Pay By Touch Unit Enabling Web-Based PIN-Debit Purchases

  J. Paul, a Dallas-based retailer of promotional merchandise, began in June piloting a system developed by ATM Direct, an Irving, Texas-based division of Pay By Touch, to enable customers to make purchases with their PIN-debit cards on the Internet.
  Fiserv is switching the transactions on its Accel/Exchange electronic funds transfer network. For now only employees of its network advisory council bank members can make purchases from J. Paul through ATM Direct's site. If all goes well, Fiserv gradually will roll out the option to all issuers of the 80 million cards in its network.
  ATM Direct is in talks to add another network and another merchant to its roster, neither of which ATM Direct officials would name.
  Using PIN-debit for Internet payments long has been considered risky because of the potential for PIN security to be compromised. But Robert Ziegler, ATM Direct senior vice president and general manager, says the system complies with the same security standards as in-person PIN-debit purchases.
  "We haven't had to lower the standards in order to implement this on the Internet," Ziegler says. "We've had to increase the controls, the cryptographic processes, on an order of magnitude above what people do in the [brick-and-mortar] space."
  Merchants who choose to enable ATM Direct payments would display the ATM Direct link with other payment options at checkout on their Web sites. The link serves as a payment portal so PIN data would bypass merchants, Ziegler says. Cardholders would click on a virtual PIN pad on the screen, thus avoiding keystroke entries that could be intercepted with spyware. ATM Direct's software converts the information into a normal, encrypted PIN format and forwards the data to the issuer for authorization.
  ATM Direct software also searches cardholders' computer hard drives for spyware and other malicious programs.
  Ziegler would not disclose the system's fee structure but says the cost to merchants would be 25% to 35% less than for card-not-present signature-debit transactions.
  One observer is giving the service a thumbs up. "I'm relatively bullish about it," says Ed Kountz, senior analyst of payments at Boston-based JupiterResearch, citing its appeal to the growing consumer preference for debit and the merchant quest for cheaper payment methods.
  Kountz says that while no system is fool-proof, he is impressed with ATM Direct's security. "Creating a way to enter a PIN securely on a PC is a relatively complex job," he says, adding, though, that the system will need to be easy for consumers to use.
  But not everyone welcomes PIN-debit payments on the Internet. "It's going to be disastrous for PIN debit with little benefit for consumers," predicts Steve Bacastow, founder and partner of Collective Dynamics LLC, an Atlanta-based consultancy.
  ATM Direct's system may be fraud-proof now, but it and any other Internet PIN-payment systems will have to remain steps ahead of data thieves, he says. "The disaster comes with prolonged exposure of PIN blocks and BIN (bank identification numbers) numbers," Bacastow says.
  (c) 2006 Cards&Payments and SourceMedia, Inc. All Rights Reserved.
  http://www.cardforum.com http://www.sourcemedia.com