The National Automated Clearing House Association is trying to assemble the necessary moving parts for a test of debit card payments on the Internet.
After some preliminaries this year, the association's Internet council expects to be in full swing during the second quarter of 2000 with a system that enables consumers to make on-line purchases with automated teller machine cards.
These on-line debit cards -- not the off-line versions that carry the Visa and MasterCard brand names and are processed much as credit cards are -- have been frozen out of Internet commerce because it has been impractical to verify customer identities with personal identification numbers.
The clearing house association, known as Nacha and based in Herndon, Va., is one of several organizations seeking an Internet solution for debit cards that work with PINs, and it has an impressive lineup of test participants from the banking, ATM networking, and technology vendor communities.
They reason that debit card acceptance would accelerate electronic commerce, attracting millions of wired consumers unable or reluctant to use credit cards. They see their answer in digital signatures, a type of data encryption technology that authenticates transactions and guards them from tampering.
"The benefit of this pilot to consumers is the development of a convenient and secure Internet payment method tied directly to a checking account," said Nacha president and chief executive officer Elliott C. McEntee.
"Merchants would have a guaranteed, low-cost payment mechanism running in real-time," he said. "Financial institutions would act as trusted third parties, just as they do every day for other commercial transactions."
A cardholder would apply at his bank for a private key to use in generating digital signatures with participating Internet merchants. The bank would attach a corresponding public key to the person's checking account and store it in a data base.
When buying from an Internet site, the cardholder would use his ATM card number. Instead of entering a PIN, he would use the encryption key to digitally sign an electronic authorization form. The form, in turn, would be sent to the consumer's bank for signature verification, and a successful match would result in a confirmation to the merchant.
The customer's checking account would then be debited through a participating ATM network, and the funds transfer would be settled through the automated clearing house network.
Hoping to launch a full-scale test involving live transactions by midyear, Nacha's Internet council is encouraging banks, merchants, transaction processors, and ATM networks to join an initial group that comprises Citigroup, the Star and Pulse ATM networks, Amerinet Inc., Internet Revenue Network, eFunds Corp., and UTM Systems Corp.
Certicom Corp., a Canadian data encryption technology company, is a technical and security consultant to the project, and Georgia State University's eCommerce Institute is providing legal advice.
Participants want to "develop and test a low-cost, convenient payment option for Internet purchases incorporating robust security and immediate authorization," said Lucien Dancanet, vice president and director of information security for the e-Citi division of New York-based Citigroup.
Citigroup's Citibank does not issue MasterCard or Visa debit cards, perhaps explaining its motivation to pursue the ATM card payment option. The company is also active in the digital signature area.
Though technology experts consider it most secure to store digital signature keys in hardware devices such as smart cards, it may be more practical to deliver them in software on a Web browser or personal computer. The Nacha test is designed to accommodate either approach.
"The whole thing is built to be flexible," said Jennifer L. Vancini, director of strategic marketing for Certicom, who is based in Hayward, Calif.
Citigroup is planning to go the hardware route, giving selected consumers smart cards with readers for the test.
"If a hacker goes into your system and makes a copy of that private key (in its software), you will never be aware that a copy has been made," Mr. Dancanet said. "On the other hand, if you lose your smart card or it's stolen, you are aware of that. You can quickly call the bank and disable" the card.
Credit cards have so far won the day in Internet commerce. Consumer awareness of their $50 liability limit in cases of loss or theft may be a major reason. A Web site of the American Bar Association Section of Business Law, www.safeshopping.org, points out the liability cap and says losses could be worse with payment instruments tied to checking accounts.
ATM network executives have been hankering to find a niche for their debit cards in Internet commerce, safeguarded by PINs or something similar.
Merchants may have an interest in accepting on-line debit, not just for higher sales but also because banks' processing fees are less than on credit cards.
Nacha said Pulse EFT Association of Houston will join the project in February. Other banks and ATM networks -- including NYCE Corp. of Woodcliff Lake, N.J., Cash Station Inc. of Chicago, and MasterCard International 's on-line program Maestro -- are monitoring progress from the sidelines, according to Nacha.
Some networks and technology companies are working on their own systems for Internet debit acceptance. Executives in the Nacha-sponsored program say the purpose of their test is to develop standards and an interoperable framework for everyone.
Elsewhere, the network executives council of the Electronic Funds Transfer Association has formed an advanced payments group with representatives from Star, NYCE, Cash Station, Pulse, and Transalliance of Bellevue, Wash. This group has been studying authentication schemes involving secure wallets, digital certificates, and peripheral devices such as smart card readers, said K. Nikki Waters, chief marketing officer and executive vice president of Star Systems Inc.
The EFTA and Nacha groups are communicating and are ultimately seeking the same ends, Ms. Waters said. "The opportunity for all participants in the industry is best addressed in a collaborative nature," she said.
