MADISON, Wis. – As of April 1 2003 credit unions desiring CUNA Mutual credit card fraud insurance will have to participate in the VISA or MasterCard online fraud protection programs, according to a CUNA Mutual executive. Al Stendahl, a vice president with CUNA Mutual, said that credit unions wishing to renew their fraud insurance coverage with the insurer would have to sign up with Verified by Visa or MasterCard's Secure Code program. Credit unions who fail to participate at the time of their insurance renewal will have to purchase an interim insurance option for the coverage, the insurer said. Under the programs, participating online merchants ask cardholders to type in a pre-selected security code before completing a transaction. As of April 1, credit unions who don't participate in the programs, or whose cardholders don't participate, will be liable for any charged-back transactions from the merchant. Currently, merchants are generally liable for losses due to fraud. "We are definitely putting these protections into policy," Stendahl said, pointing out that the programs served to protect even credit union card holders who do not shop online from fraud which might be perpetrated online using their stolen cards or numbers. He also wanted to make it clear that current insurance bonds would be honored, but that institutions wishing to renew would have to participate in the programs. According to VISA, roughly 6,000 VISA-issuing institutions have signed up for Verified by Visa so far. The company said roughly 40% of those, or about 2,400 credit unions have agreed to participate. The program covers both credit cards and debit cards which carry the VISA logo. PSCU Financial Services, whose members process their credit card transactions through First Data, reported that 17% of its credit union members that issue VISA cards had signed up in December, and that an additional 7% had indicated that they would do so by February. CSCU said that it had no data for how many of its members, which process their card transactions through Certegy, had decided to sign on. No data is available either for MasterCard's Secure Code program, which uses almost exactly the same software strategy as Verified by Visa but which is not expected to roll out and start collecting participating institutions until March 2003. Because of the delay, MasterCard has not yet set a date after which card issuers that don't participate in the program, and not the merchants, will be liable for any fraud losses. The shift of liability for losses has been the engine driving CUNA Mutual's decision to aggressively pursue credit union participation in the programs and Stendahl reported the insurer has been urging credit unions to go ahead and enroll all their cardholders in the program, not just those that indicate they shop online. The insurer paid out approximately $23 million in plastic card claims in 2002, noting that this number represents all plastic card losses, not just those related to the Internet. A very small amount of the plastic card claims resulted from online fraud, the insurer admitted, but Stendahl said CUNA Mutual was urging mass enrollment in the programs nonetheless. "People often fail to realize that these programs protect more than just the frequent online shopper," Stendahl argued. "They also protect cardholders from misuse of their cards and numbers coming from outside or even inside their homes." What's It Cost? More credit unions might be more eager to sign up for the programs if there were more firm ideas of what participation in the programs cost, Stendahl admitted. The primary cost for implementing the programs have fallen on the processors and none of the processors have been willing to publicly admit what they are charging credit unions to sign up with the programs then protect their members. Both Certegy and PSCU have said that there is an initial fee to participate in the program. But then there is also likely to be a per transaction fee for the actual verification that will be based on use, as well as a fee to maintain the account information on a secure server, according to Katy Slater, PSCU's director of credit services. Since relatively few cardholders are using their cards to make Internet purchases, this per-use charge is likely to be far less, Slater noted. Slater reported that PSCU has decided to implement what is called an "auto-enrollment" strategy and has not been urging credit unions to mass enroll their members. After April 1, credit union cardholders whose institutions participate in the program and have adopted the auto-enrollment strategy will receive a pop-up window on their computer screens when they try to buy something from a merchant participating in Verified by Visa. If the cardholder has already enrolled in the program, the window will ask for their personal identification number to authenticate the transaction. If the cardholder has not enrolled, they will be prompted to do so. If they fail to enroll, Slater said, the transaction would not be completed. This approach should provide protection to both cardholders who do a lot of shopping and to those who don't, Slater pointed out, and served to keep the cost of starting up the program lower for credit unions. Acceptance? All the initial indications from VISA have been that cardholders like the program and that it will help facilitate even more online commerce. However, it is unclear how much acceptance the program will find among some of the larger retailers. So far, big name retailers like Nordstrom and WalMart.com have signed on, according to VISA, but not Ebay or Amazon.com. Ebay is expected to sign up soon, according to VISA. There may be technical issues with some retailers like Amazon, which use so-called "one click" purchase programs for their regular customers. The one-click procedures may not be easily modified to allow the verification step, Slater noted. -

[email protected]