Payment cards, authentication methods, and uses for remote payments

Abstract

The invention relates to a payment card (1) comprising at least one authentication code (3) on one side (10, 11), said authentication code (3) being unique and belonging to the payment card (1), said authentication code (3) being affixed to the payment card (1), said authentication code (3) forming a means for identifying the payment card (1) by optical recognition, said identification means being linked to a bank account to which the payment card (1) is linked. The invention also relates to a method for authenticating the payment card (1) and the bearer (100) of said payment card (1) in order to carry out secure operations on personal data of the bearer (100) of said payment card (1). Finally, the invention relates to the use of the authentication method for making remote payments using the payment card (1).

Description

[Technical Field]

[0001] The present invention is in the field of protecting financial transactions with bank cards, and more particularly remote bank payments carried out over the Internet. [Background technology]

[0002] It should be noted that a bank card is a card made of plastic, paper, or cardboard, measuring a few centimeters on each side and 2 millimeters thick. The card traditionally carries at least one integrated circuit capable of containing information. This integrated circuit corresponds to a chip and may include a microprocessor capable of processing this information, or may be limited to a non-volatile memory circuit, and may optionally include a security component such as a memory card.

[0003] When making a remote payment with a bank card, it is necessary to provide "security data" of the bank card in order to carry out the financial transaction.

[0004] These security data are generally imprinted on one or other of the faces of this chip card. Typically, bank cards contain data for identifying the bank account and / or the owner of the bank card. These identification data are generally imprinted on the front side of the bank card. More specifically, the card number, also called PAN number, is linked to the bank account. In addition, most bank cards also contain the identification information of the bank card owner (first and last name and / or company name) on one side. Furthermore, banking organizations also imprint the expiration date of payment cards.

[0005] These data for identifying the account and / or owner of the chip card are generally printed or embossed on the front side of the bank card. Typically, these markings are made by chip card embossing techniques (on the front side) or by screen printing.

[0006] Most bank cards also include a security code or visual code affixed to the back (or reverse side) of the bank card.

[0007] In practice, the owner or holder of a bank card is prompted to provide these identification data when making an online or telephone payment.

[0008] Since the early 21st century, electronic commerce, and more generally online payments, has grown exponentially in terms of both the number of transactions and the financial volume of these transactions.

[0009] In the face of this increase in the volume of online payments, the issue of cybersecurity appears to be crucial. Indeed, in parallel with this increase in online payments, an increase in bank card fraud has also been observed, particularly through online or phone hacking.

[0010] Among these numerous fraudulent activities, two types are distinguished: one involves the use of a bank card and is called CP when the card is present, and the other, called CNP, when the card is not present. The first type of fraud involves the physical theft of a bank card, and the hacker who owns the stolen card also has access to security data that allows them to steal the identity of the cardholder in order to perform online payments. Visual hacking of security data can also be likened to this first type of fraud through identity theft. In fact, visual hacking is typically carried out during a store payment, where the merchant copies the security data without the knowledge of the cardholder. The hacker then possesses the bank card's security data and can perform remote transactions for themselves or to resell them to third parties.

[0011] Phishing is a second type of fraud involving identity theft. This technique has undoubtedly evolved in recent years. It consists in convincing the victim that they are a trusted third party, such as a bank or government agency, in order to extract personal information (passwords, credit card numbers, ID numbers or photocopies, date of birth, etc.). This can be done by reproducing an entire website, sending emails, or sending text messages. As a result, the hacker possesses the security data of the bank card, which can also be used to carry out transactions to their own account.

[0012] To prevent this type of fraud, banking organizations have introduced a method to secure payments by sending a payment confirmation text message (SMS) to the bank cardholder's mobile phone. This text message typically contains an alphanumeric code sent by the financial institution to validate the payment. This service has an authentication name called "3D-Secure®." While this system provides some security, it has several weaknesses that allow hackers to circumvent it. First, not all banks offer such a service. Similarly, not all payment systems used by commercial sites allow the use of this method to secure financial transactions. In fact, currently, only 40% of online transactions in France are approved by this system. Furthermore, this system can change the phone number to which the alphanumeric code is sent. This is a boon for hackers, allowing them to divert the transmission of the alphanumeric code to their own phone.

