Source: http://www.patentsencyclopedia.com/app/20130204781
Timestamp: 2018-10-23 22:55:57
Document Index: 162161152

Matched Legal Cases: ['Application No. 60', 'Application No. 60', 'Application No. 60', 'Application No. 60', 'Application No. 60', 'Application No. 60', 'Application No. 60', 'Application No. 60']

CREDIT CARD SYSTEM AND METHOD - Patent application
Patent application title: CREDIT CARD SYSTEM AND METHOD
Inventors: Daniel I. Flitcroft (County Dublin, IE) Orbis Patents Ltd. (Blackrock, IE) Graham O'Donnell (Sandycove,, IE)
Assignees: ORBIS PATENTS LTD.
Patent application number: 20130204781
1. A method for processing a transaction initiated by a customer presenting a personalized gift card number to a merchant, the method comprising the steps of: associating, in a database, a plurality of merchant identifiers and a predetermined amount with the personalized gift card number; receiving, in a central processing system, the personalized gift card number, a transaction amount, and a merchant identification number electronically routed from the merchant; determining electronically whether the personalized gift card number has been deactivated because the predetermined amount has been satisfied; electronically determining whether the merchant identification number corresponds to one of the plurality of merchant identifiers associated with the personalized gift card number; electronically determining whether authorization can be obtained against the personalized gift card number based on the merchant identification number determining step, the received transaction amount, and the predetermined amount; and electronically transmitting a signal to the merchant with the results of the authorization determining step for the personalized gift card number.
2. The method of claim 1, further comprising: transmitting a signal to the merchant denying authorization if the personalized gift card number has been deactivated.
3. The method of claim 1, further comprising: authorizing the transaction based on the results of the authorization determining step.
4. The method of claim 3, further comprising: subtracting the transaction amount from the predetermined amount associated with the personalized gift card in the database.
5. The method of claim 1, further comprising: declining authorization of the transaction based on the results of the authorization determining step.
6. The method of claim 1, wherein the personalized gift card number is associated with a master account number of an account holder.
7. The method of claim 6, further comprising: electronically transmitting a signal to a facility which issued the personalized gift card number, the signal including original transaction details but with the personalized gift card number remapped to be the master account number if the personalized gift card number has not been deactivated, wherein the authorization determining step includes electronically determining whether authorization can be obtained against the master account number.
8. The method of claim 7, wherein the personalized gift card number is linked to an organization selected from a group consisting of: a utility, a public network service provider, a telephone company, a bank account, a prepaid account, and a credit card issuer.
9. The method of claim 8, further comprising: transmitting a signal to the organization which is linked to the personalized gift card number, the signal including the original transaction details if the personalized gift card number has not been deactivated; performing a credit check to determine whether authorization can be obtained against the personalized gift card number; and transmitting a signal to the merchant with the results of the authorization determining step for the personalized gift card number.
10. The method of claim 1, wherein the predetermined amount corresponds to a funding amount for a predetermined number of transactions.
11. The method of claim 10, wherein the predetermined number of transactions is one of: a single transaction, a plurality of transactions, and a number of recurring transactions.
12. A method for conducting a transaction involving a personalized gift card number, the method comprising the steps of: initiating a transaction by a customer presenting the personalized gift card number to a merchant electronically or in person; electronically routing the personalized gift card number to a central processing system; determining electronically whether the personalized gift card number has been deactivated because a predetermined amount associated with the personalized gift card number has been satisfied; electronically determining whether a merchant identification number associated with the merchant corresponds to one of a plurality of merchant identifiers associated with the personalized gift card number; electronically determining whether authorization can be obtained against the personalized gift card number based on the merchant identification number determining step, the predetermined amount associated with the personalized gift card number, and a transaction amount of the transaction; and electronically transmitting a signal to the merchant with the results of the authorization determining step for the personalized gift card number.
13. A method for implementing a personalized gift card system, the method comprising: maintaining a pool of credit card numbers which share identical formatting; assigning at least one credit card number from the pool of credit card numbers to be a personalized gift card number which is deactivated upon use of a predetermined amount which occurs subsequent to assignment of the at least one credit card number; associating the predetermined amount with the personalized gift card number; determining whether to deactivate the personalized gift card number when the personalized gift card number was used to perform a transaction, and for generating a deactivation command in response thereto, wherein the determining step of whether to deactivate the personalized gift card number determines whether the predetermined amount has been used to fund transactions, and if so, generates the deactivation command when the predetermined amount has been used; and deactivating the personalized gift card number based on the deactivation command, wherein the personalized gift card number is valid for use at a plurality of merchants for at least one financial transaction totaling up to the predetermined amount.
14. The method of claim 13, further comprising: associating a master account number with the personalized gift card number, while ensuring that the master account number cannot be discovered on the basis of the personalized gift card number.
15. The method of claim 13, wherein the predetermined amount corresponds to a funding amount for a predetermined number of transactions.
16. The method of claim 15, wherein the predetermined number of transactions is one of: a single transaction, a plurality of transactions, and a number of recurring transactions.
17. The method of claim 13, further comprising: transmitting, to a receiver, a personalized gift card associated with the personalized gift card number in electronic or physical form.
18. The method of claim 13, further comprising: associating the personalized gift card number with a message received from a gift provider, wherein the message is displayed to a receiver of the personalized gift card number upon use of the personalized gift card number.
19. A system for processing a transaction initiated by a customer presenting a personalized gift card number to a merchant, the system comprising: a database configured to store a plurality of merchant identifiers and a predetermined amount associated with the personalized gift card number; a receiving device configured to receiving the personalized gift card number, a transaction amount, and a merchant identification number electronically routed from the merchant; a processing device configured to determine electronically whether the personalized gift card number has been deactivated because the predetermined amount has been satisfied, electronically determine whether the merchant identification number corresponds to one of the plurality of merchant identifiers associated with the personalized gift card number, and electronically determine whether authorization can be obtained against the personalized gift card number based on the merchant identification number determining step, the received transaction amount, and the predetermined amount; and a transmitting device configured to electronically transmit a signal to the merchant with the results of the authorization determination for the personalized gift card number.
