Four banks have agreed to trial Visa's card, which
generates a unique, one-use code to verify each transaction.
The idea of a one-use number to make sure that the person behind
a transaction is the genuine card owner is not new. Some banks
currently issue users of online banking with calculator-sized
devices to generate unique codes.
But EMUE Technologies has developed the Visa card which actually
contains a computer within the card itself that generates the
number. Visa said that the card is no bigger than a normal credit
card and that the system will help fight fraud when a card is used
remotely.
"The card will help in the fight against card-not-present fraud
in two ways," said a Visa statement. "Firstly, as the one-time code
generated is for a specific transaction, once used it cannot be
used again by anyone. Secondly a fraudster would need to be able to
get hold of a card and know the person's PIN in order to commit
fraud ... Visa Europe believes this will provide more consumers
with greater confidence to shop online and provide its member banks
with a unique solution for online and telephone transactions."
To use the card a person has to be shopping at an online outlet
that also uses the system. The card user puts their personal
identification number (PIN) into the card using the ten numbered
keys on the back of the card. It then generates the one-use number
that validates the transaction at the vendor's site.
Verified by Visa, the system that will use the technology if it
is implemented more widely, currently demands that users remember a
password to verify transactions. The PIN-generated number will
replace that password in the system.
The Data Protection Act could force other banks and card issuers
to use similar technology if the Visa trial is successful,
according to one expert.
One of the Data Protection Act's principles governs the security
that organisations should use to protect people's information. It
says that: "appropriate technical and organisational measures shall
be taken against unauthorised or unlawful processing of personal
data and against accidental loss or destruction of, or damage to,
personal data."
The Act says that banks, for example, should protect information
against theft "having regard to the state of technological
development and the cost of implementing any measures".
William Malcolm, a data protection expert at Pinsent Masons, the
law firm behind OUT-LAW.COM, said that Visa's development could
change the law's view of what is technically possible.
"Card issuers are under an obligation to ensure that the
security they put in place to protect a cardholder's information is
appropriate," he said. "This is a moving feast – card holders need
to keep security constantly under review, looking at emerging
technologies, the cost of implementing these technologies and take
into account the increased risk to customers of identity
theft."
"As technologies become lower cost and more standard, there
becomes more of an argument that card issuers ought to be raising
their game," said Malcolm. "The market norm for security is
constantly evolving, what is appropriate today is unlikely to be
appropriate tomorrow."
The four banks trialling the system are MBNA in the UK, Cornèr
Bank in Switzerland, Cal in Israel and IW Bank in Italy.
