See Application Data Sheet.
Not applicable.
Not applicable.
Not applicable.
Not applicable.
The object of the invention relates to a device and a method for securing security data of a bank payment card.
The present invention pertains to the field of securing data generally written on a face of a bank payment card in order to secure the payment transactions.
The security data linked to a bank account is affixed on a payment card, such as the card number, the client's name and the expiration date, which generally appear in an embossed manner, on the front (or front side) of said card. The security code or visual cryptogram is affixed to the back (or rear side) of the card. The user must typically provide this security information when executing a transaction online or over the telephone.
This payment mode is currently very widespread. However, despite the efforts of banks, online stores and other companies specializing in the security of bank cards, fraud by means of online or telephone hacking or simply by the physical theft of the card and the telephone of this security data is also increasing. To a lesser degree, the visual hacking of security data, for example when making a direct payment to a retailer is also being done. This may be the case when paying for a purchase in a store where the sales assistant copies security data unbeknownst to the cardholder. Hackers can then execute transactions remotely on their own behalf by using this security data to the detriment of the cardholder, or resell this data to a third party.
Certain devices have been developed to attempt to better secure bank card data.
For example, patent documents FR3051581 or US 2014/0279555 propose solutions in which the cryptogram is no longer a static datum printed on the card, but a dynamic datum generated by the card at the time of confirming a banking transaction. However, this type of card is expensive and particularly complex to produce. In addition, in the event the card is stolen, the cryptogram, even if generated dynamically, will be visible to the thief at the time a fraudulent bank transaction is confirmed. The changing cryptogram protects data stored by online stores. In the event of hacking, this solution is thus solely relevant to phishing situations that consist of a hacker stealing data stored by the online retailer.
Patent document FR3051060 discloses a cryptogram security method. Multiple cryptograms are printed on the card, issued and recognized by the bank. These cryptograms must be used in a predefined sequence. A manually movable mark in relation to the cryptograms allows the cardholder, according to a personal procedure, to store the position of the cryptogram that he will have to use for the next transaction. Although this solution may be interesting in some respects, it does have disadvantages. In fact, if the card is stolen, the thief will know all of the cryptograms. Given that there is a limited number of them, one only has to “test” several cryptograms in succession to validate a fraudulent bank transaction.
Document US 2010/243741 discloses a securing method according to the preamble of the main claim. The hidden data is inscribed on a medium that is separate from the card. By combining this medium with the card, the user can retrieve all the security data. Document U.S. Pat. No. 5,326,964 discloses a similar process. This type of process is relatively limited in terms of security.
One object of the invention is to remedy the disadvantages of prior art. Another object of the invention is to propose a solution allowing one to better secure security data of a payment card and to make it unusable in the event of theft.
The solution proposed by the invention is a process for securing security data of a bank payment card linked to a bank account, which security data is static and comprises the number of said card, the identification information of the holder of said card, the expiration date of said card, and a cryptogram, which bank card number and which cryptogram are composed of multiple digits and/or letters.
This method comprises the steps consisting of:
The method also comprises the following steps:
The security data is now only partially inscribed—in a readable manner—on the bank payment card. Also, if the card were to be stolen, the thief will never be able to use it since it is impossible for him to know all of the security data. Only the cardholder knows the security data. The invention thereby aims to create a security lock, particularly prior to any online transactions. In fact, to execute a purchase online, it is necessary to provide certain security data that only the cardholder will be able to provide. If the card is stolen, the arrangement of the data in the grid makes the number of combinations to be “tested” for validating a fraudulent bank transaction very much higher than the solutions known from prior art (approximately 10,000 times higher). Thus, the invention greatly secures the payment cards so as to make them unusable when picked up fraudulently by ill-intentioned individuals.
Other advantageous features of the invention are listed below. Each of these features may be considered alone or in combination with the noteworthy features defined above, and if applicable may be the subject matter of one or more divisional patent applications:
According to one embodiment, the method comprises a step consisting of generating the augmented reality image of the revealing pattern in the form of an image of a mask whose form is complementary to the real image of the grid and comprising a series of windows revealing only the real image of the concealed data when the image of said mask is superimposed on the image of said grid.
