In
recent years, a great number of approaches and technologies have
been introduced and/or proposed to reduce the incidence of fraudulent
on-line transactions. Generally, these solutions are split into
several categories, with certain solutions falling into more than
one category:
- CFD Protection
(e.g., encryption of CFD data before, during, and/or after transmission);
- Consumer
Identity Verification (e.g., verification that the individual
placing an on-line order is in fact the consumer to whom the CFD
belongs, as accomplished through software using consumer-entered
security codes, through hardware, such as biometric (fingerprint,
retina, palm, voice pattern) scanners, key cards and readers,
global positioning systems, or via a combination of both software
and hardware technologies); and
- Use of Secure
Third Party Agents (e.g., an third party organization that securely
holds the CFD and that communicates with and acts as an intermediary
between, the customer, the merchant and the customer’s financial
service provider (FSP), so that the CFD is never sent to the merchant
directly).
However,
all of the above approaches suffer from a number of disadvantages
that make them cumbersome, expensive, impractical, or otherwise
difficult to implement:
- Requirements
for changes in current commercial transaction infrastructure,
(which is virtually impossible or impractical), or that add a
significant per-transaction expense, such as use of third party
secure agents;
- Requirements
for special software and/or hardware for one or more of the involved
parties (i.e., customer, merchant, FSP, etc.). One popular recently
offered approach requires a biometric sensor (such as a fingerprint
scanner) to be utilized by the customer in conjunction with a
software program installed on the customer’s computer. Prior
to conducting an on-line transaction, the customer’s identity
was authenticated by the biometric device. However, this approach
requires customers to purchase expensive hardware and to deal
with complex biometric software, and so far has failed to capture
consumer confidence and approval; and
- Requirements
that the customers memorize special passwords, codes, and/or PIN
numbers - something which the consumers typically resist or circumvent.
In addition,
most of the previously known solutions have been limited to attempts
to prevent fraudulent on-line transactions, and thus cannot be utilized
to address fraud issues in other types of purchase transactions
(e.g., telephone, facsimile, or mail order transactions).
Unsurprisingly,
criminal parties have kept up with technological developments, finding
new ways to steal CFD, or to utilize misappropriated CFD to engage
in on-line and other types of fraud. This resulted in banks and
other financial institutions having to provide added assurances
(such as promises of insurance coverage for fraud and identity theft)
to appease the worried public, while at the same time combating
the steadily increasing cost-per-transaction. Nevertheless, the
vast majority of consumers are still wary of making on-line purchases,
and while the growth of Internet commerce is very impressive, it
is still far from its maximum potential.
It is
widely believed that consumer confidence in on-line commerce cannot
be readily elevated until there is a cost effective, simple, and
secure way to: (1) prevent misappropriation of CFD resulting from
on-line commercial transactions; and/or (2) to verify that an on-line
order for which payment to a merchant is required from a specific
customer’s financial service provider, was in fact placed
by the customer.
With respect to
fraudulent activities perpetrated by employees using CDC card products
issued to them by their employer, none of the previously known security
methodologies or technologies offer a solution, since all are concerned
with either identity verification or CFD protection – approaches
that are of little use if the person committing fraud is a legitimate
CDC card product holder.
Glossary:
“CFD” – Confidential Financial Data
“CDC card” – Credit / Debit / Charge Card
“FSP” – Financial Service Provider
“CFAU rules” - Customized Financial Account Utilization
rules
“BTST technologies” - Byz Tek’s Secure Transaction
technologies |