A pioneering Internet bank has become the first financial institution to sign up with Equifax Secure Inc., the electronic commerce business launched this month by Equifax Inc., the consumer data base company.
Security First Network Bank, an Atlanta-based subsidiary of Royal Bank of Canada, has begun relying on the digital certificate service to make communications secure and raise its level of assurance that on-line customers are who they say they are.
With consumer-level digital certificates still a relative rarity in U.S. banking, Security First has placed itself at the forefront of the movement to deploy this highly touted approach to authenticity. (The securities industry also is increasing its acceptance of digital certificates. See article on page 15.) Customers' identities will be verified in real time as they apply for products and services.
Security First chief operating officer Eric Hartz said, "The Equifax Secure authentication service is a breakthrough for electronic commerce that improves privacy and security over the Internet while providing the convenience consumers expect and the privacy protections they demand."
The choice of Equifax Secure by Security First is a significant endorsement for the new venture and the underlying technology, which includes International Business Machines Corp.'s VaultRegistry system.
Last week, the on-line auctioneer eBay of San Jose, Calif., said it would use Equifax Secure to verify the identities of buyers and sellers. Equifax said 10 other companies are testing the system.
"Equifax offered the most complete solution for identifying people over the Internet, without having direct contact with them," said Michael Rouse, head of operations for Security First Network Bank.
Equifax Secure is a logical extension of its parent's credit reporting and transaction authorization businesses, said Jeffrey R. Johnson, senior vice president and general manager of the unit. It draws upon the same credit data bases, said to be the biggest in the business, to initiate the authentication, manage the issuance of the certificates that will typically reside in a personal computer's memory, and revoke certificates when necessary.
"We're looking at the business process of remotely authenticating people based on the data bases we have and what we can get" from others, Mr. Johnson said. Equifax stresses that the system goes well beyond conventional "wallet information," such as addresses and Social Security and driver's license numbers.
The operations are based on public key encryption technology, what Equifax calls a "patent-pending remote authentication engine," and IBM's VaultRegistry for certificate enrollment and management. Equifax has in turn become an ally of and participant in a comprehensive range of e- commerce trust and assurance programs that IBM announced this week at the annual RSA Data Security Conference in San Jose.
Mr. Rouse said, "No one came close to providing a product like Equifax's. Its interactive query of remote authentication is truly unique. I don't know anyone else who has this function."
Relying on automatic authentication at the Web site, Security First no longer needs to do background checks or request further information from its 9,000 customers by telephone or mail.
It has become "seamless and painless" for U.S. citizens to apply for an account on-line, said Mr. Hartz. Authentication "is done in a secure, noninvasive manner."
Other data security vendors' perceptions of Equifax Secure and Security First were influenced by who works with or competes with whom.
John Ryan, president and chief executive officer of Entrust Technologies Inc. in Richardson, Tex., the top public key infrastructure vendor, said he is "very supportive of what Equifax is doing for Web authentication." IBM licensed Entrust's technology for VaultRegistry.
"For us it's a distribution mechanism," Mr. Ryan said. "We'll benefit down the road if it's a success."
Mr. Ryan said he expects Equifax's main competition to come from Verisign Inc. of Mountain View, Calif., his close competitor in digital certificate services.
But Verisign marketing director Anil Pereira said Equifax would be rivaled primarily by credit bureau competitors Experian Inc. and Trans Union LLC. The latter has entered into an alliance with Verisign. (See related article on this page.)
Verisign, Mr. Pereira said, does not target consumers but rather enterprises, Web sites, and large service providers. Verisign has 320 such customers.
Mr. Johnson said Equifax Secure is marketing authentication not only for consumers but also for employees' access to corporate networks and for business-to-business transactions.
"We think this technology is complex, expensive, and requires a high degree of security infrastructure around it," Mr. Johnson said. "Everyone won't want to deploy it, and they'll be looking for a trusted partner who understands the importance of privacy of customer information."
He said Equifax offers flexibility to clients. "The types of transactions people do will vary in terms of sensitivity, value, and importance. Depending on what a bank wants to do, it can use one method for a low-risk type of transaction or a more rigorous process for a higher-risk transaction such as trading stocks."
