Abstract: A user makes a payment at a POS by entering the user's phone number (either through a keypad or via a card swipe) and PIN into a POS device (such as through a keypad). That information is communicated to a payment provider, who can then access the user's account, determine whether to approve or deny the payment, and notify the merchant of the decision.

Abstract: A key is securely injected into a POS PIN pad processor in its usual operating environment. In response to entry of a personal identification number (PIN) into a PIN pad, the processor puts the PIN into a PIN block; puts additional random data into the PIN block; and encrypts the entire PIN block using asymmetric cryptography with a public key derived from the injected key residing in the PIN pad processor. The corresponding private key may be held securely and secretly by an acquirer processor for decrypting the PIN block to retrieve the PIN. The encrypted random data defends the PIN against dictionary attacks. Time stamp data and constant data encrypted with the PIN block enables a defense of the PIN against replay attacks and tampering. The method may also include accepting the PIN from a mobile phone in communication with the processor.