Abstract: A payment terminal evaluation device may include a network interface configured to receive data associated with each of a plurality of payment terminals. The data may include a plurality of data fields each having a respective value for a respective transaction processed by one of the plurality of payment terminals. Each payment terminal may be associated with one of a plurality of merchants. The payment terminal evaluation device may further include an electronic processor that may be configured to identify, based on the data, at least one of (i) a merchant of the plurality of merchants as an anomalous merchant and (ii) a payment terminal of the plurality of payment terminals as an anomalous payment terminal. The electronic processor may be further configured to transmit anomaly information to a communication device to cause the communication device to display the anomaly information.

Abstract: At least a first cryptogram and a second cryptogram are transmitted from a payment device reader component to a terminal component. A message including at least the first cryptogram and the second cryptogram is transmitted from the terminal component to an issuer of a payment device presented to the reader component, through a payment network. A message is obtained from the issuer, corresponding to authentication, by the issuer, of the payment device (and optionally the owner of the payment device) presented to the reader component, based at least on the first cryptogram and the second cryptogram. The payment network is configured in accordance with at least one of (i) a standard, and (ii) a specification, which normally employs only a single cryptogram for the message and the authentication. Apparatuses and computer program products are also disclosed.

Abstract: Disclosed are exemplary embodiments of systems and methods for enabling Internet of Things (IoT) devices to initiate payment transactions. In an exemplary embodiment, a method generally includes receiving, by a computing device, a transaction request associated with a merchant where the transaction request includes a device identifier for an IoT device associated with a consumer and/or a location of the IoT device, and retrieving, by the computing device, a payment credential associated with a payment account when the transaction request is authenticated. The method also includes causing, by the computing device, the payment credential to be sent to the IoT device associated with the device identifier, whereby the IoT device is able to direct the merchant to proceed in the transaction using the payment credential.

Abstract: The present disclosure proposes a computer implemented method for selecting test cases to be executed on a terminal by creating a configuration code and applying this code to a set of test case selection tuples. The present disclosure also proposes a method for automatically creating a set of test case selection tuples, taking a source code as an input. The created set of test case selection tuples can be used in the above-mentioned method for selecting test cases. Finally, the present disclosure proposes a method for operating a program for selecting test cases having a user interface and a selection logic. The program may apply the above-mentioned method for selecting test cases by creating a configuration code and applying this code to a set of test case selection tuples.

Abstract: The present disclosure proposes a computer implemented method for selecting test cases to be executed on a terminal by creating a configuration code and applying this code to a set of test case selection tuples. The present disclosure also proposes a method for automatically creating a set of test case selection tuples, taking a source code as an input. The created set of test case selection tuples can be used in the above-mentioned method for selecting test cases. Finally, the present disclosure proposes a method for operating a program for selecting test cases having a user interface and a selection logic. The program may apply the above-mentioned method for selecting test cases by creating a configuration code and applying this code to a set of test case selection tuples.

Abstract: A payment-enabled mobile device such as a “smart phone” incorporates risk management features applicable when used for a contactless payment transactions. In some embodiments, a mobile device processor includes a non-volatile memory storing a first counter and an associated first accumulator used for financial risk management purposes, and storing a second counter and an associated second accumulator used for enforcing a cardholder verification requirement, and storing a payment application program. In some embodiments, features govern when cardholder verification is required for consummation of the current transaction, and such features may be configurable by the payment card account issuer and/or the user of the mobile device.

Abstract: A payment-enabled mobile device such as a “smart phone” incorporates risk management features that are applicable to its use in contactless payment transactions. Some features may govern when verification of the cardholder's identity is required for consummation of the current transaction. The features may be configurable by the payment card account issuer and/or the user of the mobile device.

Abstract: A system and method for generating an authentication token which is used by an issuer associated with a integrated circuit card to authenticate a transaction. A personal card reader receives data, including an authentication cryptogram, from the integrated circuit card. The personal card reader uses the data received from the integrated circuit card to select one of at least two default bitmaps stored in a memory portion of the personal card reader. The personal card reader uses the selected default bitmap and the authentication cryptogram to build the authentication token.

Abstract: A method includes a processor of a mobile telephone receiving a top-up request for an offline balance in an offline payment application of the mobile telephone, and opening an over-the-air (OTA) connection to a top-up authorization server computer. The user is prompted to enter a monetary amount for the offline balance and to enter a form of authentication. The method also includes receiving a monetary amount input and a user authentication input, authenticating the user, calculating a cryptogram and transmitting an OTA top-up request message to the top-up authorization server computer. In addition, the method includes receiving an OTA response indicating authorization of the top-up request and including a script. The processor then executes the script to increase the offline balance stored in the mobile telephone by the monetary amount.

