DE10229619A1 - Conducting a payment process by mobile telephone involves checking identification characteristic in transaction center, completing payment process if identification check satisfactory - Google Patents

Abstract

The method involves making a telephone connection between a mobile telephone and a transaction center (20), which uses the telephone number to identify the user (10) and bank account, transmitting at least a payment amount, recipient (30) and identification characteristic from the telephone after entering a secret number, checking the identification and completing the payment process in the transaction center if the check is satisfactory.

Description

The present invention relates to a method for performing a Payment process, using the payment process a mobile phone is carried out.

Especially for cashless payment transactions, but also for Shopping with distance selling (mail order, Internet) is in great demand secure payment processing. It is both the interest of the Given the payer, on the one hand, for example, via public Data networks only want to transmit information with which other third parties can not do anything and especially not at the expense of Users can carry out further payment transactions. It would be in In this case, financial damage to the user may arise for example when using credit cards and announcement of credit card numbers in case of doubt from the credit card companies will be carried. But there is also considerable damage Misuse of such information, ultimately the user wearing. On the other hand, there is the payment recipient Interest that a payment transaction should be carried out in such a way that The payee is certain that the incoming payment and the Booking actually on the payee's account is credited and not, for example, as with one Direct debit, can be revoked later. So it turns to one the problem that the user, for example when purchasing Objects on the Internet a payment option that is safe for him is and at the same time the provider of such services - and thus the Payee also - security regarding the Payment process needed.

This problem is solved according to the invention in that the Payment process is carried out using a mobile phone, with the used mobile phone a secure identification of the user, that is the person who is charged during the payment process is enabled. It also means that a secret number on the The user's cell phone is entered and then entered by this Identification feature is sent out, ensures that the user, So the payer, by entering the secret number accordingly a declaration of intent with a signature a clear, him as justifies identifying and expressing the willingness to pay in electronic form. One in serves as the secret number usually a combination of numbers and letters, for example, a common pin code (personal identification number). To Entering the secret number is on the mobile phone Identification feature generated, which is checked by the processing agency. Furthermore, according to the invention, the information from the The user's mobile phone is sent to a processing center. The The settlement agency takes the verification of the affiliation of the Phone number to the account and also checks, at least indirectly, whether the secret number can be recognized as valid, i.e. whether it is the corresponding account and the corresponding mobile phone Number is assigned.

The identification feature can be, for example, the Secret number itself or a string derived from it as well also about the use of certain (symmetrical or act asymmetric) encryption.

According to a preferred embodiment of the invention, as Payment process a transfer from the user's account to the account of the Performed by the recipient. This type of payment has in particular the advantage that the execution of a transfer for example in contrast to a direct debit or a direct debit cannot be revoked later. The credit on the account of the payee is secured as soon as the order is placed. A secure transfer is required to carry out a transfer Assignment of the transfer order to the person authorized to dispose of the account. In the present case, this is guaranteed by the fact that the settlement agent has both the user's phone number is known and a bidirectional data exchange between the Mobile phone of the user and the settlement agency is carried out. By this bidirectional communication ensures that the Payment process actually from the user's mobile phone is carried out. In addition, by entering the Secret number, for example a PIN, ensures that the user can access the Authorized payment. The entry of the PIN and its transmission to the Settlement agency therefore replace the signature under one Transfer order. The use of secret numbers for implementation and identification of the user in payment transactions is at ATMs where direct withdrawals are also made through the account and also known as credit cards and commonly known as legally and safely accepted.

In order to further increase the safety during use, it is according to the invention possible that before executing the payment process the settlement agency will check whether the implementation of the Payment process is permitted. This check includes, for example Check whether a certain payment framework or a certain Payment volume that is required for the disposal of the account by means of the The phone has been granted, has not been exceeded or has not been exceeded. At the same time or at a later time can also be checked be whether the specific payment process is the coverage framework or Does not exceed the limits on the account, d. that is, not there is an illegal overdraft on the user's account.

According to an embodiment of the invention is a telephone number exactly one bank account assigned to a mobile phone. This assignment serves to ensure that no accidental dispositions of one Mobile phone that actually affect another bank account should.

In contrast to the clear assignment of mobile phones to Bank account It is possible for a single bank account to have several Telephone numbers of mobile phones can be assigned. For example, it is possible that different people have the same account can, each using a different mobile phone and each person can be assigned their own secret number. Through this Measure can be retrospectively checked which of the people has made a decision on the bank account.

According to a further embodiment of the invention, it is possible that when performing a payment transaction for identification the payee’s phone number on a cell phone or of another payee's phone. at This procedure is then used, for example, in the area of Settlement agency checks which bank account has this phone number assigned. As the bank account of the recipient to whom the payment then posted, this information is then used. there it is also possible if the name of the The payee has been submitted to verify that this account is also is actually an account of the desired payee.

According to further embodiments of the invention at least the data relating to the payment process is encrypted transmitted. For this purpose, information about the used key from the user's mobile phone to the Settlement agency submitted. One can also use the key Identification of the user can be made. This is then possible if, for example, the phone number of the used The key in the processing office is closed and the message can only be decrypted if it is from the corresponding mobile phone has been encrypted. So far one Encryption of the transmitted data takes place, is preferably a asymmetric encryption method used. asymmetric Encryption methods are such encryption methods, at those decrypting and encrypting with different Codes. There are various cryptological methods that a enable such asymmetrical encryption. Coming in particular, encryption methods that question one use an open key, d. H. where the key with which has been encrypted, can be transmitted openly, but is not suitable, enable decryption. The transmission of the key with which encryption was then only used to identify the Encryption and allows the message with the appropriate one, at to decrypt the secretly stored key. Examples of such two-way or asymmetrical Encryption methods are the methods of encryption as used by Diffie-Hellmann were created. Also under the name "Triple DES "(Three DES) or" RAS "are known encryption methods suitable for this.

Furthermore, the correct encryption is particularly important suitable to check the secret number on the mobile phone of the Relocate user. Will the secret number in the mobile phone stored in encrypted form and encryption takes place in the area of the Cell phones without separate intervention by the user alone the correct entry of the secret number, this is successful Decrypting the message is sufficient assurance for the The user's willingness to pay.

