​Can ScramCard make payment security sexy? This ex-bank CSO thinks so

A brand name built on trust and a network of well-known partners will spearhead a push by payments-card innovator ScramCard to offer security-based competition early in 2016, and the company's Australian founder says it's ready to ramp up manufacturing if demand takes off as anticipated.

The brainchild of former Westpac Bank and ANZ Bank CSO Simon Hewitt, ScramCard is a programmable payment card that can be linked to a range of third-party payment accounts and features a 10-digit user interface and small screen on the back. Its use of one-time passwords is designed to improve payment security, particularly for online shopping, and its design has been intentionally bundled into a card that is both familiar and innovative for consumers.

Both factors will play a role in helping ScramCard win loyal customers, Hewitt told CSO Australia, with security piggybacking on the usability and style of the device.

"It has multiple modalities to solve various problems," he explained. "It does what it says in terms of mitigating the threat, but the more important thing is that it puts something into the hands of the consumer that they're prepared to use. As any security strategist knows, that's half the battle."

Early feedback has been strongly positive not only from partners – with whom Hewitt originally envisaged launching branded ScramCards as consumer products – but also from banks, which he said have also recognised the value of a more consumer-friendly, high-assurance card solution that would particularly be relevant in an era of surging mobile-transaction security issues.

Recent consumer surveys suggest that those issues have been impacting consumer security: a recent Kaspersky Labs survey found that just 23 percent of consumers feel safe using their mobile devices for Web browsing, with fears over security widespread and concerns about mobile malware continuing to grow as Android in particular is exposed as a target for malware.

"We avoid the mobile as a strategy," Hewitt said. "From a platform perspective, anything that's networked or connected really isn't going to be secure. There will be potential issues with respect to malware. The intent around the card was to embed the technology with something that can never be connected."

Businesses face a risk from poor consumer mobile-security habits, with one recent survey finding that 58 percent of mobiles were not secured with software to force users to use strong passwords. Crossover between business and personal apps had created new concerns as online-shopping apps potentially Hoover up personal information that may potentially be business confidential.

As well as giving users something with a bit of technological cachet, Hewitt said the ScramCard will address security issues and support better information for analytics-based loyalty programs. And, if it takes off as he hopes it does, Hewitt says the company is ready to keep up with surging demand, with manufacturing capacity of around 20 million cards per year by the time it launches in early 2016. That kind of volume would, he said, help the company keep prices down and make the card cost-competitive for issuers compared with conventional contactless cards.

"We're looking to solve this problem in a product that the consumer would desire," Hewitt said. "A lot of other solutions are based on absolute convenience, and in so doing they increase the risk profile. We are specifically coming at it from the point of view of security."

Security ALERT!

Need help making the right choice for you business? Need to update your system but don't know where to start? CSO can help, check out our security hub today.

Gigamon Transform Security Zone

Join the CSO newsletter!

Error: Please check your email address.

Tags ScramCardanz banksecurityCSOSimon HewittCSO AustraliaWestpac Bank

More about CSOGigamonHooverKasperskymobilesWestpacWestpac Bank

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by David Braue

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place