Abstract:
A method of electronic commerce transaction verification, wherein a client&#39;s selected payment method information is neither provided to nor stored on the server, or elsewhere, of a transaction intermediary.

Description:
FIELD  
         [0001]    The present invention is related to method of verifying electronic commerce transactions. More specifically, the present invention is related to a method of handling and providing authorization of payments for electronic commerce transactions.  
         BACKGROUND OF THE INVENTION  
         [0002]    The Internet continues to grow as a purveyor of goods and services to online customers. Electronic commerce (e-commerce) is becoming the mainstay of numerous merchants and a virtual storefront to complement the physical storefronts of many established merchants.  
           [0003]    However, the issue of security during e-commerce transactions provides a deterrent to many consumers and merchants alike. There are currently various methods of carrying out transactions over the Internet with each posing essentially the same risk. In general, transactions across the Internet require intermediaries in order to successfully complete a transaction. A transaction intermediary is any server/agent that lies between the client and the entity providing the payment authorization. For example, a transaction intermediary may be the merchant or a payment agent such as an escrow service.  
           [0004]    Referring to FIG. 1, a prior art method of credit card authorization  10  is depicted. At step  22 , a client  20  places an order with a merchant  30 . The merchant  30  then confirms the order and requests the client&#39;s  20  credit card information (step  32 ). At step  24 , the client  20  provides the merchant  30  with the credit card information. In most cases, the merchant  30  stores this credit card information. At step  34 , the merchant requests authorization of the client&#39;s  20  credit card from the credit card company/credit card agent  40 . The credit card company/credit card agent  40  then sends an authorization to the merchant  30  (step  42 ). The authorization indicates whether the payment request has been accepted or declined. Upon receipt of the authorization, the merchant  30  confirms the authorization and the order with the client  20  (step  36 ).  
           [0005]    In this method, the merchant  30  would be a transaction intermediary. Consequently, this method is prone to security breaches from the merchant&#39;s own staff or outside hackers as the merchant  30  stores the client&#39;s  20  credit card information, even if only for a short time. This means that the client&#39;s  20  credit card information is susceptible to being retrieved and subsequently used without the client&#39;s knowledge or consent.  
           [0006]    Referring to FIG. 2, a second prior art method of credit card authorization  50  is depicted. At step  62 , a client  60  places an order with a merchant  70 . The merchant  70  then confirms the order and requests the client  20  contact the payment agent  80  to complete the transaction (step  72 ). At step  64 , the client  60  contacts the payment agent  80  and provides the payment agent  80  with the credit card information. In most cases, the payment agent  80  stores this credit card information, even if only for a short time. At step  82 , the payment agent  80  requests authorization of the client&#39;s  60  credit card from the credit card company/credit card agent  90 . The credit card company/credit card agent  90  then sends an authorization to the payment agent  80  (step  92 ). The payment agent  80  then sends an authorization to the merchant  70  (step  84 ) and to the client  60  (step  86 ). The authorization indicates whether the payment request has been accepted or declined. Upon receipt of the authorization, the merchant  70  confirms the authorization and the order with the client  60  (step  74 ).  
           [0007]    In this method, the payment agent  80  would be a transaction intermediary. Consequently, this method is prone to security breaches from the payment agent&#39;s own staff or outside hackers as the payment agent  80  stores the client&#39;s  60  credit card information, even if only for a short time. This means that the client&#39;s  60  credit card information is susceptible to being retrieved and subsequently used without its knowledge or consent.  
           [0008]    Due to the aforementioned security vulnerabilities, consumers are reluctant to engage in e-commerce.  
           [0009]    It is, therefore, an object of this invention to provide an improved method of credit card authorization wherein a client&#39;s credit card information is not stored on the server of a transaction intermediary.  
         SUMMARY OF THE INVENTION  
         [0010]    The present invention is generally directed to a method of electronic commerce transaction verification, wherein a client&#39;s credit card information is neither provided to nor stored on the server, or elsewhere, of a transaction intermediary.  
           [0011]    This method is equally applicable to a variety of payment methods including debit cards. In general, the term “debit card” or even “payment method” may be substituted for the term “credit card” when describing the method.  
           [0012]    In its simplest form, a system capable of carrying out electronic commerce using the method of this invention comprises a client, a merchant and a credit card company/authorization agent, all of which are connected via the Internet. However, in practice, there are generally a plurality of clients, merchants, credit card company/authorization agents, and alternative forms of payment requiring authorization for which security in general, and in particular the Internet, is an issue.  
           [0013]    A client places an order with a merchant to purchase certain goods. The merchant then sends at least the transaction details, transaction identifier and the merchant&#39;s credit card merchant number to the client. Upon receipt of the transaction amount and credit card merchant number, the client sends an authorization request to the credit card company/authorization agent including at least the client&#39;s credit card information, the credit card merchant number and the transaction amount. The credit card company/authorization agent then sends authorization information to the client. The authorization may include an authorization number and an indication of whether the transaction was approved or declined. The client forwards the authorization information to the merchant to complete the transaction. The merchant may have the option of verifying the authorization information provided by the client. It is important to note that the authorization number provided by the credit card company/agent to the client is automatically forwarded to the merchant without being visible to the client.  
           [0014]    In another aspect of the invention, the client may include their PIN (Personal Identification Number), or some other identifier depending on the chosen method of payment, as part of the credit card information sent to the credit card company/authorization agent. The inclusion of the PIN acts a method of verification of the transaction and authentication of the client initiating the transaction as the credit card holder.  
