Securing the PC

When an identity thief fleeces a financial firm or retailer with stolen credit-card numbers, there8217;s no stopping the fraudster from returning to the website armed with yet another stolen identity.

When an identity thief fleeces a financial firm or retailer with stolen credit-card numbers, there8217;s no stopping the fraudster from returning to the website armed with yet another stolen identity. Now companies are trying to make it that much harder by tagging the thief8217;s PC with 8220;device reputation8221; software.

The software runs on a company8217;s website, capturing the serial number and other hardware 8220;fingerprints8221; of any PC that logs on8212;when a user clicks on a page, purchases a product or places a bet. If the transaction turns out to be fraudulent, the PC8217;s fingerprint is added to a database of computers with bad reputations. Subscribers to the service, offered by Oregon-based iovation, are alerted every time a dubious PC shows up to do business. So far 30 companies in 11 countries in America and Europe have joined iovation8217;s 8220;Reputation Manager8221; network. Once a firm is ripped off, the whole group is protected. 8220;They have to suffer some pain to identify a problem,8221; says iovation CEO Jon Karl, 8220;but they only have to get hit once.8221;

The database sorts PCs into 20 categories, which range from the use of profanity in online forums to outright fraud. It8217;s up to subscribers to decide whether to accept the PCs or not, or to 8220;challenge8221; users with questions to better ascertain their identity. 8220;We8217;ve seen a huge decrease in credit-card fraud,8221; says the antifraud manager for Poker.com, an online gambling company based in Brisbane, Australia. The cost of the service varies with query volume; heavy users pay less than a penny per reputation check. By contrast, US businesses alone will lose 3 billion to online fraud this year, estimates Boston-based consultants Celent.

A big limitation to the database is that rather than stop fraudsters it just increases the cost of doing business. Serious crooks can circumvent the software by moving from one Internet cafe to another. Still, companies are likely to seek out anything that gives them an edge in shoring up their security. Privacy is another question mark. How will consumers react to their PC8217;s signatures being recorded? Most of iovation8217;s clients won8217;t admit that they use the service for fear of arousing the ire of surfers. If it works, on the other hand, the added security may become a selling point. For fraudsters, that8217;s bad news indeed.

8212;Benjamin Sutherland / Newsweek