It may look like a calculator, but it isn’t. It’s Visa’s CodeSure, a fraud-fighting technology that generates one-time passcodes for mutual authentication of online transactions. The back of CodeSure cards incorporate an alpha-numeric display, a microprocessor, a 12-button keypad and battery good for three years.
Here’s how it works:
- When shopping online or logging in to an online banking service, the cardholder activates the authentication process by pressing the “Verified by Visa” option button on the card’s keypad.
- When prompted, the consumer inputs their PIN into the keypad embedded in the card.
- A unique one-time-passcode appears on the card’s display, which is then used by the cardholder to authenticate a normal Verified by Visa transaction.
You can get a general sense for how it works in this short overview video:
CodeSure cards can also be used to authenticate online banking sessions.
- When a cardholder accesses their online bank, they would be provided a dynamic numeric challenge code (a number) from the bank.
- The challenge code would be entered into the Visa CodeSure card by the cardholder, to confirm it is a request from their bank
- Only when the challenge code has been entered and correctly verified and approved is the cardholder then prompted to enter their PIN into the card
- This subsequently creates a unique one-time passcode for access to the online banking with both parties being mutually reassured.
The same steps would apply if conducting a transaction over the phone using Visa CodeSure. The following 1-minute video illustrates how CodeSure can be used for authentication in a customer service call:
CodeSure technology can be incorporated into any Visa debit, credit, prepaid or commercial card.
Visa initially started developing its CodeSure technology in 2009. Visa, along with partner Emue Technologies, conducted extensive pilot trials with eight European banks and their cardholders. Following pilot programs in the UK, Italy, Israel, Turkey, Switzerland and Germany, Visa now says CodeSure is “fully available for commercial launch,” but it appears that launch will initially be limited to Europe. Presently, it isn’t clear when- or if CodeSure cards will be coming to North America.
Visa has approved use of CodeSure cards for the following purposes:
- PIN generated one-time-passcode for Verified by Visa payments at participating merchants globally – without changes to merchant software or cardholders having to register and remember passwords
- PIN-generated one-time passcode for online banking access
- PIN-generated one-time passcode for telephone banking services
- Transaction signing for online banking services, using specific elements such as Account Reference Number or amount of transaction
Access to third-party services such as frequent flyer programs or corporate virtual private networks (VPN) for commercial card users.
Sandra Alzetta, Head of Innovation at Visa Europe, suggested that CodeSure cards could have other, more broad uses. For instance, companies might use them as portable password generators. “The solution goes beyond just online and remote shopping but also allows organizations to use the card in place of other online log-in systems to access, for example, corporate virtual private networks (VPN),” Alzetta said.
“The Visa CodeSure card offers banks a solution to fulfill all of their multi-channel banking requirements,” the company said in a press release. “The use of PIN-generated, one-time passcodes and mutual authentication technology, will provide banks with an attractive solution that enables security and convenience in the same device – a Visa payment card.”
BofA rolled out a similar service dubbed SafePass in 2008.
Thanks to CashCow.in, the #1 financial marketing blog in India, for the lead.