[0013] These shortcomings have forced the European Commission, in a recent decision, to establish new, stricter European standards requiring a higher level of security for online payments. The ambitious timetable for applying these new standards, aiming to put them into effect in 2021, comes with major drawbacks: it risks non-standardization and allows banks to choose their own solutions.

[0014] Alternative solutions exist for securing transactions, such as bank card types that include a dynamic CVV code, which corresponds to a series of three numbers that are generally found on the front of the bank card.

[0015] The CVV code is called dynamic because it is a sequence of three numbers that changes randomly, automatically, and regularly. Therefore, it is possible to safely trust information from a dynamic bank card for online transactions. Indeed, even in the case of phishing, the security data of the bank card cannot be used because the code changes regularly.

[0016] Bank cards with dynamic cryptography only partially address the problem of phishing; they do not address the problem of physical theft of the bank card. In addition to the fact that the technology embedded in such cards is technologically advanced, particularly by incorporating both the battery and the screen into the thickness of the card, the technology is very costly and uneconomical, which has slowed universal adoption.

[0017] It should be noted that the applicant has already proposed a solution to combat identity theft following physical theft and / or visual hacking of a bank card. This solution proposes integrating a cryptogram in place of the three digits of the bank card's personal information (PAN) number. This solution is described in particular in WO 2020 / 120849. Despite possessing a bank card, a hacker does not possess all the security data necessary to make online payments himself. In fact, the owner of this type of bank card receives, on the one hand, a bank card in which part of the personal information (PAN) number is hidden, and, on the other hand, a hidden number. This hidden number can be revealed by a digital method developed by the applicant, which is also the subject of French patent application no. 2005961.

[0018] This solution of encrypting the bank card PAN number has proven effective against physical and / or visual theft of the bank card, but it does not prevent phishing of the bank card's security data.

[0019] As a result, it should be noted that at the time of writing, banking organizations and online merchants have not yet found an adequate solution for securing online bank card transactions. Summary of the Invention [Problem to be solved by the invention]

[0020] To overcome these drawbacks, the Applicant has developed a technical solution aimed at securing online payments through two-factor authentication, which guarantees the authenticity of the bank card and the holder of said bank card. [Means for solving the problem]

[0021] A first aspect of the invention relates to a payment card having a front side and a back side, the payment card also including an electronic chip, the front side carrying security data including at least one PAN number, identification information of the holder of the payment card and the expiry date of the payment card, and the back side carrying a CVV code, typically consisting of three numbers.

[0022] The payment card comprises, on at least one side, an authentication code containing between 200 and 10,000 characters, the authentication code being unique and belonging to the payment card to which it is affixed, the authentication code forming a means of identifying the payment card by optical recognition, the identification means being linked to the bank account to which the payment card is linked.

[0023] The payment card according to the present invention is provided with a unique authentication code affixed to the side of the payment card. This authentication code contains a number of characters, making it unique. In fact, the authentication code contributes to providing a means of authenticating the payment card by optical recognition of the authentication code. This authentication code contributes to improving the security of secure transactions by limiting phishing scams. In fact, if a hacker succeeds in deactivating the security data of the payment card, the authentication method according to the present invention requires verification of the secure transaction by optical recognition of the authentication code. Therefore, if a hacker does not have possession of the payment card and its security data, he or she cannot use the payment card for his or her own benefit.

[0024] According to a second feature of the first aspect of the invention, the authentication code is a matrix code forming a predetermined number of black modules arranged against a white background to form a unique pattern, each black module forming a character of the authentication code. This type of matrix code provides a large number of combinations that allow each payment card to contain a unique authentication code that is also said to "belong" to that card.

[0025] According to a third feature of the first aspect of the present invention, the PAN number consists of four sets of four digits, and the payment card includes a PAN encryption that replaces at least the four sets of digits of the PAN number. The PAN encryption provides additional security that makes it possible to resist physical and / or visual theft of the payment card. Indeed, even in the event of physical and / or visual theft, a hacker does not have the entire PAN number of the payment card. Therefore, the card cannot be used.

[0026] Specifically, the PAN code contains 16 to 100 characters, and preferably, the PAN code contains 36 to 64 characters. According to the present invention, the PAN code is a cardan grille.

