Authentication for third party digital wallet provisioning
Various embodiments are directed to securely verifying an identity of a user who is requesting to add or link a financial instrument to a third-party digital wallet using one-tap contactless card authentication. The financial instrument may be added or linked to the third-party wallet in at least two scenarios: pull provisioning and push provisioning. In either provisioning scenarios, the user may be required to authenticate the financial instrument being added or linked by successfully verifying the identity of the user via the one-tap contactless card authentication at a banking application associated with the financial instrument.
1. A system, comprising:
an apparatus comprising:
memory storing instructions that, when executed by one or more processors, causes the one or more processors to perform operations comprising:
receive, at a first-party banking application, user login information via a user input, the user login information to login into an account associated with a first-party financial entity;
provide the user login information to one or more remote computing devices associated with the financial entity;
receive, from the one or more remote computing devices, a first indication of a successful first authentication of the user login information;
in response to the successful first authentication of the user login information, provide access to the first-party banking application, and by the first-party banking application, present a link for adding or linking a payment card associated with a user and the account to a third-party wallet application;
receive, by the first-party banking application, a selection of the link;
provide, by the first-party banking application, a one-tap authentication option for the user to tap a contactless card on or near the apparatus, and wherein the contactless card is the payment card to add to the third-party wallet application;
establish a first wireless communication with the contactless card;
receive one or more encrypted concatenated cryptograms and random numbers via the first wireless communication from the contactless card, wherein the contactless card generates one or more cryptograms, one or more random numbers, concatenates the one or more cryptograms and the one or more random numbers, and encrypts the concatenated one or more cryptograms and one or more random numbers to generate the one or more encrypted concatenated cryptograms and random numbers, the one or more cryptograms including at least a customer identifier associated with the contactless card;
send, by the first-party banking application, the one or more encrypted concatenated cryptograms and random numbers to the one or more remote computing devices associated with the financial entity;
receive, by the first-party banking application, a second indication from the one or more remote computing devices of a successful second authentication based on the one or more encrypted concatenated cryptograms and random numbers;
initiate, by the first-party banking application, a transition to the third-party wallet application, the transition to include sending confirmation of the successful second authentication and information for the payment card to the third-party wallet application to add or link to the third-party wallet application, the transition to further include causing the third-party wallet application to display at least confirmation that the payment card has been successfully added or linked to the third-party wallet application;
the one or more remote computing devices comprising:
a server memory storing instructions that, when executed by one or more server processors, causes the one or more server processors to perform operations comprising:
receive the one or more encrypted concatenated cryptograms and random numbers via a second wireless communication, the second wireless communication being different from the first wireless communication;
authenticate the one or more encrypted concatenated cryptograms and random numbers based at least in part on the customer identifier included in the one or more cryptograms; and
send the second indication of the successful second authentication based on the one or more encrypted concatenated cryptograms and random numbers to the apparatus.
2. The system of claim 1 , wherein the instructions further cause the one or more processors to receive, from the user, permission to share data with the third-party wallet application.
3. The system of claim 1 , wherein the first-party banking application is a mobile-based application, a native application, a web application, or a web browser and wherein the third-party wallet application is a mobile-based application, a native application, a web application, or a web browser.
4. The system of claim 1 , wherein the authentication of the one or more encrypted concatenated cryptograms and random numbers by the one or more remote computing devices comprises the instructions further causing the one or more server processors to:
decrypt the one or more encrypted concatenated cryptograms and random numbers to obtain the customer identifier, and
determine whether an authentication information corresponding to the user and the decrypted customer identifier match.
5. The system of claim 1 , wherein the contactless card comprises memory and processing circuitry for executing instructions stored in the memory to send the one or more cryptograms as one or more N.F.C. data exchange format (NDEF) messages.
6. The system of claim 1 , wherein the first wireless communication is near field communication (N.F.C.).
7. The system of claim 1 , wherein the instructions further cause the one or more processors of the apparatus to cause displaying a transition of the apparatus from the first software application to the third-party wallet application to display the confirmation.
