How to make credit cards safer for shopping on the Internet

Staying Ahead

Dollars & Sense

March 11, 2001|By JANE BRYANT QUINN

CAN THE Web be made safe for credit cards? Online merchants say it's safe enough, but plenty of shoppers disagree.

Various studies show that as many as 80 percent of people who make financial use of the Web don't trust it with their credit-card numbers.

They might check the Net for prices and products. But for actual purchasing, they visit the store or pick up the phone.

Credit-card issuers, hoping to calm these fears, are always on the lookout for new technologies that might make you feel safe.

The latest is a system for creating disposable credit-card numbers. You use each number once and - poof! - it disappears. So there's nothing in the merchant's data bank for hackers to steal.

Shoppers have two financial security concerns today.

First, they worry that their credit-card numbers will be stolen and used. As a practical matter, that's a minor issue. By law, they're liable only for the first $50 spent by a fraudster, and most card-issuers waive even that.

The second and far greater problem is identity theft.

If crooks get your name, credit-card number, Social Security number and other identifiers, they can create a virtual you. They'll open accounts in your name, charge up a storm and ignore the bills. You'll be dunned and sued. It can take a year or more to straighten out the mess.

ID thieves steal credit-card numbers from many places - stores, restaurants, mail-order businesses. But the Web lets them steal wholesale, by breaking into the databases held by the merchants themselves.

Hence the appeal of credit-card numbers good for only a single use. They're currently available in three slightly different formats from American Express, Discover and the credit-card bank MBNA America in Wilmington, Del.

Amex developed its own system, called Private Payments. Discover and MBNA use technology from an Irish company called Orbiscom. Here's how the disposables work:

You download the disposable-card technology onto your computer. A little icon at the bottom of your screen tells you it's there.

The next time you're Web shopping and see something you want, you carry the item to the site's checkout page. But instead of entering your own, permanent credit-card number, you click on the icon for your disposable card.

The card pops onto your screen and you enter your name and password. You then get a one-time number for the single purchase you intend. Once used, it isn't good any more. Your real number is hidden away at the bank, where you hope hackers can't go.

It's like writing a check - "it can't be put through twice," says research analyst Moriah Campbell-Holt of Gomez Advisors in Waltham, Mass., a service that rates Web companies.

Hackers who steal the number steal air.

Only holders of real cards from Amex, Discover and MBNA can sign up for these free disposable cards. If the cards turn out to be popular, you can count on other banks to offer them.

Single-use numbers can be inconvenient, senior analyst James Van Dyke of Jupiter Media Metrix in New York told my associate Dori Perrucci. They can't be used on one-click shopping sites like Amazon, where permanent card numbers must be stored.

They're also no good for automatic monthly payments, such as phone service billed through your Internet service provider.

You can get around these problems, however, with an option offered by Discover's DeskShop program and MBNA's ShopSafe. They let you assign a permanent (phony) credit-card number to a site where you do business. If you use several such sites, each one would have a different number.

That gives you shopping convenience without revealing the true number on your real, plastic card. Permanent virtual numbers also let you order more than a month in advance of delivery.

If hackers broke in, they couldn't use the virtual number without your password, which the merchant doesn't have. And it couldn't be circulated to other sites. Discover and MBNA also offer a free e-mail address that you can use for communicating with stores, so you don't have to give your own address away.

Amex doesn't offer either of these options - at least, not yet.

With any of these cards, both you and the issuer always know which numbers were generated in your name. If there's a problem with a purchase, the issuer can identify the transaction.

Washington Post Writers Group

Baltimore Sun Articles
Please note the green-lined linked article text has been applied commercially without any involvement from our newsroom editors, reporters or any other editorial staff.