BY SIMSON L. GARFINKEL
Special to the Mercury News
TO GET a VirtualPIN, a consumer sends electronic mail or connects to First Virtual's Web server.
A user fills out an application, giving First Virtual his or her name, an electronic mailbox, and an identification ID -- either a word or a phrase.
First Virtual's computers then process the form and send back an e-mail message containing the user's VirtualPIN, which is the ID preceded by a four-letter word, a 12-digit application number, and an 800-number.
The user then calls the 800 number with a touch-tone phone and punches in the 12-digit number and a credit card number and expiration date. Within minutes, the consumer gets another e-mail message saying the VirtualPIN has been activated.
When the consumer wishes to buy something with the VirtualPIN, he or she sends the PIN to the merchant. The merchant then sends a message to First Virtual, asking if the PIN is valid. At this point, First Virtual sends an electronic mail message asking the consumer to authorize the transaction. The consumer responds to the electronic mail message with a single word: ''Yes,'' ''No,'' or ''Fraud.''
If ''Yes,'' First Virtual sends e-mail to the merchant, authorizing the transaction. If ''No,'' First Virtual tells the merchant the transaction has been declined. If ''Fraud,'' First Virtual marks the transaction for investigation.