Of all the mechanisms to defeat fraudulent use of credit cards on the internet that were mentioned in this article (The new fraud squad), I am puzzled that one particular mechanism we use does not  seem to have caught on generally.

To sign on to some of our systems the user needs not only a password - subject to all the usual checks including use restricted to only one or a range of IP addresses - but also  the good old PIN code. So what's unusual about that? Well, the PIN code is dynamic and changes every time. The user is advised of the PIN code via an SMS  message to a mobile. OK, a fraudster could use an unidentifiable mobile phone, but  registered phones and land lines can be checked as registered against the user, and it's one more safeguard. So, why isn't it used more?

Reg Smith.