Transaction Security

CEO Interviews
Michael Keresman, CardinalCommerce (cont.)
“CCA is different
because Cardinal
is the only one in
the market that
provides this
service or anything
like it. The market
essentially relies
on two mutually
exclusive parties
to help take fraud
out of the system.”
How is Cardinal’s Consumer Authentication (CCA) service different from other providers in the marketplace?
CCA is different because Cardinal is the only one in the market that provides this service or anything like it. The market essentially relies on
two mutually exclusive parties to help take fraud out of the system. Merchants use fraud screening services and issuers use their version of
risk mitigation technologies. Each of the parties attempts to assess which orders are “suspicious” and depending on their respective criteria,
eliminates those orders. Merchants won’t submit their suspicious orders for authorization and issuers will not authorize orders that fall into
their criteria of such.
In the POS world, there are many specifics regarding a transaction: the store, POS terminal and the consumer can be identified fairly easily
… but online, not so much. Remote commerce has inherent suspicions that the POS world does not have.
The end result is both sides of the transaction (the merchant and the IB) grind down potential orders to the lowest common denominator of
“good” orders, because their respective systems use mutually exclusive information and approaches. Good orders that the issuer might
authorize are thwarted by the merchants’ fraud screening services, and orders from the merchant’s perspective that are “good” are not
authorized by the issuer. Only CCA creates a collaborative approach in which there is visibility in how each side would treat the transaction,
essentially increasing the authorization yield from the lowest common denominator of “good” orders to the highest common denominator of
“good’ orders. Yet, and importantly, both sides still have veto power when the order is very suspicious. It may be easiest to understand this as
a classic 2 X 2 matrix; yes/yes, yes/no, no/yes and no/no. In the yes/no and no/yes the respective “yes” side can decide to accept the
transaction, whereas without this approach those orders would most likely be declined or not authorized.
Both the merchants and issuers have a vested interest in ensuring “good” orders are not thwarted. Sometimes the merchant has the better
vantage point in knowing what is good and other times the issuer does. CCA, more or less, creates a real-time arbitrage of determining the
quality of an order with this collaborative approach.
Why can’t acquirers, networks and issuers solve authentication / fraud problems themselves?
The acquirers, networks and issuers are connected to each other through the authorization stream (authorize, capture and settle
transactions) after the order begins to be processed. In the POS world, the authentication happens at the cash register, the card is verified
and the consumer, if necessary, is authenticated prior to “swiping” the card. For remote transactions, there is not a way to validate the card
(i.e. card swipe), nor authenticate the consumer, prior to requesting an authorization, without Consumer Authentication.
Simply put, the vast and complex card processing system was designed to authorize, capture and settle payments for the face-to-face, or
POS, world. The merchant is responsible in the POS world to authenticate the consumer is who he says he is. The merchant needed to figure
out how to authenticate consumers for Card-Not-Present (CNP) commerce.
That is where Cardinal comes in. With CCA, this challenge is successfully addressed by arranging a private session with the consumer’s
funding source or IB, BEFORE there is a request to authorize the payment. There are literally billions of consumers, millions of merchants and
thousands of issuing banks, and the permutations and combinations of merchant/bank processors, software/hardware systems and
connectivity is almost beyond comprehension. Cardinal leverages 3DS, enables over 100 payment brands, harmonizing transactions through
this maze.
34