WO2003012703A2

WO2003012703A2 - Method for making transactions secure

Info

Publication number: WO2003012703A2
Application number: PCT/FR2002/002671
Authority: WO
Inventors: Yves Eonnet; Evrard Guelton; Vincent Rigal
Original assignee: Smart Design
Priority date: 2001-07-27
Filing date: 2002-07-25
Publication date: 2003-02-13
Also published as: AU2002341013A1; FR2827982B1; WO2003012703A3; FR2827982A1

Abstract

The invention concerns a method for making secure transactions carried out by means of media such as bank cards and the like, said method consisting in sending through a merchant an authorisation or payment request to a server, said request comprising data concerning the transaction and terms and conditions for reading data on the medium used, the method further consisting in: associating with each medium a means for communication with the bearer of the medium, using the data included in the authorisation or payment request to determine risky transactions and sending to the bearer a message indicating a risky transaction, after the bank has authorised the transaction.

Description

Method for securing transactions

The invention relates to a method for securing financial transactions carried out by means of media such as bank cards or the like.

In the current technique, when a merchant and a buyer have defined a transaction, for example in distance selling or via the Internet, this transaction can be described, as regards its payment, by an identification of a card. payment (card number, called PAN, and expiration date), an amount, the identity of the merchant, or even the identity of the buyer. It is also characterized by a set of information on the technical terms of the transaction, contained in fields of computer messages which pass through the financial networks.

Generally, the merchant sends this transaction to his bank or to an intermediary gateway, such as a remote collection center or a telepayment gateway, in the form of an authorization request. This is sent to the buyer's bank, which has a few seconds to check the status of the card and its limits, before authorizing or rejecting the transaction.

The merchant then ships the goods and submits a payment request. This follows the same route as the authorization request, passing through a possible gateway, the merchant's bank, generally the interbank networks and arriving at the buyer's bank.

Most secure transaction systems require dual equipment, both merchant than the buyer, necessary to secure the transaction. An example is that of the smart card system, generalized in France in 1993, with its cards and its payment terminals, which use a smart card reader on the microcomputer of the online buyer, as well as a secure payment gateway on the merchant's side. Systems using double-slit cell phones require modification of the buyer's phone, as well as a specific payment gateway on the merchant side.

This double equipment constraint makes the deployment of such solutions extremely difficult. Indeed, the merchant only has an interest in investing if a sufficient number of his customers are equipped, and vice versa. In addition, the buyer is only safe when all the merchants are equipped, failing which a fraudster will attempt payments from unsecured sellers. The documents EP-A-0745961 and FR-A-2 792 143 describe security systems which do not have these two defects, because they require special means only on the buyer side or on the client side. This process described by document FR-A-2 792 143 includes the issuing of authorization requests by merchants. When such a request is received, the buyer's mobile phone is located, the locations of the telephone and the point of sale are compared, and confirmation is sought from the buyer if the two locations are different. This system can be ineffective in distance selling, while this type of sale is particularly conducive to fraud, because it may be too slow to allow a rejection of the authorization, and therefore cannot prevent the transaction from being concluded and the goods delivered, even when the card holder is warning the system that fraud is in progress. In addition, the location of the mobile telephone can only be legally obtained with the agreement of its holder. The latter will only give it to the extent that he sees an interest in it. However, cases of fraud detectable by the system, although financially very penalizing, are little known to the general public who are not aware of it.

The document EP-A-0745961 describes a process which only involves special means on the buyer side. This method includes a mechanism for interception of authorization requests by the issuing bank. Upon receipt of these requests, the bank sends a message to the buyer, typically by telephone. The buyer can thus oppose the transaction, leading the bank to send a refusal of authorization to the merchant. According to the embodiments, this refusal is sent on dispute by the buyer or on lack of response on his part within a given period.

This system is in fact inoperative. In fact, electronic money networks have an essential rule, which requires authorization servers to have a very short response time (a few seconds). It is in practice impossible in such a period of time to send a message to the customer and to obtain his response and the system described by document EP-A-0745961 would therefore produce a systematic rejection. It could only work practically if this rule was changed. However, such a modification is very difficult to envisage, for technical reasons (it is included in all banking networks and in all authorization servers in the world) and for functional reasons (this rule is essential for the fluidity of electronic money traffic and for the speed of passages from customers to checkouts ).

