Method and system for utilizing authorization factor pools
One embodiment of the present disclosure provides a system and associated processes for sharing cardholder data (CHD) between a merchant that utilizes tokenization and a second merchant that may or may not utilize tokenization. In one embodiment, the merchant, or an employee of the merchant, can use the system and associated processes to reacquire CHD from a tokenization provider system. In one embodiment, the merchant identifies to the tokenization provider system a desire to share CHD, which is associated with a token, with a second merchant. The merchant and/or the tokenization provider system can then invite the second merchant to register with the tokenization provider system. Once registered with the tokenization provider system, the second merchant can access any CHD that the merchant associated with the second merchant.
1. A system for accessing a token associated with cardholder data (CHD) to enable performing a transaction with the CHD, the system comprising:
a token access system comprising computer hardware, the token access system configured to:
receive an authorization factor from a third-party merchant, wherein the authorization factor comprises a set of one or more values associated with the token, and wherein the set of one or more values are not derived from the token, wherein the third-party merchant comprises a merchant that did not receive the CHD from a cardholder associated with the CHD, and wherein the third-party merchant received the authorization factor from a merchant that did receive the CHD from the cardholder and desires to share access to the token associated with the CHD with the third-party merchant enabling the third-party merchant to perform a transaction for the cardholder on behalf of the merchant that received the CHD from the cardholder;
identify an authorization factor pool associated with the authorization factor, wherein the authorization factor pool is one of a plurality of authorization factor pools;
identify a tokenization provider system associated with the authorization factor pool, wherein the tokenization provider system is one of a plurality of tokenization provider systems and wherein each authorization factor pool is associated with one tokenization provider system of the plurality of tokenization provider systems;
identify a token associated with the authorization factor at the tokenization provider system, wherein the token comprises a unique value that serves as a substitute for the CHD, and wherein the token cannot be processed to determine the CHD from the token itself; and
enable the third-party merchant to perform a transaction with the CHD associated with the token without receiving the CHD from the cardholder associated with the CHD by providing the third-party merchant with access to the token associated with the authorization factor.
2. The system of claim 1 , wherein the token access system is further configured to disassociate the authorization factor from the token and the third-party merchant.
3. The system of claim 1 , wherein the token access system is further configured to determine whether the third-party merchant is authorized to provide the authorization factor.
4. The system of claim 1 , wherein the token access system is further configured to determine whether the third-party merchant is associated with the token.
5. The system of claim 1 , wherein the tokenization provider system is identified based, at least in part, on the set of one or more values of the authorization factor.
6. A method of accessing a token associated with cardholder data (CHD) to enable performing a transaction with the CHD, the method comprising:
by a token access system implemented in a computing system comprising one or more processors, the token access system associated with a plurality of tokenization provider systems:
receiving an authorization factor from a third-party merchant, wherein the authorization factor comprises a set of one or more values associated with the token, and wherein the set of one or more values are not derived from the token, wherein the third-party merchant comprises a merchant that did not receive the CHD from a cardholder associated with the CHD, and wherein the third-party merchant received the authorization factor from a merchant that did receive the CHD from the cardholder and desires to share access to the token associated with the CHD with the third-party merchant enabling the third-party merchant to perform a transaction for the cardholder on behalf of the merchant that received the CHD from the cardholder;
identifying an authorization factor pool associated with the authorization factor, wherein the authorization factor pool is one of a plurality of authorization factor pools;
identifying a tokenization provider system associated with the authorization factor pool, wherein the tokenization provider system is one of the plurality of tokenization provider systems;
identifying a token associated with the authorization factor at the tokenization provider system, wherein the token comprises a unique value that serves as a substitute for the CHD, and wherein the token cannot be processed to determine the CHD from the token itself;
determining that the third-party merchant is authorized to access the token; and
providing the third-party merchant with access to the token associated with the authorization factor to enable the third-party merchant to perform a transaction with the CHD associated with the token without receiving the CHD from the cardholder associated with the CHD.
7. The method of claim 6 , wherein the authorization factor pool associated with the authorization factor comprises the authorization factor pool used to generate the authorization factor.
8. The method of claim 6 , further comprising disassociating the authorization factor from the token and the third-party merchant.
9. The method of claim 6 , wherein providing the third-party merchant with access to the token further comprises performing a transaction using the CHD associated with the token on behalf of the third-party merchant.
10. The method of claim 6 , wherein determining whether the third-party merchant is authorized to access the token comprises determining whether the third-party merchant is associated with the authorization factor at the tokenization provider system.
11. The method of claim 6 , wherein determining whether the third-party merchant is authorized to access the token comprises determining whether the authorization factor is not expired.