It is particularly advantageous if for the transmission of information between the processing agent and the mobile phone as well as under Under certain circumstances, also between the settlement agent and the payee standardized messages, such as the SMS standard correspond to be transmitted. Such short messages have the The advantage that they correspond to a standardized protocol. Within a single message or at most within two messages all necessary information will be transmitted and the processing is complete easy and inexpensive to carry out.

According to an advantageous embodiment of the invention, a Payment process then be carried out when the payee the settlement agent a request to carry out a Sends payment. This prompt to carry out a Payment process includes at least the telephone number of the User, that is, the one who carries out the Payment process is de-enriched. Because of the at the clearing house incoming request there is then a data exchange between Processing agent and mobile phone of the user.

It is advantageous if the request to carry out a Payment process at least the payment amount that is paid should be included. In addition, this prompt can also required information about the payee, especially his Name, sort code of his bank account and number of his Include bank accounts. If in the above or below Text is spoken by bank account, so every time everyone Data required to uniquely identify the bank account understood, unless otherwise specified. The bank account exists usually at commercial banks from a bank sort code and an account number. The details of the bank account must be in each Case be suitable a specific account to which the payment amount should be clearly credited. Even the bank account of the user must be identified so clearly that the contained information is clear and on a very specific Refer account.

This also applies to the exchange of data between the processing agent and the user, it is advantageous if the information provided by the processing center to the user's mobile phone at least the information about the payee, preferably in the form of a name or in a legible and understandable text and not in the form of specifying a bank account or not only in the form of a bank account. About that In addition, the mobile phone of the user is preferably also Total amount to be paid transmitted. As part of the data exchange the payee then sends a message to the Settlement agency submitted. This message contains at least the Secret number of the user who carried out the Payment process, namely in particular the implementation of a transfer, authorized. The secret number thus replaces the user's signature, in a way such as at ATMs or but other electronic payment media.

Seen overall, such a payment transaction is preferably carried out in a way that a message from the payee, specifically a request for payment, which is at least that of the Includes user payable payment amount. Of the Settlement agent will at least the payment amount and the Payment recipient transmitted to the user's mobile phone. By input a secret number, for example a so-called pin (personal identification number) and by sending a message back, which in particular the payment amount and the Contains payee along with the PIN to which Settlement point will be the execution of the payment process, in particular a transfer, approved. From the settlement office is now the execution of a payment transaction, namely, for example a transfer from the user's account to the account of the Initiated by the payee. Before the actual execution of the Payment process can also use other criteria, such as Credit limit (number of transactions, amount of transactions, Amount of transactions carried out within a period. , .) be checked. The messages between the individual participants, especially as electronic short messages in Form of so-called SMS, exchanged.

It is possible that the request to carry out a Payment process - request for payment - from The payee is generated automatically. This can be done, for example take place that the user of the payment system its corresponding Data, namely his mobile phone number, at Specifies or has deposited the payee there. The information can in particular by entry in a corresponding field on a website, for example, the payee. Because of a Linking this information with an example Ordering goods and the resulting payment amount can then the corresponding payment request from the computer system of the payee are generated and sent to the settlement agent be transmitted. In the same way, such electronic Prompts also generated automatically by checkout systems in stores be, so that the payment system also as a replacement for the Credit card functions can serve. It can be both in the Cash machine itself integrated component act as well as a standalone device connected to the pay machine. The device itself shows in particular a possibility for telephone Transmission of data to the settlement agency. This transmission can both via landline phones and a mobile phone done according to a cellular standard. The transmission of the data from the payee to the settlement agent can also be transmitted directly over the Internet. The one here Information transmitted does not necessarily have to be identified are used and therefore do not necessarily have to be in as possible can be transmitted in a tamper-proof manner, even if this is natural further increases transmission security.

According to another embodiment of the invention, a Payment process can be carried out by the user at least the information about a payee and a Payment amount to be sent to the settlement agent. After sending this information is at least processed by the settlement agent Information about the payment amount, but preferably also at least the information about the payee to the user retransmitted. By entering the secret number on the mobile phone of the user and sending a message back to the Settlement point will now be the execution of a payment transaction, namely in particular a transfer.

This procedure is the same as for all of the others described possible embodiments of the method always a bidirectional communication between the cell phone of the User, that is, the paying or stripped, and the Settlement Agent. The fact that it is required that the user of the Settlement point on the mobile phone assigned to his account Receives message and only the confirmation of this message When the payment transaction is initiated, it is ensured that a such payment process is not from another mobile phone can be carried out. In particular, if the settlement agent your phone number assigned to the user, which is stored there is used to send a message to the mobile phone, from which the confirmation is to be made prevents a A third party from another mobile phone Payment process generated.

If a payment process is initiated by the user and are thus Information about the payee to the processing agent transmitted, it can first be checked in the processing center whether the information with appropriate information about the Payees who are available to the settlement agent to match. The assignment between a Name of a payee and his bank code and Account number to be checked. The bank sort codes and Account numbers regarding an appropriate control algorithm regarding their plausibility or correctness are checked. Of course can also be checked whether the payee is at all participates in this payment system and therefore in this way and Way a payment can be submitted. However, this is usually the case the case because the use of the payment system is not dependent on it is whether the payee himself or his bank at the Payment system participates when paying itself through a Transfer from the user's bank account to the bank account of the Payee takes place. Such transfers are between all usual banks done without problems, mostly also in electronic Way so that the credit and debit on the corresponding accounts at very affordable costs for the processing banks can be carried out. In addition, at Settlement point will also be checked whether the payment process to the Payee can actually be carried out, d. H. if she Information is so complete that user, payment amount and Sufficient recipient including corresponding bank details are known to carry out such a payment transaction and handle.

According to a further advantageous embodiment, after the payment process has been initiated, also a message the payee are generated. The message can in particular in the form of an electronic message, on a cell phone of the To be sent to the payee. Similarly, it is possible to send a corresponding message to the To send the payee. In particular, information about the Payee used, deposited with the processing agent are. This transmitted information can in particular in a Protocol is transmitted, which enables the information on the flow of payments in a simple manner in the area of accounting To process the payee.

