Category: contactless

The Card Was and Is Only a Credential Carrier

Cash is here to stay – cards are the true dinosaurs

This question of the extinction of the payment card is misleading. 

What is a payment card?  It is the carrier of a set of credentials, A means of Identification offering financial Attributes capable of being authenticated by a party seeking to sell something to the individual or entity presenting the credential as a mechanism to assure payment.

Back when credit cards were designed, the goal was to offer merchants a guarantee of payment and anonymous consumers a means of paying.  Behind this means of payment, a financial institution, the issuer, provides the consumer with a “Line of Credit”.

On the merchant side, another financial institution buys these guaranteed receivables from the merchant and charges the merchant a “merchant discount”.  Later that day the Issuing Institution advances payment to the Acquiring Institution based on an agreed set of terms and operating rules. Terms and conditions the involved financial institutions collectively agreed upon.

For this method of payment to be effective, a large number of consumers and merchants had to agree to participate; hence the financial institutions came together and formed what we now know as MasterCard and Visa.

Given the state of technology at the time it was essential this new mechanism work without the burden and expense associated with the merchant, supported by the acquirer, contacting the issuer to receive approval, or, in stronger terms be assured of a guarantee of payment.  To achieve this result, the merchant needed something to acquire the necessary information to submit a request for payment.  For both the merchants and financial institutions,, there had to be a means of authentication. Designed to assure the responsible parties of the authenticity of the person or entity to present their payment credentials.

To accomplish this goal, just like with money, physical security features are integrated into the payment card designed to allow the merchant to authenticate the uniqueness of the card carrying the payment credential, thus assuring the merchant of the authenticity of the card.

Overtime criminals successfully counterfeited these security features.

As these features were compromised additional features had to be added.

Today, a computer has been embedded inside the card, in order to assure the authenticity of the payment card credentials being presented to the merchant.

These computers embedded onto the front of a payment card exploit the power of cryptography.  Cryptographic certificates and digital signatures are created by and for these computers, allowing:

    • The Issuer (symmetric cryptography) to support Online Authentication
    • The merchant (asymmetric cryptography) to support Offline Data Authentication

These two mechanisms prove to the merchant and issuer that the card is unique and the data, credentials, and digital signature it contains or produces are authentic.

Once all the merchants have are capable of reading the data from the chip card, the security features of the card become redundant. 

As these features become redundant and the merchants embrace Near Field Communications, based on the ISO 14443 standard, the issuer can replace the card form factor with anything equipped with the necessary computational capabilities and ability to communicate with the terminal over the NFC interface.

This is exactly what Apple Pay and Google Pay have done.  They replaced the card with a device.  Yes, the Payment Card may become redundant.  But, the Payment Credentials they contain, remain.

What we know as card payments, is fundamentally an account-based solution. Money, through the defined settlement process, ultimately move from the line of credit or deposit account of the buyer, through a series of accounts with the participating financial institutions, to the account of the merchant.

Card-based credential payments
simply become
Device-based credential payments

 

What You possess, What You Are, What You Claim … Your Certificates

NCCOE NIST Multi-Factor Authentication

What you Possess — The Thing

What you Are — You

Your Relationships

Responsibilities

Authority

Advice

— Secrets

My Certificates

 

 

 

 

 

 

 

 

Seven Words

World Wide Web Consortium

FIDO Alliance

Global Platform

The Trusted Computing Group

Future interests

  • Artificial Intelligence
  • Machine Learning
  • Nature Language Interface
  • Predictive Analytics

Smart Cards with Fingerprint Scanners

Over the last couple of years the reality of fingerprint cards is a hot topic in conversation, white papers and press articles.  It led me to think about the challenges and opportunities associated with this intriguing convergence of technologies.

My purpose is not to determine which solution is best or which companies are developing and selling them.  My goal is simply to explore.

The first consideration begins when the card is constructed.  Here we must ask the mechanical question relative to how the electronics are integrated into the strata of an ID-1 card.  This then begs the question of making sure this new card conforms to the specifications dictated by Payment, Networks, Governments or other bodies who define the use of these branded cards.  If we continue to think about the card manufacturing process we need to think about electronics and the use of heat in the typical lamination process or the inclusion of metallic materials used to create a particular look.  One needs to think about the method of connecting the various internal components to the other electronic elements  as the fingerprint scanner, antenna(s)m LEDs, batteries, the EMV chip or contact plate on the face of the card.

The second set of concerns must be related to the personalization of the card.  First question is where will it be personalized? in a branch or within a bureau?  How will it be personalized? With a thermal printer, laser engraver or embossing machine?  Will any of the  personalization processes adversely affect the electronic?. Similarly it will be appropriate to confirm whether any of the various card transport mechanisms will disrupt or damage the sensor and related electronics.

At some point in the processes the consumer must register their fingerprint and the resulting template must be instantiated into the card.  How will this be done?  Some speak of an in branch process.  Others talk about some type of first time cardholder activation process performed when they receive the card in the mail.

Clearly there are a lot more questions the issuer, card manufacturer and personalization provider need to address.  Let alone the method of making sure the cardholder knows how to use the card at the point of sale or ATM

The key question is the cost of the card, is it worth it?

Dual Interface Construction

When we think about the migration to contactless or Dual Interface cards it is important to have a general understanding of what goes into creating the card and the constraints one has to think about, as they work with their marketing teams to design these cards.

