EP4298580A1

EP4298580A1 - Payment card, authentication method and use for a remote payment

Info

Publication number: EP4298580A1
Application number: EP22706329.4A
Authority: EP
Inventors: William SMADJA; Marlène ABISDID
Original assignee: Ccs12
Current assignee: Ccs12
Priority date: 2021-02-24
Filing date: 2022-02-21
Publication date: 2024-01-03
Also published as: FR3120149A1; BR112023017020A2; IL305443A; JP2024507012A; FR3120149B1; CN117178283A; CA3209526A1; WO2022179986A1

Abstract

The invention relates to a payment card (1) which comprises, on one side (10, 11), at least one authentication cryptogram (3), said authentication cryptogram (3) being unique and belonging to the payment card (1), the authentication cryptogram (3) being affixed to the payment card (1), said authentication cryptogram (3) forming a means of identifying the payment card (1) by optical recognition, said identification means being linked to a bank account to which the payment card (1) is linked. The invention also relates to a method for authenticating the payment card (1) and the bearer (100) of said payment card (1) with a view to carrying out a secure operation relating to personal data of the bearer (100) of the payment card (1). Finally, the invention relates to a use of the authentication method to make a remote payment using the payment card (1).

Description

Title of the invention: Payment card, authentication method and use for remote payment

The present invention falls within the field of securing financial transactions by credit card, and more particularly remote banking payments made on the Internet.

[0002] As a reminder, a bank card is a card made of plastic, or even paper or cardboard, with a side of a few centimeters and one to two millimeters thick. The card conventionally carries at least one integrated circuit capable of containing information. This integrated circuit corresponds to the chip and may contain a microprocessor capable of processing this information or be limited to non-volatile memory circuits and, possibly, a security component such as a memory card.

[0003] During a remote payment by bank card, it is necessary to enter the data "known as security data" of the bank card in order to proceed with the financial transaction.

[0004] This security data is generally written on one or the other of the faces of this smart card. Typically, a bank card includes identification data for a bank account and/or the owner of the bank card. These identification data are generally written on the front of the bank card. More precisely, the card number, also called PAN number, is linked to a bank account. In addition, most bank cards include, on the one hand, the identity of the holder of the bank card (surname and first name and/or company name).

On the other hand, banking organizations also enter the expiry date of the payment card.

[0005] These identification data for an account and/or for the owner of the smart card are generally printed or embossed on the front side of the bank card. Generally, these inscriptions are made by an embossing technique (front side) of the smart card or by screen printing.

[0006] The majority of bank cards also include a security code or a visual cryptogram affixed to the back (or rear face) of the bank card.

[0007] In practice, the owner or holder of the bank card is asked to provide this identification data when making a payment online or by telephone.

[0008] Since the beginning of the 21st century, online commerce and more generally online payment have shown an almost exponential growth in the number of transactions but also in the financial volume of these transactions. [0009] Faced with this increase in the volume of online payments, the issue of cybersecurity seems critical. Indeed, in parallel with this increase in online payments, there is also an increase in credit card fraud, particularly through online or telephone piracy.

Among these numerous frauds, there are two types; one with use of the bank card, says CP for card present, the other without card says CNP for card not present. Fraud of the first type involves the physical theft of the bank card and the hacker, in possession of this stolen card, who also has security data that allows him to usurp the identity of the bearer of the bank card in order to online payments. The visual hacking of security data can also be assimilated to this first type of identity theft fraud. Indeed, visual hacking occurs in principle during a payment in store, the seller copying the security data without the knowledge of the holder / cardholder. The pirate is then in possession of the secure data of the bank card and can carry out transactions remotely, either for his own account or to resell them to a third party.

[0011] Phishing is the second type of identity theft fraud. This technique is undoubtedly the one that has developed the most in recent years. The technique consists in making the victim believe that he is addressing a trusted third party such as a bank, an administration, in order to extract personal information from him: password, credit card number, number or photocopy of identity card, date of birth, etc. This can be achieved by replicating an entire website, by sending an email or even by sending a text message. As a result, the hacker finds himself in possession of the secure data of the bank card which also allows him to carry out transactions for his own account.

[0012] To prevent this type of fraud, banking organizations have implemented payment security methods by sending a payment confirmation text message or "sms" to the cardholder's mobile phone. banking. This text message generally includes an alphanumeric code sent by the banking institution in order to validate the payment. This service is called “3D-Secure ^® ” authentication. Although this system provides some security, it has some flaws that allow hackers to circumvent it. First of all, not all banks offer such a service. Similarly, the payment system of all merchant sites does not allow the use of this method of securing the financial transaction. So that to date only 40% of French online transactions are validated by this system. In addition, this system makes it possible to change the telephone number to which the alphanumeric code is sent. A godsend for the pirate who can thus divert the sending of the alphanumeric code to his own mobile phone.

