Dual Interface Construction

When we think about the migration to contactless or Dual Interface cards it is important to have a general understanding of what goes into creating the card and the constraints one has to think about, as they work with their marketing teams to design these cards.

The design of a payment card involves assembling multiple of PVC into a sandwich that will be bonded and then punched out to form the card body.

On the face of the card: a clear laminate to protect the surface
On the back a clear laminate with the magnetic stripe affixed to it

In the middle two printed sheets

The front
The back

In the middle of the card body, your manufacturer will need to insert an antenna. The antenna is typically provided to the card manufacturer as an inlay, as seen on the left. The inlay is a sheet of plastic with the copper antenna, sometimes aluminum embedded within. The card manufacture will add this inlay into the middle of sandwich.

On the right is an example of a six layer card construction including one element as an example, a metal foil. This has been included given it has an impact on the effectiveness of the radio signal. More about this a little later. Using pressure and heat, the layers of the sandwich are bonded together in a process called lamination. The bonded sandwich is then run through a series of additional processes designed to create an ID-1 card as specified in the ISO 7810 specifications supplemented by the additional payment network requires, such as the signature panel and the hologram.

After quality inspection the next step is to mill and embedded chip into the card body and simultaneously assure a connection between the contacts on the back of the chip and the antenna. There are various means of connecting the chip to the antenna. These different methodologies for connecting the chip to the antenna is a specific skill and is the responsibility of your card manufacturer. Look to your manufacturers to propose, construct and certify your card to your requirements and employing their unique processes, techniques and technologies.

One thing you will need to be aware of is how the use of the antenna affects the certification process. It is important to understand that the combination of ink, materials and methods of construct means; each construction will need to go through a unique certification. This need for certification is a result of the use of radio frequency to communicate between the card and the terminal. Think of your cell phone when your inside a big building or within an elevator and how the conversation maybe disrupted. It is this possibility of the radio signal to be disruption based on the materials employed and the method of construction.

When metal elements like metallic foils and layers are used in card construction, the challenge increases. Eddy currents are emitted by the metal and will interfere with the level of power and quality of communications emanated by the antenna and radio in the POS received by the antenna and the computer in the card.

So far we have spoken only of the hardware. The chip in the card is a computer and needs an operating environment, application and data in-order to function. The introduction of the contactless interface alters the operating environment, the payment applications and the data which is loaded into the card. All of this impacts the card manufacturing and card personalization process.

Will the US truly embrace dual interface cards or is our phone the future

When the US decided to migrate to EMV, it took the safe course

When it was time to migrate to EMV here in the USA, both issuers and acquirers focused on addressing the market and the required technology, one step at a time. They recognized the confusion created by the Durbin Amendment, the reality of the competitive US debit market, the complexity of the merchant environment and the legacy infrastructure underneath the American card payment system. Unfortunately unlike in other parts of the world the American merchants tended to migration to EMV in the following order credit & debit, Common AID, contactless (MSD mode), Mobile Pays and finally contactless (EMV mode). This journey is still a long way from complete with less than 25% of the terminal base contactless enabled, let alone in EMV contactless mode.

The larger and most invested merchants also worried about the impact of sharing data with the likes of Amazon, Google and Apple. The “honor all card” rule is also the “honor all wallet” requirement. Wal-Mart, Target and Home Depot were clear, they did not intend to expose the NFC antenna to the various NFC Mobile Wallets. Instead they are implementing solutions, post MCX, based on their mobile apps using QR codes and often times enabled to support frictionless payment.

We are now looking at the second wave of card issuance and Issuers are wondering what merchants will finally do about enabling contactless. As the Issuers prepare to issue their cardholders with their second EMV enabled card they must also think about the future of the card in the context of the future of mobile payments.

Are the payment credentials carried in the mobile wallet the companion of the card
or
Is the card the companion (fallback) for the payment credential carried in mobile wallet / device

Or
Are we on a journey to a new paradigm
Where facial recognition, loyalty, geolocation
Enabled by the always connected devices

We surround ourselves with
Help merchants to focus on
the shopping experience
And
Turn the Payment into

A frictionless “thank you”

A Letter to Karen Webster of PYMNTS.COM

Karen, you come to mind off and on, especially when I’m try to keep up with what is happening in the wild world of payments, block chain, cryptocurrency, identity, authentication, trust, identification and who knows what else.

One thing is clear. Lot’s of companies are investing significant sums of money in these various “opportunities”. Yet are we, as a society, on the right path?