[0027] According to a fourth feature of the first aspect of the present invention, the CVV code may be replaced by a code having a number of characters greater than 3. This feature also aims to conceal security data of the payment card in order to counter physical and / or visual theft of the payment card.

[0028] A second aspect of the present invention relates to a payment card as defined in accordance with the first aspect of the present invention and to a method for authenticating the holder of said payment card, the authentication method being aimed at performing secure operations on personal data of the holder of the payment card, in this respect comprising at least: a) a first step of authenticating the payment card by entering payment card security data and / or a first authentication of the payment card holder, in which the payment card holder enters his / her identity and / or identifier; b) requesting a secure operation on personal data of the holder of the payment card, the request being performed using a secure digital space linked to the payment card's bank account opened with the financial institution, the secure digital space being stored on a remote server managed by the financial institution; c) validating the entered security data of the payment card by comparing the entered security data with reference data stored in a secure digital space; d) a second step of authenticating the payment card and the holder of the payment card, the second authentication step being carried out by recognition of an authentication cryptogram belonging to the payment card, the second authentication step being carried out by a digital authentication module available or accessible via a digital terminal belonging to the holder of the payment card; e) completing a secure operation on the payment card holder's personal data;

[0029] Through two authentication steps a) and d), the method according to the invention incorporates two-factor authentication of the payment card and / or the holder of said card. This two-factor authentication enhances the security of secure transactions such as remote payments. In fact, the method involves entering the security data of the payment card, but the holder of this card who carries out the transaction must open the recognition module, and finally, the holder of the payment card must have possession of his / her payment card for the encryption code belonging to the payment card to be recognized. In fact, this type of hacking does not make it possible to recover the authentication code belonging to the payment card, so the authentication method renders phishing as it currently exists ineffective.

[0030] According to a first feature of the second aspect of the invention, the second authentication step d) is performed by opening a secure communication channel between the secure digital space of the bank account and a digital terminal of the holder of the payment card, the secure digital space of the bank account requesting the opening of a digital recognition module.

[0031] According to a second feature of the second aspect of the present invention, the authentication method comprises a biometric and / or code authentication operation of the holder of the payment card when the recognition module is opened, and if the authentication of the holder of the payment card is successful, the recognition module grants access to a camera of the digital terminal to enable digital capture of an authentication code of the payment card.

[0032] According to a third feature of the second aspect of the present invention, the method includes comparing an authentication code affixed to the payment card with a digital image of the authentication code stored in a secure digital space of the bank account.

[0033] According to a fourth feature of the second aspect of the invention, when the connection step a) is performed in a secure online portal separate from the secure digital space 6, a secure communication channel is opened between the secure online portal and the secure digital space linked to the bank account of the payment card.

[0034] According to a fifth feature of the second aspect of the present invention, the authentication method includes the step of location information of the digital terminal of the holder of the payment card.

[0035] A third aspect of the invention relates to the use of an authentication method as defined in accordance with the second aspect of the invention for enabling remote payments, in particular remote payments carried out via a website, the remote payments being made via a payment card as defined in accordance with the first aspect of the invention. [Brief explanation of the drawings]

[0036] Other features and advantages will become apparent in the following detailed description of two non-limiting exemplary embodiments of the invention as illustrated by the accompanying FIGS. [Figure 1] 1 shows the front side of a payment card according to the present invention; [Figure 2] FIG. 2 shows the back side of the payment card of FIG. 1. [Figure 3]FIG. 1 illustrates a digital terminal receiving a call from a bank server to authenticate a payment card. [Figure 4] FIG. 3 shows the steps of recognition of the authentication code of the payment card of FIGS. 1 and 2. [Figure 5] FIG. 1 illustrates a system and method for authenticating a payment card according to a first exemplary embodiment of the present invention. [Figure 6] FIG. 1 illustrates a system and method for authenticating a payment card according to a second exemplary embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0037] As shown in Figures 1 to 5, the present invention relates to a payment card 1, which corresponds to a bank card. In practice, the payment card 1 according to the invention is connected to a financial account opened with a banking institution. The bank account and the payment card 1 are assigned to a user, also called the owner of the bank account or the bearer 100 of the payment card 1.

[0038] The payment card 1 includes a front side 10 and a back side 11. Conventionally, the payment card 1 also incorporates an electronic chip 12. This electronic chip 12 comprises a processor and memory configured to execute algorithms and / or store data.