20. The system of claim 19, wherein the transmitting device is further configured to electronically transmit a signal to the merchant denying authorization if the personalized gift card number has been deactivated.
21. The system of claim 19, wherein the processing device is further configured to authorize the transaction based on the results of the authorization determination.
22. The system of claim 21, wherein the processing device is further configured to subtract the transaction amount from the predetermined amount associated with the personalized gift card number.
23. The system of claim 19, wherein the processing device is further configured to decline authorization of the transaction based on the results of the authorization determination.
24. The system of claim 19, wherein the personalized gift card number is associated with a master account number of an account holder.
25. The system of claim 24, wherein the transmitting device is further configured to electronically transmit a signal to a facility which issued the personalized gift card number, the signal including original transaction details but with the personalized gift card number remapped to be the master account number if the personalized gift card number has not been deactivated, and wherein the authorization determination includes electronically determining whether authorization can be obtained against the master account number.
26. The system of claim 25, wherein the personalized gift card number is linked to an organization selected from a group consisting of: a utility, a public network service provider, a telephone company, a bank account, a prepaid account, and a credit card issuer.
27. The system of claim 26, wherein the transmitting device is further configured to electronically transmit a signal to the organization which is linked to the personalized gift card number, the signal including the original transaction details if the personalized gift card number has not been deactivated, the processing device is further configured to perform a credit check to determine whether authorization can be obtained against the personalized gift card number, and the transmitting device is further configured to electronically transmit a signal to the merchant with the results of the authorization determination for the personalized gift card number.
28. The system of claim 19, wherein the predetermined amount corresponds to a funding amount for a predetermined number of transactions.
29. The system of claim 28, wherein the predetermined number of transactions is one of: a single transaction, a plurality of transactions, and a number of recurring transactions.
30. A system for conducting a transaction involving a personalized gift card number, the system comprising: an initiating device configured to initiate a transaction by a customer presenting the personalized gift card number to a merchant electronically or in person; a routing device configured to electronically route the personalized gift card number to a central processing system; a processing device configured to determine electronically whether the personalized gift card number has been deactivated because a predetermined amount associated with the personalized gift card number has been satisfied, electronically determine whether a merchant identification number associated with the merchant corresponds to one of a plurality of merchant identifiers associated with the personalized gift card number, and electronically determine whether authorization can be obtained against the personalized gift card number based on the merchant identification number determination, the predetermined amount associated with the personalized gift card number, and a transaction amount of the transaction; and a transmitting device configured to electronically transmit a signal to the merchant with the results of the authorization determination for the personalized gift card number.
31. A personalized gift card system, comprising: a database configured to store a pool of credit card numbers which share identical formatting; an assignment device configured to assign at least one credit card number from the pool of credit card numbers to be a personalized gift card number which is deactivated upon use of a predetermined amount which occurs subsequent to assignment of the at least one credit card number, an associating device configured to associate the predetermined amount with the personalized gift card number; and a processing device configured to determine whether to deactivate the personalized gift card number when the personalized gift card number was used to perform a transaction, and to generate a deactivation command in response thereto, wherein the determination of whether to deactivate the personalized gift card number determines whether the predetermined amount has been used to fund transactions, and if so, generates the deactivation command when the predetermined amount has been used, and deactivate the personalized gift card number based on the deactivation command, wherein the personalized gift card number is valid for use at a plurality of merchants for a plurality of financial transactions totaling up to the predetermined amount.
32. The system of claim 31, wherein the associating device is further configured to associate a master account number with the personalized gift card number, while ensuring that the master account number cannot be discovered on the basis of the personalized gift card number.
33. The system of claim 31, wherein the predetermined amount corresponds to a funding amount for a predetermined number of transactions.
34. The system of claim 33, wherein the predetermined number of transactions is one of: a single transaction, a plurality of transactions, and a number of recurring transactions.
35. The system of claim 31, further comprising a transmitting device configured to transmit, to a receiver, a personalized gift card associated with the personalized gift card number in electronic or physical form.
[0001] This application is a continuation of U.S. Non-Provisional application Ser. No. 12/268,063 filed Nov. 10, 2008, which is a continuation of U.S. Non-Provisional application Ser. No. 10/160,178 filed Jun. 4, 2002, which is a continuation-in-part of U.S. Non-Provisional application Ser. No. 09/506,830 filed Feb. 18, 2000, which in turn is a continuation-in-part of U.S. Non-Provisional application Ser. No. 09/235,836 filed Jan. 22, 1999. This application claims the benefit of U.S. Provisional Application No. 60/295,020 filed Jun. 4, 2001; U.S. Provisional Application No. 60/120,747 filed Feb. 18, 1999; U.S. Provisional Application No. 60/134,027 filed May 13, 1999; U.S. Provisional Application No. 60/144,875 filed Jul. 20, 1999; U.S. Provisional Application No. 60/147,153 filed Aug. 4, 1999; U.S. Provisional Application No. 60/099,614 filed Sep. 9, 1998; U.S. Provisional Application No. 60/098,175 filed Aug. 26, 1998; U.S. Provisional Application No. 60/092,500 filed Jul. 13, 1998; Irish Application No. S98 0458 filed Jun. 15, 1998; Irish Application No. S98 0346 filed May 5, 1998; Irish Application No. S98 0223 filed Mar. 25, 1998. The entire contents of each of these applications are incorporated herein by reference.
[0006] The former are concerned about fraud because essentially the financial institutions have to bear the initial cost of the fraud. Additionally, the credit card companies have an efficient credit card system which is working well for face to face transactions, i.e., "card present" transactions where the credit card is physically presented to a trader and the trader can obtain the credit card number, compare signatures and in many cases photographs before accepting a particular credit card.