[0013] These disadvantages led, in a recent decision, the Commission

European Union to establish new stricter European standards which require a higher level of security with regard to online payments. The ambitious timetable for the application of these new standards aimed for entry into force in 2021, with a major drawback, that of leaving the choice of solutions to the banks with the risk of a lack of harmonization.

[0014] Alternative solutions exist to secure transactions. For example, there is a type of bank card that has a dynamic CW cryptogram. The CW cryptogram corresponds to the sequence of three digits which is generally found on the front side of the bank card.

[0015] The CW cryptogram is said to be dynamic, since the series of three digits evolves randomly, automatically and at regular frequency. Thus, it is possible to entrust without fear the information of a dynamic bank card for online transactions. Indeed, even in the event of hacking by phishing, the security data of the bank card will be unusable, since the cryptogram changes regularly.

[0016] The dynamic cryptogram bank card is only a partial answer to the problem of phishing. However, it does not address the problem of physical theft of the bank card. Apart from the fact that the technique embedded in such a card is a technological feat, in particular through the integration of both a battery and a screen in the thickness of the card, this technology is very expensive and not ecological, which delays its generalization.

[0017] It should be noted that the plaintiff already offers a solution to combat identity theft following physical theft of the bank card and/or its visual hacking. The solution proposes to integrate a cryptogram instead of the three digits of the bank card's PAN number. This solution is described in particular in document WO 2020/120849. Although in possession of the bank card, the hacker does not have all the secure data in order to make online payments for his own account. Indeed, the holder of this type of bank card receives, on the one hand, a bank card of which part of the PAN figure is masked, and on the other hand, the masked number. This masked number can be revealed by a digital process also developed by the applicant has also been the subject of a French patent application FR 20 05961.

[0018] Although this solution of encrypting the PAN number of the bank card has proven itself against the physical theft and/or the visual hacking of a bank card, it does not does not prevent hacking by phishing of secure bank card data.

[0019] Consequently, on the day of writing this document, we are forced to note that banking organizations and e-commerce players have not yet found an appropriate solution to secure online transactions by bank card. .

To overcome these drawbacks, the plaintiff has developed a technical solution which aims to secure online payment through double authentication ensuring the authentication of the bank card and the holder of this bank card.

A first aspect of the present invention relates to a payment card comprising a front side and a back side, the payment card also incorporates an electronic chip, the front side comprising security data which includes, at least, a PAN number , an identity of the bearer of the payment card and an expiry date of the payment card, the back side having a CW cryptogram generally consisting of three digits.

The payment card is characterized in that it has on one side at least one authentication cryptogram comprising a number of characters between 200 and 10,000, this authentication cryptogram is unique and the owner of the payment card. payment on which the authentication cryptogram is affixed, this authentication cryptogram constitutes a means of identification of the payment card by optical recognition, this means of identification being linked to a bank account to which the payment card is linked.

The payment card according to the invention is equipped with a proprietary authentication cryptogram which is affixed to one side of the payment card. This authentication cryptogram contains a large number of characters which makes it unique. In fact, the authentication cryptogram contributes to providing a means of authentication of the payment card by optical recognition of the authentication cryptogram. This authentication cryptogram helps to improve the security of secure operations, by limiting phishing fraud. Indeed, when a hacker has managed to steal the security data of the payment card, an authentication method according to the invention requires the validation of the secure operation by optical recognition of the authentication cryptogram. Thus, if the hacker does not hold the payment card and its secure data, he cannot use the payment card for his benefit.

According to a second characteristic of the first aspect of the invention, the authentication cryptogram is a matrix code consisting of a determined number of black modules arranged in a white background so as to form a single pattern, each black module constituting a character of the authentication cryptogram. This type of matrix code provides a large number of combinations which allows each payment card to include a unique authentication cryptogram also called "owner".

According to a third characteristic of the first aspect of the invention, the PAN number consists of four series of four digits, the payment card comprising a PAN cryptogram substituting at least one series of four digits of the PAN number.

The PAN cryptogram provides additional security that helps prevent physical theft and/or visual hacking of the payment card. Indeed, even in the event of physical theft and/or visual hacking, the hacker does not hold the full PAN number of the payment card. It is therefore unusable.

