FR2828040A1 - Method enables a user to made a remote payment for goods or services with authentication of payment made using the user's mobile phone in a manner that can be executed entirely remotely and securely - Google Patents

Abstract

Method whereby a user (2) transmits a personal identifier, particularly his mobile phone number, to an acceptor trader (23), supplying goods or services and transmits a password (15) to a banking institution (7). The password was transmitted during user registration by the banking organization to the user entirely or partly via a terminal (8), in particularly an automatic cash dispenser (ATM). The invention also relates to a corresponding system

Description

<Desc / Clms Page number 1>

PAYMENT METHOD WITH CONFIDENCE
Introduction
The present invention relates to a confident payment method based on the certain link between an identifier + password and a bank card CB.

 The method comprises a registration, intended to establish the connection mentioned above, and a use in payment, particularly at a distance, that is to say through a telecommunications network, between a customer and a merchant (or to use the terminology of electronic banking, between a holder and an acceptor).

 This process was invented by Messrs. U. BERGSTEN and F. ASSUERUS as part of their functions at Crédit Lyonnais.

Description of the process
The method for introducing a payment concept with confidence allows a customer to remotely pay for goods and / or services. The method comprises the step, for the customer of the goods and / or services, of transmitting, to a merchant supplying the goods and / or services, an identifier, in particular consisting of the customer's mobile telephone number. The method further comprises the step, for the client,

<Desc / Clms Page number 2>

 to transmit, directly or indirectly, a password to a banking organization. During a customer registration phase, the password was transmitted, by the banking organization to the customer, in whole or in part via a terminal, in particular an ATM of the ATM type.

Thus, the payment of goods and / or services is paid remotely by the customer.

 The objective of registration is to authenticate the card, to verify that we are in the presence of the card holder and to obtain that this client signs the registration request (signature produced by the chip on his card ), which in particular contains the identifier retained.

 The terminal used must be able to establish a secure session with a server managing the recording. In response to a valid registration request, this server communicates to the terminal a password which is finally disclosed to the client.

 Different types of terminals can be used, including ATMs (ATMs), TPEs (electronic payment terminals) and personal computers equipped with a smart card reader.

 ATMs are particularly well suited to check-in because they are accessible for self-service to any CB card holder.

 The mobile phone number constitutes the identifier which has been mentioned and which is thus linked in a certain way to a bank card. The password includes a first part, the root, which will be directly disclosed to the holder of the bank card CB (display on the terminal screen and / or printing on a ticket given to him at the end of registration). The second part of the password, the extension, possibly necessary depending on the intended use of the process, is disclosed to the holder of the mobile phone number which was declared during registration by sending a short message ( SMS) to the phone number in question.

<Desc / Clms Page number 3>

ment. L'activation de l'enregistrement intervient lors de la 1 première transaction, en principe de paiement, ayant permis d'authentifier avec succès le client (identifiant et mot de passe). Cela désactive le cas échéant un enregistrement préexistant, déjà actif et relatif au même numéro de téléphone mobile. Registration is activated as soon as it is established that the card holder is indeed a user of the mobile telephone number which had been declared during the registration.

is lying. The activation of the registration takes place during the first 1 transaction, in principle of payment, having successfully authenticated the customer (username and password). This deactivates, if necessary, a preexisting registration, already active and relating to the same mobile phone number.

 A merchant will have to use a specially enriched Virtual POS service to accept payment with confidence by which a customer pays by giving the username and password that had been assigned to him when registering for payment with confidence.

The identifier allows you to find the card number (and the expiration date, possibly even the visual cryptogram) and the Virtual POS can continue to accept payment in conventional distance selling mode (typically authorization request then delivery bank on behalf of the merchant concerned).

gérant l'acceptation pour compte du commerçant des paiements en toute confiance . Plutôt que de présenter sous session SSL un formulaire de saisie par le client de son numéro de carte (avec la date d'expiration et éventuellement le cryptogramme visuel), ce TPE Virtuel spécifique affichant clairement un logo représentant la (ou les) banque (s) responsable (s), présente toujours sous session SSL (ou équivalent si on est sur un téléphone mobile) un formulaire pour la saisie de l'identifiant et du mot de passe. Technically, the merchant offers his potential customers payment with confidence by adding a specific button among the different payment methods that he is ready to accept. Pressing this button by the client causes the transfer of the interactive dialogue to the Virtual POS

managing acceptance on behalf of the merchant of payments with confidence. Rather than presenting under SSL session a form for entering by the customer his card number (with the expiration date and possibly the visual cryptogram), this specific Virtual TPE clearly displaying a logo representing the bank (s) ) responsible (s), always present under SSL session (or equivalent if you are on a mobile phone) a form for entering the username and password.

