News by Vendor /

Safer online purchasing

By Wayland Hancock
Network World Technology Executive Newsletter, 02/04/02

Online credit card security is becoming more important everyday, but how do you bring the same level of security to the virtual world as card issuers, such as Visa, have done in the physical world? To give merchants and cardholders the same confidence in virtual transactions as " card-present " purchases, the security behind the scenes must be as secure.

In this newsletter, we'll give you some basic information about Visa's authenticated online payment program called Verified by Visa, and how to meet its specifications.

The program was designed to protect consumers, merchants and banks from online fraud by confirming to the merchant that the online buyer is the actual cardholder. It is based on Visa's 3-D Secure protocol, an interoperability standard created by Visa's Compliance Testing Facility.

The standard protects cardholders while shopping online because the cards are authenticated during the sale by the card issuer, which also notifies the merchant that the buyer is legitimate. When finished shopping, the cardholder checks out as usual, and is asked to confirm the purchase with the card issuer. The confirmation is passed to the merchant, which validates it using a plug-in software module. Extensive use of this service is expected to reduce fraudulent Internet transaction disputes and gives consumers and merchants increased confidence in e-commerce.

The first transaction authentication systems vendor to be named compliant with Visa's 3-D Secure protocol is Arcot with its TransFort product. The product is being adopted by more than 20 banks around the world.

TransFort has been field-tested by banks and merchants worldwide since June 2000. With it, merchants can initiate authentication of an online Visa transaction, offering protection from credit card fraud losses for themselves as well as banks, card processors, and consumers.

The mechanics of the solution seem simple on the surface, but there's a lot going on in the background. When a cardholder enters his or her card number into a Web checkout form and presses the process button, a TransFort merchant software module at the merchant site alerts a TransFort module at the card-issuing bank. It makes them aware that someone is making a purchase using a Visa card that is enrolled in the program. Next, the bank module requests that the customer authenticates by entering a pass code on his or her screen. Interestingly, this works not only on computer screens, but on properly equipped PDAs and mobile phones, too.

When completed successfully, the bank module notifies the merchant module that the cardholder has been authenticated. This greatly reduces the merchant's exposure to fraud and dispute for online Visa purchases. The program offers dramatic benefits in fraud reduction and increased confidence with very little change in the normal online purchasing process since it strongly authenticates and digitally signs transactions in real-time. Scalable to hundreds of millions of transactions, TransFort allows companies to grow the volume and value of their online transactions and provide their customers and themselves with an added level of confidence in the security of doing business electronically.

A multiplatform solution, TransFort can authenticate transactions on the Web, as well as in VPNs and wireless environments. The solution is based on industry-standard digital certificate technology and patented Cryptographic Camouflage technology. This technology enables a tamper-proof software container to be created that contains the user's digital credentials. If the container is stolen or a forced entry attempted, it is impossible to decode the user's credentials to gain access and the container is deactivated after a few attempts.

In October 2001, Compaq Global Services became the first hardware vendor to begin bundling TransFort with its line of ProLiant servers. Later, Sun signed to resell TransFort optimized for the Solaris operating environment, while First Data Resources agreed to provide a managed hosting service that allows First Data's card issuing financial institution clients to enroll cardholders and verify online purchases under the Verified by Visa initiative. CyberSource also resells Arcot's TransFort merchant software bundled with its electronic and risk management products.

Wayland Hancock is business technology editor at Currid & Company, a Houston IT assessment company. You can reach him by e-mail at hancock@currid.com.