In particular, the PAN cryptogram comprises between 16 and 100 characters, preferably the PAN cryptogram comprises between 36 and 64 characters. According to the invention, the PAN cryptogram is a gimbal grid.

[0027] According to a fourth characteristic of the first aspect of the invention, the CW ciphertext can be substituted by a ciphertext having a number of characters greater than three. This feature also aims to hide the security data of the payment card in order to fight against physical theft and/or visual hacking of the payment card.

A second aspect of the invention relates to a method for authenticating a payment card defined according to the first aspect of the invention, and the bearer of this payment card. The authentication method aims to carry out a secure operation relating to the personal data of the bearer of the payment card. With this in mind, the authentication process comprises at least: a) A first step of authentication of the payment card by entering the security data of the payment card and/or a first authentication of the bearer of the payment card, the bearer of the payment card providing his identity and/or an identifier; b) A step of requesting a secure transaction relating to the personal data of the bearer of the payment card, the request made to a secure digital space linked to the bank account of the payment card opened with a banking institution , the secure digital space being stored on a remote server managed by the banking institution; c) A step of verifying the security data entered on the payment card, this step being carried out by comparing the security data entered with reference data stored in the secure digital space; d) A second step of authentication of the payment card and the bearer of the payment card, the second authentication step being carried out by recognition of the authentication cryptogram owner of the payment card, this step being carried out through a digital recognition module available or accessible via a digital terminal belonging to the bearer of the payment card, and; e) A stage for finalizing the secure transaction relating to the payment card holder's personal data.

[0029] Through the two authentication steps a) and d), the method according to the invention integrates a double authentication of the payment card and/or of the holder of this card. This double authentication reinforces the security of a secure operation such as a remote payment. Indeed, this process involves entering the security data of the payment card, but also that it is the bearer of this card who performs this operation to open the recognition module, and finally that the bearer of the payment card holds his payment card for the cryptogram owner of the payment card is recognized. In fact, the authentication process makes phishing hacking, as we know it today, ineffective since this type of hacking does not make it possible to recover the proprietary authentication cryptogram of the payment card.

According to a first characteristic of the second aspect of the invention, the second authentication step d) is performed by opening a secure communication channel between the secure digital space of the bank account and the digital terminal of the bearer of the payment card, the secure digital space of the bank account then calling for the opening of the digital recognition module.

[0031] According to a second characteristic of the second aspect of the invention, the authentication method comprises, on opening the recognition module, a biometric and/or codified authentication operation of the bearer of the payment card, in if the authentication of the bearer of the payment card is successful, the recognition module gives access to a camera of the digital terminal to allow digital capture of the authentication cryptogram of the payment card.

According to a third characteristic of the second aspect of the invention, the method comprises a comparison of the authentication cryptogram affixed to the payment card, with a reference digital image of the authentication cryptogram stored in the secure digital space. from the bank account.

[0033] According to a fourth characteristic of the second aspect of the invention, when the connection step a) is performed on a secure online portal separate from the secure digital space 6, a secure communication channel is opened between the portal in secure line and a secure digital space linked to the bank account of the payment card.

[0034] According to a fifth characteristic of the second aspect of the invention, the authentication method comprises a step of geolocation of the digital terminal of the bearer of the payment card.

A third aspect of the invention relates to a use of the authentication method defined according to the second aspect of the invention, to operate a validation of remote payment and in particular of a remote payment made via a website, the remote payment being operated through a payment card defined according to the first aspect of the invention.

Other features and advantages will appear in the following detailed description of two non-limiting embodiments of the invention illustrated by Figures 1 to 6 placed in the appendix and in which:

[0037] [Fig. 1] is a representation of a front face of a payment card in accordance with the invention.

[0038] [Fig. 2] is a representation of a reverse side of the payment card in Figure 1.

[0039] [Fig. 3] is a representation of a digital terminal receiving a call from a banking server in order to authenticate a payment card.

[0040] [Fig. 4] is a representation of a recognition step of the authentication cryptogram of the payment card of figures 1 and 2.

[0041] [Fig. 5] is a representation of a system and method for authenticating a payment card in accordance with a first embodiment of the invention.

[0042] [Fig.6] is a representation of a system and method for authenticating a payment card that complies with a second embodiment of the invention.

As illustrated in Figures 1 to 5, the invention relates to a payment card 1.

This payment card 1 corresponds to a bank card. In fact, the payment card 1 according to the invention is linked to a bank account opened with a banking organization. The bank account and the payment card 1 are assigned to a user also called the holder of the bank account, or bearer 100 of the payment card 1 .

