Contactless payment relay attack protection
A method for contactless payment relay attack protection includes receiving an online authorization request including a cryptogram, a measured processing time, and a reference processing time from a terminal. The cryptogram is verified, and a determination is performed as to whether the measured processing time exceeds the reference processing time. An online authorization response authorizing or declining a monetary transaction is transmitted, based on the determination. An artificial intelligence transaction analysis can be performed based on past and current conditions (e.g., battery level, operating system, open applications) of a payment device such as a mobile phone, past and current conditions of a terminal, and/or a monetary amount. The online authorization response can be based on the artificial intelligence transaction analysis.
1. A point of sale (POS) terminal, comprising:
a processor;
memory;
a payment interface;
a network interface; and
instructions stored on the memory that when executed by the processor direct the POS terminal to:
transmit, via the payment interface to a payment device, a request for a reference processing time for a monetary transaction;
receive, via the payment interface from the payment device, the reference processing time;
calculate a measured processing time as an amount of time between transmitting the request for the reference processing time and receiving the reference processing time;
transmit, via the payment interface to the payment device, a request for an application cryptogram that includes the measured processing time and the reference processing time;
receive, via the payment interface from the payment device, the application cryptogram that includes the measured processing time and the reference processing time;
send, via the network interface to a protection server, an online authorization request including the application cryptogram that includes the measured processing time and the reference processing time; and
receive, via the network interface from the protection server, an online authorization response that indicates whether the transaction is authorized based on verification of the application cryptogram and a determination of fraud using the measured processing time and the reference processing time.
2. The POS terminal of claim 1 , wherein the request for the reference processing time is a send response command in a form of an EXCHANGE RELAY RESISTANCE DATA (ERRD) command, wherein the reference processing time indicates an amount of time taken to process the ERRD command.
3. The POS terminal of claim 1 , wherein the online authorization request further comprises a terminal identifier or a device identifier.
4. The POS terminal of claim 1 , wherein the instructions to calculate the measured processing time direct the POS terminal to:
start a timer upon transmitting the request for the reference processing time;
stop the timer in response to receiving the reference processing time; and
determine the measured processing time based on the timer.
5. The POS terminal of claim 1 , further comprising instructions that direct the POS terminal to:
upon receiving the application cryptogram, determine whether the measured processing time indicated by the application cryptogram has been altered; and
decline the monetary transaction if the reference processing time has been altered.