[0039] As shown in Figure 1, the front side 10 includes security data 2. The security data 2 includes at least one PAN number 20. The PAN number 20 is made up of several series of digits, for example, four series of four digits, totaling 16 digits. The term "PAN" is common in banking jargon. In this example, by reading the payment card 1 from left to right, the PAN number 20 includes a first series of digits 200, a second series of digits 201, a third series of digits, and a fourth series of digits 203.

[0040] As shown in Figure 1, it is possible to replace at least a series of four digits of the PAN number 20 with the PAN code 21. In this example, the PAN code 21 replaces the third series of digits of the PAN number 2. However, it is alternatively possible for the PAN code 21 to replace the fourth series of digits 203 of the PAN number 2.

[0041] According to the invention, the PAN code 21 contains between 16 and 100 characters. Preferably, the PAN code 21 contains between 36 and 64 characters. In the example of Fig. 1, the PAN code 21 consists of a cardan grille. Nevertheless, it is possible to envisage the use of other types of PAN code 21, such as a linear barcode or a matrix barcode.

[0042] It is noted that this technique of encrypting the PAN number using a cardan grille as the PAN cipher 21 is described in more detail in WO 2020 / 120849 filed by the applicant. Furthermore, a method for digitally revealing the encrypted sequence of digits is described in French patent application FR 2005961, also filed by the applicant. As explained in the introduction, the encryption of the sequence of digits of the PAN number 21 makes it possible to effectively combat identity theft fraud, in particular after physical theft of a payment card.

[0043] 1, the security data 2 also includes the identification 22 of the holder 100 of the payment card 1. In addition, the security data 2 includes the expiration date 23 of the payment card 1.

[0044] Conventionally, the security data 2, 20, 21, 22, 23 affixed to the front side 10 of the payment card 1 are imprinted by printing and / or embossing, or even by screen printing, onto the surface of the payment card 1. In this embodiment, apart from the printed PAN code 21, the other security data 2, 20, 22, 23 are affixed by embossing.

[0045] As shown in Figure 2, the back side 11 has a CVV code 24. This CVV code 24 is typically three numbers. Optionally, the CVV code 24 can be replaced by a code having more than three characters. As information, codes such as a cardan grille, a linear barcode, or a matrix barcode can be used instead of the CVV code 24.

[0046] The CVV encryption 24 also utilizes security data 2 of the payment card 1. These security data 2 are called security data because they are used to authenticate the payment card 1 with the banking authority during remote payments.

[0047] According to the invention, the payment card 1 comprises at least one authentication code 3, which is unique and belongs to the payment card 1. This authentication code 3 constitutes a means of authenticating the payment card 1 by optical recognition. It is linked to the bank account of the payment card 1.

[0048] The authentication code 3 may be affixed to one side 10, 11 of the payment card 1. In the embodiment of Figure 2, the authentication code 3 is affixed to the back side 11. However, the authentication code 3 may also be available on the front side 10 of the payment card 1.

[0049] According to the present invention, the authentication encryption 3 contains 200 to 10,000 characters.

[0050] In the embodiment shown in Figures 2, 4, and 5, the authentication code 3 consists of a matrix code. A matrix code is also called a "two-dimensional barcode." In practice, a matrix code consists of a predetermined number of black modules arranged against a white background to form a single pattern. Thus, each black module constitutes one character of the authentication code 3. Each black module has a predetermined dimension. This type of matrix code is known as a QR Code (registered trademark). The large number of characters in the authentication code 3 makes the authentication code 3 unique.

[0051] It should be noted that the authentication code 3 can be formed by another type of visual code, such as a holographic code, a cardan grille, etc. The advantage of a Data Matrix type code is its already established ability to be read and recognized by smartphones and current banking applications.

[0052] As shown in Figures 5 and 6, the present invention also relates to an authentication system 4 of a payment card 1 and a holder 100. Two-factor authentication of the holder 100 and its payment card 1 contributes to performing secure operations on personal data of the holder 100 of the payment card 1. For example, the secure transaction may correspond to a remote payment performed using the payment card 1 (Figure 5). This two-factor authentication is particularly useful for remote payments over the Internet. However, two-factor authentication can also be used to perform digital signatures, transactions on customer accounts, bank fund transfers, etc.

