Method and system for enabling merchants to share tokens
One embodiment of the present disclosure provides a system and associated processes for sharing cardholder data (CHD) between a merchant that utilizes tokenization and a second merchant that may or may not utilize tokenization. In one embodiment, the merchant, or an employee of the merchant, can use the system and associated processes to reacquire CHD from a tokenization provider system. In one embodiment, the merchant identifies to the tokenization provider system a desire to share CHD, which is associated with a token, with a second merchant. The merchant and/or the tokenization provider system can then invite the second merchant to register with the tokenization provider system. Once registered with the tokenization provider system, the second merchant can access any CHD that the merchant associated with the second merchant.
1. A method for sharing a token associated with cardholder data in a tokenization provider system to enable the sharing of cardholder data between users, the method comprising:
by a token access system implemented in a computing system comprising one or more hardware processors:
generating a first authorization factor;
associating the first authorization factor with a token by storing a relationship between the token and the CHD in physical computer memory, wherein the token is associated with cardholder data (CHD) in a tokenization provider system;
associating, in the physical computer memory of the token access system, the first authorization factor with a user;
providing the user with access to the first authorization factor;
receiving user authentication information associated with the user;
receiving a second authorization factor from the user;
determining whether the user is authorized to use the token by at least authenticating the user based, at least in part, on the user authentication information, and determining whether the second authorization factor matches the first authorization factor; and
in response to determining that the user is authorized to use the token, providing the user with electronic access to the token;
receiving a transaction request associated with a transaction using the CHD;
performing the transaction on behalf of the user using the CHD corresponding to the token without providing the user with access to the CHD; and
in response to a triggering event, removing the user's authorization to access the token by disassociating the token from the user in the physical computer memory.
2. The method of claim 1 , wherein the first authorization factor and the second authorization factor comprise one or more words.
3. The method of claim 1 , wherein determining that the user is authorized to use the token further comprises determining whether the user is authorized to provide the second authorization factor.
4. The method of claim 1 , wherein providing access to the token further comprises providing access to the CHD associated with the token.
5. The method of claim 4 , wherein providing access to the CHD further comprises retrieving the CHD from the tokenization provider system.
6. The method of claim 4 , wherein providing access to the CHD further comprises authorizing the user to initiate the transaction with the CHD.
7. The method of claim 4 , wherein providing access to the CHD further comprises:
accessing the transaction request associated with the user; and
providing the token and the transaction request to the tokenization provider system, wherein the tokenization provider system performs the transaction associated with the transaction request.
8. The method of claim 1 , further comprising disassociating the first authorization factor with the token in response to a predefined event.
9. The method of claim 1 , further comprising registering the user with the token access system.
10. The method of claim 9 , wherein associating the first authorization factor with the user further comprises:
determining if the user is registered with the token access system;
determining if the user is authorized to access authorization factors; and
in response to determining that the user is registered with the token access system and is authorized to access the authorization factors, associating the first authorization factor with the user.
11. The method of claim 1 , further comprising maintaining a relationship between tokens and a number of sets of CHD for at least a thousand users.
12. The method of claim 1 , wherein the triggering event comprises at least one of a received command; a number of accesses of the token; or a time period associated with access by the user of the token.
13. The method of claim 1 , wherein the first authorization factor and the second authorization factor comprise a number, an image, a sound, or a challenge.
14. The method of claim 1 , wherein the CHD is received from a second user who obtains the CHD from a customer, the second user associated with a separate entity from an entity of the user.