Secure communication of payment information to merchants using a verification token

1. A validation entity computer comprising a first data processor and a computer program product embodied on a tangible computer-readable medium coupled to the first data processor to implement a method comprising:

directing the first data processor to receive identification information of a portable consumer device read and sent by a verification token over a communications network with a second data processor in a user computer, the second data processor disposed between the verification token and the communications network, the verification token being coupled to the second data processor in the user computer by way of a peripheral interface of the user computer

directing the first data processor to apply at least one validation test on a piece of information sent by the verification token, the validation test producing a result of pass or fail; and

directing the first data processor to send, if the result of the at least one validation test is pass, data representative of at least a portion of the received identification information to a merchant computer.

2. The validation entity computer of claim 1 , wherein the method further comprises directing the first data processor to receive a serial number of the verification token and a test message encrypted by the verification token with an encryption key; and

wherein directing the first data processor to apply at least one validation test comprises directing the first data processor to access a database to obtain a key and one or more acceptable messages, and directing the first data processor to validate the encrypted test message using the encrypted test message, the obtained key, and the obtained one or more acceptable messages.

3. The validation entity computer of claim 1 , wherein the method further comprises directing the first data processor to receive a serial number of the verification token; and

directing the first data processor to have the received serial number compared with serial numbers stored in a database that stores serial numbers of suspicious tokens.

4. The validation entity computer of claim 1 , wherein the method further comprises:

directing the first data processor to receive one or more data messages having information specific to the user computer, the information being obtained by the verification token, and

directing the first data processor to have the received information compared with information stored in a database that stores computer-specific information of suspicious computers for a match.

5. The validation entity computer of claim 1 wherein the received identification information is conveyed by way of a network packet passing through the communications network, and wherein directing the first data processor to apply at least one validation test comprises:

directing first the direct processor to obtain a source IP address from the network packet; and

directing first the data processor to have the obtained source IP address compared with suspect IP addresses stored in a database for a match.

6. The validation entity computer of claim 1 , wherein the received identification information includes an account number of the portable consumer device and a digital fingerprint of a magnetic stripe of the portable consumer device; and

wherein directing the first data processor to apply at least one validation test comprises instructions that direct the first data processor to obtain a valid digital fingerprint for the portable consumer device having the account number in the received identification information, and to compare the digital fingerprint in the received identification information to the valid digital fingerprint.

7. The validation entity computer of claim 1 , wherein the received identification information includes an account number of the portable consumer device and a variable datum that varies each time the portable consumer device is read for its identification information; and

wherein directing the first data processor to apply at least one validation test comprises instructions that direct the first data processor to obtain one or more acceptable datum values for the portable consumer device having the account number in the received identification information, and to compare the variable datum in the received identification information to the obtained one or more acceptable datum values for a match.

8. The validation entity computer of claim 1 , wherein the received identification information includes an account number of the portable consumer device and a variable datum that varies each time the portable consumer device is read for its identification information; and

wherein directing the first data processor to apply at least one validation test comprises instructions that direct the first data processor to send the account number and the variable datum to an issuing bank with a request for the bank to determine if the variable datum is valid, and instructions that direct the first data processor to receive the issuing bank's determination.

9. The validation entity computer of claim 1 , wherein directing the first data processor to apply at least one validation test comprises instructions that direct the first data processor to apply at least two validation tests pertaining to the received identification information.

10. A method of communicating payment information to a merchant, the method comprising:

receiving, at a server, identification information of a portable consumer device read and sent by a verification token over a communications network with a data processor in a user computer disposed between the verification token and a communications network, the verification token being coupled to the data processor in the user computer by way of a peripheral interface of the computer;

selecting, by the server, a merchant to send data representative of at least a portion of the received identification information to; and

sending, from the server, data representative of at least a portion of the received identification information to a merchant computer of the selected merchant.

11. The method of claim 10 , wherein the identification information has an account number associated with a user, wherein selecting the merchant comprises identifying the selected merchant from a portion of the account number.

12. The method of claim 10 , wherein the identification information has a personal account number that comprises a bank number and a user number, wherein selecting the merchant comprises extracting the bank number in the personal account number of the identification information and identifying the selected merchant from the extracted bank number.

13. The method of claim 10 , wherein the identification information is received by the server in the form of a request that includes a merchant identifier, and wherein selecting the merchant comprises identifying the selected merchant from the received merchant identifier.

14. The method of claim 10 , wherein the identification information is received by the server in the form of a request that includes a merchant identifier, and wherein selecting the merchant comprises selecting a single merchant for processing the request before the request is received.

15. The method of claim 10 , further comprising:

applying at least one validation test pertaining to the identification information received by the server before sending the data representative of at least the portion of the received identification information to the merchant computer of the selected merchant.

16. The method of claim 15 , wherein applying at least one validation test comprises:

receiving a serial number of the verification token; and

comparing the received serial number with serial numbers of suspicious tokens.

17. The method of claim 15 , wherein applying at least one validation test comprises:

receiving one or more data messages having information specific to the user computer, the information being obtained by the token, and

comparing the received information with computer-specific information of suspicious computers for a match.

18. The method of claim 15 wherein the identification information is conveyed by way of a network packet through the communications network, and wherein applying at least one validation comprises:

obtaining a source IP address from the network packet; and

comparing the obtained source IP address with suspect IP addresses for a match.

19. The method of claim 10 , wherein applying at least one validation test comprises:

receiving a serial number of the verification token and a test message encrypted by the verification token by an encryption key;

obtaining a key and one or more acceptable messages; and

validating the encrypted test message using the encrypted test message, the obtained key, and the obtained one or more acceptable messages.