Recorded Behavior as Data Authentication

Taming Credit/Payment Card Fraud and Identity Theft

Why Not Text Me to Confirm Each of My Credit Card Transactions?

Back in the 90s, when e-commerce was in its infancy, one vision held that commerce would come to depend on everyone acquiring certificates and private keys under public key infrastructure (PKI). Under this vision, each actor in commerce would be identified by her unique private key. But she would have to protect her private key as though her life depended on it. If a criminal were to shanghai her private key, he could impersonate her (steal her identity).

The PKI school eventually fell out of favor. One reason is that it assumed ordinary people and corporations could prevent crooks from stealing the private keys.

Today we see that the stealing of data like private keys is not so uncommon.

Peter Huber offers an alternative vision in “Secure I.D.s and the Net,” Forbes, August 13, 2007, p. 64. Recognizing that criminals routinely swipe credit card and social security numbers, he argues that efforts to keep such data elements secret do little to authenticate legitimate users. Instead, what really confirms a person's identity is her recorded pattern of behavior over time.

As multiple, independent databases record the details of our day-to-day march through life, they create a unique profile for each of us. They record that you went through a toll booth here (at 7:15pm), you purchased a hamburger there (at 7:39pm), you scanned a thumbprint some other place and on and on. When it comes time to confirm you are you, a gatekeeper will pull details from these disparate databases and compare them against the person claiming to be you. For instance, when your credit card company wants to confirm it is really speaking to you on the phone (or responding to a cell-phone text message seeking confirmation of a transaction), it will ask you to reveal that you know where you purchased the hamburger the night before.

Here is an article I posted on the law of card data security.

--Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader in data records management.

About

Benjamin Wright is an attorney in private practice. He teaches the Law of Data Security and Investigations for the SANS Institute. He is author of The Law of Electronic Commerce (published by Wolters Kluwer) and Business Law and Computer Security (published by SANS). He helps others navigate the law of data compliance, including privacy, e-commerce, e-discovery, cloud contracts, records management and cyber investigations.

He is spotlighted in the book The Devil Inside the Beltway for his uncommonly insightful advice to LabMD in its now famous information security law dispute.

Public Statements Are Not Legal Advice

None of Mr. Wright's public statements, such as remarks on blogs, twitter, youtube web pages, social media and the like, are guaranteed for accuracy or are legal advice for any particular situation. You use the ideas in those statements at your own risk. If you need legal advice, you should consult a lawyer.

Mr. Wright's blogs, updates, tweets, web comments, youtube videos, web courses and the like constitute part of the online update service for the book The Law of Electronic Commerce. Originally released 1991, and revised continually since then, the book is a reference for lawyers, published by Wolters Kluwer.

Mr. Wright does not have and never has had intention to infringe the rights of anyone. If any person has any information, suspicion or belief that Wright has done anything illegal or unethical, he asks that person promptly to telephone him at 1.214.403.6642. Promptness helps mitigate damage.

Any person accessing any of Mr. Wright's blogs, tweets, profiles, comments, web pages or other public activities or statements agrees not to use data from them in a way that is adverse to Wright's interests.

No Advertisement

Mr. Wright's public statements on blogs and the like are not intended to advertise or solicit legal services.

Mr. Wright does not have an attorney-client relationship with any person unless and until he and that person explicitly so agree. Interaction with Mr. Wright through public media does not create an attorney-client relationship. Communication with Mr. Wright via private message does not, in itself, create an attorney-client relationship.

Privacy/Security Vision

Some people provide Mr. Wright private information. Mr. Wright strives to treat such information reasonably according to the circumstances. People should have no more than reasonable expectations about information security. It is unreasonable to expect that the offices, computers, cell phones, brief cases, filing cabinets and online or other services used by Mr. Wright are very secure.

IMPORTANT Confidentiality Notice

Benjamin Wright is licensed as an attorney. Some of Mr. Wright's non-public records stored in the cloud are confidential and subject to protections associated with attorney work and communications. The laws of many countries recognize such protections. Mr. Wright insists that you recognize those protections with respect to his records and communication.

Relationships

The only person responsible for Mr. Wright's words is Mr. Wright.

Mr. Wright has earned money from some organizations he mentions online, such as Messaging Architects/Netmail, SANS Institute and LabMD.

Attribution

Some images, sounds and font output associated with Wright's work and comments are copyrighted by Corel Corporation or its licensors or partners like iStockphoto; they reserve all their rights. Some images are declared on wikimedia to be public domain. Mr. Wright strives to respect IP rights, but sometimes technology behaves in surprising ways. If you are an IP owner and you have a problem with something published by Mr. Wright, please telephone him promptly. Trademarks are property of their respective owners.

Dallas, Texas. Tel: +1.214.403.6642

4 comments:

AnonymousOctober 16, 2008 at 6:22 AM
your idea and the inevitable trend of enabling cardholders to control the usage of their cards by setting their own user limits that will automatically enable issuing banks to reject or approve card authorization requests and also trigger notifications is a validation of the system and methods I designed and created in 2000, piloted/trialed in 2002 and which has been granted a patent 6931382 by the USPTO in August of 2005. VISA applied an application with similar claims but were over a year later than mine.
Benjamin WrightOctober 16, 2008 at 7:46 AM
Marite: I am pleased to hear from you and about your technology. I'd like to know more. I note that in 1994 an online payments company named First Virtual Holdings (long defunct) launched a system under which a message was sent to the user each time a transaction against his account was initiated. In order for the transaction to proceed, the user had to transmit (via e-mail, text message or the like) an affirmative response. --Ben
Benjamin WrightOctober 16, 2008 at 8:21 AM
Background: I documented the First Virtual payment system in the Second Edition of my book The Law of Electronic Commerce (circa 1995-1997). --Ben
Marite FerreroMay 14, 2009 at 12:09 AM
Hello Ben. Yes, there are a couple of systems that are offering that feature of sending a message to the user and waits for the user to respond as a requirement to proceeding with the transaction. In the real world, it is quite difficult to do this - actually not possible with card payments given the context that messages to users are sent each time a transaction against his account is initiated which means that this system is linked with the account (issuer). The authorization process/systems for card transactions are just not capable of 'holding'.

In anycase, the system that I designed and invented does not work this way.

InfoSec & Forensics Law