| 摘要 |
A payment is made using a mobile device 104 e.g. tablet, smart phone etc. which displays a 2D code e.g. QR code, including a payment cryptogram to be read by a POS terminal 120. The terminal transmits the payment information and transaction information to an acquirer 12 who transmits it to an issuer 108 for authentication. The mobile device receives payment details and a single use key via dual channel communication with mutual authentication from a remote secure element, which may also transmit the information to an issuer. Registration may be required with the remote secure element (Figure 8) and a payment application 106 may be installed and activated (Figure 9) on the mobile device which may store the payment details, a shared mobile key for decrypting received data and the single use key 118. The single use key may be generated in response to a request from a mobile including a mobile PIN. It may include an identifier identifying it with a card, an application transaction counter (ATC) and generating key e.g. CVC3 or an application cryptogram, used to generate a payment cryptogram to be included in the 2D code. An incorrect single use key may be provided if the correct PIN is not received, the payment then not being authorised. The mobile device may generate a chip authentication program (CAP) token which is authenticated by the remote system before transmitting the payment information. A contactless payment can be made without the use of a secure element. |
