Online mall security: Earthlink develops system for safer Internet credit transactions.

E-commerce, the sale of goods and services online, is expected to pass the $20 billion mark next year as more merchants adapt to the relatively new technology and consumers overcome fears of being defrauded.

Those fears - that hackers will hijack credit-card numbers out of cyberspace - have been well-publicized. But an equally thorny problem, and one that has gotten less attention, is finding ways to make it simpler for merchants to do business over the Internet.

"Right now, someone places an online order and it takes us about 15 minutes to process it, from approving credit cards to filling out invoices," said Warwick Stone, senior creative director at Los Angeles-based Hard Rock Hotel and Casino, which sells merchandise and offers hotel bookings online.

"So far, online purchases are automated on the screen for the buyer, but for us there's still a lot of legwork," Stone said.

Enter Pasadena-based Earthlink Network Inc. The company introduced a pilot e-commerce program this month that promises to give companies the means to verify credit-card purchases more quickly and easily than they can using current technology.

The Earthlink program has two main attractions - it provides instant online verification of credit and a state-of-the-art encryption program to ease the fears of wary buyers.

Hard Rock Hotel is one of the four companies chosen by Earthlink to participate in the pilot program. The others are Shell Lubricants (a division of Shell Oil Co.), Surfer Magazine and Goldmine Software Corp., representing a cross-sampling of products and business models.

"We've already had a strong response from companies trying to get into the pilot program," said Bill Greene, director of corporate sales at Earthlink. "We hope to open it to a few thousand merchants in 1998 and grow from there."

Earthlink's program is elbowing its way into an increasingly crowded field. Countless software companies have launched or are scrambling to launch e-commerce packages that offer a variety of features.

Among them is "Intershop Online," the San Francisco's Intershop Co.'s software package that will be one of Earthlink's more direct competitors similarly claims to be a comprehensive e-commerce solution. Its selling point is advanced database organization of online sales.

Breakthrough Software Inc. recently began selling its "Internet Business Breakthrough," which in addition to standard e-commerce features such as a security system, emphasizes the user's ability to create an online store with the click of a button using its design templates. And one of the older software packages still pushing along is the "Trading Process Network," which GE Information Services and Thomas Publishing began developing for business-to-business commerce back in the Web's frontier days in 1995.

Earthlink officials, however, say their service is different from their competitors because of its automatic verification of credit-card purchases through partner American Express Co.

For merchants participating in the program, American Express will check credit instantly when an order is placed.

With current systems, merchants have to check the credit-card numbers themselves through whatever verification system they use. The Earthlink system does not allow a purchase on an invalid card ever to reach the merchant. Instead, the order is bounced back to the buyer instantly, forcing the buyer to solve the problem with his or her credit-card company rather than the merchant.

And with the software provided by partner Mercantec Inc., the invoicing process for merchants is fully automated.

Partner Hewlett-Packard Co. developed a "virtual vault" to encrypt online goods and bill information throughout the entire transaction process. The "vault" is secure enough to qualify for a military-level security designation.

In addition to the encryption, which makes it virtually impossible for a third party to intercept and unscramble information, Earthlink uses a variety of protocols to verify the identities of both the merchant and consumer.

"This is the most secure thing we found to date for online retail, which we just started flirting with at the beginning of the year," said Stone.

Currently, a more comprehensive protocol for secure online purchases is moving ahead quickly. The Secure Electronic Transaction, or SET, is already in use in several pilot programs across the nation, with Alaska Airlines, Bank of America, First Union Corp. and Interpath Marketing, a subsidiary of Capital Broadcasting Corp. participating.

SET is designed to protect online purchases with digital certificates, authentication processes and encrypted information.

"SET is moving along well and will be available to merchants by next summer," said Greg Jones, the director of corporate communications at Visa USA, which is helping develop the protocol.

Earthlink's Greene said his company's pilot program will switch over and become SET-compliant in the second quarter of 1998.

No matter how secure new technology can make e-commerce, human fallibility can decrease the effectiveness of any program.

"SET and similar protocols move the goalpost for standards of online security by pretty much eliminating the risks," said John Pettitt, chief technology officer of CyberSource, a San Jose-based online security firm. "However, you're assuming that the user is smart enough not to give their digital certificate number or authentication information to someone else."

Even with existing reservations about security, online sales continue to grow rapidly. They hit $10.4 billion in 1997, according to Cambridge, Mass.-based Forrester Research Inc., more than doubling the $4 billion spent online in 1996.