The procedures for performing the payment process as they have been described above, according to advantageous training stipulate that the settlement office of the user's bank electronically transmits the data necessary for the implementation of a Transfer from the user's account to a bank account of the Recipient are required. After receiving this data, the bank of the User automatically through a transfer process. The Processing of payments between the user's bank and the bank of the user Receiver takes place for example in the for the implementation of Transfers traditional way. Here, in particular so-called clearing houses, which are responsible for the settlement of the Take over cash flows. It can be checked on the bank side whether payment within the granted to the user Is available and can be processed.

A further embodiment of the invention can provide that the Payment process takes place in two stages. After the user by typing the secret number and sending the message with the Secret number to the processing agent has confirmed that a corresponding Payment process to be carried out by the Settlement agency transfers the amount from the user's account to initiates the account of a trustee. The trustee takes over Transfer the payment amount to the account of the Payee as soon as he receives the message that the payment underlying counter transaction has been settled. This The trustee can send a message, in particular electronically, for example via a corresponding SMS, whereby again the Settlement point may be received. The Information about the execution of the counter transaction, whereby the Counter transaction can consist in particular in the delivery of goods be generated by a representative, such as a Parcel or courier service that delivers the goods to be delivered to the user delivered. Confirmation of delivery delivery Goods can then be made, for example, in such a way that the User related to such through a trustee Payment process a code number is transmitted and this Code number entered on a data collection device of the agent becomes. This can be obtained from the data collection device of the agent Information then again to the trustee or the processing agent be transmitted. This ensures that only under Participation of the user confirmation of the implementation of the Counter transaction can be generated. Processing a Payment process via a trustee and forwarding the payment to the payee only at a point in time after delivery, provides a process that works for both the user and the user Offers the highest security to the payee. It is with this procedure First, it ensures that the payee is safe with his money receives, d. that is, the user after performing the counter transaction and thus after receipt of the corresponding goods, the payment process cannot withdraw. On the other hand, the user has the security that the payment is not made to the payee, but to someone intermediary trustee and this is the Forwarding the money only when the user actually does the Receives goods. This approach is particularly related on purchases on the Internet where the user does not necessarily have the Knows the identity of the payee and is not sure that an order like the one he actually placed in one Delivery of the corresponding goods ends, of interest.

The above and other features go beyond the Claims also from the description and the drawings, wherein the individual characteristics individually or in groups in form of sub-combinations in one embodiment of the invention and be realized in other areas and beneficial as well can represent protective designs for which protection here is claimed.

Otherwise, the invention is also based on the in the Drawing illustrated figures explained in more detail, showing

Figure 1 is a schematic block diagram of a payment method for the purchase of goods on the Internet.

Fig. 2 is a block diagram of an inventive payment method in which the payee requests the user to perform the payment,

Fig. 3 shows the block diagram for a user-initiated payment transaction;

Fig. 4 shows an inventive method for performing a payment transaction using encryption, where the billing information is sent directly from the payment to the mobile phone of the user; and

Fig. 5 shows the schematic block diagram of an inventive method, in which the payment is conducted through an escrow or a trustee.

Simply the Invention Figs. 1 to 3 show embodied method for carrying out payment transactions, in accordance with. In the case of the methods, the communication between the user 10 and the processing center 20 and between the processing center 20 and the bank 11 of the user 10 can take place in unencrypted as well as in encrypted (symmetrical or asymmetrical) form. The following examples are particularly shown in connection with the use of digital electronic short messages, so-called SMS. Of course, communication with other protocols, e.g. B. according to the so-called WAP protocol or in other formats and under other protocols. The messages, whether they are coded or not, are defined as a defined sequence of fields with associated field contents. A separator can then be placed between the individual fields. A message can e.g. B. from a specific identifier, a telephone number (of the user or the payee), a payment amount, possibly a secret number (PIN) and possibly another phone number (for example, payee or user). The fields and the field contents are each defined. In order to make the system easier to use, it may be possible to store corresponding programs on the user's mobile phone or on the data entry stations or on the Internet pages of the payee. The required field contents are entered at certain points in the masks. The associated program transmits the structured information (data records) entered in the fields of the mask, but not the information contained in the mask. This considerably reduces the effort of the data to be transferred.

• - Telefonnummer des Mobiltelefones
• - Bankkonto (Bankleitzahl plus Kontonummer)
• - Identifikationsmerkmal (Geheimnummer oder Schlüssel eines Verschlüsselungsverfahrens)
• - Unter Umständen einen Namen, eventuell hierzu auch ein Alias
• - falls die Kommunikation verschlüsselt erfolgt, den zur Entschlüsselung der Nachricht geeigneten Schlüssel(teil) sowie unter Umständen auch das Datum der Herausgabe des Schlüssels und eine das Mobiltelefon identifizierende Information, beispielsweise die SIM-Karten-Nummer des Mobiltelefones, die das Mobiltelefon zu Abrechnungszwecken gegenüber dem Mobiltelefonnetz-Betreiber identifiziert und die ohne weiteres selbsttätig im Rahmen der Kommunikation zwischen Mobiltelefon und Abwicklungsstelle überprüfbar ist,
• - eventuell weitere vom Benutzer vorgebbare bzw. einstellbare Personalisierungen. Dies können insbesondere Grenzen betreffend die Verfügungssumme für das Zahlungssystem, sowohl für einen einzelnen Zahlungsvorgang, als auch für die Gesamtzahl der Zahlungsvorgänge über einen gewissen Zeitraum hinweg oder aber auch die maximale Zahlungssumme über einen bestimmten Zeitraum hinweg sein.

In the examples shown below, it is assumed that the following data is stored in the processing center 20 for each user:

• - Mobile phone number
• - Bank account (bank sort code plus account number)
• - Identification feature (secret number or key of an encryption process)
• - Under certain circumstances a name, possibly also an alias
• - If the communication is encrypted, the key (part) suitable for decrypting the message and, under certain circumstances, the date of release of the key and information identifying the mobile phone, for example the SIM card number of the mobile phone, which the mobile phone uses for billing purposes identifies the mobile phone network operator and can be checked automatically in the context of communication between the mobile phone and the processing agency,
• - possibly further personalizations that can be specified or set by the user. In particular, these can be limits regarding the amount available for the payment system, both for an individual payment transaction, and for the total number of payment transactions over a certain period of time, or also the maximum payment amount over a specific period.