[0008] There is also the additional fear of being overcharged on a credit card. There are thus particular risks for those credit card holders who have relatively high spending limits, in that if fraud should occur, it may be some considerable time before it is detected. One particular form of fraud referred to as "skimming" is particularly difficult to control. What happens is the card holder proffers his or her card at an establishment to make a transaction, the relevant information is electronically and/or physically copied from the card and the card is subsequently reproduced. This can be a problem with travelers particularly during an extensive period of travel as the fraudulent card may turn up in other places and it may be some considerable time before the fraud is detected.
[0009] For remote credit card use, the credit card holder has to provide details of name, master credit card number, expiration date and address and often many other pieces of information for verification; the storing and updating of the information is expensive but necessary. This of itself is a considerable security risk as anybody will appreciate that this information could be used to fraudulently charge goods and services to the card holder's credit card account. Such fraudulent use is not limited to those people to whom the credit card information has been given legitimately, but extends to anybody who can illegitimately obtain such details. A major problem in relation to this form of fraud is that the credit card may still be in the possession of the legitimate holder as these fraudulent transactions are taking place. This is often referred to as "compromised numbers" fraud. Indeed all this fraud needs is one dishonest staff member, for example in a shop, hotel or restaurant, to record the credit card number. It is thus not the same as card theft.
[0016] There are also specific electronic transaction systems such as "Cyber Cash," "Check Free" and "First Virtual." Unfortunately, there are perceived problems with what has been proposed to date. First, any form of reliance on encryption is a challenge to those who will then try to break it. The manner in which access has been gained to extremely sensitive information in government premises would make anyone wary of any reliance on an encryption system. Second, a further problem is that some of the most secure forms of encryption system are not widely available due to government and other security requirements. Limiting the electronic trading systems and security systems for use to the Internet is of relatively little use. In addition, entirely new electronic payment systems require changes in how merchants handle transactions and this represents an important commercial disadvantage for such systems.
[0017] Additionally, various approaches have been taken to make "card present" transactions more attractive. For instance, Japanese Patent Publication No. Hei 6-282556 discloses a one-time credit card settlement system for use by, e.g., teenage children of credit card holders. This system employs a credit card which can be used only once in which various information such as specific personal information, use conditions, and an approved credit limit identical to those of the original credit card are recorded on a data recording element and displayed on the face of the card. The one-time credit card contains the same member number, expiration date, card company code, and the like as on existing credit card, as well as one-time credit card expiration date not exceeding the expiration date of credit card, available credit limit for the card, and the like. The one-time credit card makes use of some of the same settlement means as the conventional credit card. However, the system also requires use permission information to be recorded on the credit card, the information permitting the credit card to be used only once or making it impossible to use the credit card when the credit limit has been exceeded. A special card terminal device checks the information taken from the card for correctness and imparts use permission information for when the card is not permitted to be used on the transmission to the credit card issuing company. The use permission information takes the form of a punched hole on the card itself. This system has obvious drawbacks, such as the card terminal having to be modified for additional functions (e.g., punching holes, detected punched holes, imparting additional information, etc.). Also, such a system offers little additional security insofar as fraud can still be practiced perhaps by covering the holes or otherwise replacing the permission use information on the credit card. Further, such a system would require a change in nearly all card terminal equipment if it were adopted.
[0018] U.S. Pat. Nos. 5,627,355 and 5,478,994 (Rahman et al.) disclose another type of system that uses a plurality of pin numbers which are added to a credit card number on an electronic display. U.S. Pat. No. 5,627,355 discloses a credit card having a memory element containing a series of passwords in a predetermined sequence. These passwords are identical to another sequence stored in a memory of a host control computer. Further, the card contains a first fixed field containing an account number (e.g., "444 222 333"). In operation, the memory element of the credit card device provides a unique password from the sequence with each use of the credit card device. This permits verification by comparing the account number and the password provided with each use of the device with the account number and the next number in sequence as indicated by the host computer. The host computer deactivates the password after the transaction. Among the drawbacks with this type of system is the need for a power supply, a display, a memory device, a sound generator and the need to recycle a limited sequence of pin numbers. Such a system is not readily adapted to current credit card transactions because it lacks the ability of providing a check sum of the card number and cannot be read by a standard card reader. Also, if the card is lost or stolen, there is little to prevent a person from using the card until it is reported to be lost or stolen by the correct holder. See, also, U.S. Pat. No. 5,606,614 (Brady et al.).
[0043] In this specification the term "credit card" refers to credit cards (MasterCard®, Visa®, Diners Club®, etc.) as well as charge cards (e.g., American Expressquadrature, some department store cards), debit cards such as usable at ATMs and many other locations or that are associated with a particular account, and hybrids thereof (e.g., extended payment American Express®, bank debit cards with the Visa® logo, etc.) or any other present or future financial transaction card having similar characteristics. Also, the terms "master credit card number" and "master credit card" refer to the credit card number and the credit card as generally understood, namely, that which is allocated by the credit card provider to the customer for his or her account for multiple uses for a renewable period and a credit limit. It will be appreciated that an account may have many master credit cards in the sense of this specification. For example, a corporation may provide many of its employees with credit cards but essentially each of these employees holds a master credit card even if there is only one customer account. Each of these master credit cards will have a unique master credit card number, which set of master credit card numbers will be linked to the account. Similarly, in families, various members of the family may hold a master credit card, all of which are paid for out of the one customer account.
[0044] Additionally, the "master credit card" account can be in some embodiments something other than a credit card account. For instance, while not otherwise affecting the formatting or processing of the limited use credit card numbers as described herein, the master card number can be a prepaid account or another type of account, such as a utility, telephone service provider or Internet Service Provider (ISP) account. The utility company, telephone company, ISP or other account holder would generate a bill, which, in possible addition to or separate from to the regular bill, would include a listing of limited use credit card transactions. An advantage of this type of arrangement is that the service provider already has information as to a pool of individual and their credit worthiness, as well as low increased overhead due to the already in place billing system. In these embodiments, the "master account" may but likely does not have the format of a standard credit card or the like.