 Entering the identifier is not necessary when the context has already made it possible to identify the client, notably

<Desc / Clms Page number 4>

 ment by a cookie (for a personal computer type workstation) or by the caller's number (for a mobile phone type workstation). The identifier is then displayed and the client is invited to modify the value if he is not the owner.

 This Virtual POS service should be operated under the responsibility of the bank (s) which registers customers wishing to access payment with confidence.

de répudier des paiements en toute confiance . It is indeed necessary to keep each password confidential, that is to say that the password should only be known to the client and the bank (s) managing the registration service. The bank (s) somehow play the role of a trusted third party between customers and merchants. The objective is to protect customers against the use by third parties of their card number, in this case when paying with confidence, but without seeking formally to prohibit customers

to repudiate payments with confidence.

To benefit from payment with complete confidence, a merchant must subscribe directly or indirectly through a portal or shopping mall to the specific service of TPE Virtual.

 The merchant remains free to entrust the acquisition of payments to a CB bank of his choice, therefore regardless of his subscription to the specific service of Virtual POS. The merchant must nevertheless obtain from his acquiring bank that he interconnect with such a Virtual POS service.

Interest and limits of the process
The development of consumer electronic commerce, that is to say the marketing of products or services from a commercial site typically represented by a server on internal, through a network like the Internet and destination of the general public of individuals including Internet users on a personal basis, remains hampered by

<Desc / Clms Page number 5>

 the absence of means or methods of payment totally adapted to such situations. The almost universally available means of payment suffer from different types of problems: - the check does not lend itself to dematerialization and supposes the subsequent sending of an order containing a check containing the check, - the CB bank card is still usable on a large scale only in distance selling mode where the customer must communicate to the merchant as payment the number of his card and some information related to his card (expiration date with possibly a visual cryptogram).

 Banks and in particular banks in France have sought to develop a payment method based on the CB bank card and supposed to be suitable for consumer electronic commerce: secure electronic payment in various technical forms. Secure electronic payment seeks to approximate proximity payment by credit card CB: payment guarantee provided to merchants thanks to the fact that this payment method is designed to prohibit the repudiation of payments by customers.

 In distance selling mode, the merchant benefits from a payment bank guarantee against certain risks: nonexistent card, card in opposition (card declared lost or stolen), customer insolvent at the time of payment. There nevertheless remains the risk of repudiation where the holder of the card used for payment disputes the payment, that is to say that he formally declares that he has not made the payment in question.

 The solution commonly used to hedge against the first category of risks is the technique of requesting authorization.

 The object of secure electronic payment is to supplement the guarantee permitted by the authorization request by eliminating the risk of repudiation. We use for this the present chip

<Desc / Clms Page number 6>

montrera que la responsabilité du titulaire de la carte est bien engagée. in CB bank cards; this will generate an electronic signature which will be associated with the payment and which

will show that the responsibility of the card holder is well engaged.

1 The problem which has remained insurmountable up to now comes from the fact that the use value of secure electronic payment remains low as long as we have not succeeded in generalizing simultaneously the electronic payment support both on the side of customers and merchants. Indeed, as long as we stay away from such a generalization, the motivation of customers and traders remains limited while there are significant constraints (including cost, ease of use): for a merchant, acceptance secure payment is not enough because to develop its business, it must be able to accept payments from the vast majority of Internet users. As a result, he will have to continue accepting payments in distance selling mode for a long time.

But unfortunately, under these conditions, he will hardly see a drop in the default rate; these arrears are motivated by the repudiation of part of the payments. 100% of fraudsters will indeed choose the least secure method of payment, - for a client, accessing secure remote payment requires a significant effort (acquisition of a bank card reader, installation on a workstation, learning ... ) while this method of payment does not bring him anything tangible directly. In other words, why make such an effort when almost all merchants agree to be paid in distance selling mode?
The process of paying with confidence does not pretend to be a payment method similar or equivalent to the different forms of secure electronic payment. The process of paying with confidence does not seek to provide a perfect solution to the problem of adapting payment to consumer electronic commerce but on the other hand seeks

<Desc / Clms Page number 7>

 in the current context to provide merchants with a better solution than distance selling mode and more quickly applicable than secure remote payment mode.