8. The system of claim 1 , wherein the instructions further cause the one or more processors of the apparatus to cause an adding or linking, at the third-party wallet application, the payment card to the third-party wallet application based on the confirmation of the successful second authentication based on the one or more encrypted concatenated cryptograms and random numbers.
9. A method, comprising:
receiving, via an apparatus, user login information from a user at a first software application, providing the user login information to one or more remote computing devices, and receiving a first indication of a successful first authentication of the user based on the user login information;
in response to the successful first authentication of the user login information, providing the user with an access to the first software application, and at the first software application, providing a link for adding or linking at least a payment card associated with the user to a third-party wallet;
receiving, via the apparatus, a selection of the link, and providing, at the first software application, one or more user verification options, wherein the one or more user verification options includes at least one-tap authentication via a contactless card, and wherein the contactless card is the payment card;
in response to a selection of the one-tap authentication, establishing, via the apparatus, a first wireless communication with the contactless card;
receiving, via the apparatus, one or more encrypted concatenated cryptograms and random numbers via the first wireless communication from the contactless card, wherein the contactless card generates one or more cryptograms, one or more random numbers, concatenates the one or more cryptograms and the one or more random numbers, and encrypts the concatenated one or more cryptograms and one or more random numbers to generate the one or more encrypted concatenated cryptograms and random numbers, the one or more cryptograms including at least a customer identifier associated with the contactless card;
sending, via the apparatus, the one or more encrypted concatenated cryptograms and random numbers to the one or more remote computing devices by the first software application;
receiving, via the apparatus, a second indication from the one or more remote computing devices of a successful second authentication based on the one more encrypted concatenated cryptograms and random numbers by the first software application, the second authentication being different from the first authentication, wherein the one or more remote computing devices are configured to perform the operations of:
receiving the one or more encrypted concatenated cryptograms and random numbers via a second wireless communication, the second wireless communication being different from the first wireless communication;
authenticating the one or more encrypted concatenated cryptograms and random numbers based at least in part on the customer identifier included in the one or more cryptograms; and
sending the second indication of the successful second authentication based on the one or more encrypted concatenated cryptograms and random numbers to the apparatus;
transitioning, by the first software application, on the apparatus to the third-party wallet, the transitioning comprising sending confirmation of the successful second authentication and information for the payment card to the third-party wallet application to add or link to the third-party wallet application; and
displaying, by the third-party wallet and based on the transitioning, at least a confirmation that the payment card has been successfully added or linked to the third-party wallet.
10. The method of claim 9 , wherein the first software application is an online baking application.
11. The method of claim 10 , further comprising receiving, via the apparatus, permission to share data with the third-party wallet application from the user.
12. The method of claim 9 , wherein the first software application is a mobile-based application, a native application, a web application, or a web browser and wherein the third-party wallet application is a mobile-based application, a native application, a web application, or a web browser.
13. The method of claim 9 , wherein the authenticating of the one or more encrypted concatenated cryptograms and random numbers by the one or more remote computing devices further comprising:
decrypting the one or more cryptograms to obtain the customer identifier; and
determining whether an authentication information corresponding to the user and the decrypted customer identifier match.
14. The method of claim 9 , wherein the contactless card comprises memory and processing circuitry for executing instructions stored in the memory to send the one or more cryptograms as one or more N.F.C. data exchange format (NDEF) messages.
15. The method of claim 9 , wherein the first wireless communication is near field communication (N.F.C.).
16. The method of claim 9 , further comprising causing, via the apparatus, a display transition of the apparatus from the first software application to the third-party wallet application to display the confirmation.
17. The method of claim 9 , further comprising causing, via the apparatus, an adding or linking, at the third-party wallet application, the payment card to the third-party wallet application based on the confirmation of the successful second authentication based on the one or more encrypted concatenated cryptograms and random numbers.