[0045] The term "limited-use" credit card number is used to encompass at least both the embodiment in which the credit card is designated for a single use, and the embodiment in which the credit card is designated for multiple uses providing that the charges accrued do not exceed a prescribed threshold or thresholds, such a total single charge, total charges over a limited time period, total charge in a single transaction, etc. A common feature is that the limited use credit card number is deactivated upon satisfaction of a limited-use condition, and not just the expiration date of the card. Stated differently, the a limited-use credit card number is deactivated upon a use-triggered condition which occurs subsequent to assignment of said at least one credit card number.
[0046] The term "deactivated" means that new transactions cannot be initiated using the same limited-use credit card number, but the limited-use credit card number is still available for further activity related to the original transaction, such as for charge-backs where an account is credited, such as upon return of unaccepted merchandise.
[0047] The terms "card holder" and "user" are used interchangeably to refer to an entity, e.g., an individual, that has been rightfully issued a credit/debit/charge card number, e.g., through a contractual arrangement, or that has been authorized to use such card by such entity or a representative of such entity.
[0057] The third way in which the invention could be carried out is by physically providing additional single use credit cards each of which would have a unique additional credit card number. Such additional single use credit cards could then be used both for remote trade by using the additional credit card numbers for respective transactions, and for "card present" trade where each card would be "swiped" in the normal manner. Such a disposable credit card could be made like any common credit card, or from a relatively inexpensive material, such as cardboard or thin plastic, with the relevant information entered into it in readable (e.g., magnetic) form, as is already the case with many forms of passes for use in public transport and the like. Again, substantially the same features as with the credit card number could be provided. Thus, for example, the disposable credit card could be limited to use geographically, to a use, to an amount, to a frequency of use, to an expiration date, and so on. Again, those skilled in the art will appreciate that there are many variations to this concept.
[0064] As an alternative, the above-discussed cards could be, in effect, debit cards in the true sense, in which funds are withdrawn against a customer's account. In this case, the "credit card" issued, whether it be a one time use card or multi-use card, and whether have a credit limit or not, would be used to debit the account immediately. Preferably, the credit card issued in these circumstances would be single use with or without a transaction amount limit which would be used and processed by the customer and merchant for a transaction as if it were a credit card, while in the customer's bank it would be treated like any other debit to the account.
[0068] The central processing station 102 itself may include a central processing unit 120, which interfaces with the remote units via network I/O unit 118. The central processing unit 120 has access to a database of credit card numbers 124, a subset 126 of which can be designated as being available for limited use (referred to as the "available range"). Also, the central processing unit 120 has access to a central database 122, referred to as a "conditions" database. This database is a general purpose database which stores information regarding customers' accounts, such as information regarding various conditions which apply to each customers' account. Further, this database 122 may store the mapping between a customer's fixed master credit card number and any outstanding associated limited use credit cards, using, for instance, some type of linked-list mechanism. Databases 122 and 124 are shown separately only to illustrate the type of information which may be maintained by the central processing station 102; the information in these databases can be commingled in a common database in a manner well understood by those having skill in the data processing arts. For instance, each limited use credit card number can be stored with a field, which identifies its master account, and various conditions regarding its use.
[0076] After the limited use card is deactivated or a number of limited use cards are deactivated, an additional limited use card or cards can be activated. As described in detail in the following section, the actual activation of the credit card number can involve various intermediate processing steps. For instance, the credit card numbers from the list 126 can be first allocated to an "allocated" range of numbers, and then to an "issued but not valid" range of numbers, and then finally to an "issued and valid" range of numbers. FIG. 2 is a high-level depiction of the process, and encompasses this specific embodiment, as well as the more basic case where the credit card numbers are retrieved from a database and then immediately activated.
[0082] To achieve these allocation requirements, an issuing bank decides within its total available range of credit cards to allocate a certain range or ranges of numbers to the single use system, referred to herein as the "available range." This may represent spare numbers using existing header sequences (e.g., the sequence of usually 4-6 digits that define the issuing institution and are used to route the card to the appropriate transaction processor) or within newly created header sequences. The numbers not allocated include existing credit card accounts for that issuer and sufficient spare capacity for new account holders and replacement numbers for existing customers. The additional non-embossed components of the card details and any card specific information that is transmitted during a transaction may be varied from card to card to enhance security and privacy of credit card transactions.
[0089] This allocation process generates another series of single use numbers, the "allocated range" with an associated identification field to determine how the account will be settled once used, i.e., onto whose account the transaction will be charged. The allocation process can occur a significant time before the single use numbers are required. Once allocated, they are not added into the list of valid accounts until required by the user.
[0091] When a customer needs multiple-use cards, the CPU can issue the additional credit card numbers to the customer. Unless these multiple-use numbers are issued directly into the hands of the customer (e.g., by an automated teller machine (ATM)), they are not directly added to the list of valid account numbers held within the central computer system. These numbers are added to an "issued, but not valid" list of numbers. (Step 312). The number of multiple-use numbers issued at one time depends upon the rate at which the customer will use the cards and the capability of the device used to store the multiple-use numbers until used. The CPU can provide the customer with enough multiple-use numbers to fulfill their multiple-use purchase requirements for up to, for example, 2 years. Each multiple-use number can be endowed with specific restrictions in terms of transaction type or value, provided that these properties do not exceed the restrictions placed up on the customer's account (such as the available credit balance).
