GB2519527A

GB2519527A - A method of processing a credit card transaction

Info

Publication number: GB2519527A
Application number: GB1318677.0A
Authority: GB
Inventors: Dave Gormley
Original assignee: MOBIPAYPOINT UK Ltd
Current assignee: MOBIPAYPOINT UK Ltd
Priority date: 2013-10-22
Filing date: 2013-10-22
Publication date: 2015-04-29
Also published as: GB201318677D0

Abstract

A method of processing a credit card transaction using a credit card terminal comprises swiping the credit card in a magnetic strip reader of the credit card terminal 23, retrieving the card issuer identifier (CII) information from the magnetic strip on the credit card 25, accessing a CII look-up table containing information as to whether the institution identified by the CII issues credit cards with or without a chip 27and thereafter requiring chip verification 29 before allowing the credit card transaction to proceed. The chip verification may be to verify that there is a chip present and may optionally include steps to determine the authenticity of that chip, such as using PIN information and retrieving card data. Alternatively, the chip verification may include one or more steps, such as visual inspection, to confirm that no chip is present if there should be no chip present on the card. The present invention is aimed to prevent fraud associated with cloning chip and pin cards and using them in jurisdictions which do not commonly use chip and pin.

Description

"A method of processing a credit card transaction"

Introduction

This invention relates to a method of processing a credit card transaction.

Plastic card payments are becoming increasingly popular as a method of paying for goods and services. According to a survey carried out by Javelin Strategy and Research, in 2011, cash accounted for only 27% of all point of sale purchases in the United States, cheques accounted for 7% of all point of sale purchases and plastic card purchases accounted for the remaining 66% of point of sale purchases. Of the entire point of sale purchases, 31% of all purchases were made using debit cards and 29% of all purchases were made using credit cards. It is thought that the use of cash for transactions will decrease further in years to come and the use of credit cards will increase over time.

Throughout this specification, the term credit card transaction" and variants thereof will be understood to include transactions involving the use of either a credit card or a debit card.

One problem with credit card transactions is that they are susceptible to fraud. It is not uncommon for a stolen credit card to be used to purchase goods or services before the fraud is detected. Furthermore, it is now relatively simple for technically-minded criminals to "skim" the magnetic strip details from a credit card, upload those details onto another card and use the modified card to purchase goods and services. Often, a substantial fraud occurs before the fake card is detected. Credit card fraud represents a major problem for credit card companies, merchants and consumers alike.

Various steps have been taken to reduce the incidences of credit card fraud. For example, Chip and Pin technology has been introduced in many countries around the World to combat fraud. Chip and Pin technology requires a card holder to insert a personal identification number (PIN) into a credit card payment terminal when the card holder is making a card-present transaction. This means that traditional "skimming" scams will not work.

However, not all jurisdictions have converted to Chip and Pin technology. For example, at the date of filing, the United States still operates a payment system predominantly reliant on swiping a credit card through a card reader and reading the card details from the magnetic strip of the credit card. This methodology is far less secure than Chip and Pin technology and it is estimated that billions of dollars are lost every year as a result of fraudulent card-present credit card theft in the United States.

One area of particular concern in the United States at present is where card details are skimmed from the magnetic strip of cards that normally operate in jurisdictions that operate Chip and Pin technology (for example, throughout most of Europe), and these magnetic strip details are then placed onto credit cards in the United States. The fraudulent credit cards thus produced are thought to constitute a significant portion of the total card-present credit card fraud in the United States.

It is an object of the present invention to provide a method of processing a credit card transaction, a credit card terminal and a credit card payment processing system that overcome at least one of the problems with the known solutions and that offers a useful alternative to the known methods, terminals and systems.