We could look to Washington DC, and the other capitals around the world, and this same question would apply. But, not to get distracted.

Let’s start with identity and authentication in the digital space

As you may remember, EMV was something I got deeply involved with, both here in the USA and back when we originally conceived of the specification. We the three founding payment associations had one goal – solve for counterfeit. And, when the issuer or country so desired address lost and stolen fraud. Focused on the physical world of commerce, the Point of Sale. Our original goal was simple. Assure global interoperability by defining a global migration path away from the magnetic stripe. We mutually agreed we had to select a technology capable of protecting the physical token, the card, well into the 21st century.

Simultaneously, as was so beautifully captured by the Pete Steiner’s famous 1993 New Yorker cartoon, we knew there would be an issue in the digital space, that thing we then call the World Wide Web. MasterCard and Visa set out to define the Secure Electronic Transactions SET, then Visa patented a concept called 3D Secure and more recently worked together with the other owners of EMVCo to create EMV 3D Secure. Each of these, attempts to find a meaningful way of authenticating the cardholder when they paid with a credit or debit card.

Today billions of identities have been compromised. The techniques used during an enrollment process online, to verify who you, are no longer viable. Identifiers like our social security number and Person Account Number (PAN), unfortunately, became authenticators, a role they were never designed to support. As EMV was deployed criminal shifted their focus to the Internet and PCI had to be introduced to address the challenges of criminals acquiring payment card and PII data.

As the World Wide Web morphed and grew in value and importance, the potential of monetizing the vast amount of data companies where collected began to scare people; as this recently found comic so aptly demonstrates. People, governments and corporations started to struggle with their desire for privacy offset against the value of data corporations are collecting.

Way back then, an opportunity to address the issue was offered by Bill Gates. As is always the case, Microsoft the then technical giant wanted something to support what society would ultimately need. The idea of the social good was lost to the value of corporate profit and control.

As the Internet grew to become this marketplace, library, museum, cinema, place to play and place to meet and connect; we imposed well understood enterprise security techniques (username and password) to the consumer space. The password thus became our challenge. How do we convince customers (let alone employees) of the importance of complex, hard to remember passwords – unique to every security conscious relationship we establish on the World Wide Web.

Are biometrics the answer, has the FIDO Alliance and W3C created a set of authentication standards we can all embrace? Hopefully. Unfortunately, most opportunists are seeking to monetize their often proprietary solution, creating what they think is a best of breed consumer experience.

My fear, we are moving from the familiar experience of typing our user name and password; to multiple unique experiences at the front door of each and every web site we seek to log-in to.

As an example my Samsung Android phone has a fingerprint sensor and is FIDO certified. There is a Samsung Pass Authenticator, Microsoft Authenticator, Google Authenticator and several demo versions of various other authenticators. I also receive SMS messages with one time tokens I am asked to enter onto the screen. My PC it also is enabled with a FIDO U2F set of dongles.

Unfortunately my tablet has none of these and assumes I will simply remember, thank you Norton Identity Safe, my various passwords. What a mess we are created all with monetization and the desire to offer a unique consumer experience as the justification.

With all those already installed, I await the introduction of WebAuthN, within the various browsers installed in my PC, tablet and phone.

Moving to Block Chain and Cryptocurrencies

The wild west. The makings of a speculators dream. The realm of the incomprehensible, built on complex mathematical concepts and the desire to remove the man in the middle and replace them with the miners and nodes distributed around the center. Or, is the idea of the distributed ledger the solution to the challenges of trust in an every expanding universe of connected people and things. One can only wonder?

People speak of removing central governments. Yet, they remind us that there is a governing body, book of rules and set of code that is designed to assure immutability. If I understand their, logic we should not trust Governments instead we trust these new open societies and digital enterprises? they speak of removing intermediaries and replace them with nodes and miners. New players responsible for creating and signing the new blocks and distributing it all those who maintain a current copy of the chain.

Is there potential, Absolutely. The challenge is to understand why one would wish to move data from a trusted central repository to a distributed trustless environment. Cost and latency should be part of the discussion and most importantly the level of trust the parties have with each other, identified intermediaries and governing bodies involved in the ecosystem.

