Cyber Law: Secured online payment

Till date, online payment is still perceived as non-secure by Internet users, and hence constitutes a bar to the development of electronic commercial transactions. However, it is obvious that "trade" requires "payment" either when carried out traditionally or through the Internet.

But when it comes to selling and buying on the Web, the involved parties; the trader and the consumer or businesses, has both understandable concerns as to possible fraud from the other side.

The trader need indeed to be secured that he is dealing with the real credit card holder, and the consumer need to be secured as to dealing with a well-established and serious web merchant.

Nevertheless, we know how risky it is to provide and circulate our credit card number on the Net as it can be easily intercepted by hackers or other indelicate people who made it their specialty to break into public and private networks and fraudulently get third parties confidential information.

Therefore, in order to encourage people to use the Web and complete their commercial operations by paying on line, some International banks along with financial institutions, and industrial businesses have decided to institute secured on-line payments methods using
(1) either the traditional credit card combined with other elements, or
(2) through other electronic mechanisms.

(1) As the credit card remains the consumer favourite mean for online payment, several possibilities are offered:

(a) the client send his credit card number encrypted to the merchant, with a risk of being intercepted by hackers.

(b) this option has the advantage of adding a control system by a third party: the on-line client send his credit card details encrypted to a monitoring company (with whom the on-line merchant deals for his on-line business) which shall verify that the used credit card is valid, not stolen, lost, etc.., all these investigations being of course made within few seconds.

(c) the above scheme (a) is completed with the possibility for the merchant to prior verify through a specific mechanism that the client is in physical possession of its credit card, which constitute an additional security for the Merchant.

(2) Other institutions offer different secured online payments through the use of:

- an "electronic wallets" similar to a prepaid card in which the user securely stores (off line) a limited amount of money to use when shopping and paying on specific affiliated merchant sites, or

- a "virtual wallet" in which the money is virtually stored in the user's computer (memory or hard disk) after downloading the secured payment software which shall enable the user (consumer) to launch the on-line payment by simply clicking on the "icon" displayed on the merchant site as the bank is already in possession of the consumer bank details, as well as his identity and secret code.

We may observe that whether on line payments are carried out through secured credit card payment or through electronic wallet, all these methods use the cryptography science.

Cryptography consist of "using specific techniques and software to render clear messages and data entirely incomprehensible (encryption) for third parties, and using the same techniques to later decode such unintelligible message into a clear one (decryption) for the message's recipient"

Such science is generally strictly regulated by national regulations as the use of cryptography principally relates to the protection of confidential, strategic and/or military information, etc.

This is the reason why, in principle non-state institutions and businesses should get the governments prior authorisation enabling them to work in this sensitive field.

The development of the Internet has any way compelled national governments to amend their regulation in this respect as to allow security expert businesses to exploit cryptography under the supervision of relevant authorities for strengthening security on the Net.

Online payments are a perfect illustration of the valuable contribution of cryptography in building online security.

It should be noted that the most well-known on-line payment protocols; the SSL (secure socket layer) and SET (secure electronic transaction) protocols, created by prominent institutions among which Visa and MasterCard, are based on the use of encryption techniques enabling the "authentication" of the merchant server, and maintaining the "integrity" and "confidentiality" of the exchanged on-line commercial messages.

The experience has also shown that the efficiency of these protocols is subject to the use by the consumer of his own electronic certificate obtained from an accredited Certificate Authority as to identify him through such e-certificate and signature.

Indeed, when electronically signing his on-line order to the merchant, the consumer identify himself, and as a result will not be able to subsequently repudiate his order, as his electronic signature would unquestionably validate his order and constitute accordingly a conclusive evidence of the e-transaction's occurrence.

In closing, we observe that security on the Internet is mainly and essentially based on encryption techniques that are greatly contributing to protecting consumers and businesses interests on the Net.

However, as hackers and fraudsters' efforts will always improve and follow the technology progress, it would be recommended for on-line actors to additionally reinforce their on-line security by subscribing to insurance policies covering such possible malicious acts.