Abstract: Generating authentication data for use in a transaction by providing a contactless payment device or smart card configured to communicate with a mobile device, placing the contactless chip card in a proximity to the mobile device to instantiate communication between the contactless chip card and the mobile device, inputting a first input value into the mobile device, communicating data derived from the first input value from the mobile device to the contactless chip card, the contactless chip card converting a set of conversion data, including the first input value, into at least one dynamic value based at least in part on a secret value, communicating the dynamic value from the contactless chip card to the mobile device, and communicating authentication data based at least in part on the dynamic value to a user. In some embodiments the first input value is a Personal Identification Number (PIN), a challenge, or both a PIN and a challenge.

Abstract: At least a first cryptogram and a second cryptogram are transmitted from a payment device reader component to a terminal component. A message including at least the first cryptogram and the second cryptogram is transmitted from the terminal component to an issuer of a payment device presented to the reader component, through a payment network. A message is obtained from the issuer, corresponding to authentication, by the issuer, of the payment device (and optionally the owner of the payment device) presented to the reader component, based at least on the first cryptogram and the second cryptogram. The payment network is configured in accordance with at least one of (i) a standard, and (ii) a specification, which normally employs only a single cryptogram for the message and the authentication. Apparatuses and computer program products are also disclosed.

Abstract: Live payment terminals employing payment system public keys are evaluated. Dedicated test payment cards are internally issued by an operator of the payment system. Presentation of at least one of the cards to at least one of the terminals is facilitated. Testing the at least one of the terminals for proper management of the payment system public keys is facilitated. The testing can be in a test transaction conducted when the at least one of the cards is presented to the at least one of the terminals. The steps of facilitating presentation and facilitating testing can be conducted substantially without auditing.

Abstract: A payment-enabled mobile device such as a “smart phone” incorporates risk management features that are applicable to its use in contactless payment transactions. Some features may govern when verification of the cardholder's identity is required for consummation of the current transaction. The features may be configurable by the payment card account issuer and/or the user of the mobile device.

Abstract: A system and method for generating an authentication token which is used by an issuer associated with a integrated circuit card to authenticate a transaction. A personal card reader receives data, including an authentication cryptogram, from the integrated circuit card. The personal card reader uses the data received from the integrated circuit card to select one of at least two default bitmaps stored in a memory portion of the personal card reader. The personal card reader uses the selected default bitmap and the authentication cryptogram to build the authentication token.

Abstract: A method includes receiving an over-the-air message from a mobile telephone. The message requests top-up of a prepaid payment capability in the mobile telephone. The method further includes authorizing the requested top-up. In addition, the method includes transmitting an over-the-air response to the mobile telephone. The response indicates to the mobile telephone that the top-up is authorized.

Abstract: Live payment terminals employing payment system public keys are evaluated. Dedicated test payment cards are internally issued by an operator of the payment system. Presentation of at least one of the cards to at least one of the terminals is facilitated. Testing the at least one of the terminals for proper management of the payment system public keys is facilitated. The testing can be in a test transaction conducted when the at least one of the cards is presented to the at least one of the terminals. The steps of facilitating presentation and facilitating testing can be conducted substantially without auditing.

Abstract: Generating authentication data for use in a transaction by providing a contactless payment device or smart card configured to communicate with a mobile device, placing the contactless chip card in a proximity to the mobile device to instantiate communication between the contactless chip card and the mobile device, inputting a first input value into the mobile device, communicating data derived from the first input value from the mobile device to the contactless chip card, the contactless chip card converting a set of conversion data, including the first input value, into at least one dynamic value based at least in part on a secret value, communicating the dynamic value from the contactless chip card to the mobile device, and communicating authentication data based at least in part on the dynamic value to a user. In some embodiments the first input value is a Personal Identification Number (PIN), a challenge, or both a PIN and a challenge.

Abstract: A one-way permutation over financial transaction card data provides a merchant with a unique card identifier for each financial transaction card that is used by a customer to purchase goods from a merchant. This card identifier, which is not the actual financial transaction card data, may then be permissibly stored by the merchant and used to uniquely identify the customer's financial transaction card, and may also be used to determine the frequency with which that customer makes purchases using that card.

Abstract: Systems and methods are provided for secure transmission of information identifying account holders in electronic payment transactions made using payment cards or devices that are based integrated circuit chip technology. Individual cards or devices are associated with a cipher key. Information such as personal account numbers, which may be stored on the cards or devices, is encrypted using a block cipher in a variant of the cipher feedback mode. This manner of encryption preserves the length of the cleartext, and allows the ciphertext to be securely transmitted in standard data structure formats over legacy electronic payment networks.

Abstract: A one-way permutation over financial transaction card data provides a merchant with a unique card identifier for each financial transaction card that is used by a customer to purchase goods from a merchant. This card identifier, which is not the actual financial transaction card data, may then be permissibly stored by the merchant and used to uniquely identify the customer's financial transaction card, and may also be used to determine the frequency with which that customer makes purchases using that card.