The payment card 1 comprises a front face 10 and a back face 11. Conventionally, the payment card 1 also incorporates an electronic chip 12. This electronic chip 12 comprises a processor and a memory configured to execute an algorithm and/or store data. [0045] As illustrated in Figure 1, the front face 10 includes security data 2. The security data 2 includes at least one PAN number 20. The PAN number 20 is composed of several series of digits, for example four series four digits, making a total of sixteen digits. The term PAN is common in banking jargon. In this example, reading payment card 1 from left to right, the PAN number 20 has a first set of numbers 200, a second set of numbers 201, a third set of numbers and a fourth set of numbers 203.

As illustrated in Figure 1, it is possible to substitute at least one series of four digits of the PAN number 20 by a PAN cryptogram 21. In this example, the PAN cryptogram 21 replaces the third series of digits of the PAN number 2 However, alternatively, it is possible that the PAN ciphertext 21 substitutes the fourth series 203 of digits of the PAN number 2.

According to the invention, the PAN 21 cryptogram comprises between 16 and 100 characters. Preferably, the PAN cryptogram 21 comprises between 36 and 64 characters. In the example of figure 1, the cryptogram PAN 21 consists of a gimbal grid. Nevertheless, it is quite possible to consider the use of another type of PAN 21 cryptogram such as a simple bar code or a matrix bar code.

It should be noted that this technique for encrypting the PAN number using the gimbal grid as the PAN 21 cryptogram is described in more detail in international application WO 2020/120849 filed by the applicant. In addition, a process for digitally revealing the series of encrypted digits is described in French patent application FR 20 05961 also filed by the applicant. As explained in the introductory part, the encryption of a series of digits of the PAN 21 number makes it possible to effectively fight against identity theft fraud, in particular following the physical theft of the payment card.

[0049] As illustrated in Figure 1, the security data 2 also includes the identity 22 of the bearer 100 of the payment card 1. In addition, the security data 2 includes a deadline 23 for the validity of the payment card 1 .

[0050] Conventionally, the security data 2, 20, 21, 22, 23 affixed to the front face 10 of the payment card 1 are written by printing and/or embossing, or even by screen printing on the surface of the payment card 1 In this example, with the exception of the PAN cryptogram 21 which is printed, the other security data 2, 20, 22, 23 are affixed by embossing.

As illustrated in Figure 2, the reverse side 11 has a CW cryptogram 24. This CW cryptogram 24 generally consists of three digits. In a way optional, it is also possible to substitute the ciphertext CW 24 by a ciphertext having a number of characters greater than three. For information, a gimbal grid, simple barcode or matrix barcode type cryptogram can be used to replace the CW 24 cryptogram.

The CW cryptogram 24 is also part of the security data 2 of the payment card 1. We are talking about security data since during a remote payment, these security data 2 are used to authenticate the payment card 1 with the bank management organization.

According to the invention, the payment card 1 comprises at least one authentication cryptogram 3. It is unique and owner of the payment card 1. This authentication cryptogram 3 constitutes a means of authentication of the card of payment 1 by optical recognition. It is linked to the bank account of payment card 1.

The authentication cryptogram 3 can be affixed to a face 10, 11 of the payment card 1. In the example of Figure 2, the authentication cryptogram 3 is affixed to the back face 11. However, the authentication cryptogram 3 could also be placed on the front face 10 of the payment card 1.

According to the invention the authentication cryptogram 3 comprises a number of characters between 200 and 10,000.

In the example illustrated in Figures 2, 4 and 5, the authentication cryptogram 3 consists of a matrix code. Matrix code is also called “two-dimensional barcode”. In practice, the matrix code consists of a determined number of black modules arranged in a white background in such a way as to form a single pattern. Therefore, each black module constitutes a character of the authentication cryptogram 3. Each black module has determined dimensions. This type of matrix code is known as a “QR code®”. The high number of characters in the authentication cryptogram 3 gives it its unique character.

It should be noted that the authentication cryptogram 3 could consist of another type of visual cryptogram such as a holographic cryptogram, a gimbal grid, etc. The advantage of a data matrix cryptogram is that it can already be read, recognized by a smartphone and current banking applications.

