Tag: contactless

The Dual Interface Business Case

These cards and often times the terminals are more expensive than a classic “Dip” EMV card

How much, is dependent on volume, complexity and the pure skill of negotiation. This incremental expense is the first factor one must quantify when building the business case

  • for enabling, in the case of the terminal
  • adding in the case of the card, the contactless antenna
  • upgrading the software by adding the contactless terminal kernels or selecting the appropriate chip software and profile

This then must be compared to the incremental value
For the merchant, issuer and ultimately the cardholder

To explore the benefits lets think about

  • The user experience
  • Availability of merchant contactless acceptance
  • The intersect of the cardholder base with the contactless acceptance infrastructure

As we look around the world and consider what stimulates dual interface card issuance and merchant NFC enablement. Two scenarios emerge.

  • A country made a collective decision and drove NFC terminal enablement and dual card issua.
  • A merchant segment, typically transit, decided to introduce electronic fare-collection.

The first scenario is often driven:

  • By the payment schemes
  • The belief NFC “Near Field Communications” mobile payments will happen
  • A country simply wants to start dual interface and prepare for mobile payments

Which ever option they select, the merchant and financial institutions, within the country, typically migrate together.

In the case of the second scenario, merchant driven migration. We can look to the United Kingdom as a perfect example. “Transit For London” made the decision to migrate from paper tickets to an electronic fare-collection solution based on NFC. The initial deployment was a closed loop payment card, branded the Oyster Card, they quickly decided to upgrade the solution to support Open Loop e.g. Visa, MasterCard and American Express enable dual interface cards and NFC enabled mobile phones.

Given the importance of public transit to the urban demographic. Their decision to embrace open contactless fear collect, becomes a driving factor for issuers and therefore a ripple effect on merchant enablement.

America, as is true in many things, is different.

Contactless was tried last decade without much success.

Issuers did not see any significant lift in consumer spend nor did the merchant see any real increase in revenues. This experiment did not create a perception of a real benefit for either the merchant of the cardholder. Later in this same period, Starbucks launched their QR code mobile payment solution. From its original deployment to now it has been a resounding success.

Around the same time and based on the work of GSMA and the European Payment Council, major telecom operators began toying with NFC based mobile payments. Here in the United States two pilots emerged, the original Google Pay pilot and ISIS (SoftCard) offer. The results were intriguing, the commitment half hearted and frankly both solutions had issues. Google Pay tried to model its solution after de-coupled debit. Whereas the mobile network operators behind SoftCard, wanted to charge the issuers rent and load fees associated with the payment credentials they would store within the SIM.

Merchants Attempted to Create a new Payment Scheme

Major retailers in their continued quest to improve the customer experience and reduce the cost of payments; came together to create MCX the Merchant Commerce eXchange. The hope, merge their existing private label charge card programs together into a Mobile App capable of working across the family of MCX merchants.

Terms where written, in particular one agreeing these merchants would not accept another competing Mobile Wallet. Net result, the merchants agreed not to enable the NFC interface for any of the Visa, MasterCard, Discover or American Express contactless cards or NFC enabled mobile payment devices.
MCX slowly faded into oblivion, as the merchants struggles with the idea of sharing customer relationships and transaction data. Some merchants notably Walmart, Target, Macy’s and Kohl’s set out to build their won mobile wallets embracing QR codes and other none NFC based techniques.

The Introduction of HCE

While this was going on, north of the American border, the idea of HCE “Host Card Emulation” was created by the founders of Simply tapping 2011. It was ultimately by Android and released as part of KitKat in version 4.4 of the Android operating system. With HCE now inside the Android Operating System it unlocked the NFC interface from dependence on the SIM and MNOs. Now any application could take advantage of the NFC interface, once supported by the internarional payments schemes, enabling wider deployment of NFC enabled mobile payments. Google moved ahead to expand its payment ecosystem and Royal Bank of Canada embraced HCE. As Issuers enabled the ability to authorize the load of EMV secured Payment Credentials into the OEM Mobile Wallet or the Issuer’s own mobile app. Consumer now had the opportunity to experiment with mobile payments that communicate with the POS, just like a dual interface card.

