Slashdot Mirror
American Express Seeks To Swap Card Numbers For Secure Tokens
jfruh writes: One of the fundamental problems of the electronic payment business is that it's by and large based on the fundamentally insecure infrastructure of the credit card system, where anyone who has your 16-digit card number can make purchases on your account. American Express is trying to improve its security by moving towards the use of unique tokens for online purchases.
PCI compliance would probably be a lot less of a headache as well...
This is interesting news for sure, but what's the ideal setup? Working backwards, what do you think is the perfect payment method for security and flexibility?
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
>> anyone who has your 16-digit card number can make purchases on your account
Wasn't CCV (the extra 3-digit number on the card) supposed to fix that? (https://www.dcporder.com/ccv.htm) Oh wait...intermediates started storing THAT too.
So yeah...bring it on!
Triumph the Insult Comic Dog: "So, have you ever actually talked to a girl without giving her your secure unique token first?"
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
My Discover Card had a feature where you could be given a one time number for a transaction online, I don't know if they still do it, but I imagine they do. This doesn't seem much different than that or any more convient. So what's the big deal?
I think it was called "Private Purchase"? You could log in to your AmEx account and generate a number that was good for one use. It was great, I don't know why they got rid of it.
It's 2014, why are we still getting stamped plastic cards? Can't they put a tiny microcontroller, lcd, battery, and display a unique time synchronized calculated number along with 4 exposed pads that you can read the number with synchronized serial (SPI)?
Of course, you can have a physical backup number on the card itself, but it should set off alarms if used.
Considering I just had 2 fraudulent purchases made online to the total of $2850 to my American Express card I welcome anything secure and not tied to my card number. Despite never losing or having my card stolen I've had to replace my card multiple times in the past few years. After a while it starts to get old.
It should work something like this:
The merchant gives me a transaction ID.
*I* contact AMEX to authorize payment using my own secure channel.
AMEX contacts the merchant to get transaction details.
AMEX has me confirm the transaction.
AMEX pays the merchant.
If I want to make a payment for someone else, they can pass the transaction ID from the merchant to me.
Just give me a card that plugs into the USB port and that I can charge up at the 7-11 with cash...
“He’s not deformed, he’s just drunk!”
As anyone who has one knows. The CCV code is 4 digits to bring it into alignment with the other cards.
I'd sign up for this. I hope they offer it to people sooner rather than later.
Occasionally living proof of the Ballmer peak.
While cumbersome, you'd login to your account, magically find the tab and you could generate a 1 time credit card number. You could set a one time balance, set a monthly balance for recurring charges, etc.
Fantastic for any online purchases you make. But, in reality - how many times are CC #'s getting stolen online vs in real life?
Change the system to use longer numbers, say 32 digits and make it hex, not dec
They should also have a needle number (like a pin, but longer)
Because it's a pain and people are lazy.
Hey, maybe we don't even need those credit card companies in the mix at all.
Where are we going and why are we in a handbasket?
A number of companies have offered single use credit card numbers in the past. You could generate new credit card numbers online, set time and dollar limits, and then use those for purchases. That offers similar levels of protection but is backwards compatible. Unfortunately, it hasn't caught on much.
the title and the post is really hard to read.
And yeah, Amex cards are 15 digits:
en.wikipedia.org/wiki/Bank_card_number
Am I to assume form this that these token are to be reused?!?!?!? If so, they deserve to be frauded in to the ground.
I initiate a purchase online, Amex gives a probationary okay and sends a 5 digit code to my mobile device
Then how would you initiate a purchase of a mobile device itself or of the first month of service for your mobile device?
Because it's a pain and people are lazy.
And by removing that option, this has resulted in me diverting over $60,000 in personal charges online from my Amex over to Bank of America that offers ShopSafe.
There was no excuse to remove the optional feature. ShopSafe exists for BoA but it's not like they force you to use it. I would have preferred to use my Amex, but it has been relegated to point-of-sale terminal use.
If they come up with a feature-for-feature match with ShopSafe (I.e. allowing me to set charge limits, expiration dates, recurring auths, etc) then I will happily switch.
Please implement it immediately.
USB dongle with a little computer, display, fingerprint/pulse scanner, and a few buttons. Dongle plugs into a port on the POS payment terminal. You authenticate with an authenticated fingerprint from a finger with a pulse. Dongle makes its own secure connection to the payment clearinghouse and indicates to the clearinghouse that a transaction with [Merchant_ID] is imminent. [Merchant_ID]'s payment terminal makes its own connection to the clearinghouse and says [Your_Public_ID] owes $112.96. The clearinghouse sends a message to your dongle (snicker) saying [Merchant_ID_Common_Name] says you owe them $112.96. Do you want to [P]ay from Primary account, pay from [O]ther account, or [D]ecline payment. Your dongle sends your response to the clearinghouse which sends your response to the merchant. If you opted to pay from one of your linked accounts, the money is transferred to the merchant's account, confirmation of the transfer is sent to the merchant, and the transaction is concluded.
At no time is your account information shown, transmitted, stored, or even provided. You don't even have your account information to provide.
Same system can be used for online purchases, online identity verification, building access, home access, car access, and pretty much any kind of authentication where internet access is available.
Hell, I'll bet a lot of people would even pay for the device after being on their 2nd or 3rd round of replacement credit cards in the last two years. Shouldn't cost more than $25 to make a keychain-dangler.
I use "virtual account numbers" for online purchases with my Citi Mastercard. It adds a few steps to the process for a merchant that you haven't used before but it's totally worth it. You're still fucked in a brick and mortar shop, of course.
It's really good that the security of the credit card system is being improved. I'm sure that the same thing will happen to the ATM network and operation just as soon as the banks are made liable for consumer losses through ATM fraud. (Today's election day in the US, good luck voting for a candiate that will even propose that solution).