As illustrated in Figures 5 and 6, the invention also relates to an authentication system 4 of a payment card 1 and of the bearer 100. The double authentication of the bearer 100 and of his payment card 1 contributes to achieving a secure operation relating to the personal data of the bearer 100 of the payment card 1. For example, the secure operation may correspond to a remote payment made using the payment card 1 (FIG. 5). This double authentication is particularly useful for remote payment via the Internet. However, double authentication can also be used to carry out a digital signature, operation on a loyalty account, transfer of bank funds, etc.

In the example of Figures 5 and 6, the authentication system 4 includes a digital terminal 5. The digital terminal 5 may consist of a "smartphone" or smart mobile phone, a digital tablet, etc. More broadly, it is possible to implement the invention with an electronic device equipped with display means such as a screen, a multimedia capture tool such as a camera or a video camera, a memory and a processor to store and run algorithmic applications. The electronic device can also comprise means of communication through a telecommunications network such as a mobile telephone network, a wired telephone network, the Internet, etc.

According to the invention, the digital terminal 5 integrates a recognition module 50 of the authentication cryptogram 3 owner of the payment card 1. The recognition module 50 is configured for a digital capture of the authentication cryptogram 3. For these purposes, the recognition module 50 is integrated into an application system configured to take control of the camera of the digital terminal 5. For information, the recognition module 50 can be integrated into an application for managing the bank account linked to payment card 1 . This bank account management application is of course stored and executed by the digital terminal 5. It should be noted that on the day of writing this document, each banking organization provides its customers with a bank management application. The recognition module 50 is therefore an algorithmic brick which can be added to an already pre-existing application or correspond to an application algorithm strictly speaking.

The digital terminal 5 is configured to communicate remotely through a wireless communication network. To this end, the digital terminal 5 can include communication means such as a mobile telephone transmitter/receiver. By way of example, the transmitter/receiver can be of the GSM, 2G, 3G, 4G, 5G, 6G type. In addition, the digital terminal 5 can include a near field transmitter/receiver, such as Bluetooth, Wifi or other. It should be noted that most digital terminals include a Wifi transmitter/receiver and a transmitter/receiver Bluetooth. Furthermore, mobile telephones or smartphones additionally comprise a mobile telephone transmitter/receiver.

As illustrated in Figures 5 and 6, the authentication system 4 according to the invention further comprises a secure digital space 6. The secure digital space 6 is linked to the bank account of the payment card 1. In general, the secure digital space 6 is managed by a banking organization managing said bank account of the bearer of the payment card 1. The secure digital space 6 is stored by a remote server. In a known manner, this secure digital space 6 is accessible remotely via secure protocols, such as the service call. This service call is of the same type as that used by electronic payment terminals (TPE) to make bank payments following the reading of a bank payment card.

[0063] Typically, a service call can be secured by a security protocol of the APA, HTTPS, OAuth2 type.

The secure digital space 6 is also configured to open a secure communication channel using a payment validation system, of the PSP or “Payment service provider” type for example. Such a PSP payment validation system corresponds to an application programming interface also called “API”. The API of this payment validation system is configured to open a secure communication channel between the secure digital space 6 and the holder of the bank account, in order to confirm a remote payment. In this example, the payment validation system used is configured to establish secure communication between the secure digital space 6 and the digital terminal 5 of the bearer 100 of the payment card 1 connected to said bank account.

In the example illustrated in Figure 5, the authentication system 4 may include a secure online portal 7. The online portal 7 is itself stored on a remote server which is separate from the banking server. In this example, the online portal 7 is configured to communicate with the remote server storing a secure digital space 6 of a bank account. When the bearer 100 wishes to carry out an online payment transaction, the online portal 7 is a payment portal hosted on a website such as a merchant site.

According to the invention, the online portal 7 is configured to carry out a secure operation relating to the personal data of the bearer 100 of the payment card 1 . Said secure operation may correspond, as described previously, to a remote payment, a digital signature, a transaction on a loyalty account, a transfer of bank funds, etc.

In the example of Figure 6, the online portal 7 can be confused with the secure digital space 6. This possibility is more specific to a bank funds transfer operation or an operation on a card. of loyalty. In this configuration, the wearer 100 communicates directly with his digital terminal 5 with the secure digital space 6.

Thus, within the framework of the authentication system 4, the secure digital space 6 is configured to communicate remotely through a wireless communication network with the digital terminal 5 and/or the online portal 7 .

