Feeds

Visa's digital credit card could raise legal stakes

Competitors may hop on bandwagon

The essential guide to IT transformation

Visa has introduced a computerised credit card which it hopes will help banks battle fraud. The innovation could force other card issuers and banks to implement similar technology, one data protection expert has said.

Four banks have agreed to trial Visa's card, which generates a unique, one-use code to verify each transaction.

The idea of a one-use number to make sure that the person behind a transaction is the genuine card owner is not new. Some banks currently issue users of online banking with calculator-sized devices to generate unique codes.

But EMUE Technologies has developed the Visa card which actually contains a computer within the card itself that generates the number. Visa said that the card is no bigger than a normal credit card and that the system will help fight fraud when a card is used remotely.

"The card will help in the fight against card-not-present fraud in two ways," said a Visa statement. "Firstly, as the one-time code generated is for a specific transaction, once used it cannot be used again by anyone. Secondly a fraudster would need to be able to get hold of a card and know the person's PIN in order to commit fraud ... Visa Europe believes this will provide more consumers with greater confidence to shop online and provide its member banks with a unique solution for online and telephone transactions."

To use the card a person has to be shopping at an online outlet that also uses the system. The card user puts their personal identification number (PIN) into the card using the ten numbered keys on the back of the card. It then generates the one-use number that validates the transaction at the vendor's site.

Verified by Visa, the system that will use the technology if it is implemented more widely, currently demands that users remember a password to verify transactions. The PIN-generated number will replace that password in the system.

The Data Protection Act could force other banks and card issuers to use similar technology if the Visa trial is successful, according to one expert.

One of the Data Protection Act's principles governs the security that organisations should use to protect people's information. It says that "appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data".

The Act says that banks, for example, should protect information against theft "having regard to the state of technological development and the cost of implementing any measures".

William Malcolm, a data protection expert at Pinsent Masons, the law firm behind OUT-LAW.COM, said that Visa's development could change the law's view of what is technically possible.

"Card issuers are under an obligation to ensure that the security they put in place to protect a cardholder's information is appropriate," he said. "This is a moving feast – card holders need to keep security constantly under review, looking at emerging technologies, the cost of implementing these technologies and take into account the increased risk to customers of identity theft.

"As technologies become lower cost and more standard, there becomes more of an argument that card issuers ought to be raising their game," said Malcolm. "The market norm for security is constantly evolving, what is appropriate today is unlikely to be appropriate tomorrow."

The four banks trialling the system are MBNA in the UK, Cornèr Bank in Switzerland, Cal in Israel and IW Bank in Italy.

Copyright © 2008, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Related links

Demo video of Emue card on Youtube

Next gen security for virtualised datacentres

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?