First Virtual Goes Off-Line To Secure On-Line Payments

Enough about Hollywood. Lee H. Stein is no longer interested in recalling his days in the 1980s as business manager to celebrities like Rod Stewart and Matthew Broderick, or his later career as a marketer of television infomercials. Today he is steeped in the mores of the Internet.

As chairman and chief executive officer of First Virtual Holdings Inc., Mr. Stein, 43, is surrounded by scientists instead of stars. The scientists have devised Internet Payments System, which works through electronic mail and what the company calls a VirtualPIN. Mr. Stein is their front man.

"This group developed an architecture that permitted messaging as the major component of a payments system," Mr. Stein said. "If you're going to do things in business, you need a way to get paid, and when we started there was no way to get paid on the Internet."

First Virtual's approach differs radically from those of competitors like Cybercash Inc. and Digicash Inc., which use cryptographic scrambling to shield data from intruders. First Virtual moves sensitive parts of a transaction off the Internet.

First Virtual customers who want to buy something on the World Wide Web never type a credit card number into their computer. Instead they read it over the telephone and receive a PIN, or personal identification number, which they use when paying for something on-line. The transaction is settled off-line.

In electronic commerce circles, people either love First Virtual's solution or hate it. Among the believers are top executives at powerful companies like First USA Paymentech Inc., GE Capital Services, and First Data Corp., which have invested a combined $12.5 million in the two-year- old venture.

"We have experience with their system, and it's worked," said Pamela H. Patsley, president and chief executive officer of First USA Paymentech, who also sits on First Virtual's board of directors. "We've had no problems with it from a security or risk perspective."

To offer a menu of payment options, First USA Paymentech also works with rival Cybercash. Ms. Patsley had kind words for both companies but said her company's early investment in First Virtual was unusual and represented strong confidence.

First Virtual's strategy "is to continue to be very aggressive in developing new products and expanding on their core systems, which are based on E-mail connectivity," Ms. Patsley said. "From there, there are other opportunities, like moving more into advertising."

Mr. Stein hits this point squarely and repeatedly: that First Virtual offers not just a payment method but a way of marketing goods and services on-line. The bonus, he said, is that the payment instrument is built into the advertisement.

"The other payment systems that are being developed are fabulous and interesting, but they are not taking care of that direct marketing need," Mr. Stein said. "What First Virtual really started to build was a communications technology - a payment system was just application No. 1."

Application No. 2, released in September, was a technology called VirtualTags, which embeds the transaction process into on-line ad banners. By clicking on a Web advertisement, a First Virtual customer could directly buy a product or donate to charity. (Among the first to sign up for Tags are the Casio Timepiece Division and the United Cerebral Palsy Foundation.)

Application No. 3, scheduled to become available this year, will be an on-line subscription renewal service. The idea is that publishers could send messages asking people to subscribe or renew, and people could agree and pay for the service at the same time.

"First Virtual really needs to be viewed as an advanced communications system that permits seller-enabled advertising and marketing," Mr. Stein said. "The key is that if you can build the payment transactions directly into the communication, then you're really working in an interactive environment."

Competitors are diplomatic about the San Diego-based entrepreneur, whose system calls into question the conventional wisdom that the Internet can be made secure for financial transactions. While other payment companies want to admit electronic coins and checks into the on-line mix, First Virtual only takes MasterCard and Visa. (Negotiations are under way with other card companies.)

"First Virtual has a solution that some vendors view as a good way to get started," said Ed Soo Hoo, director for business development at Cybercash. "As things start to come up from a volume perspective, end users will want to have more options than a credit card, and they're going to want to have more flexibility to use different payment types and to control the certification on their desktop."

Mr. Soo Hoo added, "We believe that First Virtual will have a percentage of the market, and we hope to share in that as well. I don't want to be disparaging - we need as many players as possible in this market to make this happen."

First Virtual does have outright detractors.

"Their system has been obsolete for a long time," said David E. Weisman, an electronic commerce analyst at Forrester Research in Cambridge, Mass. "They've been obsolete since encryption was put on the Internet. They can make a great case as to why (the Internet is) still dangerous, but people are going to keep working on the security, and there's plenty of risk using a credit card in the physical world."

When the final touches are put on MasterCard and Visa's Secure Electronic Transactions protocol for the Internet, Mr. Weisman said, there will be no place for an off-line solution.

"First Virtual's contention that you can't have safety over the Internet goes against where all the electronic commerce world is going," Mr. Weisman said. "People will say, 'Oh, MasterCard and Visa say I can use my credit card on the Internet, great!' "

Mr. Stein, the promoter, remains indefatigable.

A year ago, he went on a media tour to talk about the danger of "sniffer" software that could steal credit card numbers as they were typed on a keyboard. Some critics viewed the hype as self-serving, since First Virtual's distinguishing feature is its off-line nature.

Today Mr. Stein calls Internet security "an evolving process."

"We basically break the world down into two types of security, which are technology-based security and process-based security," he said.

