Visa issues 10 'commandments' for online merchants

From...

by Maria Trombly

(IDG) -- In an attempt to reduce online credit-card fraud, Visa U.S.A. in San Francisco announced 10 "commandments" for online merchants to guard its cardholders' information. And, next week, Visa will follow up by releasing the details of a broad online security program. John Shaughnessy, Visa's senior vice president for risk management, said merchants would be required to obey these rules or face fines, sales restrictions or loss of membership.

The rules won't go into effect immediately but will be phased in over the course of a year, starting in the fourth quarter, Visa spokeswoman Angie Grothoff said.

MORE COMPUTING INTELLIGENCE

IDG.net home page

Computerworld's home page

Net driving identity theft

Online shoppers beware

Retail fraud more prevalent online

Reviews & in-depth info at IDG.net

E-BusinessWorld

TechInformer

Questions about computers? Let IDG.net's editors help you

Subscribe to IDG.net's free daily newsletter for IT leaders

Search IDG.net in 12 languages

News Radio

Fusion audio primers

Computerworld Minute

The first sector that will have to comply are gateways and Internet service providers. Visa partners would be expected to be compliant in the first quarter of next year; major Internet "pure plays" in the second quarter, third parties in the third quarter and other merchants in the fourth quarter.

Among the new requirements, merchants must install a firewall, keep security patches up-to-date, encrypt stored and transmitted data, use and regularly update antivirus software and restrict employee access to sensitive data to a need-to-know basis.

Merchants must also assign unique IDs to everyone with access to data, track access by ID, avoid using default settings for passwords and regularly test security systems.

Brian Buckley, Visa's vice president for product risk and analysis, said these security initiatives are expected to reduce Internet transaction disputes by up to 50%.

According to a recent survey by Stamford, Conn.-based Gartner Group Inc., credit-card fraud is 12 times higher for online merchants than their offline counterparts.

About 1.1% of online credit-card transactions involve stolen card numbers, said Gartner analyst Ken Kerr. Online merchants have to bear the cost of the scam, while the credit-card companies usually take care of the bill for fraudulent face-to-face transactions, he added.

Digital signatures create market potential
July 31, 2000
Defunct Web site leaks credit card info
July 26, 2000
AOL says hackers may have stolen credit card numbers
June 17, 2000
Will online escrow services protect you from auction scammers?
May 16, 2000
Online bill payment becoming popular with consumers
March 29, 2000

Dispute sparked on Internet retail fraud
ComputerWorld
Visa wants to lead Net pack
Industry Standard
Online shoppers beware
PC World
Visa exec talks about credit card fraud
NW Fusion
Visa program to fight online fraud debuts
ComputerWorld
Fraud center: Net driving identity theft
IDG.net
VeriSign launches fraud-screening software
ComputerWorld
Who's holding your money?
PC World

Visa U.S.A. Cardholder Information Security Program
The Better Business Bureau
National Fraud Center

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.