According to one embodiment, the augmented reality image of the revealing pattern is generated in the form of an image emphasizing the real image of the concealed data when said augmented reality image is superimposed on the image of the grid.
Advantageously, the card number is composed of four series of four digits, the method comprising a step involving the concealment of the second and/or third series.
The method may comprise a step that involves placing the concealed data in the grid in a random or logical manner.
Another aspect of the invention relates to a securing device for the security data of a bank payment card linked to a bank account, which security data is static and comprises the number of said card, identification data of the holder of said card, the expiration date of said card, and a cryptogram, which bank card number and which cryptogram are composed of several digits and/or letters.
The device also comprises the following features:
According to one embodiment, the augmented reality image of the revealing pattern is in the form of an image of a mask whose form is complementary to the real image of the grid and comprising a series of windows revealing only the real image of the concealed data when the image of said mask is superimposed on the image of said grid.
According to one embodiment, the augmented reality image of the revealing pattern is in the form of an image emphasizing the real image of the concealed data when said augmented reality image is superimposed on the image of the grid.
According to one embodiment, the grid comprises multiple boxes each containing a digit between 0 and 9, each digit being represented one or more times in said grid.
Other advantages and features of the invention will be clarified upon reading the description of a preferred embodiment below, with reference to the attached drawings produced as non-limiting, illustrative examples.
The attached drawings depict a payment card 1, or bank card (CB). The card 1 is linked to a bank account of its holder. It typically comes in the form of a plastic card measuring approximately 86 mm×54 mm. It is equipped with an electronic chip 2 having flush contacts on the front side, and possibly a magnetic strip 3 on the back side. The chip 2 and/or the strip 3 allows the payment to be made to brick-and-mortar stores having an electronic payment terminal or to online stores. It also allows cash withdrawals from automatic teller machines (ATMs).
The card 1 is linked to security data. This security data is static in the sense that it is permanent and does not change over time. In a known manner, the security data comprises the number 4 of the card 1, identification data 5 of the holder of said card, the expiration date 6 of said card, and a cryptogram 7. The number 4, the identification data 5 and the expiration date 6 are typically inscribed on the front side of the card 1, while the cryptogram 7 is inscribed on the back side of said card. The number 4 is composed of multiple series of digits, for example four series of four digits, or 16 digits total. The number 4 may also be composed of multiple digits, not arranged in series, of an alphanumeric code (combination of digits and letters) or a series of letters. The identification data 5 typically comprises the last name and first name of the cardholder, or the name of a company holding the bank account linked to the card 1. The date 6 is composed of two elements, typically the expiration month in two digits (e.g., 02 for February) and the expiration year in two digits (e.g., 25 for 2025). Obviously, the month and/or the year may be composed of more or less digits and may be linked to letters. The cryptogram 7 is composed of multiple digits, typically three digits (e.g., 432), but it may also be composed of more digits (for example, four digits) or fewer ones (for example, two digits). The cryptogram 7 may also be composed of digit(s) and/or letter(s).
In
In
In
In
The embodiments described above may be combined in that one can simultaneously conceal all or part of the number 4 and all or part of the cryptogram 7. One can also conceal all or part of the number 4 and all or part of the expiration date 6. All the possible combinations are covered by the present invention.
In the rest of the description, the concealed elements of the security data are referred to as “concealed data.” The security data of the card 1 may be recorded on the chip 2 and/or in the magnetic strip 3. To prevent any hacking, it is preferably provided that the concealed data of the chip 2 and/or the magnetic strip 3 is/are eliminated.
A means of disclosing this concealed data is communicated to the only cardholder. This disclosure means may consist of a document sent by postal mail to the holder of the card 1 and on which is printed the concealed data. To secure the communication of the concealed data, this document may be a sealed document, sent in a separate letter or attached to the letter sent along with the card 1. It may even be the same document on which the secret code of the card 1 is printed (generally a four-digit code), allowing one to withdraw money from cashpoints and to pay merchants. The holder will thus be able to memorize or record this concealed data, which will be known to him alone.
