As mentioned in the press recently, credit card fraud has soared, with APACs reporting an increase in card fraud for the first time since 2004!
What is interesting is that domestic card fraud has also increased, despite the introduction of CHIP & PIN! This was mainly due to the fact that fraudsters were still able to use stolen credit card details to purchase goods online or by mail order over the phone.
Most people are now well aware of phishing and ensuring their machines are protected from trojans and viruses (through Firewalls and Virus Scanners), however how does this stop someone from hacking a retailers systems and stealing the purchase information from its database. One of the recent advancements has been Verified by Visa and MasterCard SecureCode, both systems which require a secondary level of authentication for purchases. This is pretty good, but again this doesn’t stop a key logger on your PC picking up your password as you type it!
So I got thinking, what about these 2 Factor Authentication (2FA) devices (see image below from BBC website) currently being used by the banks: NatWest and Barclays have both rolled out 2 Factor Authentication devices which are used to securely manage your account online.
The 2FA device is basically a card reader which reads the information of the chip in the card (thereby verifying you have the card in your possession) and after you insert your bank card into the 2FA device (aka Card Reader), and after entering some information into the device, the device generates a "One time only pass code". This pass code is then entered into the site to verify you and therefore the transaction.
I know there is a lot of negative press about these devices, because let’s be honest they aren’t exactly small (the size of a small calculator), and from a usability perspective are appalling, but they do perform a useful function - keeping my online banking account secure.
So why can’t we use these devices for our online shopping? Surely similar to when Verified by Visa you could be taken to a secure area of the site, or perhaps to a secure Visa server and instead of asking you for a password it could ask you to insert your card in the device, and enter a onetime only pass code? I think this would be a great advancement in technology and would mean that we could once again try and stay one step ahead of the fraudsters. However there are a number of reasons why this won’t happen:
- Not everyone is like me and thinks these devices are a good thing... for example: http://www.stopthecardreaders.org/
- These devices are currently only being used by a couple of the big banks, to my knowledge HBOS, HSBC and LTSBR are yet to introduce these (I may be wrong).
- People will argue why should I have to carry this device around when I am doing my online shopping - People won’t like them
- People will argue why should they have to carry their card with them? Most online retailers allow you to save your card details for further use.
- It will require a big retailer such as Amazon and Play.com to sign up to this for it to be even the slightest success...
- It will cost a considerable amount of money, and who will pay for all these card readers??? (Estimate £2-5 per device)
- What do we do about payments to international websites e.g. http://www.amazon.co.jp/ or http://www.amazon.com/.
I think for this to work and be implementable we would need it to be driven by the two major card providers (Visa and MasterCard) and for them to mandate or offer protection or insurance against fraud which takes place with these devices. It would also require more widespread uptake of these devices, with all the major banks implementing the 2FA devices.
Here is an interesting snippet from the Visa website:
"The future of card-not-present security
Chip and PIN cards have introduced a higher level of security to our face-to-face transactions. The industry is now looking at ways of using chip's security features in the card-not-present environment.
Dynamic pass code authentication is Visa's solution that uses the added security of chip cards to offer better protection against online fraud. It validates the cardholder's identity and physical presence of their card via a pocket-sized card reader provided by their bank.
This is a new solution, and from the end of 2006 various banks across Europe will start running pilot schemes." http://www.visaeurope.com/merchant/handlingvisapayments/cardnotpresent/security.jsp
I could not find anything on two factor authentication from the MasterCard website (maybe I didn’t look close enough)
Anyway enough of the blurb, what are peoples thoughts on using Card Readers for online shopping as well as banking?
-------------------------
Links to Additional Information
Natwest Card Reader: http://www.natwest.com/microsites/general/card-reader-user-guide/index.asp?cmp=reader
Barclays Card Reader: http://www.barclays.co.uk/pinsentry/
E-Consultancy Paper on Card Readers and 2FA: http://www.e-consultancy.com/news-blog/362677/banks-to-give-out-card-readers-to-combat-online-fraud.html
BBC Article: http://news.bbc.co.uk/1/business/7023743.stm
Visa: http://www.visaeurope.com
Mastercard: http://www.mastercard.com/uk/gateway.html
Stop the Card Readers: http://www.stopthecardreaders.org/
-------------------------
We have an active Finance team within CGO, if you would like an interesting conversation about our thoughts on the Finance Market or would like to hear more about what we do and how to be a part of our team please visit us on:
http://www.conchango.com/join-us/