[0053] 5 and 6, the authentication system 4 comprises a digital terminal 5. The digital terminal 5 may comprise a smartphone, a digital tablet, etc. More broadly, the invention can be implemented using any electronic device comprising a display means such as a screen, a multimedia capture tool such as a still or video camera, a memory, and a processor for storing and executing algorithmic applications. The electronic device may also comprise a means for communication via a telecommunications network such as a cellular phone network, a landline telephone network, the Internet, etc.

[0054] According to the invention, the digital terminal 5 incorporates a module 50 for the recognition of the authentication cryptogram 3 belonging to the payment card 1. The recognition module 50 is configured for the digital capture of the authentication cryptogram 3. For these purposes, the recognition module 50 is integrated into an application system configured to control the camera of the digital terminal 5. By way of example, the recognition module 50 can be integrated into an application for managing a bank account linked to the payment card 1. This application for managing a bank account is naturally stored and executed by the digital terminal 5. It is noted here that each financial institution makes its bank management application available to its clients. The recognition module 50 can therefore be added to an already existing application or is an algorithmic brick corresponding to the application algorithm itself.

[0055] The digital terminal 5 is configured to communicate remotely via a wireless communication network. For this purpose, the digital terminal 5 may be equipped with communication means such as a mobile phone transceiver. By way of example, the transceiver may be of the GSM, 2G, 3G, 4G, 5G, 6G type. In addition, the digital terminal 5 may be equipped with a short-range transceiver such as Bluetooth, Wi-Fi, etc. It should be noted that most digital terminals are equipped with Wi-Fi transceivers and Bluetooth transceivers. Furthermore, a mobile phone or a smartphone may also be equipped with a mobile phone transceiver.

[0056] As shown in Figures 5 and 6, the authentication system 4 according to the invention further comprises a secure digital space 6. The secure digital space 6 is linked to the bank account of the payment card 1. Typically, the secure digital space 6 is managed by the financial institution that manages said bank account of the holder of the payment card 1. The secure digital space 6 is stored by a remote server. In a known manner, this secure digital space 6 is remotely accessible via a secure protocol, such as a service call of the same type as that used by an electronic payment terminal (EPT) to perform a bank payment after swiping a bank payment card.

[0057] Typically, service calls can be protected by security protocols such as APA, HTTPS, or OAuth2.

[0058] The secure digital space 6 is also configured to open a secure communication channel, for example with a payment verification system of the PSP or "Payment Service Provider" type. Such a PSP payment verification system corresponds to an Application Programming Interface, also called "API". The API of this payment verification system is configured to open a secure communication channel between the secure digital space 6 and the owner of a bank account in order to verify remote payments. In this embodiment, the payment verification system used is configured to establish secure communication between the secure digital space 6 and a digital terminal 5 of the holder 100 of a payment card 1 linked to said bank account.

[0059] In the embodiment shown in Figure 5, the authentication system 4 may comprise a secure online portal 7. The online portal 7 is itself stored on a remote server separate from the bank server. In this embodiment, the online portal 7 is configured to communicate with the remote server that stores the secure digital space 6 of the bank account. When the holder 100 wishes to perform an online payment transaction, the online portal 7 is a payment portal hosted on a website, such as a merchant site.

[0060] According to the present invention, the online portal 7 is configured to perform secure operations on personal data of the holder 100 of the payment card 1. Such secure transactions may correspond to remote payments, digital signatures, transactions on customer accounts, bank fund transfers, etc., as described above.

[0061] In the embodiment of Figure 6, the online portal 7 may be identical to the secure digital space 6. This possibility is more specific for bank transfer transactions or transactions on customer cards. In this configuration, holders 100 communicate directly with their digital terminals 5 via the secure digital space 6.

[0062] Thus, in conjunction with the authentication system 4, the secure digital space 6 is arranged to remotely communicate with a digital terminal 5 and / or an online portal 7 via a wireless communication network.