Let’s not forget Apple Pay.

Given their brand value and total control of the Apple operating environment, Apple was able to turn to Issuers and suggest they enable the load of EMV secured Payment Credentials into the Apple Pay Wallet. They came at payments with all guns loaded. They knew the value of their brand and were able, unlike the MNOs to ask for a 0.15% of the issuers’ interchange revenue. Most importantly, they facilitated Visa and Mastercard domination of the role of the Trusted Service Manager TSM-SP or better said the Token Service Provider TSP.

Merchant Acceptance Is Key

As has been true with any solution designed to serve a two sided market, issuance and acceptance must grow together to assure the operator success and prosperity. Without a national imperative and with the experience of the original ZIP (Discover), Express Pay (Amex), PayPass (MasterCard) and PayWave (Visa), the merchant must determine if it is worth the effort to enable the NFC interface and train their staff to support Contactless payments.

Transit, like has been true around the world, absolutely sees the value of using contactless, for fare collection and are busy engaging with Visa and MasterCard to embrace and assure acceptance of bank branded dual interfaces cards. Urban areas such as Chicago (CTA), Salt Lake City (UTA), LA Metro, Portland OR (Trimet) and Philadelphia (SEPTA) are live with deployments. Others are in various stages of planned, including the MTA in New York City.

The Business Case

For issuers, where transit is seeking to exploit open loop contactless payments, at the turnstile, there is a revenue opportunity to deploy dual interface cards.

In rural areas or urban communities where public transportation does not exist. The business case is dependent on what local merchants do and if they intend to or will be forced to enable the NFC capabilities of their POS.

This is the big question. Does the merchant see value? Do they believe contactless will increase revenue, reduce time at checkout or do they believe Apple Pay, Android Pay and the other mobile NFC enabled devices are the future?

  • If the answer to these questions is yes then Issuers should seriously consider deploying dual interface cards.
  • If the jury is still out then the investment in dual interface cards may not yet be worth it!

What is the Future Payment Credential Carrier

One cannot discuss contactless payments without thinking about how Apple Pay, Android Pay, Samsung Pay, OEM Pay, Issuer Pay … Device Pay play into the future of cards. Some years ago there were three belief systems

  1. Cards are here to stay the mobile device is a fad
  2. The wallet is replaced by the mobile device
  3. The card is the token of last resort

I think we know mobile devices are not a fad. Until mobile devices never run out of power they will not replace the wallet or all of the cards.

To say much more, given the fogginess my crystal ball, would be to wild a bet.

The following articles produced by the Secure Technology Alliance offer a series of perspectives on the value of migrating to a dual interface card.

Alliance Activities : Publications : Contactless Smart Cards

Alliance Activities : Publications : Payments : Contactless Payments

Alliance Activities : Events : Webinar: Contactless EMV Payments: Issuer Opportunities

Alliance Activities : Events : Webinar: Contactless EMV Payments: Merchant Opportunities

What Happens When the Lights Go Out

Since 1984, when I was told I needed to carry this mobile phone with me, there has been that nagging issue of needing to make sure it had enough life to get me to the next charge point.  My first phone was luck if it could last a half a day so they gave me two, one was always being charged while the other hung on my shoulder.  In 1993 while working on the development of the EMV Specifications we focused on the ability to authorize a transaction when the Point of Sale POS device was unwilling or unable to reach the issuer.  In 2013 I listened to Visa representatives explain how 100% of all payment transactions could be executed online.  Then I ponder getting a Tesla Model 3 and learn it is only capable of traveling a maximum of 310 miles, it make me wonder; how do I finish the last 19 miles to my fathers home.

Today, I was reading an article emanating from the Money 2020 event when IDEMIA spoke of the idea of the mobile drivers license and that nagging feeling emerged.  What happens when the power goes off after the hurricane hit and someone asks me for my drivers license.  Its locked securely inside my dead mobile phone.  I then saw that their competitor Gemalto and even NIST are working on this concept of the mDL.