The design of a payment card involves assembling multiple of PVC into a sandwich that will be bonded and then punched out to form the card body.

  • On the face of the card: a clear laminate to protect the surface
  • On the back a clear laminate with the magnetic stripe affixed to it

In the middle two printed sheets

  • The front
  • The back

In the middle of the card body, your manufacturer will need to insert an antenna.   The antenna is typically provided to the card manufacturer as an inlay, as seen on the left.  The inlay is a sheet of plastic with the copper antenna, sometimes aluminum embedded within.  The card manufacture will add this inlay into the middle of sandwich.

On the right is an example of a six layer card construction including one element as an example, a metal foil.  This has been included given it has an impact on the effectiveness of the radio signal.  More about this a little later.  Using pressure and heat, the layers of the sandwich are bonded together in a process called lamination.  The bonded sandwich is then run through a series of additional processes designed to create an ID-1 card as specified in the ISO 7810 specifications supplemented by the additional payment network requires, such as the signature panel and the hologram.

After quality inspection the next step is to mill and embedded chip into the card body and simultaneously assure a connection between the contacts on the back of the chip and the antenna.  There are various means of connecting the chip to the antenna.  These different methodologies for connecting the chip to the antenna is a specific skill and is the responsibility of your card manufacturer.  Look to your manufacturers to propose, construct and certify your card to your requirements and employing their unique processes, techniques and technologies.

One thing you will need to be aware of is how the use of the antenna affects the certification process.  It is important to understand that the combination of ink, materials and methods of construct means; each construction will need to go through a unique certification.  This need for certification is a result of the use of radio frequency to communicate between the card and the terminal.  Think of your cell phone when your inside a big building or within an elevator and how the conversation maybe disrupted.  It is this possibility of the radio signal to be disruption based on the materials employed and the method of construction.

When metal elements like metallic foils and layers are used in card construction, the challenge increases.  Eddy currents are emitted by the metal and will interfere with the level of power and quality of communications emanated by the antenna and radio in the POS  received by the antenna and the computer in the card.

So far we have spoken only of the hardware.  The chip in the card is a computer and needs an operating environment, application and data in-order to function.  The introduction of the contactless interface alters the operating environment, the payment applications and the data which is loaded into the card.  All of this impacts the card manufacturing and card personalization process.

 

Will the US truly embrace dual interface cards or is our phone the future

When the US decided to migrate to EMV, it took the safe course

When it was time to migrate to EMV here in the USA, both issuers and acquirers focused on addressing the market and the required technology, one step at a time.  They recognized the confusion created by the Durbin Amendment, the reality of the competitive US debit market, the complexity of the merchant environment and the legacy infrastructure underneath the American card payment system.  Unfortunately unlike in other parts of the world the American merchants tended to migration to  EMV in the following order credit & debit, Common AID, contactless (MSD mode), Mobile Pays and finally contactless (EMV mode).  This journey is still a long way from complete with less than 25% of the terminal base contactless enabled, let alone in EMV contactless mode.

The larger and most invested merchants also worried about the impact of sharing data with the likes of Amazon, Google and Apple.  The “honor all card” rule is also the “honor all wallet” requirement.  Wal-Mart, Target and Home Depot were clear, they did not intend to expose the NFC antenna to the various NFC Mobile Wallets.  Instead they are implementing solutions, post MCX, based on their mobile apps using QR codes and often times enabled to support frictionless payment.

We are now looking at the second wave of card issuance and Issuers are wondering what merchants will finally do about enabling contactless.    As the Issuers prepare to issue their cardholders with their second EMV enabled card they must also think about the future of the card in the context of the future of mobile payments.

Are the payment credentials carried in the mobile wallet the companion of the card
or
Is the card the companion (fallback) for the payment credential carried in mobile wallet / device

Or
Are we on a journey to a new paradigm
Where facial recognition, loyalty, geolocation
Enabled by the always connected devices

We surround ourselves with
Help merchants to focus on
the shopping experience
And
Turn the Payment into

A frictionless “thank you”

 

The case for Identification and Authentication

As we continue to explore the case for Identification and Authentication I share the below article.

What is becoming clear is standards are being embraced.

In the Payment space

Will it be W3C WebAuthN, 3DC and Webpayments or EMVCo SRC & Tokenization?

My guess depends on if standards bodies can play well together. EMV (contact or contactless) will remain the many stay for physical world commerce, until the App takes over the Omni Channel shopping experience. then the merchant will properly authenticate their loyal customer and use card on file scenarios for payments. The question of interchange rates for CNP will see a new rate for “Cardholder Present&Authenticated/ Card Not Present.”. In time when a reader is present I can see an out of band “tap to pay” scenario emerging using WebPayments and WebAuthN.

In the identity space

I contend the government and enterprise market will go for a pure identification solution with the biometric matched, in the cloud, in a large central database. In order to maintain a unique and secure cloud identity, they might probably make use of various opportunities that come their way (you can hover over at this website to learn more).

However, does that mean it includes what you know username, email address or phone number? Maybe! If it is simply the captured image or behavior, then it is a 1 to many match. If it is with an identifier, it is classic authentication with a one-to-one match.

