From the early days of the Internet, credit and charge card companies recognized the enormous opportunities presented to them - but they also saw challenges ahead. Credit cards are easily the best way to pay for products and services online and some 90 per cent of all online transactions are made by credit or debit cards compared to only 28 per cent of purchases made in person. These figures are based on research by Datamonitor, who also forecast that the value of Internet transactions will reach $3.9 billion by 2005 in the U.S. and Europe alone.

However, online shopping also has the highest levels of fraud, and proving that the cardholder actually conducted the authorized transaction over the Internet cost Visa member banks $250 million to resolve disputed charges in 2000. The problem is that ‘card not present' transactions only require the card number and expiry date, so there is no way to be sure that it is the actual cardholder providing the details.

It's not surprising then that the card companies have been focusing their minds on the problem of online fraud. The challenge for them is to reduce the cost of fraud while at the same time increasing consumer confidence and encouraging more of us to buy online - whether that is through the internet or other emerging channels, including mobile phones and interactive digital TV.

From the moment we decide to make a purchase using a credit card, there is a complex sequence of processes and organizations that handle the transaction. But in short, the key players are the card associations, the card issuers, merchants and acquirers. The card associations, also known as 'the brands,' are the likes of Visa, MasterCard and Discover. The issuers are the banks who provide us with our credit cards and the acquirers are the financial services companies that process transactions on behalf of the merchants. Some large merchants will do this for themselves but most outsource to an acquirer that may also provide merchant hosting facilities.

The question of which of these parties bears the cost of online fraud is a complex one. While in most cases the cardholder is liable for his or her cards being stolen and used, the actual cost to the user is capped and prevented from exceeding a modest limit. The card issuer bears most of the costs associated with investigating the details of a disputed charge, which may be considerably higher if the dispute is not resolved quickly, and always has the potential to damage customer relationships. However, it is the merchant that is liable for the value of the items purchased if the cardholder disputes that the purchase ever happened or just refuses to pay the bill.

If it were possible for the cardholder to be authenticated before a purchase, to a reasonable level of certainty, it should be possible to reduce the likelihood of a stolen credit card number being used. Obviously the merchants and banks would benefit directly, but so would the cardholder. The process of proving identity provides a greater feeling of security and should encourage more cardholders to shop online.

3D Secure is a payment authentication mechanism defined by Visa for use on all non-traditional networks such as the internet, mobile and interactive TV. The system puts an extra step into the checkout process that requests that the bank that issued the card verifies the online user and the legitimate cardholder. Once completed, the merchant can process the transaction as normal but is now guaranteed payment, even if the transaction is disputed. So in this case, liability shifts to the card issuer.

The consumer branding for this initiative is called Verified by Visa and Visa has stated that by 2005, issuing banks must support 3D Secure for their cardholders in order to conduct authenticated online transactions. Verified by Visa is already up and running in the U.S. and was recently launched in Europe, where Visa, in agreement with BT Ignite, now provides a hosted service for issuing banks. Barclaycard Merchant Services and the Bank of Scotland - two of the largest issuing banks - have announced that they will support Verified by Visa, while leading merchants that already support it include Dell, Blockbuster Video, Petsmart.com and United Airlines.

Visa estimates that the shift in liability away from the online retailers in the U.K. alone could save them up to £55 million a year. Overall Visa expects that the arrival of authentication initiatives like 3D Secure will reduce the level of Internet fraud by as much as 80 per cent.

To meet the new levels of security that customers, credit card associations and financial institutions require, the new generation of online payment services need to meet best practice security standards and address a wide range of threat scenarios. One of the key tools for this is cryptography that dates back to Egyptian hieroglyphics circa 1900 BC.

Today, cryptography is widely used in a variety of applications, such as securing electronic documents and discouraging the copying of valuable material such as digital movies. But increasingly, cryptography is used to verify the identity of someone or something and to prove that an event actually happened.

The de-facto security standard used for Internet based transactions is SSL (secure sockets layer). Originally developed in 1994 by the creators of the Netscape browser, SSL is commonly used to encrypt Internet communications and prove that you’re connected to the right web site and not a fake. Sites that support SSL are clearly identified, usually by a padlock icon at the bottom right hand corner of the browser screen.

However, although the use of SSL can keep credit card numbers secret as they cross the Internet, this does not provide proof that the person typing in the card number is actually the cardholder. With Visa 3D Secure and MasterCard’s equivalent solution, called MasterCard SPA, cryptography is used to validate legitimate card users by asking them to prove their identity. Assuming this process is completed successfully, the merchant in question is given approval to complete the transaction through the use of a secure message sent from the cardholder’s bank. This message becomes the merchant’s primary piece of evidence if at some later stage the transaction is disputed.

For consumers, the process is very simple. In the case of the Verified by Visa initiative, existing cardholders can visit their bank’s web site and enroll in the system, by providing some basic personal information such as a password or PIN (personal identification number), which is stored by the bank. To make a purchase from an online merchant that supports the Verified by Visa system they will be presented with an extra screen in their browser to enter this information. Hidden from the merchant, this is provided directly to the issuing bank that authenticates the cardholder and authorizes the transaction with the merchant.

Simple in practice, but the secure generation, storage and management of the cryptographic keys that underpin the core encryption, digital signature and cardholder validation processes, relies on sophisticated technology. Because of the severe security and branding implications of a successful attack, stringent measures have been defined by the card associations. To meet these challenges, software companies developing cardholder authentication solutions for the online payments market such are turning to specialists to provide this additional level of security and functionality.

For example, a system may use cryptography in a variety of ways to protect sensitive information and to create digital signatures to provide a record of authenticity for transactions and payment authorization. The integration of a hardware security module would establish a safe, tamper-resistant hardware environment that overcomes the inherent security and performance problems associated with handling sensitive information or performing complex secure processes on unprotected server platforms.

Ensuring that the processing of encrypted customer data is performed within the boundaries of the hardware environment helps to ensure that sensitive data is never exposed to potential attackers where it could be stolen or manipulated to create fraudulent authorization of illegitimate transactions.

Previous initiatives by the card industry to increase the security of online transactions have failed to be widely adopted because they were too cumbersome for consumers and expensive for the banks. SET (secure electronic transactions) for example, required consumers to download a 5Mb 'wallet' and digital certificates. The difference with Verified by Visa and MasterCard SPA is their simplicity. Consumers only need to remember a password and PIN. The main pressure is on the issuing banks that become liable for Verified by Visa transactions whether they have implemented the system or not - so long as the merchants and acquirers have taken the necessary measures.

In addition to these online systems, there are other industry initiatives to reduce payment fraud in general and deliver a wider range of cardholder services. For example, the card associations expect that next generation chip based credit cards, or ‘smartcards’ rather than traditional cards with magnetic strips, will be used by about two-thirds of all credit card users before the end of 2006.

The good news is that through industry collaboration and initiatives such as Verified by Visa and others, there will be a high level of interoperability and standardization. The end result should be a dramatic reduction in credit card fraud and should also accelerate the use of the Internet and other online channels for e-commerce by increasing consumer confidence.