Comparative evaluation of electronic payment systems

INFOR, Feb 2002 by David Wright

* The payment is transferred to the merchant's bank account from the customers credit card issuer non-interactively, e.g. at the end of the business day.

Within this sequence of operations there are three options for customer input of the credit card number.

1. In the first case, the customer inputs the number while filling out the order form on the merchant's web server. The merchant has to provide security for the transfer of the credit card number from the customer to the merchant and from the merchant to the e-payment service provider. The merchant has access to the credit card number and may choose to store it in a database of customer information, in which case, security is important for access to that storage.

2. In the second case, the customer never sends the credit card number to the merchant - he/she only sends it to the e-payment service provider, after the merchant has redirected the customer there, as shown by Step 4 in Figure 1. In this case security is less important on the merchants web server. Security is required between the service provider and the customer. A customer database including credit card numbers cannot be built up by the merchant, but can be built up by the e-payment service provider.

Third, the international standard, Secure Electronic Transactions, SET, [8], can be used. In this case the customer sends the credit card number together with the order to the merchant. However, the credit card number is encrypted using the public key of the credit card issuer, so that the merchant cannot read it. The merchant passes it via a SET gateway to the credit card issuer, which has the corresponding private key and can therefore decrypt the number. SET employs extremely robust cryptography to link the credit card number with the order via a dual signature while preventing the merchant from seeing the credit card number and preventing the credit card issuer from seeing the order information. The credit card number is always encrypted while on the internet, from the customer to the merchant and from the merchant to the credit card gateway. The disadvantage of SET to the merchant is that a database of customers' credit card numbers cannot be built up. The disadvantage of SET to the customer is the extra step of becoming authenticated by the SET system, which needs to be done once only. Thereafter SET can be used for any number of transactions at any merchants accepting SET payments.

The above description refers to B2B or B2C, business to business or consumer, credit card transactions. In addition, C2C, consumer to consumer, transactions, may require the use of credit cards. An example is Billpoint, [9], which provides an e-payment service between consumers who have done business on auction sites such as eBay. In the case of C2C payments, it is essential that the recipient does not see the credit card number of the payer, and therefore the e-payment service provider operates in mode 2, above. The auction site transfers details of the required payment to the service provider. The credit card number is entered, by the payer, on the service provider's web site. The recipient enters details of the account into which he/she would like the funds deposited, and the funds are transferred by the service provider to the recipient's credit card or bank account.