To withdraw money from cashpoints and to pay merchants, the holder will conventionally use the secret code of card 1. For online purchases, he only has to fill in the security data required by the concealed data. Therefore, if the holder has his card 1 stolen, the thief will not be able to sue it for fraudulent purchases made online or over the telephone, since he will never know the concealed data. The level of security conferred by the invention is such that it may replace SMS-OTP authentication generally used to secure online payments. The SMS-OTP authentication process is widespread and consists of sending to the holder's mobile telephone a text message (short message service (SMS)) that includes a one-time password (OTP). This one-time password must be provided in addition to security data to validate an online transaction.
In
Referring to
Referring to
In a variant of the design from
The graphic elements 410′ do not necessarily appear in the form of dots but may appear in another form, for example in the form of a series of circles surrounding the digits 4-3-2-1 of the concealed series when the medium 41′ interacts with the grid 41.
The medium 41′ may be provided with a mark indicating the side to be positioned against the grid 40. Similarly, in
Implementation of the method according to this embodiment makes use of a mobile terminal 9 (
The mobile terminal 9 comprises in particular, in a conventional manner, one or more processors or microprocessors 90, one or more memories 91, a graphic interface 92 and a visual acquisition means 93, which are interconnected via a common bus. One or more apps—or computer programs—are stored in the memory/memories 91, whose instructions (or codes), when executed by the processor(s) 90, allow the functions described earlier in the description to be executed.
The security data of the card 1, and at least the concealed data, are preferably prestored in the memory 90. If the user has several bank cards, the security data of each card, and at least their concealed data, are prestored in the memory 90. It shall be noted that the memory 91 may be a native memory of the terminal 9 or a remote memory, for example incorporated in a remote physical computer server.
The graphic interface 92 gives users the ability to capture, select and/or input data or instructions, and to post images acquired from the optical acquisition means 93. It appears for example in the form of a touch screen or a screen connected to a keyboard, and so on.
The optical acquisition means 93 appears preferably in the form of an optical scanner, of the video camera and/or photo camera types, incorporated in the mobile terminal 9. This optical acquisition means 93 is linked to a scanning app.
The user may have to install an app in his mobile terminal 9 to implement all or part of the invention from said terminal and in particular the posting of augmented reality images. This app may be preinstalled on the terminal 9. However, the user can look for this app on an online store such as Google Play®, iTunes® or on a dedicated website, and then download it to his terminal 9.
For the sake of clarity, it shall be understood within the meaning of the invention that “the terminal 9 does something” means “the app executed by the processor or microprocessor 90 of the terminal 9 does something,” just like “the app does something” means “the app executed by the processor or microprocessor 90 of the terminal 9 does something.”
Referring to
By means of a visual recognition app, such as Google Lens®, the terminal 9 recognizes that the photographed object is a bank card and that this card comprises the grid 40.
Based on optical character recognition (OCR), the terminal 9 will analyze the image of the grid 40 and in particular the digits arranged in it.
The terminal 9 will look for the concealed data (e.g., the series 4321) in the memory 91 and look for this data (e.g., each of the figures 4-3-2-1) in the image of the grid 40.
The terminal 9 will then generate an augmented reality image of the revealing pattern and post this virtual image on the screen 92 by superimposing it on the real image of the grid 40.
In
In
In any event, the generated virtual image may include concealed data that is posted in a dedicated graphic region 942.
The grid and mask system described with reference to
In the embodiments described above, the arrangement of the various elements and/or means and/or steps of the invention shall not be understood as requiring such an arrangement in all implementations. In particular, one or more features shown only in one embodiment may be combined with one or more other features shown only in another embodiment.
Number | Date | Country | Kind |
---|---|---|---|
1872665 | Dec 2018 | FR | national |
Filing Document | Filing Date | Country | Kind |
---|---|---|---|
PCT/FR19/51912 | 8/7/2019 | WO | 00 |