the contactless card by the application; the application sending to an authentication server (i) the encrypted data, (ii) an application identifier for the application, and (iii) an entity identifier associated with the entity; the application receiving from the authentication server instructions specifying that the authentication server (i) decrypted the encrypted data and (ii) determined that the contactless card was used to make a purchase at the entity; approving, by the application, the request to publish the review based on the instructions received from the server; publishing the review to the review platform based on the instructions received by the application from the authentication server; A device that performs the above.

2. The memory storing instructions that, when executed by the processor, cause the processor to, before granting the request: receiving transaction data from the contactless card for one or more previous transactions in which the contactless card was used to provide payment information; determining that the entity identifier is specified in the transaction data of the one or more previous transactions, wherein the application approves the request based at least in part on the determination that the entity identifier is specified in the transaction data of the one or more previous transactions; The apparatus of claim 1 , further comprising:

3. The memory storing instructions that, when executed by the processor, cause the processor to, before granting the request: the application disabling a submit element of a graphical user interface (GUI) of the application, the submit element functioning, when enabled, to submit the review for publication; The apparatus of claim 1 , further comprising:

4. The memory storing instructions that, when executed by the processor, cause the processor, upon receiving the instruction from the server: enabling, by the application, the send element of a GUI based on the instructions received from the authentication server; The apparatus of claim 3 , further comprising:

5. The memory stores instructions that, when executed by the processor, cause the processor to: the application sending a review confirmation to the contactless card specifying that the review has been published to the reviews platform; the application receiving the review confirmation from the contactless card specifying that the review has been published to the reviews platform; the application sending to a point of sale device associated with the entity a received review confirmation specifying that the review has been published to the review platform; receiving, from the point of sale device, an indication of a reward for at least one of (i) the purchase, and (ii) a subsequent purchase, based on the review confirmation; The apparatus of claim 1 , further comprising:

6. The memory stores instructions that, when executed by the processor, cause the processor to: receiving, by the application, a second request to publish a review of a second entity to the review platform; receiving, by the application, second encrypted data from the contactless card; the application sending to the authentication server: (i) the second encrypted data; (ii) the application identifier of the application; and (iii) an entity identifier associated with the second entity; the application receiving from the authentication server at least one of: (i) an indication that the authentication server did not decrypt the second encrypted data; or (ii) an indication that the authentication server determined that the contactless card was not used for a purchase at the second entity; rejecting the second request to publish the review based on at least one instruction received by the application from the server; and The apparatus of claim 1 , further comprising:

7. 7. The device of claim 6, wherein the application rejects the second request based on instructions specifying that the authentication server did not decrypt the second encrypted data and instructions specifying that the authentication server determined that the contactless card was not used to make a purchase at the second entity.

8. A non-transitory computer-readable storage medium storing instructions that, when executed by a processor of a device, cause the processor to: receiving a request to publish a review of an entity, the entity being a merchant and / or a service provider, to a reviews platform; receiving encrypted data from the contactless card by the application; the application sending to an authentication server (i) the encrypted data, (ii) an application identifier for the application, and (iii) an entity identifier associated with the entity; the application receiving from the authentication server instructions specifying that the authentication server (i) decrypted the encrypted data and (ii) determined that the contactless card was used to make a purchase at the entity; approving, by the application, the request to publish the review based on the instructions received from the server; publishing the review to the review platform based on the instructions received by the application from the authentication server; A non-transitory computer-readable storage medium for causing the computer to execute

9. The non-transitory computer readable storage medium storing instructions that, when executed by the processor, cause the processor to, before granting the request: receiving transaction data from the contactless card for one or more previous transactions in which the contactless card was used to provide payment information; determining that the entity identifier is specified in the transaction data of the one or more previous transactions, wherein the application approves the request based at least in part on the determination that the entity identifier is specified in the transaction data of the one or more previous transactions; 10. The non-transitory computer-readable storage medium of claim 8,

