Mastercard International Incorporated

Eddy Van De Velde

Patrick Mestre

Patrik Smets

Duncan Garrett

Sebastien Pochic

Charl Frederik Botes

Enda Rice

Mark Aquilina

David Anthony Roberts

Jonathan James Main

Florent Hay

A method for contactless payment relay attack protection includes receiving an online authorization request including a cryptogram, a measured processing time, and a reference processing time from a terminal. The cryptogram is verified, and a determination is performed as to whether the measured processing time exceeds the reference processing time. An online authorization response authorizing or declining a monetary transaction is transmitted, based on the determination. An artificial intelligence transaction analysis can be performed based on past and current conditions (e.g., battery level, operating system, open applications) of a payment device such as a mobile phone, past and current conditions of a terminal, and/or a monetary amount. The online authorization response can be based on the artificial intelligence transaction analysis.

Contactless payment relay attack protection

A method of performing a contactless transaction between a payment device and a terminal is described. The method comprises establishing a data connection between the payment device and the terminal and then establishing if the payment device and the terminal both support an enhanced security architecture. If they do not, they will then perform the contactless transaction according to a basic transaction flow using a first cryptographic system. If they do, they will perform the contactless transaction according to an enhanced transaction flow using a second cryptographic system. The first cryptographic system and the second cryptographic system comprise different asymmetric cryptographic systems. Suitable payment devices and terminals, and methods at the payment devices and terminals, are described.

Security for contactless transactions

A method for providing scripts for execution as part of an electronic transaction includes: storing, in a memory of an integrated circuit payment card, at least one or more executable scripts, payment credentials, and a cryptogram rule; receiving, by a receiving device of the integrated circuit payment card, a transaction request from a point of sale device, wherein the transaction request includes at least one or more transaction items and a script request; generating, by a generation module of the integrated circuit payment card, at least one payment cryptogram based on at least the cryptogram rule and at least one of the one or more transaction items; and electronically transmitting, by a transmitting device of the integrated circuit payment card, at least one of the one or more executable scripts, the payment credentials, and the generated at least one payment cryptogram to the point of sale device.

Method and system for issuer-defined prompts and data collection

Examples provide a system and method for initiating contactless communication sessions between computing devices using a variety of modalities. A user pre-registers a selected modality for triggering session initiation. A session initiation device generates trigger data based on a detected occurrence of a predetermined event corresponding to a user selected modality, such as, but not limited to, biometric data, a unique user identifier (ID), a vehicle identifier, or any other type of modality. The trigger data is mapped to a mobile device ID. The mobile device ID can be requested from a connection server. The communication session is established between the first computing device and the mobile user device using the mobile device identifier. The computing device transmits data to the mobile user device via the established communication session when the computing device is brought into proximity to the mobile user device.

Contactless communication session initiation between devices

A method for verification of a bearer of a credential device at a device reader is described. The method comprises first establishing a digital communication channel with the credential device, and then determining a set of verification options for the bearer and providing the set of verification options to the credential device over the digital communication channel. The credential device then selects a verification option from the set of verification options and communicates this to the device reader. The device reader can then verify the bearer of the credential device in accordance with the selected verification option. Methods at both the credential device and the device reader are described, as are suitably programmed credential devices and device readers.

User verification for credential device

A system and method for operating a payment terminal, the method including receiving a list of eligible applications from a payment device; generating a candidate list including applications from the list of eligible applications received that are supported by the payment terminal; determining a reduced candidate list, the reduced candidate list including applications from the candidate list that match merchant-specified network preference criteria; determining a final selection of an application based on the reduced candidate list; and providing an indication of the final selection application.

Growing community of inventors

Leuven, Belgium

Eddy Van De Velde