Statements of Invention

According to the invention there is provided a method of processing a credit card transaction using a credit card terminal comprising: swiping the credit card in a magnetic strip reader of the credit card terminal; the credit card terminal retrieving card issuer identifier (CII) information from the magnetic strip on the credit card; the credit card terminal accessing a CII look-up table containing information as to whether the institution identified by the CII issues credit cards with or without a chip; and on determining that the institution identified by the CII issues credit cards with a chip, requiring chip verification before allowing the credit card transaction to proceed.

By having such a method, the credit card terminal will determine whether or not the card should have a chip thereon. If it is determined that the card should have a chip thereon, the method requires that a chip verification step is undertaken in order to allow the credit card transaction to proceed. If the chip verification step is not successful, the credit card transaction will be refused. If the card is genuinely a Chip and Pin type card, it will be a relatively straightforward exercise to carry out a chip verification. It will also be readily apparent if the card is not a Chip and Pin type card and if the details on the card have been fraudulently obtained. It is envisaged that this method will prevent fraud being perpetrated using European Chip and Pin credit card details loaded onto US magnetic strip only cards as the method will detect that there should be a chip present on the card and it will be apparent that the card is fraudulent if a chip verification step cannot be carried out. This will reduce the amount of fraud significantly.

According to the present invention, the CII will comprise information taken from the card that is capable of identifying the institution or being used to idenfify the institution that issued the card. The CII may comprise a Bank Identification Number (BIN), an Issuer Identification Number (IIN), or other combination of information taken from the card that may be used to identify the institution that issued the card such as the Personal Account Number (PAN), or the PAN and LUHN check digit. It is envisaged that the PAN or the combination of PAN and LUHN check digit may be used in conjunction with the ISOIIEC 7812 data records to determine the identity of the card issuer.

In one embodiment of the invention there is provided a method of processing a credit card transaction in which the step of requiring chip verification comprises requiring a card holder to enter their personal identification number (PIN) into the credit card terminal, the credit card terminal passing the PIN to the chip for verification, and allowing the credit card transaction to proceed if the PIN entered is verified by the chip. This will be a simple way of verifying the validity of the card and will be a relatively trivial exercise for the owner of a Chip and Pin card to perform. If the card is a fraudulent card, there will be no chip or the chip will be a fake and it will not be possible to perform a PIN verification using the card. This will immediately alert the merchant to the fact that the card may be stolen.

In one embodiment of the invention there is provided a method of processing a credit card transaction in which the step of requiring chip verification comprises requiring the credit card terminal to verify the presence of a chip on the card. It is envisaged that the credit card terminal may be able to determine whether or not a chip is present by using a standard chip reader or by using a near field communications (NFC) communication attempt with the card's chip. If the attempts to read the chip are unsuccessful, this may be because there is no chip or the chip is not a functional chip.

In one embodiment of the invention there is provided a method of processing a credit card transaction in which the step of requiring chip verification comprises requiring a cashier to verify the presence of a chip on the card. In one simple embodiment, a cashier may be alerted to the fact that there should be a chip on the card and they can visually inspect the card for the presence of a chip. For example, a prompt on the credit card terminal's screen could be provided requesting the cashier to confirm that they have seen a chip on the card. If the cashier cannot see the chip on the card, the credit card transaction can be cancelled.

In one embodiment of the invention there is provided a method of processing a credit card transaction in which the method comprises the additional step of requiring a signature of the credit card holder before allowing the credit card transaction to proceed.

In one embodiment of the invention there is provided a method of processing a credit card transaction in which having verified the presence of a chip, the method comprises the step of retrieving card data from the chip for use in processing the credit card transaction. By using the card data from the chip instead of the magnetic strip once the card has been PIN verified, this will obviate the possibility of fraud perpetrated by an individual placing fraudulent magnetic strip details on a card that they know the PIN code for the chip on that card.

In one embodiment of the invention there is provided a method of processing a credit card transaction in which on determining that the institution identified by the CII issues credit cards without a chip, the method comprises requiring verification that no chip is present on the card before allowing the credit card transaction to proceed.

