Card-not-present transactions with cardholder-chosen CVV
A cardholder enters ( 305 ) payment information and a freely-selected transaction CVV in a merchant system ( 20 ). A payment system ( 30 ) receives ( 400 ) a request from the merchant system including the transaction CVV and transaction information, and sends ( 405 ) a transaction authorization request to a cardholder device ( 13 ). The transaction information are displayed ( 310 ) on the cardholder device and invites the cardholder to enter the transaction CVV for confirmation purpose. In response, the cardholder enters ( 315 ) a confirmation CVV. The payment system approves ( 240, 415 ) the transaction when the transaction and confirmation CVVs are the same. As a result, the CVV can have a short life and be changed at each transaction, thereby increasing the security of the transactions. Also, PCI certification constraints on servers are reduced since no issuer master key is required for the CVVs. Lastly, the cardholder has more control on the transaction validation.
1. A method of performing a card-not-present transaction, the method comprising, at a payment system:
receiving, from a merchant system,
transaction information including payment card information entered by a user in the merchant system, and
a user-defined first card verification value (CVV) entered by the user in the merchant system, the user-defined first card verification value (CVV) satisfying one or more conditions;
upon receiving the transaction information,
checking that the one or more conditions is fulfilled, and
automatically sending a transaction authorization request to a cardholder device;
generating a first digital signature based on a card-payment token at the cardholder device;
subsequently receiving, from the cardholder device, a transaction authorization response including the first digital signature and a second CVV provided by the user on the cardholder device;
validating, by a cardholder bank, the received payment card information and the first digital signature;
comparing, by the cardholder bank, the second CVV to an expected value of the user-defined first CVV; and
determining, by the cardholder bank, a transaction authorization decision that approves the transaction based on determining that the second CVV equals the expected value of the user-defined first CVV, and successful validation of the payment card information and the first digital signature, the determining the transaction authorization decision comprising
computing a second digital signature based on the user-defined first CVV and a locally-generated card-based payment token for the cardholder, and
comparing the first and second digital signatures.
2. The method of claim 1 , wherein the user-defined first CVV is entered by the cardholder in the merchant system and the second CVV is entered by the cardholder on the cardholder device or selected by the cardholder from a list of CVVs displayed on the cardholder device or confirmed by the cardholder when displayed on the cardholder device.
3. The method of claim 1 , wherein the receiving the transaction authorization response is responsive to sending the transaction authorization request to the cardholder device.
4. The method of claim 3 , wherein the sending the transaction authorization request is responsive to receiving a request for a transaction from the merchant system, the request for the transaction including the user-defined first CVV and the transaction information.
5. The method of claim 1 , wherein the transaction is refused when the user-defined first CVV is the same as one CVV used during a last transaction.
6. The method of claim 1 , wherein the one or more conditions includes the user-defined first card verification value (CVV) is different from a CVV already printed on the payment card.
7. The method of claim 1 , wherein the one or more conditions includes the user-defined first card verification value (CVV) is selected from a subpart of a range of possible values.
8. The method of claim 1 , wherein the one or more conditions includes the user-defined first card verification value (CVV) has a predefined number of digits different from the number of digits of a CVV already printed on the payment card.
9. A method of performing a card-not-present transaction, the method comprising:
entering, by a user, a user-defined first card verification value (CVV) and payment card information in a merchant system connected to a payment system, to initiate a transaction, the user-defined first card verification value (CVV) satisfying one or more conditions;
in response to determining that the one or more conditions is fulfilled, generating a first digital signature based on a card-payment token at the cardholder device;
subsequently entering a user transaction confirmation on a cardholder device connected to the payment system, the user transaction confirmation including a second CVV, and generating a transaction authorization response including the first digital signature and the second CVV provided by the user on the cardholder device;
validating, by a cardholder bank, the received payment card information and the first digital signature;
comparing, by the cardholder bank, the second CVV to an expected value of the user-defined first CVV; and
receiving, through the merchant system, a transaction authorization decision that approves the transaction based on determining that the second CVV equals the expected value of the user-defined first CVV, and successful validation of the payment card information and the first digital signature, the transaction authorization decision being determined by:
computing a second digital signature based on the user-defined first CVV and a locally-generated card-based payment token for the cardholder, and
comparing the first and second digital signatures.