[0063] In all cases, secure operations on the holder's 100 personal data are performed after a two-factor authentication of the payment card 1 and the holder 100 of the payment card 1. In practice, the authentication system 4 includes a first, conventional authentication in every online payment transaction. This first authentication corresponds, on the one hand, to the authentication of the holder 100 by connecting to a personal digital space. This authentication of the holder 100 involves entering an identifier and password or biometric recognition. On the other hand, the first authentication also includes information about the security data 20, 21, 22, 23, 24, 200, 201, 203 of the payment card 1. Note that in this example, the PAN number 20 includes a PAN cryptogram 21. If the holder 100 does not have the sequence of digits replaced by the PAN cryptogram 21 in its memory, the holder 100 can reveal this sequence via a visualization method described in French Patent Application No. 2005961, also held by the applicant. In the example of FIG. 5, the first authentication is performed by connecting to the online portal 7. Conversely, in the embodiment of FIG. 6, the first authentication is performed directly from a secure digital space 6 linked to the payment card 1 .

[0064] Secondly, the authentication system 4 includes a second authentication, which is performed via a secure communication channel opened between the secure digital space 6 and the digital terminal 5 of the holder 100 of the payment card 1.

[0065] In practice, this second authentication corresponds, on the one hand, to authentication of the holder 100 by entering a password or by biometric recognition via the recognition module 50. In case of successful authentication of the holder 100 of the payment card 1, the recognition module 50 performs a second authentication of the payment card 1. This second authentication comprises reading or capturing the authentication cryptogram 3 of the payment card 1. In fact, this two-factor authentication is a condition for authorizing a secure transaction, since the holder 100 is in possession of his or her payment card 1 during verification of the transaction. Without the biometric data of the holder 100 or the authentication cryptogram 3, a hacker cannot activate the secure transaction. Furthermore, an additional level of security is provided by the payment card 1 comprising the PAN cryptogram 21.

[0066] The invention also relates to a compliant payment card 1 according to the invention and a method for authenticating the holder 100 of this payment card 1. This authentication is performed in order to carry out secure operations on the personal data of the holder 100 of the payment card 1. According to the invention, this authentication method can be used to authorize remote payments, in particular remote payments carried out via a website. However, the method according to the invention can also be useful for carrying out financial transactions, transactions on customer accounts, digital signatures, etc.

[0067] As shown in Figures 5 and 6, the authentication method comprises a first step of authenticating the payment card 1 and the bearer 100 of the payment card 1. This first authentication step is called step a). During this step a), the bearer 100 enters the security data 20, 21, 22, 23, 24, 200, 201, 203 of the payment card 1. In practice, step a) may also comprise authenticating the identity of the bearer 100 of the payment card 1. This authentication is performed by connecting to a secure digital space. The connection involves entering an access code and / or an identifier with biometric recognition. The biometric recognition can be digital or facial. This functionality depends on the features integrated into the digital terminal 5 of the bearer 100 of the payment card 1.

[0068] As shown in Figures 5 and 6, the authentication method comprises a step of requesting a secure operation on personal data of the holder 100 of the payment card 1. The request step is indicated by b). According to the invention, the request is made using a secure digital space 6 linked to the bank account of the payment card 1. Naturally, this bank account is opened with a financial institution. In this embodiment, the secure digital space 6 is stored on a remote server managed by the financial institution. As mentioned above, the secure digital space 6 is remotely accessible via current telecommunication means (Internet, mobile phone).

[0069] The authentication method comprises a step of verifying the entered security data 20, 21, 22, 23, 24, 200, 201, 203 of the payment card 1. This step is denoted c). The verification step c) is carried out by comparing the entered security data 20, 21, 22, 23, 24, 200, 201, 203 with reference data stored in the secure digital space 6. If this step is successful, the method according to the invention requires a second authentication to enable operations on the personal data of the holder 100 of the payment card 1.

[0070] For these purposes, the authentication method comprises a second step of authenticating the payment card and the bearer of the payment card, which is indicated with d). According to the invention, the second authentication step is carried out by recognition of the authentication code 3 of the payment card 1.

[0071] In this embodiment, step d) is performed via a digital identity module 50 available or accessible to the digital terminal 5 belonging to the holder 100 of the payment card 1. In practice, the second authentication step d) is performed by opening a secure communication channel between the secure digital space 6 and the digital terminal 5 of the holder 100 of the payment card 1. Such a secure communication channel may use the PSP system mentioned above. In practice, the secure digital space 6 of the bank account requires the opening of a digital identity module 50 on the digital terminal 5 of the holder 100 of the payment card 1.