In order to ensure that a Chip and Pin credit card has not been subjected to fraud by loading alternative card details onto the magnetic strip of the card and then presenting that card for payment, a check may be carried out to determine whether the card issuer institution issues cards without chips. If the card issuer institution identified by the CII taken from the magnetic strip is known to issue cards without a chip, and a chip is present on the card, this is indicative that the card is fraudulent and the credit card transaction is not permitted to proceed.

In one erribodiment of the invention there is provided a method of processing a credit card transaction in which the step of requiring verification that no chip is present on the card comprises requiring the cashier to inspect the card for the presence of a chip and verify that there is no chip present on the card.

In one embodiment of the invention there is provided a method of processing a credit card transaction in which the step of requiring verification that no chip is present on the card comprises requiring the credit card terminal to monitor for the presence of a chip on the card and verify whether or not a chip is detected on the card. The credit card terminal may have a chip reader and or an NFC circuit that is operable to detect a chip on the card. If a chip is detected on the card and the CII indicates that there should be no chip, the transaction may be prevented.

In one embodiment of the invention there is provided a computer program product having program instructions that when loaded onto a credit card terminal cause the credit card terminal to perform a method of processing a credit card transaction having the following steps: retrieving the card issuer identifier (CII) information from the magnetic strip on the credit card; accessing a CII look-up table containing information as to whether the institution identified by the CII issues credit cards with or without a chip; and on determining that the institution identified by the CII issues credit cards with a chip, requiring chip verification before allowing the credit card transaction to proceed.

In one embodiment of the invention there is provided a credit card terminal comprising: a magnetic strip reader; a processor for executing computer program code for processing a credit card transaction; and an accessible memory, the accessible memory comprising a card issuer identifier (CII) look-up table containing information as to whether an institution identified by a CII issues credit cards with or without a chip.

In one embodiment of the invention there is provided a credit card payment processing system comprising: at least one credit card terminal comprising a magnetic strip reader and a communications module; and a remote memory accessible by the credit card terminal, the remote memory comprising a card issuer identifier (CII) look-up table containing information as to whether an institution identified by a CII issues credit cards with or without a chip, the remote accessible memory being accessible by the credit card terminal over a communications network.

Detailed Description of the Invention

The invention will now be more clearly understood from the following description of some embodiments thereof given by way of example only with reference to the accompanying drawings, in which:-Figure 1 is a diagrammatic representation of a system in which the method according to the invention may be executed; and Figure 2 is a flow diagram of the method according to the invention.

Referring to Figure 1, there is shown a diagrammatic representation of a system in which the method according to the present invention may be executed, indicated generally by the reference numeral 1. The system 1 comprises a credit card terminal 2 and a remote accessible memory 3. The remote accessible memory is accessible over a communication network, in this instance the internet 5. The remote accessible memory has a look-up table 7 of Card Issuer Identifiers (Clis) thereon. The look-up table includes the known ClIs and an indication of whether or not the institution (not shown) associated with the CII issues credit cards equipped with a Chip and whether or not the card is Chip and Pin enabled.

In an alternative embodiment, instead of having the ClIs stored in a remote accessible memory 3, the credit card terminal 1 will have an accessible memory 9 in which the CII look-up table may be stored. This look-up table may be updated periodically by downloading the CII look-up table or updates thereto from a remote accessible memory 3 over the communication network.

Referring to Figure 2, there is shown a flow diagram according to the present invention, indicated generally by the reference numeral 21. In step 23, a card is swiped in a magnetic strip reader of a credit card terminal (not shown). The credit card terminal retrieves the card issuer identifier (CII) information from the card in step 25. The CII information is usually contained on the track 2 information on the strip and is usually the first six digits of the personal account number (PAN). Once the CII has been retrieved, in step 27, the credit card terminal accesses a CII look-up table in an accessible memory.