• - Eine Kennummer, wie beispielsweise die Telefonnummer eines Mobiltelefones oder eines die Kommunikation abwickelnden Zahlungssystems, das insbesondere mit einer Kasse verbunden sein kann
• - Das Bankkonto des Empfängers (insbesondere Bankleitzahl und Kontonummer)
• - unter Umständen eine Geheimnummer
• - Name und Anschrift
• - Abrechnungsmodalitäten und andere Informationen.

Data is also stored in the processing center for each payee. If this data is not known to the processing agency, it is possible that it will be requested either automatically or in writing from the user or the recipient of the payment before executing a payment transaction. The following data are involved:

• - An identification number, such as the telephone number of a mobile phone or a payment system handling the communication, which can be connected in particular to a cash register
• - The recipient's bank account (in particular bank code and account number)
• - possibly a secret number
• - Name and address
• - billing modalities and other information.

• - Der Benutzer des Zahlungsverfahrens, der als Kunde oder Käufer einer Ware oder einer Dienstleistung auftritt. Der Benutzer möchte unter Verwendung eines Mobiltelefones eine Bezahlung für eine Gegenleistung, ein Gegengeschäft, vornehmen. Die Bezahlung kann sich dabei sowohl auf ein Erwerbsgeschäft im Einzelhandel oder im Internet (I-Commerce) oder auch um ein Geschäft, das über ein WAP-Handy (M-Commerce) angebahnt wurde, beziehen. Der Benutzer 10 hat sich als Teilnehmer an dem Zahlungsverfahren angemeldet. Diese Anmeldung kann direkt bei der Abwicklungsstelle 20, bei der es sich beispielsweise um eine Bank oder um eine unabhängige Institution, die im Auftrag mehrerer Banken die Abwicklung der Zahlung vornimmt, oder aber um ein Kreditkartenunternehmen oder den Betreiber einer Mobiltelefongesellschaft handelt, erfolgen.
• - Die Anmeldung kann aber auch über seine Bank 11 erfolgen. Die Anmeldung kann dabei bei der Einrichtung des Bankkontos generiert und an dieses geknüpft sein. Im Rahmen der Anmeldung werden die erforderlichen, insbesondere die oben angeführten Informationen, an die Abwicklungsstelle 20 übermittelt.
• - Der Zahlungsempfänger ist in der Regel ein gewerblicher Nutzer. Es kann sich dabei allerdings auch um einen Privatmann handeln, insbesondere um einen beliebigen dritten Benutzer. Der Zahlungsempfänger 30 kann insbesondere Online-Geschäfte im Internet oder ein Einzelhandelsgeschäft betreiben. Er bietet seinen Kunden unterschiedliche Zahlungsarten und unterschiedliche Abwicklungsmethoden der Zahlung (Barzahlung, Rechnung, Kreditkartenzahlung, Zahlung per Nachnahme . . .) an. Zur Durchführung des Verfahrens gemäß der Erfindung bietet er seinen Kunden auch die Zahlungsabwicklung gemäß diesem Verfahren an. Hierzu kann er sich als Teilnehmer an dem Zahlungsverfahren bei der Abwicklungsstelle 20 anmelden. Dies kann ebenfalls über seine Bank 31 erfolgen. Auch bei dieser Anmeldung werden die erforderlichen Daten, insbesondere die oben angeführten Daten, an die Abwicklungsstelle 20 übermittelt.
• - Die Abwicklungsstelle 20 ist die Kommunikationsdrehscheibe zwischen dem Zahlungsempfänger und dem Benutzer. Sie nimmt die Zahlungsaufforderungen und Zahlungsaufträge an und leitet bei positiver Prüfung die Zahlungsaufforderungen und -aufträge in die entsprechenden Kanäle weiter. Die Abwicklungsstelle überprüft zudem die Sicherheit der Kommunikation. Sie führt routinemäßig Prüfungen aus, die einen gezielten Angriff auf das Zahlungssystem erschweren sollen. Es kann beispielsweise die Anzahl der Transaktionen pro Zeiteinheit und die Höhe der Transaktionssummen überprüft werden. Es ist möglich, dass dann, wenn voreingestellte Werte überschritten werden, die Ausführung eines Zahlungsauftrages zurückgewiesen wird und nicht an die Buchungssysteme der Bank 11 des Benutzers 10 weitergeleitet werden. Darüber hinaus werden bei der Abwicklungsstelle 20 die Geheimnummern verwaltet. Dies schließt die Generierung, die Verteilung, die Änderung, das Sperren und das Entsperren der Identifikationsmerkmale mit ein. Dabei kann sich die Abwicklungsstelle, beispielsweise bei der Generierung der Geheimnummern, Schlüssel- und Identifikationsmerkmale, auch der Mitarbeit Dritter bedienen - zum Beispiel der Mobilfunk-Betreiber oder der SIM-Card- Hersteller, der zum Beispiel bei der Herstellung der SIM-Card diese mit einer entsprechenden Geheimnummer versieht. Falls die Kommunikation verschlüsselt stattfindet, umfasst das Aufgabenfeld der Abwicklungsstelle 20 auch das Generieren und das Übermitteln und Verwalten der zugeordneten Schlüssel bzw. Schlüsselpaare. Gegebenenfalls kann die Abwicklungsstelle 20 auch als Treuhänder agieren und die Treuhandkonten verwalten.

