Eliminating Credit Card Fraud

Now that Visa is a Public Company it needs to take responsibility for the harm it creates.

The antiquated system of trading credit card numbers is only something that seems reasonable in a pre-1978 world, one without public key cryptography.

A modern credit card authorization scheme should look something like this:

• Merchant requests transaction from Visa for a specified amount of money with a signed/encrypted message
• Merchant passes transaction information to client in a signed/encrypted message
• Client (human) accepts/declines terms of transaction by passing signed/encrypted message to Visa. Input of a credit card number is optional, and could be replaced by a cert/PIN.
• Merchant can check transaction status via signed/encrypted exchange with Visa.
• Merchant can handle returns/exchanges via this transaction

This stuff can be easily streamlined today with a simple browser extension or integrated into future web browsers. A physical token (smartcard) is even better, and extends the model beyond Internet transactions.

Just today I learned that my credit card number may have been compromised by shopping at Hannaford’s. There’s no reason for Hannaford to have held onto credit cards for this length of time, that’s just reckless, but there’s also no theoretical reason for them to have to store credit card numbers in the first place.

How many times are we going to have to go through the cycle of:
* merchant gets hacked
* new cards are issued
* everybody changes all of their automated billing setups

before everybody gets fed up? My wife’s card was compromised last summer by shopping at TJ Max, now her card and mine probably at Hannafords. Given enough time, all the merchants are going to get hacked. This will be her second replaced card in a year, and there’s still time for a third. This rate will only accelerate.

More importantly, the current system is a house of cards [ouch – ed.] built on the assumption that every merchant with whom you do business has bullet-proof security. PCI is a pathetic attempt to try to impose IT security upon merchants, but it’s full of holes, and can never be perfect, no matter how hard everybody tries.

The real secret is that PCI is just an attempt to cast blame on the merchants and make it shoulder all of the costs, when Visa is capable of making the whole problem go away and has been for some time.

The disconcerting aspect is that as a non-profit they should have been more willing to do this. Let’s hope real security is an intended use of proceeds from their IPO.

If not, they’ll be displaced by somebody offering much better rates to all the merchants and shopping without fear to the cardholders. Sure, it’ll require large capitalization, but the value proposition is immense. Drop me a line if you want to fund this. 😉