We live in a world where electricity is becoming as essential as water and food.  Yet, we hear of power outages that last weeks and even months.

It is like with Mobile Payments, if the phone is dead and in order to pay it must, then what?  The card remains the essential element of a successful payment transaction.

I dream of the day when I can merge my leather wallet and my mobile device into one.  Yet, I appreciate there are technical challenges like the need for electricity.  Until we lead with these technical challenges and not simply the dream.  Exciting concepts and ideas will go where so many have gone before.

The Future of EMVCo Next Gen

Back in 2011, when I was part of American Express, I was part of the team responsible for our involvement in the work of EMVCo.  At this stage in the work of EMV the discussion had turned to the confusion the multiple contactless kernels was creating in the market and more importantly the challenges we would face as the external threats increased demanding that the length of the RSA keys increase accordingly.  Ultimately we collectively determined the best course of action was to begin the work on what began know as “Next Gen”.  From the beginning it was well understood the migration from where we are today to the “Next Gen” technology solution, both in the card and on the terminal, would be complex and expensive.  In September of 2014 an initial specification was released and my understanding is that a draft has been issued to subscribers and Associates for review and feedback.

This post stems from a conversation with a good friend, he asked me if I thought there was still relevance to what is now being called 2nd Gen.  In that discussion we reviewed the genesis of the work, the baseline for EMV and the unfortunately reality of how contactless was implemented.  Our conversation then turned to the question of what makes the most sense live with what we have today or suffer the expense of the migration to a new solution.

Thinking back to the original reason for “Next Gen” was to consolidate the 7 contactless kernels into one common kernel and replacement  RSA with what was called XDA or Elliptic Curves.  When I think about these two requirements one can only wonder why in the most recent EMVCo Stated EMV® 2nd Generation there is no  reference to enhanced cryptography.  In fact the only thing the document describes is the creation of one unique kernel.

Referring back to the September 2014 Net Gen Specification there is clear reference to enhanced security with specific call out of “an elliptic curve Diffie-Hellman key establishment protocol with blinding applied by the card”.  I then remember hearing about issues with Elliptic Curves and wonder why there is no reference to enhanced cryptograph in this most recent EMVCo document.

Back to the question raised in our conversation.

Do I see value in the world investing in the migration to 2nd Generation?

The answer is I am not sure anymore. 

When EMV started we had four agreed requirements, summarized on this slide I initially created back in 1994.  Offline Authorization, in other words, the issuer’s ability to securely approve a transaction without requiring the terminal to request an expensive online authorization request was the reason Offline Authentication was part of the original design of EMV.

  • If the value of offline authentication, given the ubiquity of wired and wireless telecommunications networks, is deprecated.
  • If  the performance efficiencies, original seen in Elliptic Curves, is no longer as significant, given the increased threats and vulnerability.

Then why make the investment in changing the software in both the card and the terminal to support XDA?

Next

  • If most if not all terminal manufacturers have addressed the complexity of the multi-kernel configurations, compounded by the existence of various unique national contactless kernels.

Then why demand the investment in supporting a complex migration from multiple kernels to a single EMVCo Licensed kernel?

Finally

The threat of quantum cryptograph suggests that most if not all asymmetric cryptographic algorithms commercially available will be broken.

It does beg the question.

What is the business case for driving the world into a expensive, long and complicated migration?

What we created in 1994, and EMVCo has maintained, is a very effective Online Authentication mechanism, the ARQC.  A mechanism based on symmetric cryptography which, as far as I can tell, will remain under the control of the Issuer and is not, as of yet, threatened by quantum computing.

I look forward to your feedback.

 

 

 

 

 

 

The case for Identification and Authentication

As we continue to explore the case for Identification and Authentication I share the below article.

What is becoming clear is standards are being embraced.

In the Payment space

Will it be W3C WebAuthN, 3DC and Webpayments or EMVCo SRC & Tokenization?

