Creating Online Security

Adding a payment system to your website can be complicated, but ensuring that customers trust that their money is safely transmitted is just as important as the technical considerations. Angus Kidman looks at how to achieve the twin goals of functionality and trustworthiness online.

Jace Lai has more than 30 years’ experience in managing payment systems, but when it came to ensuring the security of his own online business one of the first decisions he made was to use a specialised external provider to ensure security and help build consumer trust.

Two years ago, with the assistance of a business development grant from Microsoft, Lai launched Mobbiexpress, a service that allows small businesses such as taxis and tradespeople to handle EFTPOS-style payments using a smart mobile phone, PDA, or similar device.

"Basically, I had the mobile EFTPOS facility business idea three years back," he says. "I was looking at EFTPOS terminals and thought they were a bit clumsy and not all that flexible in delivering services to the end user."

To demonstrate the validity of the concept, Lai launched Cabbiexpress, which provides on-the-spot processing services for taxis, chauffeured cars, and other motoring services. That required two separate groups to trust his system: the customers making their payments through the devices, and the drivers themselves, who needed each individual payment to be authorised and also wanted to be able to access online records of their payment histories.

"A lot of mobile tradesmen can't afford to do complex invoicing," Lai said. "The bank doesn't always provide a simple output. Because we also capture the cash income, we can do that."

While that might be a useful service, building trust was equally important. "When you're talking about trust, system availability is the most important element—the belief that you're able to transact," Lai says. "Customers are after 100 percent. When the bank goes down, we still transact. When the gateways go down, we still transact.

"The driver must trust that we can pay them. Because we settle with them on a weekly basis, they must feel comfortable that we won’t go bankrupt and run away with the hard-earned money they have made. This kind of trust is only built over time.

"The other trust is with the customer. The customer must make sure the information they send over the system is secure and will not be stolen and will not be misused. Every driver is issued with their own login so we are able to track their behaviour. We must be able to trace the transaction end-to-end. This tracking is provided to the driver online. If they see it in the report, they know they are sure to get the money."

Having a well-established security provider is also important for minimising time spent on managing IT basics and for ensuring service continuity. "I spoke to a few people to find a provider, and Virtual.Offis came up tops," Lai says. "That's where we park our sensitive information. I just want to pass it on and let them worry about the security part, so I can concentrate on business development. At least I don't have to do stupid things that way."

The challenges faced by Lai are far from atypical. Building security into a system to ensure consumer trust is a critical issue for any online business.