[0072] As shown in Figure 3, when the recognition module 50 is opened, the method may include a biometric and / or coded authentication transaction of the holder 100 of the payment card 1. In this embodiment, biometric authentication by recognition of a fingerprint 51 is required. In case of authentication of the holder 100 of the payment card 1, the recognition module 50 grants access to the camera of the digital terminal 5 to enable digital capture of the authentication code 3 belonging to the payment card 1 (see Figure 4). The recognition module 50 includes a frame 52 within the payment card 1 which must be placed through the screen of the digital terminal 5. It should be noted that the recognition module 50 asks to scan the payment card 1.

[0073] The second authentication step involves a transaction in which the authentication code 3 attached to the payment card 1 is compared with a digital reference image of the authentication code. This reference image is stored in the secure digital space 6 of the bank account. If the reference image corresponds to the code 3 attached to the payment card, the second authentication step is considered successful.

[0074] If the second authentication step fails, the secure transaction may be immediately aborted, although the method may allow the payment card holder 100 to attempt a predetermined number of recognition tests. For example, it may be possible to provide three authentication cryptography 3 recognition tests before the secure transaction is aborted due to failure of two-factor authentication of the payment card 1 and the identity of its holder 100. In the event of a first failure, it may also be possible to switch to a more conventional authentication method, such as the secure 3D system described in the introduction of this specification.

[0075] However, in the case of a second authentication step d), the authentication method includes a step of terminating the secure operation on the personal data of the holder 100 of the payment card 1. The terminating step is indicated with e), which in effect transmits authorization to proceed with the secure transaction.

[0076] In addition, the authentication method may include a step of location information of the digital terminal 5 of the holder 100 of the payment card 1. The location of the holder 100 of the payment card 1 may provide information about fraud attempts. Indeed, if the digital terminal 5 is located in a country different from the country in which the bank account is opened, an alert can be generated that is sent to the holder 100. In practice, the recognition module 50 is configured to access location data of the digital terminal 5. Alternatively, the IP address of the digital terminal 5 may make it possible to provide information about the location information of the holder 100 of the payment card 5.

[0077] In essence, the purpose of this location information is to ensure that the entry of the security data 20, 21, 22, 23, 24, 200, 201, 203 of the payment card 1 and the recognition of the authentication code 3, in particular the QR code, are carried out from the same place.

[0078] According to a first exemplary embodiment shown in Fig. 5, the first authentication step a) is performed following connection to a secure digital space of a secure online portal 7 separate from the secure digital space 6. This possibility is very common and corresponds to a purchase made by the holder 100 of the payment card 1 on the online portal 7 of a commercial site. According to this example, the holder 100 enters the security data 20, 21, 22, 23, 24, 200, 201, 203 directly into the secure digital space of the online portal 7.

[0079] The request step b) is performed via a secure communication channel that is open between the online portal 7 and the secure digital space 6. This channel may be one that is already in use between the payment service provider and the bank.

[0080] In this situation, the final step e) is also performed via this secure communication channel. If the online portal 7 is a payment portal for a commercial website, the final step e) is to transmit a debit authorization between the financial institution of the payment card 1 and the financial institution to which the payment portal is assigned. The online portal 7 may also require a digital signature, which is provided through the authentication method of the present invention. In this case, the verification step e) transmits the authorization or the digital signature.

[0081] According to a second exemplary embodiment of the method shown in Fig. 6, a first authentication step a) is performed following connection of the payment card 1 to a secure digital space 6 linked to a bank account. According to this example, the holder 100 identifies himself to the secure digital space 6. In practice, the holder 100 authenticates himself by entering his identification information via an identifier. This identifier is verified by a password and / or biometric recognition (digital or facial recognition).