10. The non-transitory computer readable storage medium storing instructions that, when executed by the processor, cause the processor to, before granting the request: the application disabling a submit element of a graphical user interface (GUI) of the application, the submit element functioning, when enabled, to submit the review for publication; 10. The non-transitory computer-readable storage medium of claim 8,

11. The non-transitory computer-readable storage medium storing instructions that, when executed by the processor, cause the processor, after receiving the instructions from the server, to: enabling, by the application, the send element of a GUI based on the instructions received from the authentication server; 11. The non-transitory computer-readable storage medium of claim 10,

12. The non-transitory computer-readable storage medium stores instructions that, when executed by the processor, cause the processor to: the application sending a review confirmation to the contactless card specifying that the review has been published to the reviews platform; the application receiving the review confirmation from the contactless card specifying that the review has been published to the reviews platform; the application sending to a point of sale device associated with the entity a received review confirmation specifying that the review has been published to the review platform; receiving, from the point of sale device, an indication of a reward for at least one of (i) the purchase, and (ii) a subsequent purchase, based on the review confirmation; 10. The non-transitory computer-readable storage medium of claim 8,

13. The non-transitory computer-readable storage medium stores instructions that, when executed by the processor, cause the processor to: receiving, by the application, a second request to publish a review of a second entity to the review platform; receiving, by the application, second encrypted data from the contactless card; the application sending to the authentication server: (i) the second encrypted data; (ii) the application identifier of the application; and (iii) an entity identifier associated with the second entity; the application receiving from the authentication server at least one of: (i) an indication that the authentication server did not decrypt the second encrypted data; or (ii) an indication that the authentication server determined that the contactless card was not used for a purchase at the second entity; rejecting the second request to publish the review based on at least one instruction received by the application from the server; and 10. The non-transitory computer-readable storage medium of claim 8,

14. The non-transitory computer readable storage medium storing instructions that, when executed by the processor, cause the processor to, prior to publishing the review on the review platform: the application receiving input including the review of the entity; 10. The non-transitory computer-readable storage medium of claim 8,

15. receiving, by an application executing on a processor of the device, a request to publish a review of an entity that is a merchant and / or service provider to a review platform; receiving encrypted data from the contactless card by the application; the application sending to an authentication server (i) the encrypted data, (ii) an application identifier for the application, and (iii) an entity identifier associated with the entity; the application receiving from the authentication server instructions specifying that the authentication server (i) decrypted the encrypted data and (ii) determined that the contactless card was used to make a purchase at the entity; approving, by the application, the request to publish the review based on the instructions received from the server; publishing the review to the review platform based on the instructions received by the application from the authentication server; The method includes:

16. The method further comprises, prior to approving the request: receiving transaction data from the contactless card for one or more previous transactions in which the contactless card was used to provide payment information; determining that the entity identifier is specified in the transaction data of the one or more previous transactions, wherein the application approves the request based at least in part on the determination that the entity identifier is specified in the transaction data of the one or more previous transactions; The method of claim 15 further comprising:

17. The method further comprises, prior to approving the request: the application disabling a submit element of a graphical user interface (GUI) of the application, the submit element functioning, when enabled, to submit the review for publication; The method of claim 15 further comprising:

18. The method includes, after receiving the instruction from the server, enabling, by the application, the send element of a GUI based on the instructions received from the authentication server; 20. The method of claim 17, further comprising:

19. The method comprises: the application sending a review confirmation to the contactless card specifying that the review has been published to the reviews platform; the application receiving the review confirmation from the contactless card specifying that the review has been published to the reviews platform; the application sending to a point of sale device associated with the entity a received review confirmation specifying that the review has been published to the review platform; receiving, from the point of sale device, an indication of a reward for at least one of (i) the purchase, and (ii) a subsequent purchase, based on the review confirmation; The method of claim 15 further comprising:

20. The method comprises: the application outputting instructions specifying tapping the contactless card against the device to approve the request; The method of claim 15 further comprising:

Images