Irish firm outflanks web credit card fraud

By Stephen McKinley

One day in Dublin, in 1996, two brothers-in-law were having a quiet pint when they came up with an idea that could solve one of the biggest drawbacks of the wired world: credit card fraud. The result was Orbiscom, the Irish technology company they founded in 1997. Orbiscom has had a New York office since April of 2000.

The musing, drinking duo were Dubliner Graham O’Donnell and Englishman Iain Flitcroft, and with their combined background in software engineering and mathematical modeling, they were acutely aware of the risks a customer takes when trusting existing internet security in many online stores. In 2000, Visa said that half of all credit card disputes are about internet transactions. One recent survey by a Boston consulting group revealed that 44 percent of internet users don’t shop online because they don’t want to risk giving out their credit card numbers.

If you’ve ever shopped online, the experience goes something like this: you select the goods you want to buy — an airline ticket, a book, or even, these days, a car. You type your credit card details into the purchase form, click the "buy" button, and it’s goodbye — off goes your confidential card number and information to the databases of buythisstuff.com or some other online merchant.

And it may indeed be goodbye. Goodbye, that is, to your credit and confidential details. It is at the database end of the transaction where trouble lies, not with the customer. Creditcards.com was hacked in 2000, and 55,000 credit card numbers with details were stolen — and that’s only one small example of the breaching of virtual walls and the pillaging of private data. E-commerce is a growing business — but so is online fraud.

That’s where Orbiscom comes to the rescue. The solution hit on by Flitcroft and O’Donnell back in 1997 makes each credit card transaction like writing a check. Once a check is written and cashed, it can’t be reused. Using Orbiscom, when you click on the buy button, a new, unique, once-off credit card number is generated by the Orbiscom software.

This random number replaces your original credit card number for each payment you make. Even if security is badly implemented or hackers prove simply too smart for the latest secure servers and firewalls, the random numbers are useless for further illicit purchases.

With current security measures, "at the end of the day, you are still trusting somebody, somewhere," said Ajay Arora, an expert in online security, "as soon as you send off your card number and details." Moriah Campbell-Holt, a research analyst with the Gomez group, agreed. "Many of the high-profile security breaches are the result of human error," she said. Looking at Orbiscom, she said that the Irish solution simply circumvents this, so that a hacked card number generated by Orbiscom would be useless to a thief. "Fraud would be virtually impossible," she said.

Orbiscom’s chief operating officer in New York, Ray Sheridan, would not go so far as to say "virtually impossible," but he vigorously asserted the principle behind the company’s software in response.

"If you don’t put your real credit card number out there, it can’t be stolen," he said. Apart from the immediate security advantage, Sheridan also said that Orbiscom’s solution should reassure shoppers and increase credit card usage over the Internet.

After finishing their pints and founding Orbiscom, Flitcroft and O’Donnell got to work on selling their product to interested parties. The Allied Irish Bank in Ireland was an early convert, taking the Orbiscom software onboard where it is available as an essential part of their Transactonline system. So impressed was the AIB after several months’ trial, that they bought a 5 percent stake in the company.

Since then, opening their U.S. office has led to deals with MBNA and Discover in 1999 and 2000, two of the largest credit card providers on this side of the Atlantic. "That’s a potential of nearly one hundred million card holders combined," Sheridan said.

Despite these successes, the company that started over a couple of pints won’t be ordering any post-IPO champagne just yet. There is no stock market flotation planned "for the foreseeable future," Sheridan said.