The one-time PAN patents (and the merchant or tx-bound PAN) patents of the late '90s are largely expired at this point, so it is open art now. I see more and mo

The one-time PAN patents (and the merchant or tx-bound PAN) patents of the late '90s are largely expired at this point, so it is open art now. I see more and more companies starting to implement it more broadly (Citi, BofA, CapitalOne). It's nifty because you don't have the hefty "Verified by Visa" type integration (nor any of that SET stuff also from the 90s). The last time I logged into my PayPal pre-paid debit card portal, they still had this functionality (sans Browser plug-in), but I don't recall seeing it on PayPal proper for a while... The last time I talked to the MC folks (granted, it has been a long while), they actually thought it (OTP) was a nifty client-side (plus closed-loop) technique and was a nice (and orthogonal) add-on to the types of security that they are pushing vis-a-vis tokenization on the merchant side...