[0092] Once a series of multiple-use numbers are issued, the user has the option of confirming receipt by telephone or other communication media before any of the issued numbers become validated on the processing system. (Step 314). Once receipt has been confirmed (or assumed), not every issued multiple-use number is necessarily added to the "issued and valid" list. (Step 316). To prevent excessive valid multiple-use numbers being held within the processing system, the number of multiple-use numbers declared to be valid at any one time is limited to account for waste of numbers (i.e., numbers that are accessed by a customer but are never used to complete a transaction) and to allow for time delays between different transactions leading to differences in the sequence in which multiple-use numbers are accessed by the customer and the sequence in which they arrive at the processing center. The maximum number of multiple-use numbers valid at any one time can be determined by the card issuer but would be preferably in the range of 5-10. In the case of any attempted use outside the allocated range, the next multiple-use number can be used as an additional identifier to validate the transaction. In this case, only a subset of the digits should be given by the user to prevent a fraudulent trader being able to gain access to multiple unused multiple-use numbers. As soon as a single use number is disabled (step 320) on use (step 318), an additional number from the "issued not valid" list for that customer is allocated to the "issued and valid" list, ensuring a continual supply of multiple-use numbers up to the maximum allowed until the next set of multiple-use numbers are issued. (Step 322).
[0093] In relation to the actual supply of the additional credit card numbers, this will not cause any difficulties to the credit card provider. For example, with a standard master credit card number, there are up to fifteen or more digits, the first of which is used to identify the credit card provider, e.g., American Express®, VISA®, Mastercard®, etc. For major banks, three digits are used to identify the issuing bank. The last digit in a typical sixteen digit master credit card number is a checksum used to confirm that the number is a valid number. This leaves a total of up to 11 digits or more for the account identifying number and the expiration date. In some instances, the expiration date may not be sent back for clearance, while with certain credit card providers, additional credit card numbers or even additional information is required for clearance. For example, certain credit card providers print additional numbers on the card, which additional numbers are not embossed on the card and do not form part of the master credit card number. These additional printed and non-embossed credit card numbers can be used to identify that the person proffering the card for a non-present card transaction is actually in possession of the card when the order is made whether it be in writing or by phone. There are many devices, digits, pieces of information, etc. used by a credit card issuer or processor working for a credit card issuer to clear the credit card for the specific transaction. According to another embodiment, when issuing additional credit card numbers in accordance with the present invention, such additional credit card numbers could include a code which would identify that the person using the additional credit card number in a remote transaction is the one to whom the numbers were sent or, in the case of a disposable credit card, is the one to whom the disposable credit card was sent.
[0094] A preferred feature of these additional credit card numbers is that they be constrained to be in the correct format for a credit card number with a valid check sum, while at the same time be mathematically unrelated to each other or to the master credit card. In certain situations, for single use numbers, the expiration date is virtually irrelevant. Thus, using the month code of the expiration date with said eleven digits, there are 12×1011, i.e., 1.2×1012, i.e., 1,200 billion possible unique codes available for any given credit card provider. This would allow for 50 transactions a month for 10 years for 200 million account holders, before any codes would have to be recycled or a new header code introduced. When it is understood that there are then another 104 header numbers that a credit card provider can use, it will be appreciated that the structure and arrangement of existing master credit card numbers is sufficient to operate this invention with the advantage that the existing infrastructure of dealing with credit card transactions can be used with minimum modification. All that is required for the credit card provider is to store the generated numbers against the master credit card number or other type of account number.
[0095] If, for example, the card is a VISA® card, there are approximately 21,000 issuing banks. The sixteen digit number has a "4" followed by a five digit code to identify the card issuer. The last number is a checksum to verify that it is a valid number. As a result, there are 21,000×109×12 (252 trillion) unique numbers and associated expiry months. This number of codes is sufficient for 36,000 years of transaction processing at the current annual rate of approximately 7 billion transactions per year.
[0102] Finally, a credit card number can be used as a gift voucher where the credit card number is limited to a specific transaction value or limit, but it can be used for any merchant. A gift voucher limited use card could also have a pre-determined limitation to a specific merchant or a type of merchants or to a group of merchants such as within an "online shopping mall".
[0108] Alternatively, an opaque removable cover can conceal a message such as "used". The opaque removable cover can be a scratch off layer that is scratched off before or after the card is used. The scratch off layer can resemble the layer that is often used to cover lottery numbers or the like. Or alternatively, the single use cards can be placed in a self-contained container that resembles a razor blade dispenser. (Step 516). The owner can remove a single use card from a first compartment and then place the used card into a second compartment.
[0113] Cards/single use numbers can be issued directly into an electronic device that is capable of storing such numbers. This applies to mobile phones and pager devices to which information can be transmitted using existing systems and computers connected either directly or via a telecommunications system to the Internet or a specific host computer system. In such a situation a mechanism is required to protect these numbers in transit to prevent unauthorized access. For global applications, this mechanism must not be subject to export restrictions. In addition, this protection should not be susceptible to "brute force" decryption techniques. Such a system is described below in relation to the storage of single use cards.
[0129] For "card not present" transactions, it is proposed that the customer uses an electronic device to store issued single use numbers. This may represent a range of devices from a mobile telephone, pager, dedicated single use storage device or a software package that can run on range of platforms such as a conventional desktop computer, television based Internet access device (e.g., WebTV) or a portable computing device.
[0133] "Brute force" decryption involves using multiple fast computers and specific algorithms to test large numbers of possible encryption "keys." Success can be determined by seeing whether the result appears in the expected format, for example as comprehensible English text in the case of an encrypted document. If the encrypted version is in an identical format to the unencrypted version (though with different information) then brute force decryption cannot succeed. This is not a computationally viable option for text but it is possible for credit cards.
[0135] For example, for a card with a 6 digit header and valid checksum, e.g., "1234 5678 9012 3452 expiration date of 12/99," 123456 is randomly assigned to a currently unused header sequence, e.g., 090234 (this is an example and does not necessarily represent an unused header sequence). 789012345 is encrypted into another 9 digit number, e.g., 209476391. 12/99 is encrypted to a valid date format that ensures the card is not expired, e.g., 3/00. The checksum is recalculated to produce a valid appearing credit card number, for this example the checksum is 4, i.e., 0902 3420 9476 3914 expiry 3/00.
