Patent ID: 7797251

Claim:
A computer-implemented method of securely authorizing a financial transaction between a merchant terminal and an authorization server, said method comprising: in the merchant terminal: reading an account number from a customer-held device; and sending the account number to the authorization server; in the authorization server: using the account number to retrieve an associated index value from a factor database; and sending the index value to the merchant terminal; in the merchant terminal: requesting the customer to enter a multi-digit personal identification number (PIN) and to close a security switch, said security switch physically isolating a table of factors from the merchant terminal when the switch is open and enabling access to the table when the switch is closed; using the index value to retrieve an associated factor from the table of factors; modifying the PIN with the factor retrieved from the table of factors; and sending the modified PIN to the authorization server; and in the authorization server: authorizing the financial transaction only if the modified PIN matches a stored PIN as modified by a factor associated with the index retrieved from the factor database.