Two factor authentication using a one-time password
View Patent ↗Methods and systems for online authentication eliminate the common username plus password combination, using instead a novel two-factor authentication that employs a mobile phone number and a one-time, limited life password. The user provides the mobile phone number to a login dialog and receives, from a service provider, the one-time password, e.g., via a text message, at the mobile device to which the phone number belongs. If the user enters the one-time password before it expires, the user is authenticated and logged in. A method for authentication or authorization to a website includes: receiving a phone number from a user via a communication network in response to a login prompt displayed to the user; transmitting a one-time password to the phone number using text messaging; and in response to receiving the one-time password back from the user, authenticating the user for transactions with the website.
1. A system comprising:
a non-transitory memory storing machine-readable data; and
one or more hardware processors coupled to the non-transitory memory and configured to communicate over a network with a mobile device of a user and with a plurality of websites and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:
displaying a login prompt to the user at a merchant website from the plurality of websites;
receiving a phone number from the user having an account with a financial service provider (FSP), via the network, in response to the login prompt;
transmitting a one-time password to a mobile phone using the phone number; and
in response to only receiving the one-time password from the user via the network,
authenticating, by the FSP, the user with the merchant website;
sharing, with the merchant website, profile information about the user from the user's account with the FSP, including a unique identifier generated by the FSP that represents the user's account with the FSP, wherein the profile information is associated with the unique identifier generated by the FSP;
logging the user directly into the merchant website based on the profile information and the unique identifier; and
logging the user, from the merchant website, into a second website of the plurality of websites based on the profile information and the unique identifier without further use of the one-time password or phone number.
2. The system of claim 1 , wherein the one-time password is not sent to the merchant website.
3. The system of claim 1 , wherein the login prompt is displayed on a login host website.
4. The system of claim 1 , wherein the one-time password has predefined expiration period, after which the processor does not authenticate the user in response to receiving the one-time password.
5. The system of claim 1 , wherein receiving the phone number comprises receiving the phone number via the network from a device displaying the login prompt.
6. The system of claim 1 , wherein the one-time password is transmitted using short message service (SMS) texting to a device having the phone number.
7. The system of claim 1 , wherein receiving the one-time password comprises receiving the one-time password via the network from a device displaying the login prompt.
8. The system of claim 1 , wherein receiving the one-time password comprises receiving the one-time password via the network from a phone to which the one-time password was transmitted.
9. A method comprising:
displaying a login prompt to a user at a merchant website;
receiving a phone number from the user having an account with a financial service provider (FSP), via a network, in response to the login prompt;
transmitting a one-time password using the phone number; and
in response to only receiving the one-time password from the user via the network,
authenticating, by the FSP, the user with the merchant website;
sharing, with the merchant website, profile information about the user from the user's account with the FSP, including a unique identifier generated by the FSP that represents the user's account with the FSP, wherein the profile information is associated with the unique identifier generated by the FSP;
logging the user directly into the merchant website based on the profile information and the unique identifier; and
logging the user, from the merchant website, into a second website based on the profile information and the unique identifier without further use of the one-time password or phone number.
10. The method of claim 9 , wherein the one-time password is not sent to the merchant website.
11. The method of claim 9 , further comprising displaying the login prompt on a login host website.
12. The method of claim 9 , further comprising:
setting an expiration period for the one-time password, wherein:
after the expiration period has passed, authentication of the user fails.
13. The method of claim 9 , wherein receiving the phone number comprises:
receiving the phone number via the network from a device displaying the login prompt.
14. The method of claim 9 , wherein receiving the one-time password comprises:
receiving the one-time password via the network from a device displaying the login prompt.
15. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
displaying a login prompt to a user at a merchant website;
receiving a phone number from the user having an account with a financial service provider (FSP), via a network, in response to the login prompt;
transmitting a one-time password using the phone number; and
in response to receiving only the one-time password from the user via the network,
authenticating, by the FSP, the user with the merchant website;
sharing, with the merchant website, profile information about the user from the user's account with the FSP, including a unique identifier generated by the FSP that represents the user's account with the FSP, wherein the profile information is associated with the unique identifier generated by the FSP;
logging the user directly into the merchant website based on the profile information and the unique identifier; and
logging the user, from the merchant website, into a second website based on the profile information and the unique identifier without further use of the one-time password or phone number.
16. The non-transitory machine-readable medium of claim 15 wherein
the one-time password is not sent to the merchant website.
17. The non-transitory machine-readable medium of claim 15 further comprising machine-readable instructions executable to cause the machine to perform operations comprising:
displaying the login prompt on a login host website.
18. The non-transitory machine-readable medium of claim 15 further comprising machine-readable instructions executable to cause the machine to perform operations comprising:
setting an expiration period for the one-time password, wherein:
after the expiration period expires, the processor does not authenticate the user in response to receiving the one-time password.
19. The non-transitory machine-readable medium of claim 15 further comprising machine-readable instructions executable to cause the machine to perform operations comprising:
transmitting the one-time password using short message service (SMS) texting to a device having the phone number.
20. The non-transitory machine-readable medium of claim 15 further comprising machine-readable instructions executable to cause the machine to perform operations comprising:
receiving the one-time password via the network from a phone to which the one-time password was transmitted.