In all cases, the secure operation relating to the personal data of the bearer 100 is carried out after a double authentication of the payment card 1 of the bearer 100 of the payment card 1. In practice, the authentication system 4 involves a classic first authentication in all online payment transactions. This first authentication corresponds, on the one hand, to an authentication of the bearer 100 by his connection to a personal digital space. This authentication of the bearer 100 includes the information of an identifier and a password or else a biometric recognition. On the other hand, the first authentication also involves information security data 20, 21, 22, 23, 24, 200, 201, 203 of the payment card 1. It should be noted that in this example the number PAN 20 includes a PAN 21 cryptogram. When the bearer 100 does not have in memory the series of digits substituted by the PAN 21 cryptogram, the bearer 100 can reveal this series of digits via a revelation process described by the French patent application FR 20 05961 also held by the plaintiff. In the example of Figure 5, the first authentication is performed by connecting to an online portal 7. Conversely, in the example of Figure 6, the first authentication is performed directly with the secure digital space 6 linked to payment card 1.

[0070] Secondly, the authentication system 4 involves a second authentication. This second authentication takes place through a secure communication channel open between the secure digital space 6 and the digital terminal 5 of the bearer 100 of the payment card 1.

In practice, this second authentication corresponds, on the one hand, to authentication of the bearer 100 by entering a password or by biometric recognition via the recognition module 50. When the authentication of the bearer 100 of the payment card 1 is a success, the payment module recognition 50 performs a second authentication of the payment card 1. This second authentication involves reading or capturing the authentication cryptogram 3 of the payment card 1. In fact, this double authentication conditions the validation of the secure operation on the fact that the bearer 100 holds his payment card 1 during the validation of the operation. In the absence of the biometric data of the bearer 100 or of the authentication cryptogram 3, a pirate cannot validate the secure operation. In addition, an additional level of security is provided by a payment card 1 equipped with a PAN 21 cryptogram.

The invention also relates to a method for authenticating a payment card 1 in accordance with the invention and the bearer 100 of this payment card 1. This authentication is carried out in order to carry out a secure operation relating to data personal details of the bearer 100 of the payment card 1. According to the invention, this authentication method can be used to carry out a validation of remote payment and in particular of a remote payment made via a website. Nevertheless, the method according to the invention can also be useful for carrying out a financial transaction, an operation on a loyalty account, a digital signature, etc.

As illustrated in Figures 5 and 6, the authentication process includes a first authentication step of the payment card 1 and of the bearer 100 of the payment card 1. This first authentication step is named a). During this step a), the bearer 100 enters the security data 20, 21, 22, 23, 24, 200, 201, 203 of the payment card 1. In practice, step a) may also involve authentication of the identity of the bearer 100 of the payment card 1. This authentication is carried out by connection to a secure digital space. The connection involves entering an identifier accompanied by an access code and/or biometric recognition. Biometric recognition can be digital or facial. This functionality depends on the characteristics integrated into the digital terminal 5 of the bearer 100 of the payment card 1.

As illustrated in Figures 5 and 6, the authentication method includes a step of requesting a secure transaction relating to the personal data of the bearer 100 of the payment card 1. The request step is denoted b) . According to the invention, the request is made to a secure digital space 6 linked to the bank account of the payment card 1. This bank account is of course opened with a banking organization. In this example, the secure digital space 6 is stored on a remote server managed by the banking organization. As described above, the secure digital space 6 is accessible remotely through current telecommunication means (internet, mobile telephony). The authentication process includes a step of verifying the security data 20, 21, 22, 23, 24, 200, 201, 203 entered on the payment card 1. This step is denoted c). The verification step c) is performed by comparing the security data 20, 21, 22, 23, 24, 200, 201, 203 filled in with reference data stored in the secure digital space 6. When this step is successful the method according to the invention calls for a second authentication in order to validate the operation relating to the personal data of the bearer 100 of the payment card 1 .

For these purposes, the authentication process includes a second step of authentication of the payment card and of the bearer of the payment card. This second authentication step is denoted d). According to the invention, the second authentication step is carried out by recognition of the authentication cryptogram 3 owner of the payment card 1.

In this example, step d) is performed through a digital recognition module 50 available or accessible by the digital terminal 5 belonging to the bearer 100 of the payment card 1. In practice, the second authentication step d) is carried out by opening a secure communication channel between the secure digital space 6 and the digital terminal 5 of the bearer 100 of the payment card 1 . Such a secure communication channel can use a PSP system described above. In practice, the secure digital space 6 of the bank account calls for the opening of the digital recognition module 50 on the digital terminal 5 of the bearer 100 of the payment card 1.

