Chip Authentication Program: Difference between revisions

Revision as of 01:55, 5 February 2009

Revision as of 02:43, 10 February 2009

Line 1:

[[Imageimage:nationwide-CAP-readerBarclays pinsentry.jpg|thumb|right|250px|A Barclays PINsentry CAP readerDevice]]

The '''Chip Authentication Program''' (CAP) is a [[MasterCard]] initiative and technical specification for using [[EMV]] banking [[smartcards]] for [[authentication|authenticating]] users and transactions in online and telephone banking. It was also adopted by [[Visa (company)|Visa]] as '''Dynamic Passcode Authentication''' (DPA)<ref>[http://www.visaeurope.com/aboutvisa/products/dynamicpasscode.jsp Dynamic passcode authentication], VISA Europe</ref>. The CAP specification defines a handheld device ("CAP reader") with a smartcard slot, a decimal keypad, and a display capable of displaying at least 12 characters (e.g. a [[starburst display]]). Banking customers who have been issued a CAP reader by their bank can insert their [[Chip and PIN]] ([[EMV]]) card into the CAP reader in order to participate in one of several supported [[authentication protocol]]s. CAP is a form of [[two-factor authentication]] as both a smartcard and a valid PIN must be present for a transaction to succeed. Banks hope that the system will reduce the risk of unsuspecting customers entering their details into fraudulent websites after reading ‘[[phishing]]’ emails.<ref>http://www.theregister.co.uk/2007/04/18/pinsentry/</ref>

Line 26:

* [[Nordea]] began using CAP in November 2007.<ref>[http://www.nordea.se/Privat/Internet%2boch%2btelefon/Internet/Ny%2bs%C3%A4kerhetsl%C3%B6sning/983832.html New security solution | nordea.se], in Swedish.</ref>

===United Kingdom===

[[Image:pinsentrynationwide-CAP-reader.jpg|right|thumb|The BarclaysA PINsentryNationwide CAP deviceDevice]]

*[[APACS]] defined a CAP subset for use by UK banks.

*[[Barclays Bank]] began issuing CAP readers (which they call "PINsentry") in 2007 to customers who make an online payment to a new recipient.<ref>{{cite web|url=http://www.barclays.co.uk/pinsentry/ | title=Barclays PINsentry}}</ref><ref>[http://www.theregister.co.uk/2006/08/09/barclays_launches_cardreaders/ Barclays to launch two-factor authentication], The Register, 2006-08-09.</ref> Their online-banking website uses the "identify" mode for login verification and the "sign" mode for transaction verification. The "respond" mode is not currently used. The PINsentry device is powered by four [[LR44]] [[button cell]] batteries, which the manual claims will last from five to seven years. A version for vision-impaired users (with voice output) is available on request.