In the pure authentication space where the relying party simply wants to know it is the person they registered. Then, the classic FIDO solutions work perfectly and will be embedded into most of our devices. Additionally, the use of a visitor sign in sheet synced with the security database could expedite the sign-ins of visitors. It could also see its applications with employee log authentication and verification. Or, as we’ve seen with some enterprises, the relying party will embrace U2F with be a FIDO Key, like what Yubico and Google recommend.

The classic process needs to be thought about in respect to what can be monetized.

  • Enrollment = I would like to become a client or member
  • Proofing = Ok you are who and what you claim, we have checked with many to confirm your Identity – This is where federation comes in.
  • Registration – Verification = Ok, now we confirm it is you registering your device(s)
  • Authorization & Authentication = Transaction with multiple FIDO enabled relying parties using your duly registered authentication.

How Microsoft 365 Security integrates with the broader security ecosystem-part 1

by toddvanderark on July 17, 2018

Today’s post was coauthored by Debraj Ghosh, Senior Product Marketing Manager, and Diana Kelley, Cybersecurity Field CTO.

This week is the annual Microsoft Inspire conference, where Microsoft directly engages with industry partners. Last year at Inspire, we announced Microsoft 365, providing a solution that enables our partners to help customers drive digital transformation. One of the most important capabilities of Microsoft 365 is securing the modern workplace from the constantly evolving cyberthreat landscape. Microsoft 365 includes information protection, threat protection, identity and access management, and security managementproviding in-depth and holistic security.

Across our Azure, Office 365, and Windows platforms, Microsoft offers a rich set of security tools for the modern workplace. However, the growth and diversity of technological platforms means customers will leverage solutions extending beyond the Microsoft ecosystem of services. While Microsoft 365 Security offers complete coverage for all Microsoft solutions, our customers have asked:

  1. What is Microsofts strategy for integrating into the broader security community?
  2. What services does Microsoft offer to help protect assets extending beyond the Microsoft ecosystem?
  3. Are there real-world examples of Microsoft providing enterprise security for workloads outside of the Microsoft ecosystem and is the integration seamless?

In this series of blogs, well address these topics, beginning with Microsofts strategy for integrating into the broader security ecosystem. Our integration strategy begins with partnerships spanning globally with industry peers, industry alliances, law enforcement, and governments.

Industry peers

Cyberattacks on businesses and governments continue to escalate and our customers must respond more quickly and aggressively to help ensure safety of their data. For many organizations, this means deploying multiple security solutions, which are more effective through seamless information sharing and working jointly as a cohesive solution. To this end, we established the Microsoft Intelligent Security Association. Members of the association work with Microsoft to help ensure solutions have access to more security signals from more sourcesand enhanced from shared threat intelligencehelping customers detect and respond to threats faster.

Figure 1 shows current members of the Microsoft Intelligent Security Association whose solutions complement Microsoft 365 Securitystrengthening the services offered to customers:

Figure 1. Microsoft Intelligent Security Association member organizations.

Industry alliances

Industry alliances are critical for developing guidelines, best practices, and creating a standardization of security requirements. For example, the Fast Identity Online (FIDO) Alliance, helps ensure organizations can provide protection on-premises and in web properties for secure authentication and mobile user credentials. Microsoft is a FIDO board member. Securing identities is a critical part of todays security. FIDO intends to help ensure all who use day-to-day web or on-premises services are provided a standard and exceptional experience for securing their identity.

Microsoft exemplifies a great sign-in experience with Windows Hello, leveraging facial recognition, PIN codes, and fingerprint technologies to power secure authentication for every service and application. FIDO believes the experience is more important than the technology, and Windows Hello is a great experience for everyone as it maintains a secure user sign-in. FIDO is just one example of how Microsoft is taking a leadership position in the security community.

Figure 2 shows FIDOs board member organizations:

Figure 2. FIDO Alliance Board member organizations.

Law enforcement and governments

To help support law enforcement and governments, Microsoft has developed the Digital Crimes Unit (DCU), focused on:

  • Tech support fraud
  • Online Chile exploitation
  • Cloud crime and malware
  • Global strategic enforcement
  • Nation-state actors

The DCU is an international team of attorneys, investigators, data scientists, engineers, analysts, and business professionals working together to transform the fight against cybercrime. Part of the DCU is the Cyber Defense Operations Center, where Microsoft monitors the global threat landscape, staying vigilant to the latest threats.

Figure 3 shows the DCU operations Center:

Figure 3. Microsoft Cyber Defense Operations Center.

Digging deeper

In part 2 of our series, well showcase Microsoft services that enable customers to protect assets and workloads extending beyond the Microsoft ecosystem. Meanwhile, learn more about the depth and breadth of Microsoft 365 Security and start trials of our advanced solutions, which include:

Of NFC, Mobile and History

Today I read Karen Augustine’s  Mobile Payments Use in the U.S. Lags

As I read and reflected on what Karen wrote, I reflected on my experiences as a sagged payment consultant and executive, with international experience.

What I see is an issue of legacy and muscle memory – setting a pattern for the future.  Said another way – our history defines the boundaries of our future.

Asia did not have electronic payments.  I am sure did not want to embrace the globally dominate American solution.  Therefore, they had the opportunity to start fresh.  It is very much like what Spain went through, went they moved from cash to electronic card-based payments.  They bypassed the check.

