Apparatus, system and method

摘要

One or more elements of EMV cardholder data are tokenized at a security compliant payment terminal 106 by tokenization sub-module 212. If the token is not recognised a registration sub-module 220 comprises instructions to register an EMV card user and associated mobile phone number into a scheme (Figure 3) e.g. a loyalty scheme or to provide electronic receipts. Purchase restrictions, discounts and security limits may be associated with the token. The payment terminal communicates cardholder data and token 206 through a firewall 108 with EMV merchant acquirer 110 and server system 112/114. Tokenisation may be one way or non-reversible such that it cannot be decrypted to reveal cardholder data, thus tokens do not need to be handled by PCI DSS compliant procedures. Linking the token with cardholder or transaction data allows electronic receipts to be provided without the cost of making the server system compliant with security standards.