Securing The Consumer

By Contributing Editor Scott Smith
Principal Analyst - Internet Commerce
Current Analysis, Inc.
Email: scott@currentanalysis.com
URL: http://www.currentanalysis.com
Voice: (703) 404-4169
Fax: (703) 404-9300

Visit for more related articles at Journal of Internet Banking and Commerce

Over a year ago now, I wrote an editorial for a publication on electronic commerce urging the parties who had the most to gain - and lose - from consumer commerce on the Internet not only to settle their differences over which blueprint for transaction se curity they would use, but to move quickly to use their position as trusted intermediaries to assuage consumer fears. Several weeks later, Visa and MasterCard and their respective technology supporters announced the Secure Electronic Transaction (SET) pro tocol, and rosily predicted a roll-out sometime in 1996.

No sooner had the ink dried on headlines touting SET did these parties begin to retreat again into their old ways, making different pronouncements about SET's timetable. By year end, SET was still in the planning stages, and recaps of consumer spending on line in early 1997 found that the totals spent online using credit cards was indeed much lower than many analysts had predicted for the year (myself included). Best back-of-napkin guesses would indicate that total consumer spending online in 1996 fell som ewhere in the $600 million to $750 million, about half of the expected amount projected by Jupiter Communications and Forrester Research. Coincidence? Probably some. While perceived lack of security wasn't all to blame for consumers sitting on their wall ets, it certainly had some hand in dampening interest and willingness to pass credit card numbers over the Internet to merchants (It is worth noting that a slice of blame can be laid at the feet of merchants, many of which weren't offering anything worth buying).

Overall, consumers are shopping more, though this is probably still an activity of a small though growing core group. A look at the quarterly surveys performed by the GVU Center at Georgia Tech show the numbers have changed for the better, recently as wel l. Respondents in the most recent survey rated giving a credit card number online versus giving it to an unknown offline store less risky than those on the previous survey, though only by a about three percent less. Not exactly heartening.

Yet the technology companies have continued to take an engineer's view of the world (more complex is better, and users be damned), and financial institutions have followed multiple paths dictated by both varied risk tolerances and strategic interests. The whole issue of certificates was sidestepped initially, but being so central to the functionality of SET, and for secure commerce in general, it seems we are years away from user-friendly certificates that can be managed by consumers within perhaps the b rowser or soon the OS environment. While certificates will find their strongest market on the enterprise side, consumers will still have to grapple with them as digital identities, and banks, credit card groups, etc., will have to realize that fact and ma ke adjustments accordingly.

What about those at the front line of the battle? While Visa has taken a more careful, some would say to hesitant, stance toward SET pilots, MasterCard has sought to make up some of the gap between itself and Visa by positioning itself as a technology fri endly organization, from launching the first SET pilot to its current series of television spots touting itself as the "Future of Money" (Anyone smell a prep of the smart card market here?).

Other efforts have included both IBM's newest series of commercials aimed primarily at technology buyers selling safe commerce via IBM's Net.Commerce solution, and weak announcements, first by AT&T, then by America Online and now search engine Excite!. Th e latter promise to pay the bill for provably fraudulent use of credit cards to buy merchandise on those sites. Laudable, but ultimately this means a maximum of $50 in any instance, as the rest is forced back to the credit card organization under federal credit law. None has caused any marked increase in shopping, though they are a step in the right direction.

The upshot? Through efforts like those of IBM, Microsoft (which wants to cordon off segments of the Internet into Microsoft-branded safe zones to avoid dealing with the security problems of ActiveX), Visa, and MasterCard, what is appearing is not a univer sally safe Internet, but various flavours of security attached to brands. "Consumer, want to shop safely? You may only do so using a combo of Visa and IBM", or "AT&T is the only safe place to buy" seem to be the billboards of the future. Otherwise we are seeing nice but equally weak efforts by groups like TRUSTe to label safe sites, which also don't seem to make a huge difference at this point.

What this threatens to create is a series of secure "townships" on the Web, making the Internet a type of safe-shopping South Africa - travel at your own risk if you shun known brands. While this takes care of the needs of the brands themselves, it doesn' t see the forest for the trees; these companies need to work together to boost overall security, or commerce over the Internet will not grow in a solid manner. The current model uses security as a tool to direct consumers into different camps, instead of securing the environment as a whole.

Consumers want to buy, not worry about the brand on their computer, browser, bank, or favourite online store's merchant server.