Her article brings back memories of life in Belgium in the 90’s.  Writing a check was a rare occurrence.  Direct debit mandates, a MisterCash card and a Eurocard was all we needed to buy and enjoy life.  Electronic payments was the norm, paper checks were a rare oddity and cash, well yes there was a very present grey economy.

Here in the USA we developed our payment systems off the back of regional or state banks with acceptance networks limited to a local domain.  Moving to a national system required early adoption of a common national currency.  We then went on to replace IOUs with paper checks and store cards with credit cards.  In time we enhances the ACH system and developed support for remote deposit and check capture.

Why do we need to move the card into the wallet?  Why change habits that are comfortable and work?  Most of us drive to shop and therefore must have our drivers license.  We must carry a physical document with us.  We simply carry two or more ID-1 sized cards.

You make the statement and was once again reminded of times past.

“… universal mobile wallets and more often driven from merchant based applications that often incorporate loyalty and rewards, which to date still remain nascent in universal mobile wallets.”

When I produced this rendering, back in 1996, I was on stage talking about a world where leather and technology converged.  I imaged Bluetooth, NFC, secure elements, GPS and our various credentials converging into this personal device.  Those credentials grouped into: travel, identity, membership, loyalty and payments; easy to find and present.

When contactless payments were  introduced, in 2004, by Visa’s with PayWave and MasterCard’s PayPass; I argued why contactless cards – how can the issuer afford the extra dollar per card (cost of the antenna and inlay) and the merchant the extra 60 dollars to enable the NFC reader?  The way Issuer income works, “Interchange”, the consumer would need to spend more on that issuer’s card.  For the merchant to justify the necessary POS investment, meant the retailer believed the consumers would spend more, because it was “easier”.  Was Tap To Pay going to make me spend more.  Maybe for small ticket purchases, I may use cash less; but at the merchants expense!  We argued the cost of cash was more than the Merchant Discount.  Some agreed.  Many wondered what the blank are they trying to sell us!

Around the same time America was exploring this contactless experience, the European Payment Council and GSMA debated and ultimately offered an approach for mobile card based contactless payments https://www.europeanpaymentscouncil.eu/sites/default/files/KB/files/EPC220-08-EPC-GSMA-TSM-WP-V1.pdf .  Handset manufactures like Nokia had already added NFC Antenna’s to their mobile phones and mobile network operators, the MNO, saw the SIM as the secure element capable of holding payment credentials.

Some tried, the Trusted Service Manager as a service was developed and deployed.  The challenge, the economics of the model.  In this case the MNO saw revenue and wanted to charge fees to load the payment credential into the phone and better yet charge rent to store these payment cards in our phones.  Again I ask the question, by changing the way we pay, do I cause us to want to spend more? I think not!

Maybe some would argue, with  a credit card people am able to buy things today that they cannot afford.  Let them end up in debt.  This is true.  But then is debt  at 18% a good thing?  Europeans simply decided to establish a line of credit, as a feature of a Current Account, at reasonable interest rates.

We could go on and talk about how Apple saw the possibility of a 0.15% income stream from ApplePay based mobile payments and how the EMVCo tokenization framework evolved to support their desire to protect the Apple Brand.

What is clear, we could solve George’s problem and replace his Full Grain Vegetable Tanned Cow Leather leather wallet with a Mobile Wallet managed by Apple, Google, Samsung or …

Or, we could think about the consumer and what they really want?

As your article made clear, and so many others have shared, Asia leaped forward.  Be it AliPay or WeChat, the device, the mobile phone, became the consumers wallet, their method of engaging, shopping, learning and exploring.

We need to accept to simply replace what we are comfortable with, with something new; which does not enhance our experience, is simply not worth it!

Many of us, like Karen, would argue the experience of shopping is what the mobile phone can enhance and let the act of payment become the afterthought.  A simple click to say – yes, I agree to pay.

Amazon got it right with One Click.  Others, as the patent expires, are embracing the same technique to simplify payment to a friction-less act of satisfaction.  When my favorite stores offer me an mobile app designed to enhance my shopping experience, to thrill me with offers and entice me with things I want; then yes I will become more loyal, I will shop at their store more frequently and maybe even buy a few things I did not intend to buy.

Many years ago while attending conference of groceries  in Abu Dhabi – one of the speakers share an experience.  when that supermarket executive instructed each store to put the beer across from the diapers, the intended result occurred.  The husband, sent to get the diapers, ended up buying  a six pack too.

Maybe, like this experience reveals, if we focus on the consumer experience and on delighting them.  They will embrace change.

If there is no value why should we?

Years ago I prepared and published an idea.  I called it Cando.  I was still committed to the idea of the mobile wallet.  I was an early adopter of the smart phone and saw its potential.

 

Cando

A Shift from Check-out to Check-in will reshape the way merchants engage with their consumers

Think Uber, think order ahead, think account on file. With these ideas in your mind think engagement and Omni channel. Then consider the need of merchants to assure revenue by delighting and engaging with their customers in meaningful ways. Their focus, increasing basket size, more frequent visits and loyalty; in other words increased sales.

Then remember, Check-out is about friction, payments and long lines. These characteristics merchants seek to eliminate, reduce the cost of and enhance the experience around.

If we think Check-in, using big-data, geo-location, BLE, facial recognition, consumer centric apps and other techniques, we can image a world where human and device based personal assistants engage with the merchants loyal customers in a friendly, informed and satisfying way.