The CII look-up table contains information regarding whether or not the institution identified by the CII issues credit cards with or without a Chip. This information can then be used subsequently in fraud prevention steps. In step 29, the credit card terminal initiates a chip verification process and if the chip verification process is successful, the credit card transaction is processed as normal in step 31 and if the chip verification process is unsuccessful, the credit card transaction is declined in step 33.

The chip verification process can take several forms. First of all, and in a preferred embodiment, if the CII look-up results in the credit card terminal determining that the credit card should contain a chip, the credit card terminal initiates a Personal Identification Number (PIN) verification procedure. In other words, the terminal will initiate the standard Chip and Pin procedure in which the card is inserted into a chip reader (if it has not already been inserted into a chip reader) on the terminal, and the card holder is asked to enter their PIN into a keypad on the credit card terminal. The PIN is passed to the chip on the card in the card reader and the chip will respond by indicating whether or not the PIN is correct. If the PIN that was entered is correct, the chip verification is deemed successful and the credit card transaction is allowed to proceed. If the PIN is incorrect, the card holder may be provided with one or more other opportunities to enter the correct PIN and if the correct PIN is not entered, the transaction will be declined in step 33.

In a second embodiment, if the CII look-up results in the credit card terminal determine that the credit card should contain a chip, the credit card terminal initiates an alternative chip verification procedure consisting of the credit card terminal attempting to detect the presence of a chip on the card. The credit card terminal may use either a standard contact-type chip reader to attempt to communicate with the chip and/or may use a near field communications (NFC) type chip reader to attempt to communicate with the chip. If communication is successful, the credit card terminal accepts that there is a chip on the card, the chip verification is deemed successful and the credit card transaction is allowed to proceed in step 31. If the communication is unsuccessful, the transaction will be declined in step 33.

In a third embodiment of the invention, if the CII look-up results in the credit card terminal determine that the credit card should contain a chip, the credit card terminal initiates a further alternative chip verification procedure consisting of the credit card terminal prompting a cashier operating the credit card terminal on behalf of the merchant to attempt to detect the presence of a chip on the card. The prompt may be in the form of an audio message or indeed could be a visual message on the graphical user interface (GUI) of the credit card terminal or on a point of sale (POS) terminal screen. This embodiment will entail a manual, visual inspection of the card by the cashier. If the CII indicated that there should be a chip and there are no visible signs of a chip on the card, this will be indicative that the card is fraudulent and the transaction will be declined in step 33. If however the cashier identifies a chip as being present on the card, the transaction will be allowed to proceed in step 31. Although a valid way of implementing the present invention, this third embodiment is not seen as being as secure as some of the other methods described above.

In a fourth embodiment of the invention, if the CII look-up should indicate that there should be no Chip on the card, the credit card terminal will initiate an alternative chip verification procedure which will entail the credit card terminal attempting to detect the presence of a chip on the card. Similar to the second chip verification embodiment described above, the credit card terminal may use either a standard contact-type chip reader to attempt to communicate with the chip and/or may use a near field communications (NEC) type chip reader to attempt to communicate with the chip. If communication with a chip is successful, the credit card terminal determines that there is a chip on the card. However, according to this embodiment, there shouldn't be a chip present on the card and the chip verification is therefore deemed unsuccessful and the credit card transaction is declined in step 33. In this embodiment when a chip is not expected to be present, if the communication attempt with the chip is unsuccessful, the chip verification step is deemed successful and the transaction will be allowed to proceed in step 31.

In a fifth embodiment of the present invention, if the CII look-up should result in the credit card terminal determining that the credit card should not contain a chip, the credit card terminal initiates another still alternative chip verification procedure. This chip verification procedure will consist of the credit card terminal prompting a cashier operating the credit card terminal on behalf of the merchant to attempt to detect the presence of a chip on the card. The prompt may be in the form of an audio message or indeed could be a visual message on the GUI of the credit card terminal or on a point of sale (POS) terminal screen. This embodiment will entail a manual, visual inspection of the card by the cashier. If the CII indicated that there shouldn't be a chip and there are visible signs of a chip on the card, this will be indicative that the card is fraudulent and the transaction will be declined in step 33. If however the cashier does not identify a chip as being present on the card, the transaction will be allowed to proceed in step 31. Although a valid way of implementing the present invention, this fifth embodiment is also not seen as being as secure as some of the other methods described above.