"We decided to focus on the process-based security because that permitted us also to build a communications system that has significant direct marketing applications. If you're not doing the direct marketing, you're not going to get a lot of commerce."

Mr. Stein's observations are backed up by his scientific team, which includes Internet veterans Einar A. Stefferud, Marshall T. Rose, and Nathaniel S. Borenstein (whose first face-to-face meeting with Mr. Stein was over a promotional dinner with Peter Gabriel at the Hard Rock Cafe in New York).

Mr. Borenstein previously served on the technical staff at Bellcore; Mr. Rose was a senior scientist at PSInet; and Mr. Stefferud is adjunct professor of information and computer science at the University of California, Irvine. Other First Virtual executives came from Intuit Services Corp. and GE Capital.

First Virtual's staff has grown from four in 1994 to more than 100. The company completed an $18 million initial public offering in December, and its early backers are represented on its board.

"Everybody wants to know how we got senior executives from First USA Paymentech and GE Capital and First Data to sit on our board," Mr. Stein said. "There's a Latin saying - res ipse loquitor - the thing speaks for itself. They would not have put senior executives on our board if they had not looked under the carpet and liked what they saw."

Last month First Virtual also announced the integration of its Internet Payment System with Microsoft Corp.'s Merchant Server software. Microsoft is also working with First Virtual's competitors, but some people viewed this pairing as significant.

Jamie Kiggen, an analyst at Boston-based Cowen and Co., called it a "terrific endorsement - something I wish all my small companies could accomplish." Cowen was among those that took First Virtual public.

"The beauty of First Virtual's system is that it rides on top of a system that almost everyone has access to, namely E-mail," Mr. Kiggen said. "They're not trying to reinvent the wheel creating some sort of new encryption algorithm - they're trying to make it secure but easy and inexpensive and reliable. Now they need to get buyers and sellers to start using it."

Rebekkah Kumar, business development manager for Microsoft's Merchant Server, said the decision to work with First Virtual represented an effort to cover all bases.

"We're in a nascent market," Ms. Kumar said. "We're hoping to find as many value-added components to build the market for Merchant Server as a platform for Internet commerce. Basically we want the market to define who is the leader."

As of Sept. 30, First Virtual reported it had processed over 260,000 transactions and registered more than 2,650 merchants. The company said 180,000 consumers in 166 countries possessed VirtualPINs.

To acquire a VirtualPIN, a consumer must submit an application through the company's Web site. The consumer then receives an E-mail with instructions to call a toll-free number.

VirtualPIN holders can buy tickets for Jacksonville Jaguars football games, cappuccino brownies from Cyber Sweets, and a variety of oddball consumer and computer products. They can also donate to the Libertarian Party of Virginia.

Ira Morrow, an electronic commerce analyst at the Gartner Group in Stamford, Conn., says his quarrel with First Virtual is that its system "requires premeditation." Consumers must seek out the company's payment system and work to acquire a password, and in the end their shopping options are limited. He contrasted it to the ease of using Home Shopping Network on television.

"There will be people who sign up for their password, but there's probably a bigger market that really wants their cubic zirconium ring right now, and First Virtual is probably not going to be the right approach for them," Mr. Morrow said. "Plus, if you want that cubic zirconium ring and it's not being offered by one of their merchants, then tough luck."

Frank Accettulli, a spokesman for the electronic business markets unit of Electronic Data Systems Corp., said: "They need to get to a wider part of the market. They need to convince a financial institution that has a large cardholder base to supply those cardholders with a VirtualPIN."

EDS holds no equity in First Virtual, Mr. Accettulli said, but did make the introduction to First USA Paymentech. EDS also supplies First Virtual with computer hardware and other services.

Mr. Accettulli said he has known Mr. Stein for a long time. "His concept is still good," he said. "School is out as to whether his scheme is the right one, but he was the first."

Mr. Stein says registering people for VirtualPINs is this year's top priority, and that acquiring a PIN must be effortless and invisible.

The company will rely on First Data, the biggest credit card processor, for help. "We have granted them warrants in the company for the VirtualPINs that they cause to be directly activated," Mr. Stein said. "The more VirtualPINs that are out there, the more merchants will be on board."

VirtualPINs can be branded, and Mr. Stein hopes banks will be interested. But none has signed yet, and some bankers believe the existing strategic partnerships leave no place for them.

"If I used First Virtual, it would sort of be competing with myself because they provide credit card payment services," said Parker Foley, vice president of electronic commerce at First Union Corp.

Calling First Virtual a "maverick" for keeping credit card numbers off the Internet, Mr. Foley said, "There's no role for me to play in that."

First Virtual spent much of 1996 out of the public eye, watching as competitors grabbed headlines. This year may be different.

"We intentionally were quiet, and now we have these resources and it's time to get the marketing programs to kick in," Mr. Stein said.

He said his strategy will hold up whether or not banks choose to go with him. When asked what role he envisions First Virtual will play in the future of electronic commerce, he said: "I would answer that by just typing in a smiley." l

For reprint and licensing requests for this article, click here.
MORE FROM AMERICAN BANKER