URL-based authentication for payment cards
Systems, methods, articles of manufacture for authentication of payment cards. A server may assign, in a database, an expected card identifier to a contactless card, the contactless card associated with an account. The server may receive, from a client device, a request comprising a uniform resource locator (URL), a parameter of the URL comprising a card identifier, wherein the URL is transmitted by the contactless card to the client device. The server may extract the card identifier from the URL and compare the extracted card identifier to the expected card identifier in the database. The server may determine, based on the comparison, that the extracted card identifier matches the expected card identifier. The server may authenticate the request based on the extracted card identifier matching the expected card identifier, and transmit, to the client device, an indication specifying that the request was authenticated.
1. A method, comprising:
assigning, by a server in a database, an expected card identifier to a contactless card, the contactless card associated with an account, the server comprising a memory and a processor circuit;
receiving, by the server from a client device, a request comprising a uniform resource locator (URL), a parameter of the URL comprising a card identifier, wherein the URL is transmitted by the contactless card to the client device;
extracting, by the server, the card identifier from the URL;
comparing, by the server, the extracted card identifier to the expected card identifier in the database;
determining, by the server based on the comparison, that the extracted card identifier matches the expected card identifier;
authenticating the request by the server based on the extracted card identifier matching the expected card identifier; and
transmitting, by the server to the client device, an indication specifying that the request was authenticated.
2. The method of claim 1 , wherein the contactless card is one of a plurality of contactless cards, wherein the server assigns a respective expected card identifier to each contactless card, the method further comprising:
determining, by the server, that the extracted card identifier is encrypted; and
decrypting, by the server the extracted card identifier using an encryption key before performing the comparison.
3. The method of claim 1 , where the request is received from a client application of the client device responsive to receiving the URL, the method further comprising:
determining, by the client application, an operation associated with the request;
adding, by the client application, an indication of the operation as a second parameter of the URL;
identifying, by the server, the indication of the operation in the second parameter of the URL; and
transmitting, by the server to the client application based on the authentication of the request, account data associated with the account as responsive to the operation associated with the request.
4. The method of claim 3 , wherein the card identifier is selected from a plurality of card identifiers stored in a memory of the contactless card, wherein the plurality of card identifiers includes a payment account reference (PAR) assigned to the contactless card, wherein an applet of the contactless card selects the card identifier based on an offset associated with the contactless card, the method further comprising:
transmitting, to the client application, an indication specifying to receive authentication credentials for the account, wherein the authentication credentials comprise one or more of biometric data or a login and a password;
receiving, by the server from the client application, authentication credentials provided by a user of the client device; and
authenticating, by the server, the received authentication credentials provided by the user of the client device.
5. The method of claim 4 , further comprising:
assigning, by the server, a plurality of expected card identifiers to the contactless card in the database;
determining, by the server, the offset associated with the contactless card; and
selecting, by the server, based on the offset, one of the plurality of expected card identifiers as the expected card identifier.
6. The method of claim 1 , further comprising:
receiving, by the server, a second request from the client device, the second request comprising a second URL, a parameter of the second URL comprising a dynamic card identifier generated by the contactless card using a function;
generating, by the server using an instance of the function, an expected dynamic card identifier;
comparing, by the server, the dynamic card identifier to the expected dynamic card identifier;
determining, by the server based on the comparison, that the dynamic card identifier matches the expected dynamic card identifier;
authenticating, by the server, the second request by the server based on the dynamic card identifier matching the expected dynamic card identifier; and
transmitting, by the server to the client device, an indication specifying that the second request was authenticated.
7. The method of claim 1 , further comprising:
determining, by the server, location data of the client device based on the request; and
determining, by the server based on the location data, that the client device is within a threshold distance of one or more known locations associated with the client device.
8. The method of claim 1 , wherein the contactless card generates the URL responsive to being within a communications range of the client device, wherein the client device opens one of a web browser or a client application responsive to receiving the URL, the method further comprising:
performing, by the client device, a requested operation associated with the account based on receiving the indication that the request was authenticated.
9. A system, comprising:
a processor circuit; and
a memory storing instructions which when executed by the processor circuit, cause the processor circuit to:
receive, from a client device, a request comprising a uniform resource locator (URL), a parameter of the URL comprising a card identifier assigned to a contactless card;
extract the card identifier from the URL;
compare the extracted card identifier to an expected card identifier stored in a database and assigned to the contactless card;
determine, based on the comparison, that the extracted card identifier matches the expected card identifier;
authenticate the request based on the extracted card identifier matching the expected card identifier; and
transmit, to the client device, an indication specifying that the request was authenticated.