As illustrated in Figure 3, when the recognition module 50 is opened, the method may include a biometric and/or encoded authentication operation of the bearer 100 of the payment card 1 . In this example, biometric authentication by recognition of a fingerprint 51 is requested. In the event of successful authentication of the bearer 100 of the payment card 1, the recognition module 50 gives access to a camera of the digital terminal 5 to allow digital capture of the authentication cryptogram 3 owner of the payment card 1 (see figure 4). Here, the recognition module 50 includes a frame 52 in the payment card 1 must be placed through the screen of the digital terminal 5. It should be noted that the recognition module 50 asks to scan the payment card 1.

The second authentication step comprises a comparison operation of the authentication cryptogram 3 affixed to the payment card 1, with a reference digital image of the authentication cryptogram. This reference image is stored in the secure digital space 6 of the bank account. When the picture of reference corresponds to cryptogram 3 affixed to the payment card, the second authentication step is considered successful.

[0080] In the event of failure of the second authentication step, the secure operation can be aborted immediately, however, the method can allow the bearer 100 of the payment card to benefit from a determined number of attempts to acknowledgement. For example, it is possible to offer three recognition attempts of the authentication cryptogram 3 before the secure operation is interrupted by failure of the double authentication of the payment card 1 and the identity of its bearer 100. In the event of a first failure, it is also possible to switch to more classic authentication methods such as the 3D secure system presented in the introduction to this document.

However, if the second authentication step d) is successful, the authentication method includes a step for finalizing the secure operation relating to the personal data of the bearer 100 of the payment card 1. The step of finalization is denoted e). In practice, the finalization step transmits the authorizations to proceed with said secure operation.

[0082] Additionally, the authentication method may include a step of geolocation of the digital terminal 5 of the bearer 100 of the payment card 1. The location of the bearer 100 of the payment card 1 can give information as to a attempted fraud. Indeed, if the digital terminal 5 is located in a State different from that in which the bank account was opened, this can generate an alert for the attention of the bearer 100. In practice, the recognition module 50 is configured to have access to the location data of the digital terminal 5. Alternatively, the IP address of the digital terminal 5 can make it possible to provide information on the geolocation of the bearer 100 of the payment card 5.

[0083] In short, this geolocation is intended to ensure that the entry of the security data 20, 21, 22, 23, 24, 200, 201, 203 of the payment card 1 and the recognition of the cryptogram of authentication 3, in particular of the "QR code®" are carried out from the same place.

According to a first exemplary embodiment illustrated in FIG. 5, when the first authentication step a) is performed following a connection to a secure digital space of a secure online portal 7 separate from the space secure digital 6, This possibility is very common, it corresponds to a purchase made by the bearer 100 of the payment card 1 on the online portal 7 of a merchant site. According to this example, the bearer 100 enters the security data 20, 21, 22, 23, 24, 200, 201, 203 directly into the secure digital space of the online portal 7. The request step b) is carried out through a secure communication channel which is open between the online portal 7 and the secure digital space 6. This channel may be the one already used between a service provider payment and a bank.

In this situation, the finalization step e) also takes place through this secure communication channel. When the online portal 7 is a payment portal of a merchant website, the finalization step e) consists in transmitting the direct debit authorizations between the banking organization of the payment card 1 and a banking organization to which is attached the payment portal. The online portal 7 can also request a digital signature which will be provided through the authentication process of the invention. In this case, the validation step e) transmits an authorization or a digital signature.

According to a second exemplary embodiment of the method illustrated in FIG. 6, the first authentication step a) is carried out following a connection to the secure digital space 6 linked to the bank account of the payment card 1 . According to this example, the bearer 100 identifies himself to the secure digital space 6. In practice, the bearer 100 authenticates himself by entering his identity, via an identifier. This identifier is verified using a password and/or by biometric recognition (digital or facial).

According to this example, the request step b) is performed within the secure digital space 6. In this situation, the finalization step e) takes place directly with the banking institution, for example to carry out an internal banking transaction, that is to say, between two bank accounts opened with the same organisation. These two bank accounts can belong to the same bearer 100 or to two different entities. Alternatively, when it comes to a financial transaction between two banking organizations, the finalization step consists in transferring the direct debit authorizations from the bank account of the bearer 100 of the payment card 1 , to a beneficiary banking organization.

Claims

[Claim 1] Payment card (1) comprising a front face (10) and a back face (11), the payment card (1) incorporating an electronic chip (12), the front face (10) comprising security data (2) which include, at least, a PAN number (20), an identity (22) of the bearer of the payment card (1) and an expiry date

(23) of the payment card (1), the back side (11) having a CW cryptogram

(24) preferably consisting of three digits, the card being characterized in that it comprises on one side (10, 11) at least one authentication cryptogram (3) unique and owner of the payment card (1), the authentication cryptogram (3) being affixed to the payment card (1), this authentication cryptogram (3) constituting a means of identification of the payment card (1) by optical recognition, this identification means being linked to a bank account to which the payment card (1) is linked.