For payment people this means we need to remember that merchants want lower cost payments and friction-less check-out.

Bottom line, for loyal customers solutions that retain the payment credentials securely in the cloud. For one time and infrequent customers, they will look to incent loyalty and registration or simply accept classic means of payments e.g. cards.

This drive to move from recording a loyal customers visit to engaging when the customer arrives or better yet when they are doing their research is what we the consumer seek.

We are all about saving time, enjoying life and satisfying our needs and wants. Merchants that focus on the customer and their shopping experience will succeed and prosper./ Those that do not focus on delighting their customer will learn.

Deciphering Digital – Your Phone is Your Wallet

Today Wednesday October 18, 2017. I had the opportunity to provide the closing keynote to the EPCOR Annual Payments conference.  Today, I was reminded of the reality that payments is not only about cards it is the engine that fuels the revenue of a financial institution.  ACH, Wires, Cards, checks, transfers and even cash are revenue earning services; our community banks call payments.

My speach was about the future and focused on the evolution of our phone in this new digital age we all must learn to embrace.

IoT 2017 Payments Tuesday Afternoon

Continuing the learning and commentary

IoT Payments 2017 – Austin TX October 10th and 11th

Context-based payments

  • Security has always been an after thought as devices were deployed and solutions were developed. Security needs to be built in as a fundamental layer in these emerging IoT objects.
  • Growth in fraud in online payments is typically a result of the deployment of EMV.
  • As we think about Dash buttons and the myriad of other interfaces that can access a card on file style shopping and payment experience we must think anew about security.
  • What is context? Our digital footprint as we go through our daily lives.
  • The growing number of IoT devices can help to establish context, which can then be used as a fourth factor in an authentication scheme.
  • It is all about acquiring data and building a profile, your context.
  • What is the unique identifier that links all the objects to the individual.

Bridging the Security Gap

  • Brightsight a lab focused on security looking at both physical a logical security at both the operating system and application layer.
  • The IoT landscape is a world of objects where to goal is sell fast. No security has been built in and the attack surface is broad and wise.
  • The fear of who is able to access the vast array of data available through these connected devices.
  • Security is about managing risk. Risk evolves over time. Therefore security must evolve to stay ahead of the current level of risk – continuous improvement.
  • In the world of IoT who will define the security requirements and who shall pay becomes the key question.
  • We should consider using Common Criteria as a baseline for the security of IoT devices.
  • Bottom line – the implementation of security is all about the developer and the use of already certifies components e.g. Integrated Circuit and the Operating System.

The key to top of wallet

  • Changing our top of wallet card is not something we are driven to do.
  • So many sites drive to Card on File
  • The objects will end up with an embedded payment within
  • There is a hierarchy of needs

  • BASIC WANTS & NEEDS

  • MASS & PERMITTED RECOMMENDATION

  • SOCIAL & RELEVANT 1REFERRALS

  • ON-BEHALF

    As he speaks of On-behalf a document produced back in 1996 must be found

  • Will the IoT evolution increase consumption, Maybe?

Wearables 101

  • What is the connectivity
  • Where are the credentials stored
  • Is it a configurable device relative to which credentials
  • Types

  • Contactless cards and devices
    The mobile ecosystem introduces the token requestor

    A solid overview of the world of tokenization

  • The tap experience with a wearable is an interesting design experience.
  • A wearable is smaller and much more personal.
  • As seen from the payment networks
  • Like a card
  • Mobile device (secure element)
  • HCE
  • Wearable are in market today
  • Wearable are in market today

Risk Based Payment Security

  • Beth took a walk through the history of payment acceptance
  • The Internet of Things creates the tsunami effect on our world of risk. Both scary and empowering.
  • Risk is or was always about the balance between security and convenience.
  • Tokenization moves the authentication responsibility from the Issuer to the payment brand. In this case who has the responsibility in the event of. Has the threat of penetration moved to the payment brand.
  • The move to mobile devices as a result of the inherent transaction security to the registration and ID&V process.
  • Interoperability and security standards who controls? IoT is not a market. It is a collections of vertical and closed environments.
  • We need to agree on a common set of security values not necessarily on a common standard.
  • When we think about the wider question of the how and what of security. We need to think about the security of the device and the cloud. We need to remember it is also about the ability to spoof and acquirer the credentials of a user.
  • Security must be designed in from the beginning.

The day came to a close.

Philip Andreae & Associates is Open for Business

With decades of experience in public speaking, management, payments, information technology, cybersecurity, business development and marketing; Philip Andreae is available to help you and your team develop and implement your products and business strategies.

Is recent EMV announcement the catalyst the U.S. needs to catch up?

August 22, 2011

Is recent EMV announcement the catalyst the U.S. needs to catch up?

During this past year, the team at Portals and Rails has published several articles exploring the growing risks in card-based payments and the need to move to a more sophisticated and secure enabling technology. But overhauling a payment system is no easy task, as there are many players that need to collaborate, from the card networks to the bank issuers and merchants. How does the industry organize itself to orchestrate a much-needed transition?

http://portalsandrails.frbatlanta.org/2011/08/lessons-from-mario-brothers-finding-keys-to-fighting-fraud.html

Interesting question for the industry as we go through this transformation to a fully connected world where everything happens between our mobile phone and the merchant, friend, family, phone or cash.