10. The system of claim 9 , the memory storing instructions which when executed by the processor circuit, cause the processor circuit to:
determine that the extracted card identifier is encrypted; and
decrypt the extracted card identifier using an encryption key before performing the comparison.
11. The system of claim 10 , the memory storing instructions which when executed by the processor circuit, cause the processor circuit to prior to decrypting the extracted card identifier:
determine the encrypted card identifier is encoded according to an encoded format;
decode the encrypted card identifier to an unencoded format; and
decrypt the decoded encrypted card identifier.
12. The system of claim 9 , the memory storing instructions which when executed by the processor circuit, cause the processor circuit to:
determine location data of the client device based on the request; and
determine, based on the location data, that the client device is within a threshold distance of one or more known locations associated with the client device.
13. The system of claim 9 , the memory storing instructions which when executed by the processor circuit, cause the processor circuit to:
identify a plurality of expected card identifiers assigned to the contactless card in the database;
determine an offset associated with the contactless card; and
select, based on the offset, one of the plurality of expected card identifiers as the expected card identifier.
14. The system of claim 9 , the memory storing instructions which when executed by the processor circuit, cause the processor circuit to:
receive a second request from the client device, the second request comprising a second URL, a parameter of the second URL comprising a dynamic card identifier generated by the contactless card;
generate, by an instance of a function used to generate the dynamic card identifier, an expected dynamic card identifier;
compare the dynamic card identifier to the expected dynamic card identifier;
determine, based on the comparison, that the dynamic card identifier matches the expected dynamic card identifier;
authenticate the second request based on the dynamic card identifier matching the expected dynamic card identifier; and
transmit, to the client device, an indication specifying that the second request was authenticated.
15. A non-transitory computer-readable storage medium having computer-readable program code embodied therewith, the computer-readable program code executable by a processor circuit to cause the processor circuit to:
receive, from a client device, a request comprising a uniform resource locator (URL), a parameter of the URL comprising a card identifier assigned to a contactless card;
extract the card identifier from the URL;
compare the extracted card identifier to an expected card identifier stored in a database and assigned to the contactless card;
determine, based on the comparison, that the extracted card identifier matches the expected card identifier;
authenticate the request based on the extracted card identifier matching the expected card identifier; and
transmit, to the client device, an indication specifying that the request was authenticated.
16. The non-transitory computer-readable storage medium of claim 15 , further comprising computer-readable program code executable by the processor circuit to cause the processor circuit to:
determine that the extracted card identifier is encrypted; and
decrypt the extracted card identifier using an encryption key before performing the comparison.
17. The non-transitory computer-readable storage medium of claim 16 , further comprising computer-readable program code executable by the processor circuit to cause the processor circuit to:
determine the encrypted card identifier is encoded according to an encoded format;
decode the encrypted card identifier to an unencoded format; and
decrypt the decoded encrypted card identifier.
18. The non-transitory computer-readable storage medium of claim 15 , further comprising computer-readable program code executable by the processor circuit to cause the processor circuit to:
determine location data of the client device based on the request; and
determine, based on the location data, that the client device is within a threshold distance of one or more known locations associated with the client device.
19. The non-transitory computer-readable storage medium of claim 15 , further comprising computer-readable program code executable by the processor circuit to cause the processor circuit to:
identify a plurality of expected card identifiers assigned to the contactless card in the database;
determine an offset associated with the contactless card; and
select, based on the offset, one of the plurality of expected card identifiers as the expected card identifier.
20. The non-transitory computer-readable storage medium of claim 15 , further comprising computer-readable program code executable by the processor circuit to cause the processor circuit to:
receive a second request from the client device, the second request comprising a second URL, a parameter of the second URL comprising a dynamic card identifier generated by the contactless card;
generate, by an instance of a function used to generate the dynamic card identifier, an expected dynamic card identifier;
compare the dynamic card identifier to the expected dynamic card identifier;
determine, based on the comparison, that the dynamic card identifier matches the expected dynamic card identifier;
authenticate the second request based on the dynamic card identifier matching the expected dynamic card identifier; and
transmit, to the client device, an indication specifying that the second request was authenticated.