[0082] According to this embodiment, the request step b) is performed in a secure digital space 6. In this situation, the termination step e) is performed directly from the financial institution, for example to perform an intra-bank transfer, i.e. between two bank accounts opened at the same institution. These two bank accounts can belong to the same holder 100 or to two different entities. Alternatively, if a financial transaction between two banking organizations is involved, the termination step consists in transferring the authorization to debit the bank account of the holder 100 of the payment card 1 and credit the receiving financial institution. [Prior art documents] [Patent documents]

[0083] [Patent Document 1] International Publication No. 2020 / 120849 [Patent Document 2] French Patent Application No. 2005961

Claims

1. A method of authentication with a holder (100) of a payment card (1), the method being performed by a remote server managed by a financial institution for the purpose of performing secure operations on personal data of the holder (100) of the payment card (1), the method comprising at least: a) a first authentication step in which the remote server authenticates the payment card (1) by receiving security data (2, 20, 200, 201, 203, 22, 23) of the payment card (1) and the identity and / or identifier of the holder (100); b) the remote server receiving a request for a secure operation on personal data of the holder (100) of the payment card (1), the request being carried out using a secure digital space (6) linked to the bank account of the payment card (1) opened with a financial institution, data relating to the secure digital space (6) being stored on the remote server; c) the remote server verifying the received security data of the payment card (1), carried out by comparing the received security data (2, 20, 200, 201, 203, 22, 23) with reference data stored in the secure digital space (6); d) a second authentication step in which the remote server authenticates the payment card (1) and the bearer (100) of the payment card (1), the second authentication step being carried out by recognition of an authentication code (3) belonging to the payment card (1) and carried out by a digital authentication module (50) available or accessible via a digital terminal (5) belonging to the bearer (100) of the payment card (1); e) the remote server comparing the authentication code (3) attached to the payment card (1) with a digital reference image of the authentication code (3) stored in the secure digital space (6) of the bank account; f) authorizing said remote server to complete said secure operation on personal data of said holder (100) of said payment card (1).

2. 2. The authentication method according to claim 1, wherein step d) is performed by opening a secure communication channel between the secure digital space (6) of the bank account and the digital terminal (5) of the holder (100) of the payment card (1), the secure digital space (6) of the bank account requesting the opening of the digital recognition module (50).

3. 3. The authentication method according to claim 1 or 2, wherein the authentication method comprises, when the digital identification module (50) is activated, performing biometric and / or code authentication of the bearer (100) of the payment card (1), and if authentication of the bearer (100) of the payment card (1) is successful, the digital identification module (50) accesses a camera of the digital terminal (5) to enable digital capture of the authentication code (3) of the payment card (1).

4. 4. The authentication method according to claim 1, wherein when the reception of the security data in the first authentication step a) is performed via a secure online portal (7) separate from the secure digital space (6), a secure communication channel is opened between the secure online portal (7) and the secure digital space (6) linked to the bank account of the payment card (1).

5. An authentication method as described in any one of claims 1 to 4, comprising a step in which the remote server obtains location information of the digital terminal (5) of the holder (100) of the payment card (1), the location information being used to verify that the input of the security data and the recognition of the authentication code (3) are performed from the same location.

6. A payment card (1) for use in an authentication method according to any one of claims 1 to 5, comprising a front side (10) and a back side (11), said card incorporating an electronic chip (12), said front side (10) comprising security data (2) including at least one PAN number (20), an identification (22) of the holder of said payment card (1) and an expiration date (23) of said payment card (1), said back side (11) comprising a CVV code (24) consisting of three digits, and comprising on one side (10, 11) a unique authentication code (3) belonging to said payment card (1), said authentication code (3) being affixed to said payment card (1), The authentication code (3) is a matrix code containing 200 to 10,000 characters and forms an identification means of the payment card (1) by optical recognition, the identification means being linked to a bank account to which the payment card (1) is linked.

7. 7. A payment card (1) according to claim 6, wherein the matrix code of the authentication code (3) forms a predetermined number of black modules arranged against a white background to form a unique pattern, each of the black modules forming a character of the authentication code (3).

8. 8. A payment card (1) according to claim 6 or 7, wherein the PAN number (20) consists of four series of four digits, and the payment card (1) includes a PAN code (21) that replaces the PAN number (20) of at least four series of digits.

9. A payment card (1) according to claim 8, wherein said PAN code (21) comprises between 36 and 64 characters.

10. Payment card (1) according to claim 8 or 9, wherein the PAN code (21) is a cardan grille.

11. A payment card (1) according to any one of claims 6 to 10, wherein the CVV code (24) is replaced by a code having a number of characters greater than three.

12. Use of an authentication method according to any one of claims 1 to 5 for enabling remote payments, in particular remote payments carried out via a website, said remote payments being made via a payment card (1) according to any one of claims 6 to 11.

Images