The present invention relates to systems and methods for authenticating transactions conducted by parties over open electronic networks such as the Internet. In particular, the invention relates to authentication of Internet transactions in which customers charge payments to payment cards, including credit cards.
E-commerce is now popular. Conducting transactions over electronic networks such as the Internet has the now oft-stated advantages of convenience, lower costs, market reach and choice, for both merchants and customers. However, the anonymity of the Internet brings to a commercial or retail sale the issues of fraud and misuse. A transacting merchant has a desire to authenticate the sale, certify the sale, confirm the sale, ensure non-repudiation of the sale, ensure payment, and control anonymity. Similarly, a buyer has a desire to control authentication of the sale, integrity of the sale, recourse of a bad sale, confirmation of the sale, privacy, and anonymity.
Commonly assigned U.S. patent application Ser. No. 10/096,271 filed Mar. 11, 2002, which is hereby incorporated by reference in its entirety herein, describes a system and method for conducting secure payment transactions utilizing user software at a customer terminal to receive a set of Web page data to be used for displaying a Web page, which may include one or more hidden fields. The Web page with transaction and cardholder data is sent to the merchant as the purchase data. The merchant may submit this web page data electronically, for example, to an issuer, for authentication or authorization of the payment transaction.
Card issuers and other financial institutions now offer or use standardized Internet transaction protocols to improve on-line transaction performance and to accelerate the growth of electronic commerce. Under some standardized protocols (e.g., 3-D Secure™ Protocol developed by Visa International) card issuers or issuing banks may authenticate transactions thereby reducing the likelihood of fraud and associated chargebacks attributed to cardholder not-authorized transactions. The presence of an authenticated transaction may result in an issuer assuming liability for fraud should it occur despite efforts to authenticate the cardholder during an online purchase. Card issuers or issuing banks may assure merchants that they will be paid for issuer-authenticated transactions. The 3-D Secure™ protocol is consistent with and underlies the authentication programs offered by card issuers (e.g., Verified by Visa or MasterCard SecureCode™) to authenticate customers for merchants during remote transactions such as those associated with the Internet. The 3-D Secure™ Protocol leverages existing Secure Sockets layer (SSL) encryption functionality and provides enhanced security through issuer authentication of the cardholder during the online shopping session. A piece of software called the Merchant Plug In (MPI) is used by participating merchants to exchange messages, pass information and query participants in order to establish an authentication session between the cardholder and their card issuer during an online purchase.
The 3-D Secure Protocol services are based on a three-domain model—the issuer domain, the acquirer and the interoperability domain. The issuer is responsible for managing the enrollment of cardholders in the service, and for authenticating cardholders during on-line transactions. The acquirer is responsible for defining procedures so that merchants participating in Internet transactions operate under an agreement with the acquirer, and for providing back end processing for authenticated transactions. The interoperability domain facilitates the transaction exchange between the other two domains with a common protocol and shared services. Cardholders and their banks may come under “issuer domain”, merchants and their banks may come under the “acquirer domain”. Communication between issuing and acquiring banks or financial institutions and card issuer infrastructure may come under “Interoperability Domain”. While transacting with 3-D Secure compliant banks and merchants, a consumer may have the same Internet shopping experience as previously, except that there is a separate authentication window or pop-up screen from the cardholder's bank to determine if the transacting party is indeed the cardholder of record. The transaction flow for an on-line Internet purchase transaction under the protocol may be as follows:
(1) Customers fill in payment data at Merchant web sites in the usual fashion, via an encrypted Secure Sockets Layer (SSL) connection.
(2) The Merchant then sends a message through an MPI to a Directory, which in turn queries the card issuer, to find out whether the customer is enrolled in the 3-D Secure program.
(3) The card issuer responds to the Directory with a message indicating whether the cardholder is enrolled and, if so, provides a Web address for the bank that issued the card. This message is then processed and a response forwarded to the Merchant.
(4) The Merchant then sends a message to the issuing bank, through the cardholder device, to initiate and authentication session between the cardholder and the card issuer in which transaction details such as Merchant name and transaction amount may also be presented to the cardholder for confirmation.
(5) The issuing bank will then populate an authentication window to the cardholder detailing information related to the transaction such as merchant name and amount, a personal security message, and a response area where authentication details can be entered by the cardholder.
(6) The customer approves the transaction in one of a variety of ways, depending on how the issuing bank chooses to implement the system. Options may range from entering a static password or PIN to utilizing a smart card and a Personal Card Reader (PCR) to generate an authentication token.
(7) The issuer may process the transaction and cardholder data for authentication. If the authentication is valid, the issuer sends a message to the merchant indicating the authentication was successful. The issuer also notifies the merchant if the authentication failed or was unable to be completed. The message may include an Accountholder Authorization Value (AAV) encoding the authentication process results.
Consideration is now being given to ways of enhancing the systems and methods for authenticating customers, who use credit or debit cards for payment in electronic transactions. Attention is directed to the data and the algorithms that are used to securely authenticate the customer or card for payment to the merchant. The solutions should preferably be compatible with industry implementations of common protocols like 3-D Secure and other industry standards such as the EMV standard for smart cards.