10. The method of claim 9 , wherein the entering the user transaction confirmation is responsive to the transaction authorization request from the payment system that displays information of the transaction on the cardholder device.
11. The method of claim 9 , further comprising previously displaying card-based payment token information on a screen of the cardholder device, the user-defined first CVV being entered in the merchant system together with the displayed card-based payment token information.
12. The method of claim 9 , wherein the entering the user transaction confirmation includes selecting the second CVV from a list of CVVs displayed on the cardholder device or confirming a CVV displayed on the cardholder device as the second CVV.
13. The method of claim 9 , wherein the entering the user transaction confirmation includes confirming a CVV displayed on the cardholder device as the second CVV.
14. The method of claim 9 , wherein the one or more conditions include at least one of:
the user-defined first card verification value (CVV) is different from a CVV already printed on the payment card,
the user-defined first card verification value (CVV) is selected from a subpart of a range of possible values, and
the user-defined first card verification value (CVV) has a predefined number of digits different from the number of digits of a CVV already printed on the payment card.
15. A payment system processing a card-not-present transaction, the payment system comprising:
a transaction receiving server configured to receive, from a merchant system,
transaction information including payment card information entered by a user in the merchant system, and
a user-defined first card verification value (CVV) entered by the user in the merchant system, the user-defined first card verification value (CVV) satisfying one or more conditions;
a cardholder device configured to generate and transmit a transaction authorization response including a second CVV provided by the user on the cardholder device; and
an authorization server configured to
subsequently receive, from the cardholder device, the transaction authorization response including the second CVV provided by the user on the cardholder device, and a first digital signature being generated based on a card-payment token at the cardholder device,
validate the received payment card information and the first digital signature,
compare the second CVV to an expected value of the user-defined first CVV, and
determine a transaction authorization decision that approves the transaction based on determining that the second CVV equals the expected value of the user-defined first CVV, and successful validation of the payment card information and the first digital signature, the transaction authorization decision being determined by:
computing a second digital signature based on the user-defined first CVV and a locally-generated card-based payment token for the cardholder, and
comparing the first and second digital signatures.
16. The payment system of claim 15 , wherein the one or more conditions include at least one of:
the user-defined first card verification value (CVV) is different from a CVV already printed on the payment card,
the user-defined first card verification value (CVV) is selected from a subpart of a range of possible values, and
the user-defined first card verification value (CVV) has a predefined number of digits different from the number of digits of a CVV already printed on the payment card.
17. A method of performing a card-not-present transaction, the method comprising, at a payment system:
tokenizing payment card information to obtain a card-payment token;
receiving, from a merchant system,
transaction information including said token, and
a user-defined first card verification value (CVV) entered by the user in the merchant system, the user-defined first card verification value (CVV) satisfying one or more conditions;
upon receiving the transaction information,
checking that the one or more conditions is fulfilled, and
automatically sending a transaction authorization request to a cardholder device;
generating a first digital signature based on the card-payment token at the cardholder device;
subsequently receiving, from the cardholder device, a transaction authorization response including the first digital signature and a second CVV provided by the user on the cardholder device;
validating, by a cardholder bank, the tokenized payment card information and the first digital signature;
comparing, by the cardholder bank, the second CVV to an expected value of the user-defined first CVV; and
determining, by the cardholder bank, a transaction authorization decision that approves the transaction based on determining that the second CVV equals to the expected value of the user-defined first CVV, and successfully validating validation of the tokenized payment card information and the first digital signature, the validating the tokenized payment card information and the first digital signature including
computing a second digital signature based on the user-defined first CVV and a locally-generated card-based payment token for the cardholder, and
comparing the first and second digital signatures.
18. The method of claim 17 , wherein the one or more conditions include at least one of:
the user-defined first card verification value (CVV) is different from a CVV already printed on the payment card,
the user-defined first card verification value (CVV) is selected from a subpart of a range of possible values, and
the user-defined first card verification value (CVV) has a predefined number of digits different from the number of digits of a CVV already printed on the payment card.