The following are involved in the payment transactions described below:

• - The user of the payment process who acts as a customer or buyer of a product or service. The user wants to make payment for a consideration, a counter transaction, using a mobile phone. The payment can relate to a commercial transaction in retail or on the Internet (I-Commerce) or to a transaction that was initiated via a WAP cell phone (M-Commerce). The user 10 has registered as a participant in the payment process. This registration can be made directly to the clearinghouse 20 , which is, for example, a bank or an independent institution that processes the payment on behalf of several banks, or a credit card company or the operator of a mobile phone company.
• - The registration can also be done via his bank 11 . The registration can be generated when the bank account is set up and linked to it. As part of the registration, the necessary information, in particular the information listed above, is transmitted to the processing center 20 .
• - The payee is usually a commercial user. However, it can also be a private person, in particular any third user. The payee 30 can in particular operate online business on the Internet or a retail business. He offers his customers different payment methods and different payment methods (cash payment, invoice, credit card payment, payment on delivery ...). To carry out the method according to the invention, he also offers his customers payment processing according to this method. For this purpose, he can register as a participant in the payment process at the clearing house 20 . This can also be done via his bank 31 . With this registration as well, the necessary data, in particular the data mentioned above, are transmitted to the processing center 20 .
• - The processing center 20 is the communication hub between the payee and the user. It accepts the payment requests and payment orders and, if the check is positive, forwards the payment requests and orders into the corresponding channels. The processing agency also checks the security of the communication. It routinely carries out checks that are intended to make targeted attacks on the payment system more difficult. For example, the number of transactions per time unit and the amount of the transaction sums can be checked. It is possible that, if preset values are exceeded, the execution of a payment order is rejected and not forwarded to the booking systems of bank 11 of user 10 . In addition, the secret numbers are managed at the processing point 20 . This includes the generation, distribution, modification, locking and unlocking of the identification features. The processing center can also use the cooperation of third parties, for example when generating the secret numbers, key and identification features - for example the mobile phone operator or the SIM card manufacturer, who, for example, helps to manufacture the SIM card a corresponding PIN number. If the communication takes place in encrypted form, the processing field 20 also includes generating and transmitting and managing the assigned keys or key pairs. If necessary, the settlement agency 20 can also act as a trustee and manage the trustee accounts.

Fig. 1 shows the schematic flow diagram of a payment process for the purchase of goods on the Internet. On the website 40 , the payee 30 offers goods for purchase, for example.

Together with the order for the delivery of the goods, that is to say with the conclusion of the purchase contract by the user, the payment recipient 30 offers the selection of the payment method by means of a mobile phone. According to step 101 of the method, the user 10 selects payment by means of a mobile phone as the desired payment method. Subsequently, the payee's website 40 sends him a request to enter his cell phone number in step 102 . By carrying out a corresponding entry in the field of the website 40 and sending this information back to the website of the payee 30 in accordance with step 103 , the payment process is triggered. For this purpose, according to step 104, a request for the execution of the payment process is first transmitted from the website 40 of the payee 30 to the processing point 20 . This request consists in particular of the user's phone number and the payment amount. In addition, this message can also include, for example, a telephone number of the payee 30 .

The processing center 20 now recognizes the user to be associated with this payment on the basis of the transmitted telephone number of the mobile phone of the user 10 . It generates a short message that contains, for example, the name and / or the telephone number of the payee 30 and the payment amount. This short message is transmitted according to step 105 of the method to the user 10 or his mobile phone. The payment amount and the payment recipient can now be displayed from the mobile phone. The payee is displayed in plain text when the necessary data is transmitted.

If the user 10 wants to confirm the payment process, he enters his secret number - PIN number - at the intended location according to step 106 . The intended location can simply be an attachment to the message transmitted to it, but it can also be a field in a mask displayed on his mobile phone. According to step 107 , the mobile phone of the user 10 now transmits a short message to the processing center 20 . This message contains in particular the telephone number and / or name of the payee, the payment amount and the secret number or another identification feature derived therefrom. In the processing center 20 it is now checked whether the secret number matches the secret number assigned to the user 10 , which is stored in the processing center 20 . If this is not the case, an error message is sent at least to user 10 . This can be the repetition of the request according to step 105 , which has been added with the addition that the first payment transaction could not be carried out because the secret number had been entered incorrectly. After repeated incorrect identification of the secret number, the information about the failure to carry out the payment transaction can also be transmitted to the payment recipient 30 , so that the latter does not fulfill the counter transaction, for example the delivery of certain goods, in trust in the payment.

The processing office now checks whether the payment process can be carried out. In this case, the processing point 20 can in particular compare the payment order with a released framework. The limit of disposal may include the restriction of a financial decision with respect to a single decision. For example, it can be provided that payments cannot be made using the payment method if the amount does not exceed a certain limit value, for example 100 or 200 euros, which is dependent in particular on the user 10 . It can also be checked whether the dispositions that have been made by the user 10 do not exceed a weekly or monthly disposition limit that has been determined. This limit of availability can be predefined both by the bank 11 of the user 10 and by the user 10 . It is entirely possible that the user 10 further restricts a limit of availability given by the bank 11 .

If, during the check in the processing center 20, it was determined that the secret number had been entered and transmitted correctly and the budget was also complied with, the data for the execution of the payment process is transmitted from the processing center 20 to the bank 11 of step 108 user. This information contains, in particular, the bank account of the user 10 , that is to say his bank code and account number, the payment amount and the necessary information about the payee 30 , that is to say at least his name and his bank account (again consisting of bank code and account number). According to step 109 , the bank 11 of the user 10 checks whether the payment transaction, for example a transfer, can be carried out. This can relate in particular to whether the account of the user 10 still has sufficient cover or is within an approved overdraft framework. If this is not the case, a corresponding message is transmitted to the processing center 20 .

If the payment transaction can be carried out, the bank 11, the transfer of a transfer leads in accordance with step 110 of the payment amount to the payee 30 in the form of its account with a bank 31 of the payee 30 through. At the same time, a payment confirmation is transmitted to the processing point 20 in accordance with step 111 , which confirmation may also be transmitted to the payment recipient 30 and possibly also to the user 10 in accordance with step 112 .

FIG. 2 schematically shows the sequence of a payment procedure that arises when the payment request is generated by the payee 30 , for example, is transmitted directly from a cash register system. According to step 201 , the request to carry out a payment transaction is transmitted to the processing point 20 . The content of these and the other data transmissions correspond to those described in FIG. 1 and they are therefore no longer described in detail. The processing point 20 determines the payment recipient according to step 202 and sends the payment request to the mobile phone according to step 203 in the form of an electronic message. According to step 204 , the user 10 checks whether he wants to make the payment and the information transmitted, in particular the payment amount and the payment recipient, are correct. By entering his PIN, he expresses his will to make the payment. After entering his secret number, he transmits the corresponding data from his mobile phone to the processing center 20 in accordance with step 205 .