It is envisaged that the method according to the invention may comprise one or more of the above techniques in combination.

It is further envisaged that other steps may be taken to validate a credit card transaction, even after a Chip has been detected on the credit card. Eor example, a card holder signature may be required before allowing the credit card transaction to proceed.

Furthermore, in those cases where a chip is detected, the credit card terminal may use the details found on the chip rather than the details retrieved from the magnetic strip to process the credit card transaction. Effectively therefore, if a chip has been detected and the chip verification has been performed by way of the card holder entering a valid PIN, the transaction is executed as a Chip & PIN transaction rather than a magnetic strip transaction.

In the embodiments described, the credit card terminal may be provided with the look-up table stored in memory on the credit card terminal. This will allow the credit card terminal to operate even if operating in "off-line" mode. Alternatively, the credit card terminal may access the look-up table over a communications network in which case the look-up table could be stored in a remote memory that is accessible by the credit card terminal over the communication network. This would facilitate updating the CII information in the look-up table however if the look-up table were stored on the individual credit card terminals, the look-up tables in the terminals could be updated periodically with push or pull notifications containing updates to the look-up table.

Throughout the specification, reference is made to swiping a card in a magnetic strip reader. This will be understood to include those terminals that require insertion of the card into a combined magnetic strip and chip reader in which the card is inserted into a slot and by doing so the magnetic strip on the card is read. Therefore, swiping a card is deemed to include inserting a card.

It will be understood that the method according to the present invention will be performed largely in software and therefore the present invention extends also to computer programs, on or in a carrier, comprising program instructions for causing a computer or a payment terminal to carry out steps of the method. The computer program may be in source code format, object code format or a format intermediate source code and object code. The computer program may be stored on or in a carrier, in other words a computer program product, including any computer readable medium, including but not limited to a floppy disc, a CD, a DVD, a memory stick, a tape, a RAM, a ROM, a PROM, an EPROM or a hardware circuit. In certain circumstances, a transmissible carrier such as a carrier signal when transmitted either wirelessly and/or through wire and/or cable could carry the computer program in which cases the wire and/or cable constitute the carrier. The computer program product may be stored in the memory of a card payment terminal and the present invention is intended to extend to card payment terminals programmed to implement the method according to the present invention.

It will be further understood that the present invention may be performed on two, three or more machines or components with certain parts of the computer-implemented method being performed by one machine or component and other parts of the computer-implemented method being performed by another machine or component. For example, the CII look-up may be performed remotely from the credit card terminal. The devices may be part of a LAN, WLAN or could be connected together over a communications network including but not limited to the internet. One or more of the method steps could be performed "in the cloud", meaning that remotely located processing power may be utilised to process certain method steps of the present invention. Accordingly, it will be understood that many of the method steps may be performed remotely, by which it is meant that the method steps could be performed either on a separate machine in the same locality or jurisdiction or indeed on a separate machine or machines in one or several remote jurisdictions. For example, the card payment terminal and the remote accessible memory may be in one jurisdiction or may be located in different jurisdictions.

The present invention and claims are intended to also cover those instances where the method is performed across two or more machines or pieces of apparatus located in one or more jurisdictions and those situations where the parts of the system are spread out over one or more jurisdictions.

In this specification the terms "include, includes, included and including" and the terms "comprise, comprises, comprised and comprising" are all deemed totally interchangeable and should be afforded the widest possible interpretation.

The invention is in no way limited to the embodiment hereinbefore described but may be varied in both construction and detail within the scope of the appended claims. -12-