Finally Payments

Barter, gold sovereign, IOU, government or bank back notes and coins, checks, cards, account based solutions, digital coins and what next. Payments have been this ever evolving space. Some seek to monetize the methods businesses, consumers and governments use to pay for the good and services they seek to acquirer, use or explore. Others argue that the cost of payment should not be a source of profit. The interesting twist here is more about the stage an economy is at in their migration from one from of payment to another. Questions of legacy and history limit a markets ability to embrace the new and retire the old.

We could shift the conversation and focus on the store of funds: be it the safe in the wall, the checking or savings account at an institutions or digital coins stored in digital memory. We could talk about the entities that focus on the experience and employ the already existing mechanisms. We could think about block chain, crypto currency, identity and authentication.

Does the consumer care? or would we be pleased to simply hear the merchant say thank you for your payment. The frictionless experience of get out of an Uber car or when we click the buy button on Amazon we know the payment will be made and that we will see a receipt in our email. Remove the friction and make sure that only what I owe is paid, that is the experience we seek. We the consumer are not interested in the detail. We just want to know we successfully paid, using the source of funds we set up as our default.

In Conclusion

Yesterday, with this blog incomplete, I listened to The Economist article titled Rousseau, Marx and Nietzsche – The prophets of illiberal progress – Terrible things have been done in their name. What grabbed my attention is that it spoke to the depth of my wider concerns. The article concludes with the following:

The path from illiberal progress to terror is easy to plot. Debate about how to improve the world loses its purpose—because of Marx’s certitude about progress, Rousseau’s pessimism or Nietzsche’s subjectivity. Power accretes—explicitly to economic classes in the thought of Marx and the übermenschen in Nietzsche, and through the subversive manipulation of the general will in Rousseau. And accreted power tramples over the dignity of the individual—because that is what power does.

As I think of our capitalist environment, I am concerned and wonder if the publication of the Economist article is timed to educate and alarm. The reality is we are experiencing a concentration of power leading to an increase in the distance between those in the upper 1% and those we call the middle class. Therefore, there is a need to about what is good for the whole, yes a tiny bit of socialism, to restore balance to make sure the wealth and benefits accrue to all and not just the few.

As identification, authentication and payment systems, discussed above, evolves we need to think about the structure of how these solutions will be offered to the market. Are we seeking to address a social issue like crime or terrorism? Are we seeking to improve confidence? Are we attempting to focus on the consumer, citizen and employee needs? Or, is it all about shareholder value and the search for profit?

Like in the article discusses, my fear is Profit will create confusion and complexity. Not more convenient and frictionless experiences.

NYTimes: Transaction Costs and Tethers: Why I’m a Crypto Skeptic

Transaction Costs and Tethers: Why I’m a Crypto Skeptic https://nyti.ms/2NYYSdw

As a technologist with an understanding of cryptography and very aware that in order to remain secure and tamper proof we increasingly increase the complexity of the work to assure the integrity of what we are using cryptography to protect. I wonder why so many people got so excited about Bit coin and Blockchain. As I have written before the cost to assure the integrity of the ledgar. Be it the original work to calculate the nonce or the subsequent work to confirm that the nonce the miner calculated was the right one, there is a need to spend money buying work specific computers, renting or building a facility to houses these work units and the power to cool and run these computers.

Mr. Krugman properly outlines the challenges. He effectively focuses on two issues. The cost and the idea of tethering.

It is this need to identify the value of the coin. Governments help to stabilize their defined currency. The intrinsic value or use of Gold, establishes its value.

Understanding and being able to clearly articulate how cryptocurrencies are valued and how then can achieve the stability necessary to support commerce is essential. This is what tethering is about. How do we establish and more importantly share the nature of the valuation.

Could a US Cryptocurrency Prevent Systemic Harm to the Underbanked and Underserved?

I recently absorbed the following article and offer the following reflections.

Frankly, it disturbed my social consciousness.

http://paymentsjournal.com/there-are-an-estimated-how-many-million-smartphones-in-the-hands-of-us-consumers/

An article answering the question can now be found at this link.
http://paymentsjournal.com/could-a-us-cryptocurrency-prevent-systemic-harm-to-the-underbanked-and-underserved/

After reading the article, I thought about this graph derived from the US Census. What income level equates to that of the un-banked? I think of my expenses and about the expenses most people are dealing with. Health issuance for two people in Georgia is $1,100 a month. That’s a lot of people struggling to make sure they at least have health insurance! If $53,700 is the median income and $13 thousand is spent on health Insurance, and then we consider all the other daily expenses we need to live: food, medicine, co-pay, gas, utilities …

Then I remember an economics report which claimed that the hourly wage required to afford a place to live in the least expensive part of the US was something just over $15/hour. All of this causes me to ask the question – At what income do people find it of value to have a banking relationship, e.g. a card?

