Creating Online Security

The challenges faced by Lai are far from atypical. Building security into a system to ensure consumer trust is a critical issue for any online business.

"Merchants need to be aware of the kinds of security measures required for online transactions," says Andrew Pipolo, Australian managing director for PayPal, the subsidiary of eBay, which handles online payments for the internet auction giant.

"In fact, according to a 2006 Sweeney Research survey of Australian internet users, 67 percent of online shoppers felt that knowing their personal and financial information could not be compromised was important to feeling safe while shopping online, and 51 percent of Australians don’t want to use their credit cards online for security reasons."

"What confuses many people is the difference between a payment system and a shopping cart," says John Debrincat, CEO of e-commerce hosting provider eCorner. "You can have a shopping cart without having a payment system. A payment system means a method of accepting payment for goods and services online."

It is theoretically possible to provide product information online and then process transactions using existing in-store systems, accepting credit cards either by telephone or email. In practice, however, this is risky for several reasons. Most financial institutions will hold you as the merchant responsible in the event of any dispute, and the lack of speed in such transactions may drive potential customers to more electronically astute rivals.

Few businesses that move online have the time and expertise to fully maintain secure systems on their own, so using at least some external services is essential. While it can be difficult to accept that an additional company should be involved in your transaction, there are many benefits to this approach, not all of them obvious. "As a merchant, not holding customer financial information on file is a bonus: if your server is compromised, no customer financial details can be accessed," Pipolo says.

Ideally, an online payment system should be integrated into your existing business processes. Having to copy sales data from a separate online system into your main financial system is a waste of time that could be better spent on other aspects of business development, and it also greatly increases the possibility of errors being accidentally introduced into the system.

For the ultimate in flexibility, you can hire a specialised developer to build a system that matches your exact specifications. However, this may not be a good idea, unless you truly anticipate the vast majority of your business will be online and your transaction volumes will be exceptionally high.