ie8 fix
Security Watch : Don't get burned by viruses and hackers
Cheap gas (but there's also a catch)
By Robert Vamosi 
Senior editor, CNET Reviews
June 8, 2007

Would you drive an extra mile just to save 10 cents? With gas prices in Northern California reaching almost $4 a gallon, I might. But in looking beyond the price, in reading what's actually being asked of me, I might reconsider. And, coming on the heels of this week's Carnegie Mellon University report citing that, on average, most online users can expect to pay more to avoid disclosing personal information to the e-commerce site, I might be downright skeptical of the savings. And so should you.

Data collection
Since they were first issued in 1933, U.S. state driver's licenses have varied from state to state, with some states including more information on their licenses and others including less. Not even all states have magnetic stripes on the back of their cards. In the 1990s, an organization of state motor vehicle associations, AAMVA, introduced what it hoped would be national standards regarding what data should be included on all state-issued licenses. Its recommendations included what should be contained on machine-readable driver's licenses (and later 1D and 2D barcodes which hold even more data). Its intent was to allow portable machines to allow officers in the field to swipe a driver's license and glean all the relevant data quickly, as opposed to copying the information by hand.

So why not use your driver's license to buy gas? Personally, I could think of a number of reasons.
With the standardization of the magnetic strip data appearing on driver's licenses adopted in at least 26 states, National Payment Card, a company in Florida, is test-marketing a new system for paying for gasoline at stations in Texas. The idea behind their innovative new program is that you always have your driver's license with you, and not all gas stations accept all credit cards, or those that do often charge higher prices. So why not use your driver's license to buy gas? Personally, I could think of a number of reasons.

How it works
During an online sign up, you link your driver's license with your bank account on the National Payment Card site. To be fair, you can also use a variety of other cards, such as the discount card from your favorite loyalty store. The system doesn't rewrite or add any information to the existing card, it just uses that card plus a personal identification number (PIN). Then, at participating locations, you simply swipe your card to purchase gas, often receiving a sizable discount for doing so.

On the surface, it's pretty secure. Unlike credit cards, the National Payment Card cards are protected by that personal identification number.
How are the stations using National Payment Card able to discount the price? Unlike credit cards, which charge the stations a handling fee of as much as six percent to process each purchase, the National Payment Card uses electronic funds transfer debits or ACH (the Federal Reserve's automated clearing house) and debits your bank account directly. Using ACH allows National Payment Card to charge stations a nominal fee versus the higher fees charged by the individual credit card companies. That's also why cash prices are lower.

But is it safe?
Sound risky to link your bank account to a third-party card? On the surface, it's pretty secure. Unlike credit cards--which can be stolen or copied--the National Payment Card cards are protected by that personal identification number. That's one more layer of security than using a credit card. But this isn't a bank-issued debit card. The real question is, what happens on the back end?

Say you sign up with your driver's license. Now when you scan it at the pump, the machine records all sixteen data fields on the back of your card--that's including your legal name, home address, date of birth, height, weight, gender, and eye color. You might think, "Fine, Choicepoint already has that data on file somewhere," and that's probably true. But what happens next might give you pause: The company using your driver's license as a debit system now can also track your purchases, your whereabouts at any given time, even your preferences. When mated with your personal ID, that's a powerful database that any marketer would kill to get access to. Even if you use your CostCo card, there are now two systems that can track all your purchases and build a semicomplete profile of your lifestyle.

Cheap gas? No, thanks.

Where have you been asked to scan your driver's licenses lately? Did you? Why or why not? TalkBack to me.

Security Bites Podcast
CNET.com's Robert Vamosi tells you about the latest security threats, what's coming, and how to protect your system. Listen now


CNET's free newsletters
Rob Vamosi's
award-winning
column on Internet threats and how to counter them 
Delivered Mondays