Credit card security rules to get update

TalkBack 12 of 22:

Next »

« Previous

• Thread View
• Flat View

Solve the real problem - Merchants never needs my credit card

The real problem of electronic purchasing as it implemented today is that we not only have to give identifying details about ourself but we are also required to provide our credit card number and sometimes even the security number on the back.

Folks, this information is valuable and, therefore, ever attractive to fraudsters who will always work hard and smart to break into those commerce systems that hold this precious information.

The proposed rules miss the point because adding ore firewalls won't buy security - implementing good security is infinitely hard and maintaining even modetate security requires constant watch and monitoring, well above the level small (or even medium) businesses can afford.

The right solution is for those merchants not to have this burden to begin with. They may keep some general information on the buyer but they have absolutely no real need for the credit card data.

Consider this scenario:

1. I want to buy a CD from an independant music label Indigroove (a small shop).
2. I get to Indigroove's on-line store and instead of being asked for my credit number, I am being asked for 'the credit' (tm).
3. In order to provide Indigroove with 'the credit' I connect to my favorite credit card company's web site (authenticating of course) and ask for 'the credit'. If I have enough credit, I get 'the credit' as a 32 characters long string.
4. I copy 'the credit' to Indigroove's web page and that is it.
5. Now Indigroove connect to my credit card company and immediately claims 'the credit'. 'The credit' can be claimed once and is not usable otherwise (except for law enforcement - with the right order, the transaction details can easily be recovered).


Now the benefit of this scheme is that the merchants are no longer burdened with highly exploitable information so the incentive to break into their systems is almost zero. They are also more secure in that their transaction has been already approved.

For the customers, the benefit is that they don't have to trust the merchant with the key to their wallet. The customer pays, the merchant gets the money and provides the goods. Web purchase becomes much safer than paying with a credit card at the mall.

For the credit card companies the benefit is reduced fraud and associated costs (money and image).

I have been thinking and talking about this for years. I have no idea why this have not yet been implemented. Does anyone know?

Posted by: drorharari   Posted on: 05/17/06 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• VMware Infrastructure: A Guide to Bottom-Line Benefits VMware Frustrated by the costs of maintain ever larger data centers?or building ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Reducing Server Total Cost of Ownership with VMware Virtualization Software VMware VMware virtualization enables customers to reduce their server TCO and ... Download Now