[0139] Other types of encryption may also be used, for example, which require the use of a mask and/or private key. For example, as described above, this approach also breaks down and encrypts each component of a credit card number so as to maintain the numerical composition of each component. Similar to that described above, the bank identifying header sequence, e.g., in the case of VISA® cards, the initial digit "4" followed by the 5 digit BIN number, is replaced with an equal number of random digits taken from the range of unused headers. This ensures that the resulting number does not represent some other valid existing credit card number. These replacement header sequence digits can be fixed for a given card issuer and can be reconstructed after decryption.
[0150] Some users may wish to have the equivalent of an electronic wallet that can be de-installed from one computer and reinserted on another, for example, when transferring a "wallet" from an office to a home machine. This transfer process ensures that only one version of the program is running at any one time and that no problems arise in terms of reconciling lists of used numbers. Appropriate security mechanisms can be implemented to identify the valid user.
[0190] This system requires more modification of the existing processing software systems, but offers authorization times within the same timescale as existing transactions since only one authorization steps is involved. Other activities such as updating the limitations on the limited use card when the master account changes can be performed outside the authorization process (i.e., "off-line").
[0200] The properties of this validation or activation process can vary. For example, the validation could be for a specific time period, for a specific merchant or group of merchants, for a specific type of transaction, or for a specific number of transactions (authorizations and/or presentments). These properties can also be combined in any permutation. For example, a card holder could request that his or her credit card number be validated for one transaction with a specific merchant up to a specific value limit or value range (e.g., a specific value +/- a configurable range). In the event that no authorization is received within a defined period, the validity can lapse. This combination provides a solution that meets the need for a secure, flexible payment system for remote transactions.
[0201] More specifically, for Internet transactions the card holder would receive a software package from the card issuer along with a unique personal validity limited credit card number. This software package would also facilitate completion of the merchants web page using ECML (electronic commerce modeling language) or some other equivalent electronic wallet system. Merchants wishing to use this system provide a unique merchant identification number on their web site. For merchants who are not compliant with such systems, a simpler automated method, e.g., "drag and drop," of transferring card number and other details is supported.
[0212] FIG. 10 is a flowchart illustrating an exemplary process for using a credit card number as a PIN number. In step 1002, a card issuer generates a database of available credit card numbers. The card issuer selects a master credit card number or more generically master account number (step 1004) and distributes the master account number to a master account number owner. (Step 1006). The card issuer then allocates additional credit card numbers to the master account number (step 1008), and distributes the additional credit numbers to the master account number owner. (Step 1010). When the master credit card number owner needs or desires to access account information (step 1012), the master account owner can use one of the additional credit card numbers as a PIN number. (Step 1014).
[0217] FIG. 11 is a block diagram illustrating a credit card system 1100 in which a central processing system 1106 in accordance with an embodiment of the present invention is located within a card issuing bank's main processing system 1114. The system 1100 includes merchant acquirers 1102 connected to card issuing bank's main processing system 1114 via a credit card network 1104 and a switch 1116. The credit card network 1104 may be any type of communication network, such as the Internet, a radio network, etc. as described above. A switch 1116 includes hardware and software components. The switch 1116 may be configured to direct incoming transaction details on the basis of the card number and to direct outgoing transaction details on the basis of the merchant acquirer identification number (referred to herein as the "merchant ID"). The issuing bank's main processing system 1114 includes an issuing bank processing facility 1112 and a central processing system 1106. The central processing system 1106 includes an acquirer interface 1108 and a STIP interface 1110 for example.
[0218] Exemplary transactions will now be described with reference to FIGS. 11 and 12. FIG. 12 is a flow chart illustrating an exemplary method of conducting a limited use credit card number transaction. A user initiates a transaction by presenting a limited use credit/charge/debit card number, either in person or remotely as discussed above. (Step 1202). A merchant acquirer 1102 routes this limited use credit card number to the central processing system 1106 via the network 1104 and the switch 1116. (Step 1204). This routing is done on the basis of a specific bank identification number (referred to herein as "BIN") which is the first few digits of the limited use credit card number, as discussed above. In this example, the central processing system 1106 acts as a stand-in processor.
[0227] A card holder may desire to access a list of limited use credit/debit/charge card numbers where the limited use cards are not stored on the card holder's own computer. In the context of modern client server architecture this represents one extreme of the situation where all information storage is at the server. The previous description for local storage indicates the situation of a client program with a significant amount of local functionality. Between these two extremes a range of intermediary client server arrangements such as a "thin client" with minimal functionality obtaining limited use numbers from the server as required. The combination of encryption and dynamic passwords, as described herein, or any suitable alternative form of use identification allows a card holder to have "multiple wallets", i.e., a card holder can access limited use numbers from different devices, without the need to transmit credit card numbers.
[0228] As discussed above, software and limited use numbers can be issued via electronic communication media. In one embodiment, a card holder can access limited use credit card numbers during electronic transactions via a Remote Access Device, referred to herein as "RAD", such as the Orbis Internet Cardquadrature. The overall layout of the RAD system 1500 is shown in FIG. 15 and a flow chart illustrating an exemplary method of providing remote access devices for accessing limited use credit card numbers is shown in FIG. 16. In general, the operation of the complete system from registration to completion of a transaction follows.
[0229] When a user desires to register with RAD system 1500, the user submits user authentication information, the master account number and other identifying data for entry into a database 1502. (Step 1602). To register with RAD system 1500, the user must be a valid holder/user of the master credit card or account number. (Step 1604). Once registered, step 1606, the user obtains a RAD 1504, step 1608. RAD 1504 includes a software package to which enables communication with a remote access device support server, referred to herein as a RAD support server 1506, such as the Nexus User Support Serverquadrature, to enable the issuance of limited use card numbers.