My guess depends on if standards bodies can play well together. EMV (contact or contactless) will remain the many stay for physical world commerce, until the App takes over the Omni Channel shopping experience. then the merchant will properly authenticate their loyal customer and use card on file scenarios for payments. The question of interchange rates for CNP will see a new rate for “Cardholder Present&Authenticated/ Card Not Present.”. In time when a reader is present I can see an out of band “tap to pay” scenario emerging using WebPayments and WebAuthN.

In the identity space

I contend the government and enterprise market will go for a pure identification solution with the biometric matched, in the cloud, in a large central database. In order to maintain a unique and secure cloud identity, they might probably make use of various opportunities that come their way (you can hover over at this website to learn more).

However, does that mean it includes what you know username, email address or phone number? Maybe! If it is simply the captured image or behavior, then it is a 1 to many match. If it is with an identifier, it is classic authentication with a one-to-one match.

In the pure authentication space where the relying party simply wants to know it is the person they registered. Then, the classic FIDO solutions work perfectly and will be embedded into most of our devices. Additionally, the use of a visitor sign in sheet synced with the security database could expedite the sign-ins of visitors. It could also see its applications with employee log authentication and verification. Or, as we’ve seen with some enterprises, the relying party will embrace U2F with be a FIDO Key, like what Yubico and Google recommend.

The classic process needs to be thought about in respect to what can be monetized.

  • Enrollment = I would like to become a client or member
  • Proofing = Ok you are who and what you claim, we have checked with many to confirm your Identity – This is where federation comes in.
  • Registration – Verification = Ok, now we confirm it is you registering your device(s)
  • Authorization & Authentication = Transaction with multiple FIDO enabled relying parties using your duly registered authentication.

How Microsoft 365 Security integrates with the broader security ecosystem-part 1

by toddvanderark on July 17, 2018

Today’s post was coauthored by Debraj Ghosh, Senior Product Marketing Manager, and Diana Kelley, Cybersecurity Field CTO.

This week is the annual Microsoft Inspire conference, where Microsoft directly engages with industry partners. Last year at Inspire, we announced Microsoft 365, providing a solution that enables our partners to help customers drive digital transformation. One of the most important capabilities of Microsoft 365 is securing the modern workplace from the constantly evolving cyberthreat landscape. Microsoft 365 includes information protection, threat protection, identity and access management, and security managementproviding in-depth and holistic security.

Across our Azure, Office 365, and Windows platforms, Microsoft offers a rich set of security tools for the modern workplace. However, the growth and diversity of technological platforms means customers will leverage solutions extending beyond the Microsoft ecosystem of services. While Microsoft 365 Security offers complete coverage for all Microsoft solutions, our customers have asked:

  1. What is Microsofts strategy for integrating into the broader security community?
  2. What services does Microsoft offer to help protect assets extending beyond the Microsoft ecosystem?
  3. Are there real-world examples of Microsoft providing enterprise security for workloads outside of the Microsoft ecosystem and is the integration seamless?

In this series of blogs, well address these topics, beginning with Microsofts strategy for integrating into the broader security ecosystem. Our integration strategy begins with partnerships spanning globally with industry peers, industry alliances, law enforcement, and governments.

Industry peers

Cyberattacks on businesses and governments continue to escalate and our customers must respond more quickly and aggressively to help ensure safety of their data. For many organizations, this means deploying multiple security solutions, which are more effective through seamless information sharing and working jointly as a cohesive solution. To this end, we established the Microsoft Intelligent Security Association. Members of the association work with Microsoft to help ensure solutions have access to more security signals from more sourcesand enhanced from shared threat intelligencehelping customers detect and respond to threats faster.

Figure 1 shows current members of the Microsoft Intelligent Security Association whose solutions complement Microsoft 365 Securitystrengthening the services offered to customers:

Figure 1. Microsoft Intelligent Security Association member organizations.

Industry alliances

Industry alliances are critical for developing guidelines, best practices, and creating a standardization of security requirements. For example, the Fast Identity Online (FIDO) Alliance, helps ensure organizations can provide protection on-premises and in web properties for secure authentication and mobile user credentials. Microsoft is a FIDO board member. Securing identities is a critical part of todays security. FIDO intends to help ensure all who use day-to-day web or on-premises services are provided a standard and exceptional experience for securing their identity.

