CyberCash

CyberCash has been servicing credit card transactions over the Internet since April 1995. It has strong ties to the current credit card processing infrastructure, through Bill Melton, a founder of Verifone, as one of its fathers. The use of their payment system has grown tremendously over a year. CyberCash claims that they process thousands of transactions a day, they can send payment transactions to 80% of the banks in America, and to have distributed over 400,000 copies of CyberCash Wallet software to buyers who use their system.

It is important to note that CyberCash is not a credit card processing company. Unlike First Virtual, they do not transfer funds into the merchant's account. CyberCash sells safe passage over the Internet for credit card transaction data. They take the data that is sent to them from the merchant, and pass it to the merchant's acquiring bank for processing. Except for dealing with the merchant through CyberCash's server, the acquiring bank processes the credit card transaction as they would process transactions received through a point of sale (POS) terminal in a retail store.

The CyberCash payment system is centered around the CyberCash Wallet software program, which buyers use when making a purchase. This program must be downloaded and installed on the buyer's machine before they can make a purchase. This program handles passing payment information, encrypted, between the buyer and the merchant.

Once a potential buyer has obtained the CyberCash Wallet and installed it, there are still a few steps to take before it can be used. First, a buyer needs to create a persona or wallet ID which is a string of characters which identify the wallet, and a password. These are then registered with CyberCash. Buyers are allowed to create more than one wallet ID, each with its own password. Secondly, they must bind at least one credit card to the wallet. Binding a credit card entails entering pertinent credit card processing information such as credit card number, expiration date, shipping address and phone number. This information is then registered with CyberCash. Buyers can bind multiple credit cards to the wallet. Once the wallet ID is established, and at least one card has been bound, the buyer is ready to start purchasing.

To be able to accept payment using the CyberCash system, merchants must do two things. First, the merchants must install the CyberCash Internet Payment Software (SMPS). This software allows the merchant to interface with both the CyberCash buyer, or Wallet software, and CyberCash's servers. Secondly, the merchant must establish a merchant account with an acquiring bank that supports Internet transactions using CyberCash's Secure Internet Payment System. CyberCash can only communicate with banks they have an agreement with. The requirements for accepting payments through CyberCash are provided in detail in CyberCash's How to become a CyberCash Merchant document.

Steps to a credit card purchase using CyberCash's payment system:

1. The buyer indicates that they want to purchase an item from the merchant's WWW site by clicking on the CyberCash pay button.
2. The merchant's SMPS software sends an invoice to the buyer's CyberCash Wallet software.
   • The CyberCash Wallet is registered as a helper application to the buyer's WWW browser. It is invoked by the browser whenever it downloads a file with the MIME content encoding of application/x-cybercash.
3. The buyer selects a credit card from the ones bound to their wallet and clicks OK.
4. The Buyer's CyberCash Wallet then digitally signs and encrypts the invoice and credit card information with the key assigned to that Wallet-ID. The encrypted packet is then sent to the Merchant's SMPS software.
5. The merchant software adds information to the payment packet requesting that either the credit card payment be authorized or authorized and captured.
   • Under normal credit card operating procedures, i.e.. a merchant using a POS terminal, the merchant only receives authorization when the sale actually happens, and then that night sends all the credit card payments to the acquiring bank to be captured.
   • CyberCash is working on allowing batch capture processing and may have it in place by the time you read this.
6. The merchant's SMPS software digitally signs and encrypts the payment packet with their CyberCash key. The packet is then sent to the CyberCash server.
   • The merchant never sees the customers credit card number.
   • The payment packet is encrypted twice before arriving at CyberCash's server, once by the buyer's software and once by the merchant's.
7. CyberCash's server moves the packet to a machine that resides behind their firewall and off the Internet. CyberCash then decrypts the message and checks to make sure that the merchant has not tampered with the original invoice agreed upon by the buyer.
8. The credit card information, with the merchant's request (authorize or authorize and capture), is encrypted using hardware that banks use for encrypting financial data. This information is sent over dedicated lines to the merchant's acquiring bank.
9. The merchant's acquiring bank then processes the merchant's request as it would any other credit card transaction. It forwards the request through the card associations network to the card issuing bank.
   • Discover and American Express cards are not associated with an issuing bank. Authorizations and captures are performed through the card company itself for these particular cards.
10. The card-issuing bank sends an approval or denial code back to the acquiring bank. The acquiring bank then sends this code to CyberCash.
11. CyberCash sends the merchant a message indicating success or failure of the credit card payment transaction. This message is of course sent encrypted.
    • CyberCash claims that the process up to this point should only take between 15 to 20 seconds. (I wonder how long it takes during the Christmas shopping season?)
12. The merchant's SMPS software then sends a message back to the buyer's CyberCash Wallet indicating success or failure of the payment transaction.

As with First Virtual, the CyberCash system has its own set of advantages and disadvantages.

Advantages:

• CyberCash uses strong encryption for transporting payment information.
  • They claim to be the only Internet payment company granted an export license to use RSA's 786 bit encryption algorithm.
• The Merchant does not see the buyer's credit card number.
• Merchants do not have a waiting period for receiving payment, as with First Virtual. The merchant's bank account is credited within in the normal time frame for credit card transactions.

Disadvantages:

• Potential buyers and merchants must both install extra software in order to use the system. This makes the system harder to use for people with little computer experience.
• Merchants need to have an account with an acquiring bank that accepts CyberCash Secure Internet Payments.

CyberCash is one of the pioneering companies in Internet payment systems. They currently have little competition in handling credit card transactions over the Internet. This will change. The release of the SET protocol (see below) will make it easier for other companies to provide Internet credit card payment systems. CyberCash is reacting to this by expanding their operations to include other types of Internet payment services including digital cash (e-cash) and micropayments.

CyberCash will support the SET protocol, once it is released. They have always stated that they would support open standards for credit card processing once they existed. In fact, CyberCash is one of the companies working on developing the SET Protocol. SET capabilities will be added to their current software, and they also plan on selling SET gateway services to acquirers [Eastlake].