 

 

ISIS the new Mobile Commerce JV … What next

This goes back to november 2010 when the announced ISIS (renamed SoftCard now dead and buried)

Over the last week many of us have read and attempted to understand what are the goals and objectives of Isis and its owners AT&T, Verizon and T-Mobile.

Visa reacted, pundits speak of ISIS becoming a new payment brand/system and Google, Ericson, Apple and RIM all are embracing NFC and speaking to inclusion in the mobile phone.

To include all these links would take more space than appropriate. A simple Google search with key words like ISIS Mobile Commerce etc. will quickly get you to more than you could digest.

In the Isis press release they speak of creating the Mobile Wallet and talk about offering their services to merchants, Banks and carriers. Yet in what capacity? Clearly the relationship between the citizen and merchant today belong to the merchant, carriers and banks. So one wonders if ISIS will interact directly or if the Banks, merchants and Carriers will be the channel to market for the underlining services ISIS offers.
Of significance is Bill Gajda’s, Visa’s head of mobile products, statements which does not identify Isis as a threat or a competitor. He speaks to collaboration. It will be interesting to see what MasterCard will say.
As I thought about what ISIS wants to be, I was drawn to reread a paper produced by GSMA and ECP Global Switch Mobile Association and European Council for Payments. That paper is titled.
Trusted Service Manager Service Management Requirements and Specifications

Doc: EPC 220-08, Version 1.0 January 2010

What occurred to me is that Isis could set itself up as a “Trusted Service Manager” TSM, taking on a trust function supporting Issuers and Mobile Network Operators MNO and why not the merchant; who all all talk about the capabilities of the mobile phone and will want to dematerialize their cards and install their certificates, data and applets within the context of a mobile wallet. ISIS can then derive their revenue from fees assocaited with “Trust” and assuring the identity of the owner of the phone,.

I do not see ISIS becoming a new means of payment. I see them becoming an enabler that helps build the business case to drive the necessary investments merchants and carriers must make to assure the consumer that they can move all their cards into their mobile phone. Mobile Commerce is the key words that leads me to think about coupons, loyalty, rewards, push marketing …

As we all know contactless and NFC are not getting the traction one might have expected. Mobile loyalty, Mobile commerce, services branded as a means of enhancing the customer experience those I do imagine will excite merchants and consuemrs to demand NFC capabiliites. Imagine walking into a store and getting coupons and discounts as you tap and add to your shopping cart. Clearly merchants appreciate that they can drive consumers to buy more it they can excite them.

So what is ISIS truly going to do, compete, collaborate or enable?

The path for the USA to EMV

http://www.finextra.com/community/fullblog.aspx?blogid=5875

EMV: Let the planning begin

Original 30 Sep, 2011 16:23 updated 02/22

 

There’s no way around it – EMV transition planning will be complicated. However, while EMV is a complex specification, the good news is that it can grow over time. Thus the key is to implement an infrastructure that lets you start with a simple, single portfolio that can expand and mature with you. Looking forward, the goal is to do it once, do it properly and avoid the pain of re-doing it when it’s time to move into mobile payments

I agree totally with this sentiment. Mobile is here. EMV addresses the requirement to include Dynamic data in a payment transaction to address questions of identity and irritability.

Update 02/22/2012

Having had a chance to sit inside EMVCo working group meeting and being fully aware of those words read every time that reminded us of our confidentiality and sharing of patent and secrets that might jeopardize the future of EMV.

What I saw was the successful release of the EMV contactless specifications and type approval processes capable of testing tap if one remembers the distance has to be 2 cm instead of 10.  Otherwise the protocol and security will last us until 2025.  Plans where underway as I left that where focusing on expanding the standardization of mobile and the development of a next generation or EMV 2.0.  They are talking about 2015 and 2017 for probably dates that these new specifications and processes would be in place to allow widespread adoption so that circa 2030.  If hey are right we have a new and transparent solution that opens and never hinders access to whatever we have the right to access.  what about the next 17 years,

Well, EMV works.  It already includes mobile and contactless.

Visa and MasterCard have said yes.  Amex is OK, discover has had lots of ads for payment people with EMV knowledge and such titles.

The Federal Reserve seems to be on-board and Global Platform, NFC and Mobey forum seem to be OK.

Looks like a plan to me.

NSTIC and EMV should merge

October 03, 2011

Cyberspace trust: Proving you’re not a dog

A very real discomfort underlies the classic joke: “On the Internet, nobody knows you’re a dog.” How can you prove your own identity and confirm the identity of others during virtual interactions? Every time you reach out to a friend on Gchat, post on a classmate’s Facebook wall, or send money to a colleague via PayPal, you are relying on a key assumption: that the person you’re reaching out to behind that Gmail address, Facebook profile, or PayPal screen name is who they say they are. Without this baseline confidence, online interactions and commerce would be paralyzed.

http://portalsandrails.frbatlanta.org/2011/10/cyberspace-trust-proving-youre-not-dog.html

Philip thinks:

  • The next step is to merge the identity sought by everyone and easily relegated to the Banks to manage.  Facebook and GMail offer an option if their KYC can be improved.  With face to face meeting it is possible to truly prove identity, requiring a branch network.
  • Transaction processing is legacy in the developed world while the emerging economies offer an opportunity to build new.  Existing standards and processes need to be respected as they transform to absorb the new information attachments and Internet offers we now need to cope with.
  • The Wallet forms the basic unit to create a trusted network employing smart cards, trusted computing, persistent computing and inteligence to enable the consumer experience.
  • Privacy and integrity of that trust is essential to the system
  • The individual is key
  • Respect rights and obligations

 

 

 

 

Are the Pundits over thinking the ISIS proposition

Mobile payments is being discussed in the context of “creating” a new “means of payment” or in other words a new “Payment Brand”.  I would suggest  the expense and time it takes to create a new “Payment Brand” is significant not to ignore expensive. 