There is also known a transaction security system called virtual card, in which a particular card number is issued for remote transactions. This eliminates the risk that this number, obtained by a fraudster, will be used for other transactions, since it is only valid for one transaction before being neutralized.

However, this system also has limits in terms of security, since it does not prevent a fraudster from using the real card number for remote transactions. We could plan to systematically prohibit the use of this number for distance selling, but this solution appears very penalizing both for banks (it appears as a limitation to trade) and for holders who, in practice, could no longer use payment by card on traditional distance selling sites, since the provision of virtual card numbers is only convenient on a network of the internet type.

This virtual card system also carries a significant risk of error by the holder, who may in particular forget to request a virtual number and order with his real number.

The present invention aims to provide a simple and effective solution to these problems. To this end, it proposes a method of

securing transactions carried out between merchants and buyers using information media such as bank cards and the like, this process consisting in associating, in a protected database, each medium and a means of communication with the holder of the medium , and have an merchant terminal send an authorization or payment request to an authorization or payment server, this request comprising information relating to the transaction and the methods of reading information on the medium used by the buyer, characterized in that it also consists of:

- to use the said information included in the transaction authorization or payment request to determine whether the transaction is at risk or not, - if so, to send an alert message to the holder of the medium notifying him of the risky transaction, once authorization has been granted by the bank. Advantageously, this process also consists in asking the holder if he is indeed the author of the transaction in order to possibly put the card in opposition or to stop the shipment of the goods. We can also offer the holder to refuse the transaction and ask the bank to re-credit his account for the amount of the transaction.

The invention comprises means only on the side of the buyer and his bank. This avoids the disadvantages due to the constraint of double equipment. The invention is part of the existing electronic payment rules, which it does not require any modification. In particular, it does not imply any intervention on the functioning of the authorization servers of banks: the system according to the invention can be satisfied with receiving, in slight delay, a copy of the authorizations granted by the bank. This point is particularly important, because these servers are often extremely complex machines, the result of dozens of successive modifications, and whose operation is critical: any interruption results in ^' an impossibility of payment for the bank's customers. In general, the invention allows an extremely fast and inexpensive implementation, practically without material investment (neither for the bank, nor for the buyer, nor for the merchant) and without computer modification within the bank or at the merchant.

In return for these advantages, the invention does not allow the buyer to block the transaction at the time of the authorization request. However, it allows very rapid opposition, preventing the fraudster from reusing a card. The invention therefore allows a very significant limitation of fraud.

According to another characteristic of the invention, two main mechanisms for identifying risky transactions are proposed and can be used separately or in combination.

The first mechanism uses information describing the regulatory conditions of the transaction.

Electronic messages contain a set of information that can be used to do this, but none of which is sufficient. Field 25 of authorization requests (ISO standard 8583, "conditions of the transaction at the point of service") normally gives the distance selling information. In practice, it is not always reliably informed, particularly in France. It must therefore be completed by field 59 (national data) type 200

(technical and regulatory environment) for French transactions at least. If this field has a value between 20 and 23, between 30 and 33 or is worth 35, it is an unsecured distance sale. If it is 24 or 34, we will refer to field 59 type 407, which gives information on the security level.

In the case of messages coming from VISA networks, the procedure is similar. In the case of messages from networks

Europay / Mastercard, it is also advisable to consider field 25, because the only field 59 is not filled in reliably.

This process indicates with a good probability the transactions in distance selling, and in a reliable way those which are protected. But it is not completely sufficient, because some transactions may have been labeled as PDP (Presence Of The Carrier) by mistake, even fraudulently. The second mechanism uses the information describing the technical methods of reading information from the medium used by the wearer. The first is the entry of the confidential code, indicated by field 22 (“reading mode of the acceptance system”, second sub-field “code entry capacity”). Indeed, in current systems, entering the code requires a physical presence of the wearer. Exceptions can be treated using the field "mode of reading the carrier number" (first sub-field of field 22. In fact, there is currently no distance selling system with both input code and track playback.