Microsoft exemplifies a great sign-in experience with Windows Hello, leveraging facial recognition, PIN codes, and fingerprint technologies to power secure authentication for every service and application. FIDO believes the experience is more important than the technology, and Windows Hello is a great experience for everyone as it maintains a secure user sign-in. FIDO is just one example of how Microsoft is taking a leadership position in the security community.

Figure 2 shows FIDOs board member organizations:

Figure 2. FIDO Alliance Board member organizations.

Law enforcement and governments

To help support law enforcement and governments, Microsoft has developed the Digital Crimes Unit (DCU), focused on:

  • Tech support fraud
  • Online Chile exploitation
  • Cloud crime and malware
  • Global strategic enforcement
  • Nation-state actors

The DCU is an international team of attorneys, investigators, data scientists, engineers, analysts, and business professionals working together to transform the fight against cybercrime. Part of the DCU is the Cyber Defense Operations Center, where Microsoft monitors the global threat landscape, staying vigilant to the latest threats.

Figure 3 shows the DCU operations Center:

Figure 3. Microsoft Cyber Defense Operations Center.

Digging deeper

In part 2 of our series, well showcase Microsoft services that enable customers to protect assets and workloads extending beyond the Microsoft ecosystem. Meanwhile, learn more about the depth and breadth of Microsoft 365 Security and start trials of our advanced solutions, which include:

Something to wonder about

What You Have

The Two Sided Market

When we think of investing in various macro business needs e.g. revenue. We see that establishing relationships with customers to stimulate sales is why we create the goods and services, hopefully, others want.

If the buyer has something the seller wants, in exchange for the good or service they desire, then a transaction occurs. The challenge is simple, each party defines the value of what they are providing or exchanging and presto the trade occurs.

When society grows and the complexity of what each of us produces and when our needs are not aligned to this process called barter, a means of monetization is established. Society creates a trusted form of exchange – pebbles, coins, money, a promissory note or now even cyptocurrencies.

In other words, society creates an answer to enable the exchange of goods and services between parties who do not have goods and services the other party seeks in exchange.

With cash, coins or other trangible representations of value, commerce is easy. When we complicate things and worry about carrying cash and seek to buy things with debt. A need for a Network emerges.

These payment networks, by necessity, add complexity. They create the need to establish two sides to the market, one focused on the relationship with the buyer and the other with the seller.

Issuance and Acceptance. Two words to descibe the two sides of a network. It’s only when the two sides of the market have sufficient participants. Only at the tipping point, enough critical mass exists, to create a self sustaining network. This is the network. At this moment the network blossoms. If either side of the market does not achieve critical mass, the network collapses.

Any two entities familiar and trusting in the Brand, or each other, can easily establish a temporary relationship. Adding anonymity to the requirements, increases the leave of trust and recognition the Brand must establish.

In a digital environment we have to define mechanisms to share and establish trust across trillions of electrons. The two sides will not pursue understanding of nor focus on security. Until the risk exceeds a threshold unique to each party on either side of the market.

To often in the past, the idea of the individuality of the individual or the need to design security in from the beginning. Has left us with a legacy of system all needing design of custom approaches to how to integrate security with requisites necessary to capture, calculate and manage risk.

The Artifact of Trust

When a mutually trusted set of parties gives the citizen, consumer, employee or courtier a card, a device or an object and provides every acceptor with a reader capable of recognizing the trusted thing; then the two parties are in a position to establish “trust”. The consumer has a thing which is recognized and trusted by the acceptor. This is often referred to as “What You Have”.

Once the thing is recognized by the acceptor, then, the process of identification and authorizations (the transaction) can take place. The object – the artifact – carries an identifier. It possesses characteristics that establish its unique character. The object also posesses a means of assuring the acceptor the presentation of that identifier repreents a unique entity.

The simplest artifact of establishing “trust” is a hand held thing, be it a key, fob, card, watch, pendant, phone, ear piece. It does not matter what it is, all that counts is that the merchant recognizes it and that the consumer is willing to carry and present it.

