Resolution on the communication from the Commission to the European Parliament, the Council, the European Central Bank and the Economic and Social Committee: A framework for action on combating fraud and counterfeiting of non-cash means of payment (COM(98)0395 - C4-0455/98)

The European Parliament,

- having regard to the Commission communication (COM(98)0395 - C4-0455/98),

- having regard to its opinion of 15 May 1998 on a draft Joint Action adopted by the Council on the basis of Article K.3 of the Treaty on European Union concerning arrangements for the better exchange of information in respect of payment card crime between Member States' law enforcement agencies, and between those agencies and the payment card industry, where such information is required for the investigation of offences (5683/98 - C4-0136/98 - 98/0906(CNS) ((OJ C 167, 1.6.1998, p. 304)),

- having regard to the report by the Committee on Civil Liberties and Internal Affairs (A4-0396/98),

A. affirming that, as the representative of the interests of the European public, it considers itself as a concerned party and consequently views itself as also having been called on by the Commission to deliver its opinion on Annex 2 to the Commission communication,

B. whereas insider opinions in an industry are understandably coloured by the interests of those expressing them,

1. Notes that the industry does not automatically or on its own initiative adopt the best preventive measures for combating fraud and counterfeiting of non-cash means of payment;

2. Points out that in the absence of voluntary self regulation or legislative framework regulation, competition will lead to the most cost-effective and not the most secure variant of non-cash means of payment;

3. Calls on the Commission to ensure, by way of voluntary self regulation by the industry, of legislation or of other means, that in the European internal market:

a) as regards credit cards

- checks on applicants' identities and financial standing will be made,

- a secure procedure will be used for issuing cards,

- for certain merchandise, there will be reductions in the amount in excess of which the trader must seek authorisation for the transaction from the credit card organisation,

- magnetic strips with electronic watermarks or a chip and the affixing of the authorised user's photograph to the card will be introduced as standard security arrangements,

- security features will be made uniform on all cards, and staff at acceptance points will be trained in checking those features,

- cards used to withdraw cash from automatic cash dispensers will be subject to the same anti-counterfeiting features as EC cards,

- either the use of biometric characteristics together with a PIN code or of a chip together with a PIN code instead of a signature will be made compulsory as soon as possible,

b) as regards the use of credit cards on the Internet

- data will always be encrypted on transmission,

- the transaction will always be mediated by a third party responsible for checking credit card data and dealers' certificates (e.g. Secure Electronic Transaction - SET),

c) as a regards bank cash dispensers

- the security feature on the EC card will always be checked,

- the dispenser keyboard will be protected against visual intrusion and electronic eavesdropping,

- biometric identification of the card holder will be introduced as soon as possible,

d) as regards on-line banking

- banks will be required to advise customers on security measures (never to store TANs on the PC, regular password changes, restrictions on the amounts of transactions, no software 'improvements' to be downloaded from the Internet, browser security settings to be configured for Internet banking, etc.),

- on-line banking software will be certified for security,

- identity security in Internet banking will be secured by way of certificates and asymmetric encryption,

- encryption will be applied as soon as possible by way of hardware in the form of an enciphering card or an enciphering chip between keyboard and computer or by way of a chip card,

e) before the use of digital money becomes widespread

- a comprehensive safety test funded by the EU will be carried out,

f) as regards software

- strict separation between operating systems and applications functions will be introduced, and the integration of applications programs into operating systems will be prohibited,

- the development and placing on the market of a universally applicable, platform-independent operating system available in source text and tailored to the requirements of security will be promoted by the EU;

4. Instructs its President to forward this resolution to the Commission, the Council and the European Central Bank.