Hmm... very interesting, but rather complex. There is a better way, which doesn't inconvenience the customer, leaves no credit card details in retailers' databases, and is relatively user-friendly. Picture the scene: Each user is given a keyword, which he alone knows. The credit card company has an authentication system which generates a random string of 1's and 0's, which are presented to the user, aligned with an alphabet. The user selects a pattern of 1's and 0's corresponding to his keyword, which is sent to the credit card company, from the POS terminal/ATM, whatever. The next transaction has a different random sequence of digits. The credit card company responds with an accept/decline message, If the transaction is intercepted, or the database is stolen, the thieves get a lot of useless data. If the credit card is stolen, they get a useless piece of plastic, since the keyword is only in the user's head. The technical details of such a system are better described in www.designsim.com.au/What_is_SteelPlatez.ppsx with specific reference to ATM's, but the same principles apply equally to POS terminals, or card-not-present purchases.