           [0015]    This method provides several advantages over the previous methods. First, the client&#39;s credit card information is only stored on the client&#39;s computer and not on the merchant&#39;s server or some other transaction intermediary. Furthermore, the only other entity that has access to the credit card information is the credit card company/authorization agent who already has the number and with whom the client has presumably already established a trust relationship.  
           [0016]    Other objects and advantages of the invention will become clear from the following detailed description of the preferred embodiment, which is presented by way of illustration only and without limiting the scope of the invention to the details thereof.  
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0017]    Many objects and advantages of the present invention will be apparent to those of ordinary skill in the art when this specification is read in conjunction with the attached drawings wherein like reference numerals are applied to like elements and wherein:  
         [0018]    [0018]FIG. 1 is a schematic block diagram of a prior art method of credit card authorization;  
         [0019]    [0019]FIG. 2 is a schematic block diagram of a prior art method of credit card authorization;  
         [0020]    [0020]FIG. 3 is a schematic block diagram of a basic embodiment of the invention; and  
         [0021]    [0021]FIG. 4 is a schematic block diagram of a basic embodiment of the invention. 
     
    
     DETAILED DESCRIPTION  
       [0022]    Conventions  
         [0023]    This method is equally applicable to a variety of payment methods including debit cards. In general, the term “payment method” may be substituted for the term “credit card” when describing the method.  
         [0024]    Referring to FIG. 3, a system  100  capable of carrying out electronic commerce transaction verification using the method of this invention comprises a client  110 , a merchant  120  and a credit card company/agent  130 , all of which are connected via the Internet  102 .  
         [0025]    In general, the method commences when the client  110  sends a purchase request (step  112 ) to the merchant  120 . At step  122 , the merchant  120  responds to the client  110  with transaction information including a purchase identifier, the credit card merchant number of the merchant  120  and a credit card company/agent  130  identifier. Upon receipt of the transaction information, the client  110  sends an authorization request to the credit card company/authorizing agent  130  (step  114 ). The authorization request generally includes the credit card merchant number of the merchant  120 , the transaction amount, transaction identifier and the credit card information of the client  110 . The credit card company/authorizing agent  130  processes the authorization request and sends authorization information to the client (step  132 ). The authorization information will generally include an authorization number and an indication of whether the transaction amount was accepted or declined.  
         [0026]    Once the client  110  receives the transaction information, at step  116  it is automatically forwarded to the merchant  120 . If the credit card company/authorizing agent  130  has accepted the transaction then the merchant  120  sends a purchase request confirmation to the client  110  (step  126 ).  
         [0027]    As a further security measure for the merchant  120  and the client  110 , prior to step  126 , at step  124  the merchant may send a query to the credit card company/authorizing agent  130  verifying the authorization number provided by the client  110 . The credit card company/authorizing agent  130  will then respond with verification of the authorization number (step  134 ).  
         [0028]    Referring to FIG. 4, an alternate embodiment of the invention is depicted. A system  150  capable of carrying out electronic commerce transaction verification using the method of this invention comprises a client  160 , a merchant  190  and a credit card company/authorizing agent  180 , all of which are connected via the Internet  102 .  
         [0029]    The client  160  visits the website of a merchant  190 . The client selects the good(s) they wish to purchase. After confirming his/her selection(s), the client  160  selects the credit card payment option on the merchant website (step  192 ). Next, at step  194 , the merchant  190  sends transaction information to the client  160 . The transaction information may include a purchase identifier, the credit card merchant number for the merchant  190 , and a credit card company/authorizing agent  180  identifier.  
         [0030]    At step  162 , the receipt of the transaction information by the client  160 , initiates the credit card payment process. The credit card payment process takes the credit card information of the client  160  and creates a credit card authorization request. The credit card information of the client  160  may be entered by the client  160  or may be stored elsewhere on the client&#39;s computer and retrieved during the creation of the credit card authorization request.  
         [0031]    At step  164 , the client  160  sends the credit card authorization request to the credit card company/authorizing agent  180 . Upon processing the credit card authorization request, the credit card company/authorizing agent  180  sends an authorization response to the client  160  (step  182 ). At step  166 , the client  160  receives the authorization response from the credit card company/authorizing agent  180 . The authorization response will generally include an authorization number and an indication of whether the transaction was approved or declined.  
         [0032]    The authorization response is then sent from the client  160  to the merchant  190  (step  168 ). At step  196 , the merchant  190  receives the authorization response, and if the transaction was approved then the order placed by the client  160  is finalized and a link to an order confirmation webpage is sent to the client  160  (step  198 ). As described previously, the merchant  190  may send an authorization confirmation request to the credit card company/authorizing agent  180  to confirm the transaction was approved.  
         [0033]    At step  170 , the link causes the client  160  to review the order confirmation. At step  172 , the client  160  requests the webpage to display the order confirmation and, at step  200 , the page is displayed thereby completing the transaction between the merchant  190  and the client  160 . The merchant  190  then ships the purchased items to the client  160 .  
         [0034]    As discussed previously, at step  162 , the credit card authorization request may further include the credit card PIN to ensure the validity of the transaction.  
         [0035]    The method discussed above provides several advantages over traditional method of carrying out electronic commerce. Utilizing the method of this invention, a client&#39;s credit card information is only stored on the client&#39;s computer. The only other entity that receives the client&#39;s credit card information is the credit card company/authorization agent, and it is presumed that the client has entered into a trust relationship with the credit card company/authorization agent, as it is the issuer of the credit card.  
         [0036]    Although the invention has been described in detail in the foregoing embodiments for the purpose of illustration, it is to be understood that such detail is solely for that purpose and that variations can be made therein by those skilled in the art without departing from the spirit and scope of the invention except as it may be described by the following claims.