The processing agency 20 then checks in accordance with step 206 whether the payment can be carried out in accordance with the information available to the processing agency 20 and whether the secret number (the identification feature) is correct. If this is the case, according to step 207, the data required to carry out a transfer from the account of the user 10 to the account of the payee 30 are transmitted to the bank 11 of the user 10 . In accordance with step 208, the latter checks whether the payment process can also be carried out in accordance with the rules and regulations applicable to it. If this is the case, the corresponding transfer to the recipient's bank account at the bank 31 of the payment recipient 30 is carried out in accordance with step 209 . At the same time, according to step 210, a message about the execution of the payment process can be transmitted to the processing point. In accordance with step 211 , the processing center 20 generates a message about the payment that has been made for the payee 30 , which is transmitted to the payee 30 in accordance with step 212 . At the same time, according to step 213, the processing center also generates a message about the payment made for user 10 and transmits it to him according to step 214 .

FIG. 3 shows a method for carrying out a payment transaction, the payment request originating from the user 10 . For this purpose, the user 10 creates a payment request according to the step 301 , which is transmitted to the processing point 20 . On the basis of this payment request, in accordance with step 302, the processing center 20 generates a message which is transmitted to the mobile phone of the user 10 in accordance with step 303 . This message contains in particular the payment amount and the telephone number and / or the name of the payee 30 . According to step 303 , this message is transmitted to the mobile phone of user 10 , who then checks according to step 304 whether the payee and the payment amount correspond to his wishes. If this is the case, he enters his secret number (PIN). According to step 305 , this information is then transmitted again, for example as an electronic message, from the mobile phone of the user 10 to the processing center 20 . The settlement agency 20 can now check whether all the necessary information regarding the payee 30 is available here. If this is not the case and also if the authenticity of the payee is to be checked, then a control message or prompt is generated in accordance with step 306 within the payment center 20 and in accordance with step 307 to the payee 30 , for example on his cell phone or transmitted to a corresponding cash register system. According to step 308, the payee 30 transmits the missing data to the processing center 20 , which can be compared there according to step 309 with already known data and can be compared and checked with the data transmitted by the user 10 . Here, in particular, the identification of the cell phone of the payee 30 can be carried out in the processing center 20 via the SIM card required when the cell phone is in operation. This ensures that the information transmitted actually comes from the person in question. This can also be ensured in that this switching, like the others, in particular the transmissions carried out in accordance with steps 303 and 305, is carried out in an encrypted manner, wherein asymmetrical encryption methods in particular can be used, as already explained above. In this case, the key used can also be used as an identification feature for the user.

Once the information has been transmitted to the settlement center 20 according to step 308, adds the settlement center 20, the required information relating to the requested payment transaction by appending the information received. If it was not necessary to query additional information, it is only checked in step 310 in accordance with step 309 whether the payment order can be carried out in accordance with the rules that have been deposited with the processing point 20 regarding the user 10 . If this is the case, then according to step 311, all the data required for carrying out a payment transaction, for example a transfer, are transmitted to the bank 11 of the user 10 . In accordance with step 312 , bank 11 checks whether the payment process can be carried out from the user's account in accordance with its rules. If this is the case, according to step 313 the bank 11 makes the payment, for example in the form of a transfer of the corresponding amount of money to the account of the payee 30 at the bank 31 of the payee 30 . At the same time, in accordance with step 314, a message about the execution of the payment transaction is transmitted to the processing point 20 . As in the manner shown in FIG. 2, the latter can send this message both to the payee 30 and to the user 10 .

The Fig. 4 also shows a schematic representation of a further alternative of the inventive method. This method, which can be used, for example, at checkouts in shops and which generally requires asymmetrical encryption methods, is simplified in that all communication is carried out via the mobile phone of the user 10 . However, it requires that, for example, the cash register system of the payee 30 can generate electronic messages and transmit them to the mobile phone via a local communication option, such as an infrared interface.

According to step 401 , the cash register system transmits to the mobile phone of the user 10 a transaction identification number (TIN) which, together with the invoice data, is encrypted with the public key of the processing center 20 . The message about the payment request together with the invoice data is transmitted from the mobile phone of the user 10 to the processing center 20 in accordance with step 402 . The processing center 20 checks the authenticity of the user 10 in accordance with step 403 . If this is recognized as correct, the processing point sends back to the cash register a payment confirmation encrypted with the public key of the cash register of the payee 30 via the mobile phone of the user 10 .

After the authenticity of the user 10 has been checked, a payment request is sent to the user in accordance with step 404 . This request for payment contains, decryptable for the mobile phone of the user 10 or in plain text, the information regarding the payment amount and the payee. The user 10 checks this information according to step 405 and, if the information is correct, enters his secret number (PIN) as a declaration of intent that the payment process should be carried out. According to step 406 , the payment confirmation together with the secret number is then transmitted back from the mobile phone of the user 10 to the processing point 20 .

According to step 407 , it is checked again in the processing point 20 whether the payment transaction should be carried out, in particular whether the restrictions specified there with respect to the customer 10 , for example restrictions on disposal, would be observed if the payment transaction were carried out. If this is the case, then in accordance with step 408, the processing point 20 transmits to the bank 11 of the user 10 the data required for carrying out the payment process. The bank 11 then carries out an internal check in accordance with step 412 as to whether the payment can be carried out and, if it can be carried out, transfers the money amount to the bank 31 of the payee. With step 409 , the bank 11 of the user 10 also sends a confirmation to the processing center 20 that the payment has been made.

According to steps 410 , this confirmation is also first transmitted to the mobile phone of the user 10 and then from this mobile phone via the transmission option from the mobile phone of the user 10 to the cash register system of the payee 30 according to step 411 . By initially making the customer's payment request clear to the processing agent and entering their secret number after receiving a payment request from the processing agent 20 and thereby clearly confirming their payment request, the authenticity of the user 10 vis-à-vis the processing agent 20 can be clearly determined. This check includes both the phone number of the mobile phone and the correctness of the secret number. Furthermore, the accuracy of the data transmission can also be ensured by using symmetrical or asymmetrical encryption methods, so that, for example, the information that is transmitted from the mobile phone to the processing center 20 with a user that is fixedly specified by the processing center 20 and, for example, in the SIM card of the mobile phone stored encryption method and after entering and possibly depending on a secret number of the user. The data which the processing center 20 then receives from the mobile phone can only be retranslated into reasonably assignable and meaningful data if the processing center 20 can be decrypted correctly with the key part of the mobile phone or this customer 10 assigned to it. The encryption therefore also serves as an identification feature for the user.

