Equifax Touts a ‘Secret Question’ Test for Online Authentication

With concern mounting about the adequacy of commonly used authentication technologies in online transactions, a technique devised by a major credit-reporting agency to secure the sale of consumer credit reports online is finding adoption among financial institutions and could appeal to Internet merchants. Equifax Information Services LLC is actively licensing its e-IDVerifier technology, marketing the software to an undisclosed number of banks, telecommunications companies, utilities, and online retailers. Equifax says its sales of credit reports online will reach $100 million this year, up from $70 million in 2003, with 4 million consumers buying their reports on the company's Web site at least once during the year. The channel is proving increasingly popular. Equifax, which charges $13 apiece for reports, says the number of consumers buying from the site is growing at the rate of 250,000 a month. The company began selling credit reports online about three years ago. Since it deals in intensely personal data that could be used by criminals to commit identity theft, it realized it needed strong authentication. “We had to create a process where we could tell you are absolutely positively who you say you are,” says Steve Ely, senior vice president of marketing at the Atlanta-based company. The system it came up with presents customers with a list of up to six so-called secret questions derived from the person's credit report. The technique offers three possible answers to each question and might ask customers to select the number nearest their monthly mortgage payment, or to select the city they have not lived in. How many questions the system generates depends on how close the first few answers are. “If you're close but not close enough, we can ask more questions,” says Ely. The system randomly generates the questions, so they would not necessarily recur on subsequent visits. They also occur in a seemingly random sequence, but Equifax says research it has done has helped it determine how to order them. Ely says the system on average rejects 30% of site visitors trying to buy a report. Those rejected are then prompted to call a customer service representative to complete the transaction. The company knows of no instance in which a report was sold to an unauthorized person since the system was put in place, Ely adds. The authentication system now contributes to an $80 million business Equfax has developed selling security and authentication solutions to other businesses. It won't say how many clients have licensed e-ID Verifier, but Ely says interest, in the form of signed contracts, is running particularly high among financial institutions looking for alternative authentication technologies for online banking. Clients using the technology devise their own secret questions based on what they know about customers. Its application in retailing might be limited, Ely admits, since customers might lose patience for a series of multiple-choice questions, leading to abandoned shopping carts. He sees potential, though, among sellers of high-end merchandise. “If someone's selling a $10,000 flat-screen TV, they'll ask two or three questions,” he says. “Just one more question could take out 50% of the fraud.”