The 3 numbers printed on the back of a credit or Debit card, are designed to verify that the person that knows these numbers is the cardholder. This provides a useful indicator to whether or not the customer has had sight of the card. If CV2 fails then it is reasonable to reject a transaction, however if CV2 passes, payment is not guaranteed.

A password that is exchanged, by the cardholder with their card-issuing bank, at the time of the transaction. The transactions may then be authorised by the retailer with the potential for the liability to shift to the bank.

3D-secure relies upon the integrity of the password being maintained, and a threat to this is the number of times that users need to use passwords when trading on the Internet:

• Username and password to log onto computer

• Username and password to log onto ISP for Internet access

• Username and password for internet banking

• Username and password to log onto many e-commerce sites (without one you cannot trade)

• Card number and 3D-Secure password to do business at the bank's risk this will make the banks nervous, despite the technology working well at face value.

• Many users have one or two passwords which are used for everything hence increasing the chance of compromise

Conclusions: VbV works well particularly when combined with CV2 and AVS. The liability shift has caught the headlines and rightly so, except the rules are complicated.

3D-Secure requires a high level of adoption by cardholders to be successful. The trouble being that those customers that do not register for whatever reason may be treated as potential fraudsters. That may be acceptable from a bank's perspective but it certainly is not from a retailer's. Use 3D-Secure but be prepared to authorise the transaction using merchant risk ECI indicator.

Any retailer trading in CNP channels must take responsibility and implement systems designed to help them manage their risk by understanding exactly who they are dealing with. A first step is to stop considering it a payment issue and start regarding it as: Shoplifting with home delivery!

Last year UK retailers spent an estimated £100 million pounds delivering stolen goods to fraudsters!

Similar to 3D Secure but requiring a gismo (looks like a small calculator) which can use a chip and PIN card to generate a one-time- use passcode.

This works, provided that all online shoppers have a gismo no exceptions. The trouble is that some people will not have a gismo with them. Some overseas customers will not know what this is, and some customers may find yet another security device rather difficult or offputting. What is certain is that fraudsters will not use them, unless of course they have obtained a stolen card with compromised PIN. This is really good technically, but practically it cannot work. What about proof of delivery? It doesn't work well if goods are not received.

Dynamic passcode authentication needs fraud screening to detect the frauds that it cannot. Screening used with either 3D Secure or dynamic passcode authentication is the correct approach to use.

Retailers are in the best possible position to implement a suite of processes, most of which need not be visible to any customer, which will provide a very high level of protection against attempted cutomer / card not present CNP fraud.