Behind-the-Scenes with Visa's Security

Tight-lipped company offers unique look into security of financial information

Visa is one of the world's most famous brand names, but the company behind the credit cards operates in semi-secrecy from headquarters in Foster City.

In a cluster of unmarked and unremarkable buildings on a street the company asked me not to disclose, Visa has 3,500 employees, making Visa International and its Visa U.S.A. subsidiary one of the Bay Area's larger employers.

While usually inaccessible to the prying eyes of journalists and others, Visa, to show off its new technologies and demonstrate its vigilance against the growing scourge of identity theft, held a rare technology briefing for reporters Monday. I jumped at the chance to attend, even though I had to show my driver's license to get into the company's parking lot.

Visa is not only a major Bay Area employer but also one of the area's most technologically sophisticated companies, running a massive data network that processes up to 5,000 transactions a second in the United States during the peak holiday season. Four flat-panel computer screens outside the company cafeteria display overall activity levels on the vast Visa network.

Three massive data centers -- at undisclosed locations on the West Coast, the East Coast and the central states -- monitor every Visa transaction for possible fraud, delivering a thumbs up or a thumbs down in just 1.4 seconds.

Visa keeps a low profile in part because it's owned by the banks that issue its cards, and Visa doesn't want to alienate them by putting itself in the spotlight.

There's also a big concern with security. Visa now processes 14 percent of all consumer spending in the United States, or nearly $1 trillion per year, making it a significant potential target for criminals and terrorists.

Visa's reach is staggering. There are now 480 million active Visa cards in the United States, equal to 1.6 cards for every man, woman and child in the nation, and a total of 1.3 billion cards active worldwide. The company moves more dollars in the nation than all its competitors combined -- including MasterCard, American Express and Discover.

Despite the many identity theft horror stories surfacing these days, Visa is staying ahead of fraudsters. Total worldwide fraud losses on Visa accounts dropped from a peak of 14 cents for every $100 spent in 1993 to 5 cents today. Fraud in online transactions, about one-fourth of the fraud total, is growing somewhat -- although not as fast as the overall volume of online transactions.

The newest tool in Visa's anti-fraud arsenal is called Advanced Authorization. The system, which began full operation in June, is a computer network that instantly analyzes a database crammed with 150,000 gigabytes of Visa transaction records going back three years.

A pending transaction is evaluated for the possibility of fraud by looking at historical patterns, responding within 1.4 seconds. Some decisions are obvious, such as when you live in San Jose and a criminal gang in Eastern Europe tries to order a $5,000 plasma television for delivery to Romania.

Others are more subtle.

Nancy Hilgers, vice president of risk for Visa U.S.A., said Advanced Authorization goes beyond individual transactions to monitor what's happening across accounts. A single fraudulent transaction for $7 might slip through, Hilgers explains, but the system will flag the kind of sophisticated attack where fraudsters attempt 100,000 transactions for $7 within a few minutes of each other.

Visa declines to give much detail about Advanced Authorization, or about the type and quantity of hardware and software in its data centers. For its newest data center, in the central states, Visa will only give a few statistics: The facility has enough fuel to run on diesel generators for seven days, for example, and contains 66 miles of fiber-optic wiring.

The company stresses its ``zero liability'' policy that protects card holders from having to pay for any fraudulent charges. Of course, that doesn't help with the burden of filing police reports, contacting credit bureaus and the many other steps required when your identity is stolen.

This content continues onto the next page...