This second mechanism is a very effective filter for remote transactions. However, some of them will remain poorly identified. Mail order purchases paid for using readers available to the holder (CyberComm, GSM double slot) are in this case. To identify them correctly, the second mechanism (entering the code, reading the chip) and the first (distance selling) must be combined.

Transactions in the physical presence of the holder without reading the track or the chip and without control of the confidential code may be treated either as risky transactions (if for example they come from countries or merchants where the level of control of the identity of the bearer and mechanisms such as the hologram are deficient), or as secure transactions. In general, it will be beneficial to distinguish, in the process of selecting risky transactions, the countries of origin of the transactions.

Finally, it will be useful to identify transactions from a dynamic virtual card, and to exclude them from alert mechanisms. This can be either directly on the network ^• or on the virtual map server, both of which have the number with which the transaction was made

(therefore the virtual number, recognizable by the value of its first digits). This can also be done at the bank level. In this case, the virtual number may have been replaced by the real number, but the mention of the origin (for example the machine having made this substitution) makes it possible to identify that the original transaction used a virtual number.

These detection mechanisms apply when the transaction has been the subject of an authorization request, which is the case for most distance selling transactions. On the other hand, some of these transactions, either because they are too small, or more generally because the merchant did not wish to make such a request, go directly to the payment stage. In this case, the method described here uses the messages which reach the payment manager of the issuing bank, which essentially contain the same information as that used in the event of an authorization request. Obviously, provision is made to reconcile authorization requests with payment requests, so that the same transaction is not subject to two alerts, this reconciliation being effected by means of amount and currency, country, date and, when available, authorization, merchant, terminal number, etc.

In the event of risky transactions, alerts are sent to the card holder, or more generally to a person with the right to control over the expenses made with this card. It can be the bearer himself, the father or the mother in the case of a minor child, a purchasing manager in the case of acquisition cards for companies. This person is designated in the following as the holder.

The alerts are sent to a communication device accessible to the holder. In a preferred embodiment of the invention, this communication device is a portable telephone, for example a telephone with the GSM standard or a similar standard. In a variant, messaging devices (pagers) or communicating personal assistants are used. In another variant, a landline telephone is used, for example the holder's personal telephone or business telephone, or a fax machine. In a third variant, electronic mail is used, the communication device then being the holder's computer. In what follows, only the use of a portable telephone will be described, by way of example, with reference to the appended drawing which schematically represents the main steps of the method according to the invention.

The constitution of a correspondence list between payment card numbers and telephone numbers of the holder (respectively of his messaging number, of his electronic address for personal assistants and e-mails) is an essential element of the process according to the invention. It must be avoided that a fraudster can build or modify such a list, for example by assigning a valid card number his own telephone number. This is why this list is made up by the banks of the holders. Each line in the list is guaranteed by the bank. This guarantee can take several forms: digital certificate for each card, using a public key algorithm and a bank key; protected deposit in the confirmation site; deposit of the list and global protection by a certificate with public key of the site. The bank certifies the link between a card number, represented by a subscriber number, and the mobile phone number of the buyer (or of the person who is responsible for controlling his purchases: supervisor or parent for example).

In a variant, the list is made up and guaranteed by a telephone operator (mobile or fixed), which has the contact details of its subscribers.

For security reasons, we prefer to store the card numbers in ^an encrypted form, preferably with an irreversible encryption algorithm. In an example of a conversion function, the card number, PAN, is made up of three fields: UN (bank identification), AAN (card identifier) and a CC check digit. We choose an irreversible function f without collision (for example the RSA algorithm, whose private key has been destroyed). This function is applied to the PAN and the result is concatenated with the UN field to form a subscriber number. Then, one can proceed to a certification of the subscriber number by its correspondence with an identifier, such as for example the telephone number of the holder's mobile telephone. For this, we can form a couple comprising the subscriber number and the telephone call number and apply to the two elements of this couple a private encryption key from the bank, to generate a certificate.

The preferred alert mode is the mobile phone message. This message can be written or voice. It is advantageously in accordance with the GSM standard (SMS message, MMS, WAP push). A variant is the message written on a messaging device. Another variant is, for carriers who have such a service, the use of instant messaging, which will automatically choose the mode of transport of the message best suited to the circumstances.

