Mastercard International

The present disclosure relates to methods for preventing tokenized payment fraud. The methods include receiving a second request from a user device to provision token credentials related to a funding account and provisioning second token credentials to the user device in response to the second request. The second token credentials include an account identifier, expiry data, and a token PAN sequence number that are identical to the account identifier, expiry data and token PAN sequence number of first token credentials. In one fraud prevention solution, a token cryptographic sequence number is stored in discretionary data provisioned to the user device. In a second fraud prevention solution, a token cryptographic sequence number is stored away from the user device.

The present invention relates to a computer implemented method 500 for preventing a security threat in a computing network. The method comprises receiving 501 a data packet originating associated with an autonomous system number (ASN) and determining 503 if the ASN is in a list of stored ASNs, wherein the list of stored ASNs comprises ASNs each associated with a previous data packet received by the computer network. If the received ASN is not in the list, the method further comprises blocking (505) the received data packet from being sent to the destination IP address in the computer network.

There is provided a payment network biometric authentication service for challenge-response authentication of a cardholder during a payment transaction. The service comprises: one or more processors; a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to: receive notification of a challenge-response authentication request; send an authentication enabler to a challenge-response authentication server of a merchant; receive a challenge request for challenge-response authentication of the cardholder using the authentication enabler; perform biometric authentication of the cardholder to generate an authentication result; send the authentication result to an issuer access control server to decide whether to proceed with the payment transaction based on the authentication result; and send the authentication result to the merchant to approve or decline the payment transaction based on the authentication result. There is further provided a computer-implemented method, wherein the method is performed at a payment network biometric authentication service, for challenge-response authentication of a cardholder during a payment transaction. There is further provided a computer-implemented method, wherein the method is performed at a payment network biometric authentication service, for registration of a passkey for biometric authentication of a cardholder during a payment transaction. Further provided are corresponding computer program products.

A computer-implemented method of providing a transaction proof for a transaction is described. This is performed in a payment device. A payor credential for the transaction is established. This payor credential is provided as ciphertext input to a format preserving encryption mechanism having a cryptographic key and a tweak. Transaction details for the transaction are provided as the tweak. The output of the format preserving encryption mechanism is obtained as the transaction proof. A computing device adapted to perform such a method is also described.

A computer-implemented method of establishing a secure token in a computing device of a cardholder having a secure computing environment and a general computing environment is described. A wallet service provider for the cardholder receives a request to tokenise a transaction credential for the cardholder for the cardholder computing device. The wallet service provider generates the secure token from the transaction credential according to a processing mechanism using an initialisation element. The wallet service provider then provisions the secure token to the secure computing environment of the computing device of the cardholder. A computing device adapted to perform such a method is also described.

A computer-implemented method of tokenisation is described. A first value for a data field is provided, which is determined in accordance with a set of data field rules. Some or all places in the data field of the first value are encrypted using format preserving encryption to provide an encrypted first token also complying with the set of data field rules. The encrypted first token is used in place of the first value in one or more operations associated with the data field. A computing device adapted to implement such a method is also described.

A computer-implemented method is provided for providing proof for a digital transaction between a consumer and a merchant. The proof comprises sensitive data of one or both the consumer and the merchant. The method comprises determining a transaction type, and also determining security requirements for the determined transaction type. The proof is then prepared by one of a plurality of methods to meet the security requirements for the determined transaction type. A payment device adapted to perform such a method is also described.

Systems and methods are disclosed for bulk payment processing and for execution by a service provider system. One or more transaction files may be received from one or more financial institution systems, and the transaction file may be processed to determine a first set of instructions. This first set of instructions may then be sent to a settlement agent system, and a rejection message may be received in return that at least one instruction cannot be executed. In embodiments of the invention, this at least one instruction may be removed to give a second set of instructions which is automatically resent to the settlement agent system.

A method of authenticating, at an authentication server (14), a communications session between a user device (12) and a third party device (16), the method comprising: receiving a connection notification (30) from the third party device, the connection notification indicating the intention of the third party device to initiate a communications session with the user device by subsequently sending a session request (60) to the user device, the connection notification comprising a user identifier (32) and identification of a communications channel (26) that will be used for the communications session; retrieving a user profile (20) in dependence on the received user identifier, the user profile comprising a user device identifier; generating a communications identifier (38); sending, from the authentication server to the user device, a communications notification (40), the communications notification comprising data (34) relating to the communications channel that the third party device will use to connect to the user device, third party identification data (31) and the communications identifier; sending, to the third party device, the communications identifier (38) such that the third party device can include the communications identifier when initiating the communications session with the user device in order to indicate that the communications session is genuine

A computer-implemented method is disclosed for handling sensitive data in a network comprising multiple security zones. The method includes sharing a data cleansing ruleset among a plurality of servers that are each within a respective security zone and using a multi-party cryptographic protocol that each of the plurality of servers participates in, to obtain a shared secret. Each server individually cleanses a respective dataset containing sensitive data using the data cleansing ruleset and then hashes the resulting cleansed dataset with a hash function using the shared secret as a salt. This produces a resultant dataset containing hashed representations of the original sensitive data, meaning that the dataset produced by each server can be collated to form a composite dataset without breaching data security requirements. A data operation can then be performed on the composite dataset.