(Page 2 of 2)

"It's a really needed thing for merchants," Mr. Clements said of the round table, "because the banks aren't reacting quickly enough to fraud." There's a lag, sometimes as much as 120 days, from when a fraudulent card is reported to when the issuing bank cuts it off, he said.

"In theory," he added, "merchants could put that information into a database so the others don't get hit in two hours."

Advertisement

Mr. Clements said he did not feel a competitive threat from the round table. "We all want the same thing — a safer online shopping experience," he said. "We welcome their effort."

Notably, when merchants sell goods to people who hold stolen credit cards, they are typically liable for the fraudulent charges — not the credit card issuer, and not the consumer. Mr. Redenbaugh is among those who say credit-card issuers are not working quickly enough to cut off stolen cards — a charge that issuers dispute — and he offered an example of how that hurts merchants. A pornography site based in Gibraltar was hacked, he said, and a large portion of credit cards were stolen from the site's files.

"We reported that to the predominant bank involved and asked them to stop it because we kept seeing these cards coming back," said Mr. Redenbaugh, who would not identify the bank. Based on its own procedures for screening fraud, Hewlett-Packard rejected those cards, "but the bank kept approving them for authorizations," he said. "It took them over a month and a half to cut off the cards. Those cards may have been used on dozens of merchants' sites who didn't figure this out."

The round-table organizers said that for any fraud database to be big enough, it would have to include information from a broad array of merchants. Because merchants would probably not entrust this effort to an ad hoc group or a single member company — and because no merchant would want the responsibility of overseeing such a system — organizers said they had begun to create a formal business entity to govern the round table.

That alone will take months, Mr. Redenbaugh said. Round-table representatives have had merger discussions with the Merchant Fraud Squad, an online fraud prevention organization of which Expedia was a founding member. "They've lost a lot of premium merchants over the years that are now part of our group, so hopefully we can reinject some energy into that organization, and also leverage its basic structure," Mr. Redenbaugh said.

If the formal group goes forward with the database effort early next year, Mr. Redenbaugh said, it will probably contract with an outside technology firm to handle that responsibility.

Such a step is critical, said Robert Leathern, an analyst with Jupiter Research, an Internet consulting firm. Mr. Leathern said the concept of creating a cross-industry fraud database "is a good idea, as long as they themselves are secure and the privacy of card holder information is correctly attended to."

"My concerns," he said, "are that if this type of system is hastily or not carefully enough constructed, it will simply add additional cost and another point of potential compromise of private information."

Mr. Leathern added that such an effort could help reduce some of the fears consumers have when buying online. According to a recent Jupiter report, such fears accounted for $8 billion this year in forgone e-commerce revenue.

While catching credit-card thieves is not the primary mission of the round table, Mr. Redenbaugh said the group had been working with federal law-enforcement agencies to determine how it can pass along information to help track down criminals. "Law-enforcement people are very busy people these days," he said, "so you have to have a case with significant value to get their attention."

The round table has scored some early successes on that front, Mr. Redenbaugh said. Earlier this year, five merchants helped alert the Secret Service to a fraud ring in Maryland that was stealing credit card numbers offline and shopping online. Members of the ring, who were arrested, apparently included employees of a package-delivery company, who diverted the goods from the addresses of the legitimate card holders to warehouses.

Mr. Redenbaugh would not identify the merchants or the delivery company, but he said the gang members received prison sentences of one to 10 years. Individual merchants would not have been able to show law enforcement agencies the scope of the problem, he said. By working as a group, "we helped put those people behind bars."