Jack Mccarthy profiles PayPal CTO Max Levchin.

PayPal, as an online payment system, is a natural target for fraud. And Levchin has almost singlehandedly saved the company from thieves bent on exploiting the system, says Avivah Litan, a vice president and analyst covering financial services at Stamford, Conn.-based Gartner. "If they didn't have Max, they might have succumbed, because PayPal was susceptible to fraud and money laundering, and Max tightened them up," Litan says.

The Smart Card Alliance is holding its annual conference from October 7-10 in Scottsdale.

Yochi J. Dreazen reports in the Wall Street Journal that Citibank "used an outside company to gather e-mail addresses of its credit-card customers and then sent e-mails offering recipients access to sensitive financial data without verifying each address actually belonged to the customer."

Microsoft has announced that it is removing the wallet functionality it had originally delivered with Passport -- and replacing it with a new wallet tied to MSN. Microsoft announced that OfficeMax Inc., RitzCamera.com, Blue Nile Inc. and Nordstrom Inc are participating in accepting consumer payment information at checkout from the new MSN Wallet.

For security, all MSN Wallet payment and address information is electronically encrypted and stored in a database on servers that are located in access-controlled facilities. Many other safeguards further enhance security, including comprehensive data filtering before it enters the system and an industry-standard encryption method (triple DES) that is designed to help prevent anyone but the intended retailer from decoding and reading transmitted information. Microsoft also announced that it plans to discontinue a separate shopping service, called Passport Express Purchase, to focus Passport on its core mission: to enable a robust, online authentication platform.

Separately, Joe Wilcox reports on CNET that Microsoft has begun notifying Passport users of changes that would give them more control over their accounts and increased privacy and security.

The first change only affects new account holders, who will no longer be able use a bogus e-mail address to establish a Passport. Microsoft requires consumers to use an e-mail address as their Passport ID, but had not mandated that the address be legitimate or belong to the account holder. ... The second change could bolster Passport security. Microsoft is moving all the information viewed in a Web browser, such as the login page or member services, to servers hosted in a domain separate from the authentication components. That information would come from passport.net rather than passport.com. The two-domain mechanism also will eliminate the long, hard-to-decipher URL the user sees in the browser's Web address bar.