The payee identifies himself to the processing point 20 by means of an identifier which, for example, is sent to the processing point with the billing data via the mobile phone of the user 10 . The user 10 can understand the authenticity of the payee 30 by having the payment request, which is returned to him by the processing point 20 and which contains the name of the payee in an identification that cannot be identified and read by him, displayed as readable data and this Can check names with it. The method shown thus offers a very high degree of security for all participants. The encryption of the message between the cash register and the processor ensures that the cash register and the processor authenticate each other and that third parties cannot read or modify the data transmitted, for example, via mobile radio.

In FIG. 5, a further method is shown according to the invention. This method is characterized by the use of a trustee account or by the intermediary of a trustee who can agree with the settlement agency 20 . The payee has a high level of payment security due to the fact that the payment amount is debited from the user's account immediately and thus has a 100% payment security. From the user's point of view, however, there is always a disadvantage compared to the payment system if the goods still have to be delivered to the customer. This can take days or even weeks. There may even be a partial delivery in advance, the subsequent delivery is delayed or cannot be delivered by the payee at all. Activating the escrow account or the trustee can be an advantage so that the user does not experience any disadvantages compared to other payment systems in this case. In this regard too, the method is shown in a schematic diagram in FIG. 5. The transmitted messages can be transmitted both encrypted and unencrypted, as explained several times above.

According to step 501 , the payment recipient 30 , for example an online retailer who offers his goods on the Internet, sends the payment request with the billing data and the reference to the processing to the processing center 20 by means of the fiduciary process. In accordance with step 502, the processing center 20 checks the authenticity of the payee 30 by decrypting the encrypted transmitted message and checking its legibility and correctness. Encryption therefore serves as an identification feature. If the payment recipient 30 has been recognized as valid, the processing point transmits the payment request to the mobile phone of the user 10 in accordance with step 503 . This payment request contains in particular the payment amount and information about the payee. This information can also be transmitted in encrypted form, but this is not absolutely necessary. According to step 504 , the user 10 checks whether the payment should be carried out. If this is the case, he enters a secret number. The information, in particular the payment amount and the secret number and the payee, is now signed and encrypted in the customer's mobile phone, for example using the 3-DES method.

This encrypted message is transmitted to the processing center 20 in accordance with step 505 . The processing center 20 checks in accordance with step 506 whether the message can be decrypted. When the decryption has been carried out, the authenticity of the user 10 is guaranteed. A check is also carried out to determine whether the limit of availability of the user 10 is complied with even after the payment process has been carried out. If this is the case, then according to step 507, a data record is transmitted to the bank 11 of the user 10 , which contains all the information required for the execution of the payment process. The bank 11 uses its data to check whether the payment process can be carried out, in particular whether the available limit of the account is not exceeded. Then, in accordance with step 507 a, she makes a booking of the amount of money to a trustee account with a trustee 60 , which is managed, for example, by herself or at the clearing house 20 .

Subsequently, according to step 508, a confirmation of the booking made is transmitted to the processing point 20 . This processing point 20 now transmits the confirmation of the payment process to the trust account in accordance with step 509 to the payee 30 . According to step 509 a, the payee initiates the delivery of the goods purchased by the user 10 from the payee 30 . The delivery takes place, for example, via a parcel service or Post 50 . After delivery, this representative 50 transmits the confirmation of the delivery and acceptance of the goods to the processing center 20 in accordance with step 510 . The settlement agency 20 now transmits to the trustee 60 or the bank 11 of the user 10 , which also acts as the trustee 60 , the request to carry out the booking from the trust account to the account of the payee 30 in accordance with step 511 . According to step 514 , this booking is made in the form of a transfer from the trust account that was held at bank 11 of user 10 to the bank account at bank 31 of payee 30 . In accordance with step 512 , the bank 11 transmits the corresponding information about the execution of the booking or the transfer from the trust account to the account of the payee 30 to the processing point 20 . According to step 513, the latter at least sends a message to the payee 30 with the payment confirmation to his account from the escrow account.

Payment transactions according to the invention can be used for payment purposes of any kind. It can not only do this Goods shopping can be done in retail stores or on the Internet other payments can also be processed. It can as well Services are paid or other banking transactions be made. For example, buying or selling Securities with such a payment process.

The implementation of the payment method according to the invention is in largely independent of the counter transaction taking place. Payments between private individuals can also be processed.

It is also possible to display the most recent transactions carried out via the mobile phone of the user 10 . For this purpose, a corresponding query can be carried out via a corresponding menu that is transferred to the mobile phone of the user 10, for example by the processing center 20 and is stored in this corresponding mobile phone. After a corresponding request has been transmitted from the mobile phone of the user 10 to the processing center 20 and has been / is authenticated, for example, by using the assigned secret number and in particular also the key used, a corresponding message is sent to the processing center 20 . This checks the authenticity of the user. After the message has been checked and decrypted, the details relating to the last transactions carried out can be called up. If the processing agency 20 has the information on the account balance of the user 10 or can access it, it is also possible for the user 10 to call up the account balance relating to the account which he uses to process the payment by means of the payment method with this mobile phone , The corresponding information is then transmitted back to the mobile phone of the user 10 via the processing point 20 .

The secret number to be used for the use of the method is preferably sent to the user 10 by post by letter. It is possible that a special encrypted message is transmitted to the mobile phone of the user 10 in parallel. With this message, the new secret number can be stored in encrypted form on the so-called SIM card of the mobile phone. From this point in time, the customer is able to carry out payment transactions with this mobile phone.