 The reasons for which a transaction is repudiated can be classified into three categories: - payment is made by a third party who has managed to obtain a card number (and the expiration date, even the visual cryptogram), - the trader did not give complete satisfaction to the customer, - the customer is really in bad faith by repudiating the payment.

 The process of paying with confidence seeks to eliminate the first reason for repudiation or at least to greatly reduce the probability. On the other hand, removing responsibility from traders by protecting them against the second reason for non-payment only leads to an accentuation of the problems. Finally, and unlike secure electronic payment, the process of paying with confidence does not provide any formal guarantee against the third reason for repudiation, but customers will nevertheless hesitate to cheat because they will have the feeling that we risk being able to confuse them.

leur donnant alors accès au paiement en toute confiance . The process of payment with confidence allows traders who implement it to do without the traditional distance selling mode because it is possible to quickly and simply obtain the prior registration of customers

giving them access to payment with confidence.

It is difficult to say in what proportions the present process will be able to reduce the rate of delinquencies but this reduction will in any event be very significant. Customers will also know that you can buy and pay with confidence from merchants implementing the process because not only will their card number not be compromised on this occasion, but no fraudster will be able to buy and pay according to the process payment with confidence

<Desc / Clms Page number 8>

 at these merchants using a card number that is not his.

Implementation in the case of recharging prepaid mobile phones
The process of paying with confidence requires, as always, the prior registration of the customer before any transaction to recharge the time credit of a mobile phone operating in prepaid mode.

présent. C'est pourquoi, il faut prévoir la séparation entre : - le serveur commercial où le client passe commande, - le serveur bancaire où le client paye en communiquant son identifiant et son mot de passe. The merchant benefiting from the payment of such recharges is here a mobile operator. The password required for confident payment must not be known to merchants and this is also true in the case

present. This is why, it is necessary to provide for the separation between: - the commercial server where the customer places order, - the banking server where the customer pays by communicating his identifier and his password.

 We have a completely banal first solution: the operator sets up a site for the sale of refills and the customer accesses them via the Internet from a personal computer or from their mobile phone in WAP mode. After selecting the top-up, the interactive dialog switches to the Virtual TPE suitable for paying with confidence, etc. In other words, it is the basic solution offered to any merchant and without specificity linked to the operator's role of the merchant in the case of refills.

 We can imagine a second solution to allow recharging of mobile phones directly from these terminals and without requiring that they operate in WAP mode: - installation by the operator of a voice server on which the customer selects the formula reload that suits him; detection of the mobile phone number of the caller and interruption of communication, collection request sent by the operator's commercial server to the bank server (Virtual POS)

<Desc / Clms Page number 9>

 suitable for payment with full confidence in SMS mode) with communication of the transaction data, - sending of an SMS message requesting payment to the mobile phone concerned, - activation of an application previously downloaded to the SIM card of the mobile phone; display of the payment request and input of the password as confirmation of payment; sending back an SMS payment message containing in particular the password, - verification by the bank server of the password received (possibly activating registration); recovery of the card number (and its expiration date and possibly the visual cryptogram) and authorization request if useful; finally, notification, on the one hand, of the customer by an SMS message and, on the other hand, of the commercial server before depositing in bank of the payment CB, - the server of the operator can then release the time credit thus bought by the customer.

 Note that this illustrates the payment of a top-up made directly by means of a mobile phone without any particular capacity other than being able to exchange SMS messages and to host a specific payment application (SIM Tool Kit).

 The distance sale of any other good or service by any merchant is also possible using the same bank server. The order can be taken in any media and ends with the provision of the mobile phone number of the customer who thus chooses to pay according to the payment process with confidence.

 Finally, note that if we choose to restrict the process of payment with confidence to mobile phones in SMS mode then it is no longer necessary to deliver the password to the customer in two parts because he will not be able to make transactions in SMS mode that by being a user of

<Desc / Clms Page number 10>

 the SIM card corresponding to the mobile phone number he declared when registering.

Claims (1)

1. Method allowing a customer to remotely pay for goods and / or services; said method comprising the following steps: - the step, for said client of said goods and / or services, of transmitting, to a merchant providing said goods and / or services, an identifier, in particular consisting of the mobile telephone number of said client, - the step, for said client, of transmitting, directly or indirectly, a password to a banking organization; during a registration phase of said customer, said password having been transmitted, by said banking organization to said customer, in whole or in part via a terminal, in particular an automatic banknote dispenser of the ATM / ATM type, (of so that payment for goods and / or services is paid remotely by the customer).