Trust, for the merchant, means they can, according to the rules, recognize and authenticate the thing. They are then in a possition to pursue a temporary and trusted relationship. What can be achieved during the time the relationship of trusted is bounded, is the constrained by an additional layer. In this layer the consumer, the acceptor and any third parties address which the rights and privileges are to be granted or pursued. This is when the exchange, sale, conversation, tranaction, event or access is granted.

Two sides meet several common mediums of exchange are available.

[contact-form][contact-field label=”Name” type=”name” required=”true” /][contact-field label=”Email” type=”email” required=”true” /][contact-field label=”Website” type=”url” /][contact-field label=”Message” type=”textarea” /][/contact-form]

The NYTimes understands what EMV is

So why not go ahead, do contact ISO7614 and contactless cards ISO14442 for 1.75 a piece.  then merge 15+ cards to a few. Save 11*$.025 = 2.75 per person. or 1.100 Billion less cards as pollutants

Could U.S. consumers spur adoption of EMV in U.S.?

Tracy Kitten

• 01 Oct 2009

As the rest of the world wraps its migration to EMV/chip-and-PIN technology, Americans traveling overseas are running into mag-stripe disadvantages.

This week, travel reporter Michelle Higgins of The New York Times writes that U.S. cardholders traveling abroad are getting turned away by some merchants, since mag-stripe readers are quickly becoming things of the past in every corner of the globe except the United States.

Though EMVCo., which oversees and spearheaded the EMV shift, has said from the beginning that all chip cards and readers would continue to also read mag-stripes, many merchants are reluctant to accept mag-stripes, since they can be held liable if card information is skimmed or compromised. And because magnetic stripes are relatively easy to copy compared with chip-and-PIN technology, accepting mag-stripe transactions potentially opens the door for fraud.

The problem is that most U.S. consumers have not been informed by their financial institutions about potential transaction problems when traveling overseas. Most, in fact, have no idea what EMV or chip-and-PIN technology is.

Twenty-two countries, including most of Europe, Mexico, Brazil and Japan, have adopted EMV technology, according to the Smart Card Alliance. About 50 other countries, including China, India and most of Latin America, are in various stages of migrating over the next two years.

Last year Canada began rolling out chip-and-PIN cards and plans to stop accepting mag-stripe cards at ATMs after 2012 and at POS terminals after 2015.

American Banker Reports

Europe to Eye Mag-Stripe Ban

Cardline Global  |  Friday, June 26, 2009

European banks may consider banning the use of magnetic stripe credit and debit cards, according to Gerard Hartsink, the chairman of the European Payments Council.

Hartsink, who is also a senior executive vice president at ABN Amro in Holland, said that European financial companies will have largely completed the transition to the EMV Integrated Circuit Card Specification by 2011, and the council, which is driving the transition to the Single Euro Payments Area, could then advise its members to stop accepting magnetic stripe cards, which are considered less secure than those that use EMV.

“My feeling is, although it has not yet been decided, the [council] will take a decision in 2011, maybe 2010, to only use chip cards,” he said in comments during a presentation this week at the Contactless Cards and Payments conference in London.

The council has no enforcement power, but if banks in Europe went along with such a decision, it could leave U.S. cardholders in the lurch when they traveled to Europe and tried to use cards for purchases or ATM withdrawals.

“If [Americans] visit Europe, it’s not such a problem; their institution could issue an EMV card,” Hartsink said.

Payments council members will probably debate the issue in 2010 or 2011, he said.

Hartsink is not the only person suggesting a ban on magnetic stripe cards, according to Dave Birch, a director at the U.K. research company Consult Hyperion. In a recent blog post, he cited comments from a financial regulator in Singapore pressing for a “concerted, global effort to phase out magnetic stripe technology entirely.”

America needs to embrace the Future

Back in 1993 I had the opportunity to help in forming the working group who developed and ultimately published the EMV Smart Card Specifications for Credit and Debit Cards.  Since then, as a member of the Europay and Visa Canada executive teams I promoted the virtues of smart cards and the business case for EMV. 