This alert mode can, for certain cardholders, be replaced by a message on a landline telephone, the personal number or the professional number of the card holder. We can provide voice messages, but also written messages (which will be transformed into voice messages, or delivered in written form on the screens of phones that have this option). This variant will benefit from future intelligent mailbox services, capable of distinguishing members of the same family so as to deliver messages only to the right recipients.

The alert message includes the main information available allowing the bearer to identify the transaction. The form of the message is advantageously adapted to the alert mode and to the communication channel. An example of such a message, designed for the SMS alert mode on GSM is as follows:

Payment security alert Remote purchase 347E 10/03 personal card. In case of fraud such as '0800 123456'.

The telephone number indicated allows customer support. We will assist him to verify that he dispute the transaction, and that it is not an error on his part. He will eventually be advised to put his card in opposition.

The preferred alert mode is advantageously supplemented by one or more emergency alert modes, to compensate for cases of failure (change of telephone number, mobile phone off or outside the coverage area, network failure, etc.). Among these backup modes we will find another telephone number (landline or mobile), an electronic message, a fax machine. An example of a rescue message is as follows:

From: service XXX

Subject: purchase by unsecured bank card Date: ....

Mr / Mrs / Ms

We have alerted you, on your mobile phone (number 06 XXXX XXXX), after having detected an insecure remote transaction in the amount of 347FF made with your business card on 03/10/01 (transaction number xxxxxxxxxxxx, subscriber yyyyyyyyyy ). Not having received a response from you, we allow ourselves to send you this message.

If this is a fraudulent transaction, please send this message, mentioning the subject as 'rejection', then fill in the attached form and send it, signed, to our address. This will allow us to process your rejection with your bank, and request an investigation.

If you wish to oppose your card, call 0800 123 456. If your mobile number is incorrect, please connect to the site http://www.mabanque.fr and modify it.

Telephone assistance is available on 0800 123 456 (2FF per minute)

In the case of a transaction made by a holder subscribed to a virtual card service and having used his real card number, it will be advantageous to use a message mentioning this possibility and its advantages. This variant is particularly advantageous if the transaction lends itself well to this technology, for example if it is identified as a transaction on the Internet (for example if the field 59 type 200 is worth 24).

A transaction made with a virtual card number may not be sufficiently secure, for example in the case where this number can be used several times. A variant then consists in sending an alert which mentions the virtual card. An example of such a message for the SMS channel is as follows:

Payment security alert Internet purchase 347E 10/03 virtual personal card. For fraud go to www.mabanque.fr or such "0800 123456" The method according to one invention provides several modes of response by the carrier. The first response mode is SMS response or, more closely, the use of a two-way messaging device. The message includes the necessary information (how, or even to whom to respond to confirm or reject the transaction). This answer should be as simple as possible. It will advantageously hold on a single letter (in the example above, ^Λ A 'or ^λ S'). It must take into account predictive input mechanisms (on some mobile phones, R 'is thus automatically translated into ^Λ S').

Another response mode is voice response, to a number indicated in the message or made available to the carrier by other means. Some telephones allow, for simplicity, the call to a number mentioned in the message and recognized automatically.

The third response mode is the written response, particularly for alerts sent by email or fax.

In all response modes, you must be able to identify the transaction concerned. Indeed, the carrier may have received several alerts, of which only one or a small number must be dismissed. The method allows the bearer, in particular in the voice or written response modes, to give details of the relevant transaction. It is also planned, as an option, to manage several senders of messages or several assistance telephone numbers, each alert being sent by a different issuer or mentioning a different assistance number, which will only receive the response corresponding to the alert that 'he issued.

These transmitters / telephone numbers are advantageously used cyclically. The system has a sufficient number of transmitters / telephone numbers to manage the remote purchases of the vast majority of carriers for a sufficient period of time. These transmitters can be physical transmitters or virtual transmitters. In the case of GSM messages, the first case will naturally be found if the messages are sent by radio (so-called MO, Mobile Originated messages). We then have a battery of GSM modems, each identified by a telephone number, which are managed cyclically for each holder.

It is also advantageous to provide a response mode authenticated by the buyer. For this, the buyer can be asked, when he confirms or disputes the transaction, to enter a confidential code. This code can advantageously be written in the card or the SIM module inserted in his mobile phone. One can also ask the buyer to respond via a telephone server, which it will indicate ^• the relevant transaction and give its code.