[Claim 2] Payment card (1) according to claim 1, characterized in that the authentication cryptogram (3) is a matrix code consisting of a determined number of black modules arranged in a white background so as to form a unique pattern, each black module constituting a character of the authentication cryptogram (3).

[Claim 3] Payment card (1) according to one of Claims 1 or 2, characterized in that the PAN number (20) consists of four series of four digits, the payment card (1) comprising a PAN cryptogram (21) substituting at least one series of four digits of the PAN number (20).

[Claim 4] Payment card (1) according to claim 3, characterized in that the PAN cryptogram (21) comprises between 16 and 100 characters, preferably, the PAN cryptogram (21) comprises between 36 and 64 characters.

[Claim 5] Payment card (1) according to one of Claims 3 or 4, characterized in that the PAN cryptogram (21) is a Cardan grid.

[Claim 6] Payment card (1) according to one of Claims 1 to 5, characterized in that the CW cryptogram (24) is substituted by a cryptogram having a number of characters greater than three. [Claim 7] Payment card (1) according to one of Claims 1 to 6, characterized in that the authentication cryptogram (3) comprises a number of characters between 200 and 10,000.

[Claim 8] Method for authenticating a payment card (1) defined according to one of claims 1 to 7, and the bearer (100) of this payment card (1), in order to carry out an operation relating to the personal data of the bearer (100) of the payment card (1), characterized in that the authentication method comprises at least: a) a first step of authentication of the payment card (1) by information of the security data (2, 20, 200, 201, 203, 22, 23) of the payment card (1) and/or a first authentication of the bearer (100) of the payment card (1), the bearer (100 ) the payment card (1) providing their identity and/or an identifier; b) a step of requesting a secure transaction relating to the personal data of the bearer (100) of the payment card (1), the request made to a secure digital space (6) linked to the bank account of the card payment (1) opened with a banking organization, the secure digital space (6) being stored on a remote server managed by the banking organization; c) a step of verifying the entered security data of the payment card (1), this step being carried out by comparing the entered security data (2, 20, 200, 201, 203, 22, 23) with stored reference data on the secure digital space (6); d) a second step of authentication of the payment card (1) and of the bearer (100) of the payment card (1), the second authentication step being carried out by recognition of the authentication cryptogram (3) owner of the payment card (1), this step being carried out through a digital recognition module (50) available or accessible via a digital terminal (5) belonging to the bearer (100) of the payment card (1), and e) a step for finalizing the secure operation relating to the personal data of the bearer (100) of the payment card (1).

[Claim 9] Authentication method according to claim 8, characterized in that the second authentication step d) is performed by opening a secure communication channel between the secure digital space (6) of the account bank and the digital terminal (5) of the bearer (100) of the payment card (1), the secure digital space (6) of the bank account then calling for the opening of the digital recognition module (50). [Claim 10] Authentication method according to one of Claims 8 or 9, characterized in that it comprises, on opening the recognition module (50), a biometric and/or codified authentication operation of the bearer (100) of the payment card (1), in the event of successful authentication of the bearer (100) of the payment card (1), the recognition module gives access to a camera of the digital terminal (5) to allow digital capture of the authentication cryptogram (3) of the payment card (1).

[Claim 11] Authentication method according to one of Claims 8 to 10, characterized in that it comprises a comparison of the authentication cryptogram (3) affixed to the payment card (1), with a digital image of reference of the authentication cryptogram (3) stored in the secure digital space (6) of the bank account.

[Claim 12] Authentication method according to one of Claims 8 to 11, characterized in that, when the connection step a) is carried out on a secure online portal (7) distinct from the secure digital space ( 6), a secure communication channel is opened between the secure online portal (7) and a secure digital space (6) and linked to the bank account of the payment card (1).

[Claim 13] Authentication method according to one of Claims 8 to 12, characterized in that it comprises a step of geolocation of the digital terminal (5) of the bearer (100) of the payment card (1).

[Claim 14] Use of the authentication method defined according to one of Claims 8 to 12, to carry out a validation of remote payment and in particular of a remote payment carried out via a website, the remote payment being carried out at the through a payment card (1) defined according to one of claims 1 to 7.