System and method for authenticating a payment transaction
A system and method of authenticating a payment transaction between a merchant and a customer in an electronic payment system are described. Transaction details presented by the merchant are received at a mobile electronic device, the customer is authenticated by means of an authentication token presented by the customer at an authentication terminal, and the geo-location of the mobile electronic device and the authentication terminal are compared to verify that the device and terminal are within a predefined geographical distance at the time the payment transaction is processed.
1. A computer-implemented method comprising:
receiving over a computer network, by an automated authentication system, transaction details from a mobile point of sale device, along with a time that said transaction details were received by the mobile point of sale device;
receiving, from a first location determining device of the mobile point of sale device, first location information describing a geographical location of the mobile point of sale device;
receiving, from a second location determining device of a token authenticator device, second location information describing a geographical location of the token authenticator device separate from and communicatively coupled to the mobile point of sale device, the token authenticator device comprising a token reader device for verifying an authentication token;
determining, by the automated authentication system, based on the received first and second location information, transaction details, and time that said transaction details were received, if the mobile point of sale device and the token authenticator device are within a predefined geographical distance of each other at the time that said transaction details are received;
in response to determining that said devices are within the predefined geographical distance of each other, enabling the token reader device of the token authenticator device to proceed with verification of the authentication token using the token authenticator; and
in response to determining that said devices are not within the predefined geographical distance of each other, transmitting command data to render the token authenticator device unusable.
2. The method of claim 1 , wherein the automated authentication system verifies that the merchant mobile point of sale device and the separate token authenticator device are within the predefined geographical distance at substantially the time the transaction details are received.
3. The method of claim 1 , further comprising transmitting a transaction authorization request after the authentication token is authenticated.
4. The method of claim 3 , wherein the step of authenticating the authentication token further includes verifying a code entered to the separate token authenticator device.
5. The method of claim 1 , further comprising calculating a distance between the geographical location of the separate token authenticator device and the geographical location of the mobile point of sale device.
6. The method of claim 5 , wherein the mobile point of sale device and the separate token authenticator device are mutually authenticated when the geographical location of the separate token authenticator device and the geographical location of the mobile point of sale device are within a predefined distance and a time stamp of the geographical location of the separate token authenticator device and the geographical location of the mobile point of sale device is within a predefined time window from the time the transaction details are received by the automated authentication system.
7. The method of claim 5 , wherein the geographical location of the separate token authenticator device and the geographical location of the mobile point of sale device are tracked at predefined intervals.
8. The method of claim 1 , wherein verifying that the mobile point of sale device and the separate token authenticator device are within the predefined geographical distance is performed by an automated authentication system of a merchant acquirer or a trusted third party associated with the merchant acquirer.
9. The method of claim 8 , further comprising storing data associated with the mobile point of sale device and the separate token authenticator device in a database of the automated authentication system.
10. The method of claim 1 , wherein the transaction details provided by the mobile point of sale device are provided via a secure application running on the mobile point of sale device.
11. The method of claim 10 , wherein the secure application is secured by means of a passcode.
12. An apparatus comprising:
a mobile point of sale device comprising:
a mobile point of sale storage unit;
a merchant application stored on the mobile point of sale storage unit,
a mobile point of sale processor, configured to execute the merchant application and further configured to cause the mobile point of sale device to receive and transmit details of a transaction, along with a time that said transaction details were received by the mobile point of sale device; and
a first location determining device configured to detect a geographical location of the mobile point of sale device; and
a token authenticator device separate from and communicatively coupled via a direct communication path to the mobile point of sale device, the token authenticator device comprising:
a token reader device configured to verify an authentication token associated with the transaction; and
a second location determining device configured to detect a geographical location of the token authenticator device,
wherein the mobile point of sale device and the token authenticator device are in communication over a computer network with a computer configured to:
determine, based on received first location information describing the geographical location of the mobile point of sale device, said transaction details, time that said transaction details were received, and received second location information describing the geographical location of the token authenticator device, if the mobile point of sale device and the token authenticator device are within a predefined geographical distance of each other at the time that said transaction details were received;
in response to determining that said devices are within the predefined geographical distance of each other, enable the token reader device of the token authenticator device to verify the authentication token; and
in response to determining that said devices are not within the predefined geographical distance of each other, transmit command data to render the token authenticator device unusable.