If the mobile phone of the user 10 is lost, he can have the payment function blocked for the relevant telephone number of the mobile phone. Another reason for blocking a mobile phone in connection with the payment transactions can be that several incorrect entries of the payment secret number have been made in succession. The check whether this secret number was entered correctly can also be carried out directly on the so-called SIM card. In the event of a blockage, this information is also transmitted to the processing center 20 . Unlocking can then be carried out by the processing center 20 .

Claims (24)

1. Method for carrying out a payment transaction using a mobile phone, with the following steps - To carry out a payment transaction, a telephone connection is established between a mobile phone and a processing point ( 20 ), - at the processing point ( 20 ), the user ( 10 ) and an assigned bank account are identified at least by means of the telephone number of the mobile telephone, - After entering a secret number, at least the payment amount, the payee ( 30 ) and an identification feature are transmitted from the mobile phone to the processing center, - The identification feature is used to check whether the transmitted identification feature is assigned to this user ( 10 ) as valid, - If the identification feature is recognized as valid, the processing agency ( 20 ) carries out a payment transaction by debiting the user's bank account ( 10 ) and crediting it to a bank account of the recipient ( 30 ). 2. The method according to claim 1, characterized in that the Identification number is a secret number. 3. The method according to claim 1 or 2, characterized in that the payment process is a transfer from the account of the user ( 10 ) to the account of the recipient ( 30 ). 4. The method according to any one of claims 1 to 3, characterized marked that, before the payment process is carried out it is checked whether the execution of the payment process by the associated account is allowed. 5. The method according to any one of the preceding claims, characterized in that exactly one bank account is assigned to a telephone number of a mobile phone in the processing center ( 20 ). 6. The method according to any one of the preceding claims, characterized characterized that a bank account has multiple phone numbers can be assigned by mobile phones. 7. The method according to any one of the preceding claims, characterized in that a telephone number is transmitted from the mobile phone of the user ( 10 ) to identify the payee, wherein in the processing center ( 20 ) it is checked whether a bank account is assigned to this telephone number, and then the account data of the bank account assigned to the telephone number are used as the bank account of the recipient ( 30 ). 8. The method according to any one of the preceding claims, characterized in that the data relating to the payment process are transmitted in encrypted form, in particular an identification of the key used being transmitted from the mobile phone to the processing point ( 20 ) and serving as an identification feature. 9. The method according to claim 8, characterized in that by entering a secret number is an automatic Encryption of the data takes place, in particular also a signing of the Data is done. 10. The method according to claim 8 or 9, characterized in that the key is clearly assigned to the user ( 10 ) and is used to identify the user. 11. The method according to any one of claims 8 to 10, characterized characterized that an asymmetric encryption method is used, with another for decrypting Key part is used as for encryption, in particular the key part required for encryption is a public one Is key. 12. The method according to any one of the preceding claims, characterized characterized that the transmission of information in the form of standardized messages, especially electronic ones Short messages, such as SMS, are made. 13. The method according to any one of the preceding claims, characterized in that a request to carry out a payment transaction is sent from the payee ( 30 ) to the processing point ( 20 ), the request including at least the telephone number of the user ( 10 ) and wherein due to the When requested by the processing center ( 20 ), data is exchanged with the user's mobile phone. 14. The method according to claim 13, characterized in that the Prompt also includes the payment amount. 15. The method according to claim 13 or 14, characterized in that the request also contains the required information about the Payee, especially his name and preferably also the information about his bank account. 16. The method according to any one of claims 13 to 15, characterized in that at least information about the payee ( 30 ) from the processing point ( 20 ) to the user ( 10 ) is transmitted. 17. The method according to any one of claims 13 to 16, characterized in that a message from the payee ( 30 ) to the processing point ( 10 ) is transmitted, the message data of the payee ( 30 ) and the payment amount to be paid by the user ( 10 ) includes that the processing point ( 20 ) transmits at least the payment recipient ( 30 ) and the payment amount to the mobile phone of the user ( 10 ), the user ( 10 ) by entering the secret number, for example a so-called PIN, and sending back a message , in particular an electronic short message to the processing point ( 20 ), to carry out the payment transaction, in particular in the form of a transfer from the account of the user ( 10 ) to the account of the payee. 18. The method according to any one of claims 13 to 17, characterized in that the payment request is automatically generated by a website of the payee ( 30 ) when the user has entered the required information on the website or it is stored there in this context and by An action is carried out on the user ( 10 ) on the website, in connection with which the payment from the user ( 10 ) to the payee ( 30 ) is related. 19. The method according to any one of claims 1 to 12, characterized in that the user ( 10 ) at least the information about a payee ( 30 ) and a payment amount is transmitted to the processing point ( 20 ), then at least from the processing point ( 20 ) the information about the payee ( 30 ) and payment amount are transmitted back to the user ( 10 ), whereupon the execution of a payment process is initiated by entering the secret number and sending a message back to the processing point ( 20 ). 20. The method according to claim 19, characterized in that before the information is sent back to the user ( 10 ), the information about the payee ( 30 ) is checked according to at least one of the following criteria: the information agrees with corresponding information about the user ( 10 ) that is available to the settlement agent, - the payment order to be carried out is within a specified budget, - the payee ( 30 ) participates in the payment system, - The payment process to the payee ( 30 ) can be carried out based on the information available. 21. The method according to claim 19 or 20, characterized in that at least about the fact that such a payment process has taken place, information is sent from the processing point ( 10 ) to the payee, in particular to a mobile phone of the payee ( 30 ). 22. The method according to any one of the preceding claims, characterized in that the processing point ( 20 ) of the bank ( 11 ) of the user ( 10 ) electronically the data required for a transfer from the account of the user ( 10 ) to a bank account of the recipient ( 30 ) transmitted, in particular by the bank ( 11 ) of the user ( 10 ) automatically executing a transfer. 23. The method according to any one of the preceding claims, characterized in that the payment process takes place in two stages, a transfer first being made to an account of a trustee, the trustee transferring the amount to a bank account of the payee ( 30 ) as soon as the trustee receives the information that a counter transaction on which the payment is based has been processed. 24. The method according to claim 23, characterized in that the counter transaction is the delivery of goods to the user ( 10 ), the trustee receiving the information about the counter transaction that has taken place when an agent ( 50 ) delivers the goods to be delivered to the user ( 10 ) has delivered.