Great idea. And there are many different ways of doing this.
The core concept is to generate a unique ID for each transaction that links:
a. the vendor
b. the customer
c. the customer's bank
d. (maybe also the vendor's bank)
e. a specific amount
f. a specific time.
And being unique, it will never be used again. We have a lot of different ways to do that.
With that information, the bank should be able to flag questionable transactions that get past the customer verification. Or at least warn the customer if the vendor has an unusually large number of "problems" reported.
Among popular cards, American Express uniquely has 15 digits. (VISA, Mastercard, and Discover have 16 digits.)
If someone steals my credit card info and makes a fraudulent charge, the cc company voids it and issues me a new card (It's happened more than once). So, honestly other than being annoyed by a minor incovenience, I don't really care that much. Do other customers actually give a shit about this? It seems like something cc cards or vendors, who are actually liable for these charges, should care more about. If they drag their feet on implementing decent authentication and it means it remains easy for the actual card holder (and anyone else) to make cc payments, by all means keep it business as usual.
America (the USA, to be precise) seems to have problems no other developed country has, any more. Among them the absence of universal medical coverage and the old-fashioned credit cards. This is not USA bashing, but an expression of true amazement. For instance, codebooks, or one-time codes sent by SMS have been routinely used in Europe for quite some time now in conjunction with credit cards that are otherwise quite secure by themselves. American Express refused to upgrade and it cost them a lot of clients, both card users and places where you can use such a card (shops, cash dispensers, etc.).
Well, it can lead to identity theft for one thing which is a huge pain in the neck. It ultimately means that we all pay for it in terms of higher fees for credit cards and also fees being charged to merchants.
Visa has a tokenization program available for 3rd parties who want to integrate it. It just so happens that the biggest vendor so far is Apple.
Physics is nothing like religion. If it was, we'd have an easier time trying to raise money!
10 years or so ago, AMEX had "Private Payments", where you could generate a single-use number for a transaction. The number was valid for a single transaction and expired in two days or so.
Then they dropped the service. I never figured out why.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
It take some fraud out of the equation by making it harder. That said, the combination of tokens, mobile payments, NFC and GPS is going to make fraud damn near impossible. Mix in some big data analytics and your Credit Auth systems will block anything that gets missed.
I know it's cool and hip to say the hackers will always find a way, but the reality is they won't. The credit card industry tolerates some fraud because the cost of eliminating it has been more than the cost of allowing it. That's changing. Big Data is cheap, and cell phones shift the cost of the user side tech to the end user. Book it, done.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
"American Express is trying to improve its security by moving towards the use of unique tokens for online purchases."
...
The dumbest idea in online purchases was using Credit Card numbers in the first place
folks here in the upper 1% of collective intelligence are arguing about what's the best method for the Oligarchs to track us, our purchases, and our movements. Screw accounts, numbers, tokens, plastic, binary 1's and 0's in a computer....Why not barter our time and talents? Why not use cash? Why force small retailers to pay for a transaction some financial entity has no business profiting from, much less knowing about. I pay cash for just about everything, and the things I do purchase electronically are done with prepaid cards. I don't wear a tin foil hat, but the less the banksters, Oligarchs, and hackers know about me...the better.
With 3C, you never divulge any information that can be used to generate future transactions. All transactions are controlled by the consumer.
3C can work with current point of sale devices. 3C WOPs can be pre-printed by ATMs or home printers, for example, and used like cash. Signing keys could be changed at will without having to wait for a new credit card to come in the mail.
See 3C explanation.
Some cards let you create a virtual CC # tied to your credit card and basically set it up for one-time use by putting a dollar limit and expiration date on it. Too bad some cards like Discover actually discontinued it.
For a long time now several banks (I'm talking EU here, I never saw this in the US, but that doesn't mean they don't have it) offer services where you can generate a temporary card number for a one-time single transaction, and the generated number becomes invalid after that single transaction. It's meant for online payments - you generate the number with a specified sum that can be spent, you make the transaction after which the number disappears. This, combined with a two-layer online banking login (password + single-use token sent by text to your phone) seems pretty solid to me. At least, I never heard anyone using it having their card data stolen.
I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.
Generating a secure one time use token for any credit card that is stored?
Best Slashdot Co
If only there existed a solution for the problem of trustless transactions! If someone could write a white paper setting out an algorithm, what a boon it would be....
Prove anything by multiplying Huge Number times Tiny Number
It seems like something cc cards or vendors, who are actually liable for these charges, should care more about.
Therein lies the rub. The merchant takes on 100% of the liability, the credit card companies and banks lose NOTHING when a fraudulent charge is made. In fact, they get to collect a chargeback fee. They have little incentive to fix the problem. Merchants, of course, have incentive to fix the problem. But they have no power (other than the really big merchants) to effect change.
I didn't know BoA had a comparable feature. My past experiences with BoA haven't been good, and literally everything else (other than canceling Private Payments) I've experienced with AmEx has been good - including their removing without question charges I wasn't responsible for the handful of times it's happened.
Yeah, I thought that was a tremendous advantage for Amex over all the other credit cards -- I just loved it for on-line shopping. Then they stopped that service. :(
Tokenisation is widespread in Europe already - there are dozens of services, both tied to card brands and independent, and many of them cover the US as well. Furthermore, P2PE absolutely relies on tokenisation by the service provider. So what's the breakthrough here?
Yes, you can tell i would much rather be using my Amex. However, ShopSafe is simply the best, and I will tolerate having to deal with BoA to get it.
I know my charges are a drop in the bucket for Amex, but I doubt I'm the only one whose business they are losing.