Just look at PayPal.  How long, on the backs of eBay, did it take to reach the point where they are ready to  enter into a venture with Verifone to become a “means of payment” their buyers can use at the real world stores of their sellers.

Two models for payments exist in the market today and frankly these two models have not changed, since the beginning of any form of commerce. 

The three party model and the four party model. 

Classically banks regulated and trusted to hold our moneys in accounts are fundamental to the act of payment.  They have always been key to developing and operating the payment systems. 

Unless of course we use cash. 

In both models two parties always exist – the Buyer and the Seller, the Payer and the Payee or the consumer/cardholder and the merchant.

In the four party model we add two Banks who support one of these two parties.  There is the bank with the relationship with the consumer/buyer/payer/cardholder, often called the Issuing Bank.  On the other side of the payment there is the bank with the relationship with the merchant/seller/payee, often called the Acquiring Bank.

The three party model, simply means that the Bank of the payer and the Bank of payee are the same.  The movements of funds flows from the buyers account to the sellers, as ledger entries, within a single institution.

American Express and PayPal are perfect examples of non-Banks who operate three party payment systems. 

The central bank is another example of a three party system.  All the banks within a country are clients of the central bank and have accounts at the central bank.

Clearly the three party model is the most efficient.  But, it requires that there is a monopolist who processes payments for all buyers and sellers in order for the system to truly work.  Reality dictates that a monopoly or agreement by all parties to use a single entity for their banking and payment services must exist for such a system to dominate the market.  

Therefore, the payment systems have evolved cooperatively; based on acceptance by the consumer and merchant of a recognized means of payment.  The banks work together to establish a set of rules and procedures they employ to transact payments.  Various four party models i.e. MasterCard and Visa along with checks, electronic fund transfers, dominate the payments landscape. 

Inherent to these models is  a Brand (acceptance mark), a set of rules and a clearing mechanism.  Everything works because there are agreed rules and procedures that govern how the two banks execute payments.  To complete the cycle these two banks ultimatelyexchange real money, typically through a settlement bank or the central bank representing the total value of the payments processed.

To add complexity to the landscape, the Issuer and Acquirer often contract with processors to do the work.  These to entities are identified in the graphic as the Issuing Processor and the Acquiring Processor.

Behind the term mobile payments, some think there is a more efficient method of affecting payments.  They believe inserting a new player into the game will make the whole system more efficient and therefore cheaper.  Or more appropriately they think that their new approach will allow them to earn a portion of the Merchant Discount (fee paid by the Merchant to the Acquirer) or the Interchange (fee paid by the Acquirer to the Issuer). 

The more I think, read and discuss, the more convinced I become that creating a new payment Brand is an expensive exercise and frankly believing we can create something new and more efficient than the existing four party models is irrational. 

So what does the Mobile Phone bring to the payment landscape? 

Clearly ISIS understands.  Mr Abbott states “We plan to create a mobile wallet that ultimately eliminates the need for consumers to carry cash, credit and debit cards, reward cards, coupons, tickets and transit passes.”  Key word “WALLET” by definition “A wallet  is a small, flat case used to carry personal items such as cash, credit cards and identification documents, such as a driver’s license. “  Interesting, a mobile phone is a small, flat object that can carry a digital facsimile of cash, cards, identifications documents … . 

Next we think about NFC “Near Field Communications”, a method of transferring data between the content of the Wallet to the merchant’s Point Of Sale device “POS”.   Tap instead of swipe.  NFC replaces the  read of the magnetic stripe with the transfer of the data from the Mobile Wallet to the merchant’s POS.  To achieve this goal PayPass and the otehr contactless payment cards simply stores what is on the magnetic stripe and passes it via NFC to the POS.  Given that a mobile phone is a computer we can introduce digital certificates and do it much more securely. 

This is exactly what  EMV Europay, MasterCard and Visa defined and employ.  Debit and credit card issuer throughout the world are now employing the  trusted characteristics of a chip card to secure their credit and debit card payments using digital certificates. 

With a Mobile Wallet (remember the SIM is a chip card) a trusted component is available, inside the consumer’s wallet, capable of supporting EMV and assuring the authenticity of the content (Card) of the wallet and the identity of the owner of the wallet.

Bob Egan in a recent Forbes article The ISIS Mobile Wallet: Are Visa, MasterCard and PayPal Under Siege? writes “To me it’s quite clear the ISIS is taking matters into its own hands. I predict we will see ISIS become the issuer behind new carrier partner plastic credit/debit and prepaid cards in addition to mobile wallet capabilities for those cards become resident as applications on mobile phones.” This suggests that Isis is going to compete with Barclaycard.  If this is the case then what does the following statement in the Isis release mean “Barclaycard US, part of Barclays PLC, is expected to be the first issuer on the network, offering multiple mobile payment products to meet the needs of every customer. “ 

So what is Isis planning?  Clearly Pundits are not sure.