A rejection of a transaction by the holder can lead to the implementation of the reimbursement mechanisms provided by the banking systems. In addition, the consequences of fraud must be limited. The method according to the invention comprises several modes of limiting fraud. A first method consists of identifying the merchant whose sale is disputed and alerting him immediately. If the alert was issued quickly enough, and if the holder responded without long delay, the merchant has the option of not sending the goods. He can also deliver it while keeping it under surveillance in order to catch fraudsters.

In this method of limiting fraud, the merchant is known thanks to the information appearing in electronic messages which are merchant identification information (for example fields 42 and 43 of ISO 8583), but also the terminal number (field 41). We have a database of merchants (or at least some of them, whose importance in all distance sales is significant), their identifiers, as well as the addresses to which to send an alert. An advantage of this method of limiting fraud is that it does not require any modification of the electronic payment system or of the merchants' data processing.

In a second mode of limiting fraud, complementary to the first, the future use of the card is limited. In traditional methods, this takes the form of opposing, then destroying the card. This method is well suited to classic cases of card duplication fraud, but it is cumbersome and costly in cases of fraud using the card number. The second method of limiting fraud avoids this drawback and consists in refusing all authorizations containing the card number in question, since it may be a sale in the absence of the physical card.

In this fraud limitation mode, the authorization server is used. As soon as an authorization request including the card number is detected, it is checked whether it is a distance sale using one of the identification methods described above. If so, the authorization request is refused, and an alert is sent on the one hand to the holder to verify that he is not the author of the transaction, on the other hand to the bank to report the continuation of the fraud.

In a first embodiment of this method of limiting fraud, a blocking algorithm is implemented in the authorization server of the bank. In a second embodiment, a diversion mechanism is often used in authorization servers. This mechanism consults a list of card numbers integrated into the server. Each authorization request for a card that is part of the list is diverted to a second machine, which may or may not block the request. This second embodiment makes it possible to set up the blocking mechanism without software modification on most authorization servers. In a third embodiment, there is a dedicated server in the interbank network. It is he who can detect authorization requests, and collect those which must be blocked.

This method of limiting fraud will advantageously be supplemented by intervention at the level of the payment server. Indeed, certain transactions are not the subject of an authorization request, and the merchant also has the possibility of requesting a payment even when the authorization to make the transaction has been refused. To do this, we include in the payment algorithms a systematic rejection of any remote payment made with a blocked card. You can also use a payment card of the "first franc authorization request" type.

This supposes that the holder has formally indicated his will to reject any remote transaction with his card number, for legal reasons. We can advantageously complete the rejection systematic by the payment server by distributing a list of blocked card numbers to remote sellers, similar to a list of opposing cards. In these three embodiments, it is advantageous to provide a temporary purchasing mechanism with a normally blocked card number. This mechanism can be achieved in two ways.

In the first embodiment of the temporary unlocking mechanism, the holder who wishes to make a purchase by mail informs his bank in advance. The latter can then lift the blocking mechanism for a limited period (for example 2 hours), or for certain merchants. In this embodiment, a message is sent to the bearer in the event of an authorization request if the card has not been unlocked, in order to allow him to repair a possible oversight.

In the second embodiment of the temporary blocking mechanism, the holder who wishes to make a purchase by correspondence will first seek, for example on the website of his bank, a temporary card number. It uses this number, called virtual number, instead of the real number. The authorization request is thus directed to a particular server, called a virtual card server, which replaces the virtual number with the real number, checks that the use of the first conforms to the rules which limit its use, then retransmits the authorization request for acceptance to the bank's server. The authorization request arrives at the bank with the real number, as well as information that shows that it was originally issued with a virtual number. This neutralizes the locking mechanism.

In this embodiment, an alert message is sent to the bearer even if the transaction has been blocked. It indicates the reason for the rejection, and the possibility of using a virtual number. An example of such a message for the SMS channel is as follows:

Payment security alert Remote purchase 347E 10/03 Personal card refused. Repeat the purchase with virtual number

This virtual card server can be the recipient of all authorization requests from the bank, or can only process the numbers corresponding to virtual cards. In the first case, it can advantageously be provided that the virtual card server is also the network server provided in the third embodiment of the fraud limitation mode.