Those who argue that we should migrate from Cash to Card should remember the primary motivation for credit cards is directly related to the profits and revenue the banks, processors and other players who touch the flow of money earn from processing the payment transaction, and the revenues earned by lending money (i.e., a credit card) or by holding your money (a debit card).

Sure, we could propose giving the poor pre-paid cards, as some of the Government’s entitlement programs already do. But then who will be responsible for the fees to manage the program and who will earn the interchange from each transaction?

The service fees, OK, maybe we the taxpayer will cover, given the perceived social value of supporting the poor. On the other hand, entitlement is perceived by many to be a scheme to support the lazy, therefore many would say that the fees are part of what the entitlement should cover.

Let’s get back to the real subject at hand: What is the most economic form of payment and are crypto-currencies the future?

In the world of cards, interchange is a cost to the merchant and revenue to the Banks. Therefore, since merchants end up loading their processing costs into their price, the consumer pays. Those who advocate migration away from cash recognize and argue cash has costs, for intance:

Cost of Employee pilferage
Cost to store and carry to the bank
Cost to handle and count

Many would agree that a card is cheaper. Others would argue they are not. This becomes a question of faith in your employees, the cost of a safe and a visit to the bank and the fun of sitting up at night counting your earnings.

Are crypto-currencies an answer? At whose cost? The nodes or miners who maintain the Blockchain need to be paid to ensure the immutability and consensus inherent in the Bitcoin model. Someone must pay.

This begs the question: Which is more expensive to society?

Cards
Crypto-currencies
Checks
Cash
Coins
Certificates – in other words, tokens

Could a US Cryptocurrency Prevent Systemic Harm to the Underbanked and Underserved?

cryptocurrencies

A toll on the Massachusetts turnpike is $4.00, unless you can’t afford an EZPass then it will cost you $7.35*. This article published in Convenience, the web site of National Association of Convenience Stores (NACS), points out that restaurants are also increasingly eliminating cash and that the impact this has on the poor has finally started to create some pushback in D.C.:

“As more restaurants go cashless, a backlash is building, especially in the nation’s capital, where an increasing number of fast-casual eateries are only accepting credit or debit cards and mobile payments, the Washington Post reports. Sweetgreen, a national chain, doesn’t accept cash at most locations, including its Washington, D.C., unit, while Menchie’s, Barcelona Wine Bar, The Bruery, Jetties and Surfside in the District also refuse cash payments.

‘By denying the ability to use cash as a payment, businesses are effectively telling lower income and younger patrons that they are not welcome,’ said D.C. Council member David Grosso, who has introduced a bill that would require retailers to let customers pay in cash. Chicago didn’t pass a similar bill last year, and Massachusetts has a 1978 law on the books that’s for cash payments but it hasn’t been enforced regularly, according to the state retailers association.” (Emphasis by Payments Journal)

I was unaware of the 1978 Massachusetts law described here, but clearly MassDOT and the Massachusetts legislature are more interested in how it will spend the money saved and the new revenue generated than it is in old laws. The fact that the policy to go all electronic will also increase late payment fines from the poor, perhaps even putting some in jail for non-payment, is just icing on the cake.

In our rush to save money we have ignored the systemic biases this action creates against the poor (if you doubt this statement reread the Justice Department’s report on Ferguson Missouri and how the town’s cost cutting measures created that very same bias). My dollar bill states that “THIS NOTE IS LEGAL TENDER FOR ALL DEBTS, PUBLIC AND PRIVATE” and yet nobody is considering how this is becoming less true every day and the impact that reality will have and it isn’t just the poor.

It is ludicrous to think that paper currency can survive even as everything around us shifts to electronic bits that are controlled by software. But we mustn’t ignore the ramifications of this shift. Consider what the future would be like if all payments are electronic utilizing our existing payments infrastructure. It is likely the cost burden would move from the Federal government (that prints money) to all the entities that need to send or accept money (because they pay the network and processing fees). In this scenario a) the government will see significant savings, b) the entities making a payment will see increased costs, and c) payment networks will receive increased revenue and profits.

If we would prefer to keep the status quo then the Federal government should support an electronic form of tender, establishing a cryptocurrency that replaces paper but is also recognized as “LEGAL TENDER FOR ALL DEBTS, PUBLIC AND PRIVATE”.