The Future of Money

I took offence when I looked at the picture included in the article published on Wired.

http://www.wired.com/magazine/2010/02/ff_futureofmoney_move/

The arduous path that he has carved out for a card transaction assumes a lot of unnecessary intermediaries that have included themselves within the picture.

For me the story can be simplified.

Credit card processing involved a minimum of five parties.  The Issuing bank and its technology arm, the acquirer and its network and the scheme (Visa, MasterCard … ).  Everyone else is about the realities of the ISO marketplace and the proliferation of parties offering added value services along the transaction path.

 

 

Remember a credit card transaction is simply

 

Swipe/Tap/Dip/PIN.

Add transaction amount, time, merchant etc.

Ask Acquirer for approval.

Acquirer passed to scheme

Scheme routes to Issuer

Issuer approves and sends back the authorization.

then if necessary sign receipt

That night batches of requests for payment are sent from the acquirer to the Issuer with the Scheme, reconciled and settled.

 

Then there is ACH.  Yes the technology needs a modernization the functionality must be stream lined and ubiquity must be embedded in the pricing model.

Electronic checks that are facsimiles of hand written checks cleared through the Check 21 system should not be eliminated, they are efficient and provide a great personal audit trail.  handling the paper should be pushed as close to the original transaction as possible so that personal accountability is induced.  The person I handed the check to has the check.  So if there is a problem I have to deal with him.

Otherwise all the necessary transactions are possible and with the move to STP “straight through processing” the ability to assure availability of funds can be assured.

What are most of the other schemes.  First like American Express they are three party solutions with a man in the middle holding funds on account in a pre-paid scenario or capable of submitting as your proxy transactions into the ACH and card systems.

Yes the three party system is the most efficient.  Unfortunately it has one problem, it is not open.

Visa and MasterCard, although viewed as restrictive, are open systems.  They accept; any properly sanctioned bank as a member willing to abide by the rules and maintain sufficient reserved.  For a new system to acquire this status either means they become a bank and meet those incremental regulations or they focus on building critical mass as American Express has proven can be done.

So as this next article concludes, what is can improve and probably is better than something new.

http://www.wired.com/magazine/2010/02/ff_futureofmoney/all/1

The Future of Money: It’s Flexible, Frictionless and (Almost) Free

This is what I have done as the following snapshot indicates:

www.andreae.com/presentations

Critical mass versus ubiquity the future of payments

In a paper recently published by the Federal Reserve they begin to consider what actions the FRB should take to drive the further adoption of P2P electronic payments and the reduction in paper checks.

http://www.bos.frb.org/economic/ppdp/2010/ppdp1001.pdf

Their introduction speaks to the differences in adoption of electronic payments in the USA and Europe.  Intriguingly they include privacy concerns as a key issue.  This being said, having lived in Europe for 15 years, I am not sure the desire for privacy is greater in America.  What can be said is that the moment when the underlining infrastructure was developed defines the ideas and feature sets.  Newer systems learned grew as other economies embraced and proved the viability of innovative ideas.

They go on to discuss the fate of eCash (Mondex, VisaCash) and the need to create ubiquity in order to assure success.    Clearly, as they outline, the major adoption issue in the field of payments is achieving a density of merchants willing to accept a particular means of payment  and simultaneously demonstrating a significant number of consumers willing to employ said means of payment.

Unfortunately for the inventors of neat solutions the reality is that without figuring out how to assure ubiquity the new idea they will not be a success.  If we look at contactless, MasterCard clearly recognised this reality and funded the initial investment in equipment.  Without this investment one wonders if PayPass would have reached the low levels it has.

The interesting thought that emerges from this paper is that the wide spread deployment of mobile phones means that an infrastructure that both merchants and consumers have is in place and if one can find an intuitive means of exploiting this installed base, part of the deployment problem is mitigated.

In my heart, I believe mobile will allow the establishment of new ways of paying,  The next question can today’s infrastructure support P2P payment instructions and will the issuers and acquirers figure out how to make money without cannibalizing existing revenue streams.

What next for Smart Card and Mobile Phone

Why not start implementing EMV in the USA. It is the right thing to do. One global standard.

“Chip and PIN”, EMV … ISO 7614

The New York Times, in the previous post, looks at the issue from the obvious perspective.  The result is as one would expect.  Remember when France first introduced smart cards 1984or mandated then back in 1992 and the acceptance nightmare.

In the past I have written on the idea –

Push PCI/EMV into one coherent electronic and secure smart card reader and PIN Pad.

Mandate all new 1 July 2010; with the understanding that the reality –  every piece of equipment will be replaced in a reasonable period, say 7 to 10 years.

VARs should easily be able to do that.

The incremental ($8/device) on the device side goes down over time, as equipment becomes more affordable.

On the system side, most international providers have a solid EMV implementation they can port over to the US platform over that same 7 year time frame.

At the Network switches, gateways and IPSPs; data formats should be changed sooner, say three years from day one.

Issuers can then decide, when to embrace one  global two factor authentication solution; using contact and contact-less EMV  cards to support card authentication [Factor 1] and card holder verification processes (eg. Chip and PIN) [Factor 2] .

Biometrics were understood when EMV was created.  The mechanisms are in place to introduce an agreed, more secure, biometric verification process [Factor 3].