For all of the horror stories about huge databases of credit cards being hacked into and posted on the Internet, surprisingly little consumer fraud is actually occurring. After all, much of the glory of hacking into a supposedly secure system is a bit like climbing a mountain: people do it to prove they can.
Not surprisingly, though, these stories have done wonders for security companies while at the same time entrenching themselves as the ultimate bane to e-commerce. Canadian Imperial Bank of Commerce has decided to do something about the consumer fear of giving up credit card numbers to faceless Internet sites by introducing one-time Visa card numbers for those shopping on-line.
“What is hampering consumer use of the Internet, and actually physically shopping on the Internet and closing that transaction, was the fact that over 50 per cent of the consumers (surveyed) did not want to put their real credit card number on the Internet,” said Brenda Clark, vice-president of Internet channel management, card products division at CIBC in Toronto.
Originally, Visa cardholders were held accountable for up to $50 if fraudulent charges were made to their card. Clark said financial institutions now pick up that $50 so customers pay nothing if their cards are fraudulently used – on-line or in the real world. But this has proven insufficient in completely reducing fears of transmitting credit card numbers over the Internet.
“Consumers would say, ‘But I still don’t feel comfortable,'” Clark explained.
So CIBC decided it was time to find another solution. The financial institution looked at several solutions before deciding to implement Nexus 1 from Aplettix Inc.
Though the technology is not simple, the approach is. “[The Aplettix solution] enables consumers to shop at any e-commerce site without the need to reveal their personal credit card number,” said Guy Netef, vice-president of marketing for Aplettix in New York City.
simple to use
CIBC customers who choose to use a one-time CIBC Visa card number go to the CIBC site and download a piece of software that sits on their computer.
When they shop on-line and decide to buy, a window pops up to ask them if they would like to use a one-time number. If they choose to do so, the customer’s computer contacts the CIBC site, unbeknownst to the merchant, and is given a one-time Visa card number.
This access is, of course, password protected. The number is entered and the transaction is then completed. The service is free to CIBC Visa cardholders.
“The system will allocate randomly a one time credit card number which is not their [real credit card] number,” Netef said.
The random numbers are pre-allocated at the card-issuer’s site, so CIBC would set aside a series of Visa numbers to be used strictly as one-time issues, Netef explained.
A customer’s real and corresponding one-time Visa number is stored only on the CIBC servers, inside its firewalls, Clark said. “Your Visa number isn’t sitting with every merchant that you have shopped with, the real number is only between you and your bank.”
Theoretically billions of random one-time numbers can be created so the need to recycle them is not a pressing issue, Netef said, and the Nexus 1 solution can easily recycle numbers, he added.
merchant not involved
“The beauty of this system is that you don’t have to do anything with merchants in order for them to accept the one-time transactions,” Netef said.
In fact, the merchant has no idea if the card number given by the customer is a static Visa number or a one-time number.
One-time or not it may not be an e-commerce panacea, said John Boufford ISP, president of e-Privacy Management Systems Inc. in Lakefield, Ont.
“I don’t know if it will reduce the reluctance,” he said. “If the problem is not being comfortable with the technology, or the return policies of the vendor, then one-time (Visa number) issue certainly does not address that situation,” he explained.
But he agrees the technology is needed. “Having said that, I think this is a really important cornerstone or building block in providing for more consumer acceptance.”
The one-time CIBC Visa card number will be available sometime this year, Clark said.
Netef would not disclose the cost of the solution but did say it will be based on how much it is used.
Aplettix (www.aplettix.com) in New York City can be reached at (212) 803-8181. CIBC (www.cibc.com) in Toronto can be reached at 1-800-465-2422.