[0231] The central processing station 1508 obtains the next available limited use number. (Step 1618). Once obtained, the limited use number, and the specified limitations, is entered into database 1502 such that the limited use number is associated with the user's information already in database 1502. (Step 1620). The limited use number is then transmitted to the RAD support server 1506 for issuance to the user via RAD 1504. (Step 1622). RAD software package 1504 displays the limited use number. The user can transfer this limited use number to a web site for initiating a transaction. Transferring this number to a web site can be achieved by dragging and dropping the number onto the web page, by software-simulated key-stroke entry, by "one-click" methods, or by other suitable methods known to one skilled in the art.
[0237] The RAD software package 1504 includes a simple intuitive interface for the ease of the user, the appearance of which may be customizable without modification to the underlying code. The RAD 1504 may use images that relate to the front and back of a credit card to provide key areas of functionality. The back of the RAD 1504 includes an interactive panel with a magnetic stripe for providing additional information and/or advertising panels. The interactive panel/stripe area provides for password entry and functional selections. Upon activation, the front of RAD 1504 may be configured to provide additional functions, e.g., those required to initiate an on-line purchase. As discussed herein, supplying information required for on-line purchases can be automated in a number of ways including "clicking and transferring" the information, "dragging and dropping" the information, or "one click shopping."
[0238] In one embodiment, the RAD software package 1504 is configured to issue a sequence of paired numbers which are securely issued and activated and/or decrypted by oral or written authorization, such as the communication of a password. These paired numbers include an identifier code and a mask code. In order to retrieve a limited use number, a user at a remote device identifies himself or herself using his or her a RAD software 1504 by transmitting the identifier code, such as a dynamic password to RAD support server 1506. The RAD support server 1506 compares the identifier code with the particular RAD software package 1504 and accepts, or validates, the identifier code if appropriate. If valid, RAD support server 1506 determines the matching mask code for that identifier code from database 1502. The RAD support server 1506 uses the mask code to encrypt the limited use card number as described above, and transmits this encrypted code to the user. The RAD software 1504 decrypts the encrypted code using the known mask code and reconstructs the initial digits, the BIN number and the checksum digit. The RAD software 1504 then arranges this information and reconstructs the limited use card number.
[0242] As can be seen from the above, the described limited-use credit card numbers can be provided with user defined controls on how the numbers can be used. Hence, the phrase "controlled payment numbers" describes products which embody the invention described herein.
[0245] A card number generating and allocation system (e.g., support server 1508) that allows for additional controls to allocated to the cards in a dynamic manner.
[0246] A card issuing process for distribution of CPN's to users that supports industry standard protocols, such as shown in FIGS. 5 and 6.
[0247] A card authorization and settlement process (e.g., FIGS. 7 and 8) that provides additional verification and validation of cards against the current set of controls that have been set up for that card.
[0248] A mechanism for relating a specific CPN to an existing credit card, debit card or general financial account (e.g., FIGS. 11, 12 and 13).
[0249] The platform may be implemented with part as a personal computer connected to the Internet to provide communication with the card issuer. The customer can set a range of limitations as determined by the issuer and the card number is issued in virtual form to the users computer (usually) for immediate use.
[0252] Specifically these applications can be implemented by varying: (1) the patterns of how the controls on specific numbers are combined, (2) the controls available to user(s), (3) who sets the controls and when, (4) how the controls are communicated to the processing system, (5) the communication device(s) or channels used to deliver an issued CPN to the user, (6) the form in which the CPN is issued (virtual via software, voice generated, text message, paper receipt, paper credit card card, plastic credit card), and (7) the form in which the CPN is presented to the merchant.
[0253] The core transaction processing system for authorization and settlement is not altered to any significant degree by any of these implementation variations. In addition most of the core back end systems for number generation, account generation, linkage to other accounts, customer service and maintenance remain unaltered. The architecture for issuing numbers to users supports a range of interfaces so the same architecture can support computer based, phone, interactive TV or internal bank issuing for physical implementations. The high degree of re-usability of core platform components is a key advantage in supporting the commercial viability of these other products.
[0254] The following sections elaborate on these principles to indicate how in practical terms the system would operate and how a consumer would use the system in the various manifestations.
[0255] 3.1 Card Present Applications
[0256] There are considerable opportunities to create new payment products by issuing fixed number plastic cards with flexibility and control provided by the present invention. There are applications of this approach in both the consumer and business markets.
[0257] In these applications, new payment products can be created by placing "intelligence" within the card processing system. A critical additional step is the creation of new communication channels between these processing systems and a card issuer/card holder.
[0258] These communication channels which can include PC computer interfaces, PDA interfaces, mobile phone/telephony interfaces, ATM interfaces.
[0259] In combination with an issuer's capability to configure specific card products, these additional dynamic control features provide a mechanism for a traditional plastic payment card to be turned into a range of new products. In effect, the present invention creates "instantly configurable plastic payment cards". This capability can be combined with conventional credit cards, debit cards and pre-paid cards.
[0260] 3.1.1 Consumer Applications
[0261] There are range of consumer applications of which a few are listed here.
[0262] Teen Card
[0263] Given to a teenager, for example, this card has a pre-set limit transaction amount and/or must be spent at a particular merchant or merchants (or merchant type or types). A parent can receive feedback on card usage and change the spending power by computer interface or mobile phone at any time. This greatly enhances the control provided by existing pre-paid teen cards.
[0264] Gift Certificate Card
[0265] Given to someone to spend with a pre-set limit and can be limited to a particular merchant or merchant type. These merchants can be Visa or M/C compatible and protected by signature.
[0266] Product Rebates
[0267] A limited use card could be issued with a product that has no value but can be activated by registering the product on-line for instance. The card is then loaded with the product rebate and can be used to purchase something on-line or at a retail store limited to the amount of the rebate. This will greatly reduce costs to administer a rebate program associated with e.g., issuing and mailing a check.
