Security Device Forgoes Number Storage

Amid the bells, whistles, and hydraulic lifts at the Internet World Fall 2000 conference at New York’s Jacob Javits Center last week was an inconspicuous booth where visitors could test a small device that encrypts credit and debit card numbers for safe travel over the Internet.

The gadget, one of a growing number of entries into a high-stakes sweepstakes to give consumers confidence in online transactions, was PC Pay Authenticate, promoted by MerchantOnline.com of Boca Raton, Fla. The company says its technology is safer and easier than disposable card numbers and other technologies meant to protect card numbers on the Internet.

PC Pay Authenticate looks like a point of sale terminal, and plugs into a personal computer either through the keyboard, the USB port on newer computers, or the serial port. To buy something online, consumers would insert a card, and the account information would be encrypted and sent to the merchant and to the consumer’s bank. The bank would decrypt the information, authorize the transaction, and send an authorization or a rejection to the merchant, who would never know the real account number.

Tarek S. Kirschen, chairman and chief executive officer of MerchantOnline.com, said the system could also reduce chargebacks and losses for merchants. At the moment, merchants must install special software in order to accept transactions through PC Pay Authenticate, but Mr. Kirschen said the company is working to eliminate that step.

PC Pay is available through the company’s Web site for $129, which Mr. Kirschen said would drop to about $50 once the device is mass-produced. He said it will be available in some retail stores early next year.

With an entrepreneur’s boundless optimism, Mr. Kirschen said his company is aiming for wide distribution of PC Pay. He said MerchantOnline is working with “a top PC manufacturer” — he would not name it — that will bundle the device with new computers. Mr. Kirschen wants banks to give the devices away with new credit cards, and merchants to give them away as incentives to shop at their Web sites.

Jim Gitney, MerchantOnline. com’s chief operating officer, said the company also offers PC Payment, a card-swipe terminal for small businesses. PC Payment is plugged into the computer and does not require a dedicated telephone line. PC Pay and PC Payment can accommodate smart card transactions, according to their developers.

Alanna Kellogg, an electronic banking consultant and the president of Kellogg Group in St. Louis, said: “I was really shocked at the price point — $129? Take it down to 10 bucks.”

Worse still, she said, the equipment seems superfluous to consumers, who “actually bear no risk if a fraudulent transaction occurs on their card.”

The real benefit of PC Pay is to the merchant, Ms. Kellogg said. “I think merchants would be very interested in this because of going from card-not-present to card-present discount rates,” she said.

James P. Punishill, a senior analyst at Forrester Research in Cambridge, Mass., called PC Pay problematic. Its target audience “tends to be less technologically savvy,” he said. “How are they going to attain and install another peripheral” device?