As a consultant, one of the focuses of my practice is EMV.  In both Europe and Canada I counseled executives on the what, how, when, business value and future opportunities of EMV, smartcards. mobile payments and internet payments

One question has always been asked of this American – “when will the USA migrate”.  Up until recently I was stuck, giving bland answers.  I suggested that we would have to wait until after fraud migrated to the USA,  away from EMV protected countries.  I tried to explain to people, committing comparable sums of money, that  the size of the investment required of US Issuers, Acquirers and Merchants is enormous and frankly cannot be justified. 

Why they ask,  simple economics I answered.  I explained that when one looks at the  quality of the fraud management systems in place, the level of on-line authorization and the losses incurred; it simply does not make sense.

Debit is the real reason to Migrate to EMV

In 2007 I was working with “The Exchange”, a Canadian network that supports sharing of ATM services such as deposit, bill pay and account to account transfers.  The focus of my work was to help them to understand the implications of EMV and to work with them to develop their go forward strategy. 

Part of the research led me to talk with the Fiserv, the Brand owner and their strategic partner.  While discussing what the Canadian entity needed to do with the America responsible for the USA Exchange and Accel network; the conversation drifted to when will the USA move to EMV.

What sat front and center inour discussion is the American banks that issue PIN Based Debit Cards have a much stronger rational to migrate to EMV than the credit card and signature based Debit issuers.  In the PIN Based Debit arena the “reputational risk” has and will continue to be the real justificationfor the migrate from magnetic stripe to Chip and PIN.

Why you may ask.  My answer is simple.  The cost to a criminal to install a fascia and PIN hole camera on an ATM, capture the magnetic stripe and PIN; offers these international criminals a very rewarding business case.  They are also funding aggressive operations that embed people into factories that produce magnetic stripe and PIN Pads with the imbedded capability of capturing and transmitting the magnetic stripe and associated PIN to the Mafia

Reputational Risk is the catalyst

 

So how does this affect “Reputational Risk”? 

1.       When the criminal perpetrates debit card fraud, they focus the attack at ATMs the cardholder would probably visit.  The Issuers’ fraud management systems are finding it hard to differentiate between a valid transaction and a fraudulent transaction, so out pops the cash, 100% fungible no need to fence the goods and cheaper and more profitable than robbing the bank

2.       Weeks later the cardholder notices that there is not as much money in their checking account as they expect and they call the Bank’s call center.  The argument follows – But only people who know your PIN can withdraw funds from your account, who did you tell your PIN to, your ex, your children …

3.       Eventually after a lot of time explaining, crying, shouting and generally getting on each other’s nerves; the Bank’s customer service agent will final accept that the cardholder did everything to protect the PIN and card; so the bank will reluctantly restore the funds to the cardholders account.

4.       Bottom line the cardholder feels that the bank does not care; their systems are not safe and the cardholder is now afraid to use their debit card.  The Bank and its ATM network are now at “Risk”.

No one should be surprised at this form of attack.  I knew and teh media presented the realtities of such attacks back in 1994.  As the size cost of the equipment shrinks and the capabilities of technology expands the incidence simply increase and proportional to the rewards.

To put a point on my analysis; when most countries decide to migrate to EMV it is not the Credit side of the cardholder relationship that seals the deal for the CEO and senior executives.  It is the Debit side that pushes the bankers to say yes we must migrate to EMV.  MasterCard and Visa,  who participant in both credit and debit, want the publicity.  Whereas the debit networks would prefer to not talk about the problem.   End result we are left thinking credit cards drive the migration to EMV.  Compounded by the reality that for credit cards in the USA, there is simply not a business case.

For the US banks to come together to decide that EMV is the right thing to do; there must be a place where the Issuers and Acquirers can come to terms with the cost and agree on an equitable way to fund the investment required.  For the debit card side of the Banks there is not an obvious place to have this discussion.  Most PIN Debit networks are either regional or owned by publicly traded organizations.  There does not appear to be a common forum capable of bringing the executives together to agree and commit.