[0268] Insurance Card
[0269] A limited use card could be issued with an insurance policy or by a loss-adjuster at a visit following a claim. The company or the loss adjuster could provide instant card activation by computer or mobile phone to allow the consumer to spend an amount appropriate to immediate needs.
[0270] 3.1.2 Corporate Applications
[0271] For corporate applications the controls inherent in CPN technology together with the capability to support a range of communication systems to set up controls for a specific account provide a powerful business tool. Examples include:
[0272] Company Bonus
[0273] Given to employees as a bonus this limited use credit card number can be used anywhere Visa or M/C is accepted or alternatively limited to a particular merchant or merchant type. Cards can be issued and the company can set the reward amounts via a PC-computer interface. All charges can be billed to a central company account.
[0274] Company Expense Travel Account
[0275] This limited use card can be given to employees for specific trips. The expense budget and types of expense can be set by the employer at the start of the trip and the account deactivated until the next trip.
[0276] Purchasing Account with Integrated PO Request
[0277] This limited use card can be given to employees company purchases and pre-configured for specific rules (e.g., maximum single purchase amount and monthly expenditure). To extent these rules apply the employee can make a request via a PC or mobile phone to the company purchasing system. If approved, the company system can automatically extend the purchasing capability of the specific card and the employee receives a confirmation and purchase order number.
[0278] 3.1.3 Mail Order/Telephone Order (MOTO)
[0279] The acceptability of CPN's at any VISA/Mastercard/Europay accepting merchant is a key advantage of CPN technology. This means that the existing computer based system can be for mail order and telephone order with any alterations. Having said that, the current system is not specifically directed at MOTO users and users may not appreciate this capability. In addition many existing MOTO users may not have access to the Internet at the time of placing a MOTO order or indeed have Internet access at all. Without a credit card, telephone orders can be almost impossible. All the manifestations described below could also be provided linked to a bank account or pre-paid account.
[0280] The following represent specific products more specifically marketed the MOTO market. As with the potential cross over between Internet and MOTO usage, these MOTO products could also be used in Internet applications.
[0281] 3.1.4 Telephone Interfaces for CPN Delivery
[0282] Mobile telephony interfaces can allow both WAP (Web Access Protocol) and i-mode interaction with servers providing the CPN capabilities. This provides for authentication by password or PIN and delivery of a CPN via a simple interface for display on the screen. CPN's can also be issued by SMS (Silicon Integrated Systems), which has the additional benefit of providing automatic storage of the number for later use. Review of statements is also possible via this interface. The core functionality for MOTO orders are very similar to Internet orders and so no major differences are required in terms of additional functionality, though the functionality is best limited in line with the small screens of current mobile telephones. This application would also be well suited to web-kiosk applications where users may not want to enter authentication credentials into public systems. There is currently increasing interest in "in-store" kiosks to provide additional product lines. This implementation of the web-kiosk is designed specifically for making purchases and the mobile CPN will ideally suit such a combined "clicks and mortar" transaction.
[0283] This application, the mobile CPN, provides a suitable platform for MOTO or Internet payments. In this situation the mobile phone is used as a private and personal means of authenticating the user and delivering the number to the user.
[0284] 3.1.5 Alternative Web Access Devices
[0285] It is expected that web access will increasingly involve non-PC devices such as PDA's, set-top TV boxes, Interactive TV and "smart" consumer devices. The CPN platform architecture provides for seamless integration of a wide range of web-access devices into a standard Orbiscom implementation. The CPN platform can be used with interactive TV, which provides for integration of the purchasing process with "TV browsing".
[0286] 3.1.6 MOTO/Web Only Plastic/Paper Card
[0287] Issuing a MOTO/Web only card with no embossed figures can be implemented within the CPN platform with the export of CPN's to a card production process.
[0288] Greatly reduced re-issue costs for compromised cards. This is especially true in a chip environment where card re-issue costs are greatly increased. Also it greatly reduces the inconvenience involved in re-issuing a card.
[0289] A physical card is useful when collecting tickets for example.
[0290] Additional controls from the Orbiscom platform provide for the flexible control of the overall limit.
[0291] Controls can be applied to create specific mail order merchant cards with incentives by applying merchant ID controls.
[0292] The CPN platform provides for simple integration into an existing credit facility or account without the need to create a separate credit line.
[0293] Controls can be set-up by an issuer or via a telephone or computer interface as with other limited use credit card number products. These interfaces could provide for additional functions such as on-line statements.
[0299] user authentication
[0300] a configurable user interface
[0301] an interface to process customer requests
[0302] a screen and printing system to provide visual and printed information for the
[0303] capability for delivering other physical materials (cash, stamps and potentially magnetic stripe cards).
[0304] This provides a means for providing CPN numbers or cards for a range of card-not present applications. This route is particularly suitable for people who do not possess a credit card but wish to purchase goods over the Internet, telephone or mail order.
[0310] 1. The user would connect to the issuer's website using the WAP phone, and would log in and request a CPN.
[0311] 2. The issuer's web server would communicate with the Orbiscom server, which would issue an CPN with the required controls and link to the users account (either set by the user at the time or using pre-determined default values).
[0312] 3. The CPN would be returned to the user's WAP phone over the mobile network.
[0313] 4. The user would instruct the Bluetooth-enabled WAP phone to discover the POS service of the POS terminal.
[0314] 5. The phone and POS terminal would establish a Bluetooth connection, using suitable authentication security.
[0315] 6. The phone would beam the CPN to the POS terminal.
Patent applications by Daniel I. Flitcroft, County Dublin IE
Patent applications by ORBIS PATENTS LTD.
2014-03-27 Smart voucher systems and methods
2014-03-27 Secure payment system and method
2014-04-03 Communication system and communication method
2009-03-12 Credit card system and method