Behind-the-Scenes with Visa's Security

Oct. 26, 2005
Tight-lipped company offers unique look into security of financial information

Visa is one of the world's most famous brand names, but the company behind the credit cards operates in semi-secrecy from headquarters in Foster City.

In a cluster of unmarked and unremarkable buildings on a street the company asked me not to disclose, Visa has 3,500 employees, making Visa International and its Visa U.S.A. subsidiary one of the Bay Area's larger employers.

While usually inaccessible to the prying eyes of journalists and others, Visa, to show off its new technologies and demonstrate its vigilance against the growing scourge of identity theft, held a rare technology briefing for reporters Monday. I jumped at the chance to attend, even though I had to show my driver's license to get into the company's parking lot.

Visa is not only a major Bay Area employer but also one of the area's most technologically sophisticated companies, running a massive data network that processes up to 5,000 transactions a second in the United States during the peak holiday season. Four flat-panel computer screens outside the company cafeteria display overall activity levels on the vast Visa network.

Three massive data centers -- at undisclosed locations on the West Coast, the East Coast and the central states -- monitor every Visa transaction for possible fraud, delivering a thumbs up or a thumbs down in just 1.4 seconds.

Visa keeps a low profile in part because it's owned by the banks that issue its cards, and Visa doesn't want to alienate them by putting itself in the spotlight.

There's also a big concern with security. Visa now processes 14 percent of all consumer spending in the United States, or nearly $1 trillion per year, making it a significant potential target for criminals and terrorists.

Visa's reach is staggering. There are now 480 million active Visa cards in the United States, equal to 1.6 cards for every man, woman and child in the nation, and a total of 1.3 billion cards active worldwide. The company moves more dollars in the nation than all its competitors combined -- including MasterCard, American Express and Discover.

Despite the many identity theft horror stories surfacing these days, Visa is staying ahead of fraudsters. Total worldwide fraud losses on Visa accounts dropped from a peak of 14 cents for every $100 spent in 1993 to 5 cents today. Fraud in online transactions, about one-fourth of the fraud total, is growing somewhat -- although not as fast as the overall volume of online transactions.

The newest tool in Visa's anti-fraud arsenal is called Advanced Authorization. The system, which began full operation in June, is a computer network that instantly analyzes a database crammed with 150,000 gigabytes of Visa transaction records going back three years.

A pending transaction is evaluated for the possibility of fraud by looking at historical patterns, responding within 1.4 seconds. Some decisions are obvious, such as when you live in San Jose and a criminal gang in Eastern Europe tries to order a $5,000 plasma television for delivery to Romania.

Others are more subtle.

Nancy Hilgers, vice president of risk for Visa U.S.A., said Advanced Authorization goes beyond individual transactions to monitor what's happening across accounts. A single fraudulent transaction for $7 might slip through, Hilgers explains, but the system will flag the kind of sophisticated attack where fraudsters attempt 100,000 transactions for $7 within a few minutes of each other.

Visa declines to give much detail about Advanced Authorization, or about the type and quantity of hardware and software in its data centers. For its newest data center, in the central states, Visa will only give a few statistics: The facility has enough fuel to run on diesel generators for seven days, for example, and contains 66 miles of fiber-optic wiring.

The company stresses its ``zero liability'' policy that protects card holders from having to pay for any fraudulent charges. Of course, that doesn't help with the burden of filing police reports, contacting credit bureaus and the many other steps required when your identity is stolen.

To make credit cards less of a target, Visa is helping card issuers set up more programs to prevent fraud before it happens, such as allowing card holders to get a password that must be used for online transactions -- preventing fraudsters from using an account even if they have the person's card number and home address.

``Consumers today appear to want to have a more active role in the risk management of their accounts,'' Hilgers said.

Hilgers has the comfort of knowing first-hand that Visa's anti-fraud system is working. Her Visa credit-card information was stolen in August -- Hilgers doesn't know how -- and was used to order a $237 airline ticket. Because the fraudsters wanted the ticket sent to an address other than Hilgers' home, the transaction was blocked.

Hilgers got a new credit card; the fraudsters got nothing.

San Jose Mercury News

Knight Ridder content Copyright 2005 provided via The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.