Claims

1 - Method for securing transactions carried out between merchants and buyers by means of information media such as bank cards and the like, this method consisting in associating, in a protected database, each medium and a means of communication with the holder of the medium, this means of communication comprising a fixed or mobile telephone or a similar device, and having a merchant terminal send a transaction or payment authorization request to an authorization or payment server, this request containing information relating to the transaction and the procedures for reading information on the medium used by 1. ' buyer, characterized in that it also consists of:

-. to use the said information included in the transaction authorization or payment request to determine whether the transaction is at risk or not,

- if so, to send the holder of the medium, by the means of communication, an alert message informing him of the risky transaction, once the authorization has been granted by the bank.

2 - Method according to claim 1, characterized in that the holder of the support is proposed to put the support in opposition.

3 - Process according to claim 1, characterized in that the holder of the support is offered to refuse the transaction, and to ask the bank to credit his account with the amount of the transaction. 4 - Method according to one of claims 1 to

3, characterized in that the transactions which appear as 'distance selling' are risky transactions.

5 - Method according to claim 4, characterized in that the distance selling transactions are identified by checking information defining the technical conditions of the transaction such as the reading mode of the support number or the control of a confidential code.

6 - Method according to claim 4 or 5, characterized in that the distance selling transactions are identified by checking the regulatory conditions as well as by correlation with the availability of the result of the reading of the magnetic strip or the chip of the support. 7 - Method according to one of claims 4 to

6, characterized in that in the detection of distance sales, the country of origin of the transaction is taken into account.

8 - Method according to one of claims 1 to 7, characterized in that the means of communication with the holder of the support is a fixed or mobile phone or a messaging device or a communicating personal assistant, or an electronic mail.

9 - Method according to one of claims 1 to 8, characterized in that the alert message is a written or voice message. 10 - Method according to one of the preceding claims, characterized in that the communication means comprises a main channel and at least one secondary channel used in the event of failure or delay in the main channel.

11 - Method according to one of the preceding claims, characterized in that the alert message includes indications given to the holder on how to respond. 12 - Method according to one of the preceding claims, characterized in that the alert messages on transactions by the same holder are sent by different senders who only receive responses to the messages they have sent.

13 - Method according to claim 8, characterized in that the response is in a single character, not modifiable by the predictive input algorithm of a mobile phone. 14 - Method according to one of the preceding claims, characterized in that the rejection of a transaction by the holder triggers a blocking by an authorization server of subsequent remote transactions using the same medium. 15 - Method according to claim 14, characterized in that the authorization server includes a blocking algorithm.

16 - Method according to claim 14, characterized in that the authorization server reroutes requests whose support belongs to a list to a second machine which blocks them.

17 - Method according to one of claims 14 to 16, characterized in that the authorization server which blocks transactions is in the interbank network.

18 - Method according to one of claims 14 to 16, characterized in that the blocking of remote transactions is temporarily deactivated by a voluntary action of the holder of the support.

19 - Method according to one of claims 14 to 16, characterized in that the blocking of remote transactions can be circumvented by using a virtual support number, which the blocking mechanism does not recognize, and which is then replaced by the actual media number.

20 - Method according to claim 19, characterized in that a remote transaction made with a virtual support number triggers the transmission of a specific message to the holder of the support.

21 - Process according to claim 19, characterized in that the blocking mechanism and the virtual card mechanism are managed by the same machines.

22 - Method according to one of claims 14 to

21, characterized in that the blocking mechanism is also implemented in the payment server. 23 - Method according to one of claims 14 to

22, characterized in that a list of blocked support numbers is distributed to a set of distance selling sites.

24 - Method according to one of claims 14 to 23, characterized in that there is a database of mail-order merchants and their identifiers in electronic payment transactions, and in that any rejection by the holder of a transaction containing one of these identifiers is the subject of rapid information to the merchant, before finalization of the delivery.

25 - Method according to one of claims 18 to 24, characterized in that a remote transaction made with a blocked medium triggers the emission of a message to the holder of the medium, recommending him to use a medium number virtual instead of the actual media number.