Migration to EMV is expensive – YET really it is not

 

Everyone talks about how expensive it would be for America to migrate to EMV. 

Yes if we are to approach the migration with the Big Bang theory it will be ridiculously expensive.  Instead what the powers that be should agree is that all cards and terminals will be EMV by say 2019, ten years.

Let’s acknowledge that most of the major acquirers and processors have already implemented EMV on their international platforms; so the implications are understood and if they where intelligent when upgrading for Canada, England, Europe, Latin America, Middle East and Asia, they should have considerted how to cost effective assure the inclusion of EMV on their American platforms, someday. 

So now they simply have to add it to the list of requirements that will be included in one of the yearly upgrades, or, as part of their technology replacement plans.  Remember we are saying EMV in 10 years. 

Ten years is a long time when we think about technology.  Therefore they have no justification to argue it is punitive to force them to implement EMV.

On the terminal side we must remember that for the merchant there are only intangible benefits to implementing EMV.  Yes, like MasterCard Visa etc, EMV can be positioned as the cost of doing business and included in one of the compliance upgrades. 

Or, if we are intelligent, we say to the ATM operators, merchants, ISOs and acquirers, the next time you upgrade your point of sale system – buy an EMV compliant PIN pad and include EMV as one of the requirement for the systems that drives the device and transmits the approval requests and clearing records to the acquirer. 

Any ATM/POS supplier who sells outside the USA has EMV devices in their catalogue.  All the Value Added Resellers who sell international have support for EMV within their software.  NCR, Wincor-Nixdorf, IBM, EFunds, ACI, S1 … all support EMV.

With this plan in place, over time EMV will progressively be enabled at the point of sale. with minimal cost impact.   Yes the vendors will have to be told to play nice and not exploit the opportunity.  Yes for merchants that attact significant International clientele they should migrate sooner.  Yes, locations that are known to be high risk merchants they should be made to implement EMV sooner. 

This leaves the Issuer with an easy question to answer, when do I add an EMV chip to my card.  Well the answer is easy and it is complex.  On the simple side, when they think there are enough terminals to achieve the fraud saving then do it.  Or, we can add the contactless and mobile payment dimension and start talking about Combi cards, embedding EMV into the handset, considering Multi-application opportunities.  I’ll talk about that another day.

Agree to move and give people enough time so that there is no pain

 

Bottom line my message to the US market is the question is no longer about who will pay it is simply about how much time should we allow everyone, so that the incremental cost is irrelevant.

 This Blog was driven by reading a recent review from CTST

U.S. getting squeezed by EMV  Wednesday, May 6, 2009 in News

http://www.contactlessnews.com/2009/05/06/u-s-getting-squeezed-my-emv

With Canada and Mexico both going to EMV and most of the rest of the world doing the same it may be a matter of time before U.S. card issuers are forced to go to chip and PIN. EMV in the U.S. was the topic of a panel at the CTST Conference in New Orleans.

Mobile Payments and Banking – Consumer reaction is negative

UK consumers reject mobile payments

Security is a major hindrance, says study Written by Angelica Mari, 23 May 2008

I must admit I am confused about the potential for the Mobile Phone becoming a mechanisms we employ when making payments.  If I was simply to take the reaction in an article recently published on VNUNET.com, I would worry.  Yet in other articles and industry analyst speculate that by 2012 we will evolve to employing the mobile phone as our i means of payment.  As I suggested in a previous posting there is still a lot of work to do in developing the business case. 

Yes Vivotech reports phenomenal numbers of devices installed and Inside Contactless talks about the significant numbers of contactless cards deployed.  Standards are emerging and I am sure that EMVCO will develop the necessary security to protect Mobile Payments (assuming you don’t lose your phone).  Then there is the interesting reality that there are more mobile phone users than there are people with Bank accounts.  Micro-finance and developing worlds are embracing work like what Vodaphone is doing to drive payments in the P2P space to the mobile device. Yet when will all of these experiments and trials prove that the key issues of security and stakeholder profit are there?