If not done relatively soon, say in the next 5-8 years, then every state and private payment network will be so entrenched that it would likely prove too difficult and costly to switch.

* The difference described above is for anyone driving 113 miles between Natick and West Stockbridge according to MassDOT’s toll calculator

What is EMVCo goal with the release of their SRC framework

October 2017 EMVCo published version 1.o of their Secure Remote Commerce Technical Framework. Today I decided to read and appreciate what they are trying to accomplish and then consider how it ties into what I remember and think we need to do moving forward.

Clearly the challenge links back to the now infamous New Yorker Cartoon. We have not successfully established a means of assuring the identity of an individual when presenting payment credentials (the PAN, Expiry date, name, billing address and CVV. The first attempt, still not 100% implemented, was the introduction of CVV2, CVC2 or CID a 3 or 4 digit number printed on the back or the front of the payment card.

We then developed something called SET or Secure Electronic Transactions and unfortunately the payment networks were not willing to allow Bill Gates and Microsoft to earn 0.25% of every sale for every transaction secured by SET he proposed to build into Microsoft’s browser. Without easy integration into the consumer browser, the challenges of integrating SET into the merchant web pages and the Issuer authorization systems caused this effort to fail the death of some many other noble but complicated attempts to create a means of digital authentication.

Next came 3D-Secure, a patented solution Visa developed. It offered what was considered a reasonable solution to Cardholder authentication. Unfortunately, given the state of HTML and the voracious use of pop-ups, the incremental friction, led to abandon shopping carts and consumer confusion. Another aborted attempt at Internet fraud mitigation.

Yet 3D-Secure was not a total failure. Many tried to enhance it, exploit it and avail themselves of the shift of liability back to the Issuer. Encouraging consumer engagement and adoption was futile in some markets mandated and cumbersome in others.

Now let’s consider what EMVCo is attempting to do with their Secure Remote Commerce Technical Framework. As I started to read, I ran into this:

“As remote commerce becomes increasingly targeted and susceptible to compromise, it is important to establish common specifications that protect and serve Consumers and merchants.”

Clearly the authors do not have institutional memory and cannot remember the various attempts alumni of these same organizations spent time on and encouraged many to invest in their implementing. Clearly this lack of historic context will leave some pondering the purpose of this paper.

I then read this sentence and reflect back on a recent hearing on “Social Security Numbers Loss and Theft Prevention” in front of The House Ways and Means Subcommittee on Social Security

“Over time the Consumer has been trained to enter Payment Data and related checkout data anywhere, making it easy for bad actors to compromise data and then attempt fraud.”

Once again, I stand troubled by how the Payment Data clearly printed on the face of the card and especially the PAN, 11-19 digits, designed to simply be an identifier, was converted into an authenticator. Like the social security number, the drivers license number, the passport number and your library card number, the PAN and other “Payment Data” was never designed to be an authenticator. It was meant to be data a merchant could freely record.

The secure features of the card now the EMV cryptographic techniques otherwise referred to as the Application Request Cryptogram “ARQC” were meant to offer the “What You Have” factor in a multi-factor authentication scheme.

As I began to appreciate the scope of this document, the term “Consumer Device” becomes critical. I began to wonder if a PC is a consumer device or if a consumer device is only something like a mobile phone, watch or other like appliance. Fortunately, later in the document, the definition clears up any confusion created by the earlier use of this term.. This said, I then wonder about the difference between what they define as Cardholder Authentication and Consumer Verification?

After reading through all the definitions, I ponder why the authors had to change terminology? Why could they not embrace known and recognized nomenclature. Do we need a new vocabulary?

I wondered:

If this is another attempt to create a revenue stream for the payment networks?

Or, is this the effort of a “closed standards” body to reduce the potential value of the W3C WebPayments activity?

In search of an answer to this last question, I found this discrete comment inside the SRC FAQ.

9. Are any other industry bodies working in this area?

EMV SRC is focused on providing consistency and security for card-based payments within remote payment environments.

EMVCo aims to work closely with industry participants such as W3C to capitalise on opportunities for alignment where appropriate.

Having read bits and pieces of this and the WebPayments efforts one does wonder what is EMVCo trying to do. We shall see?

Why do we need Tokens and Tokenization

Recently I was directed to a link http://paymentsjournal.com/tokens-work-because/ and wanted to write the author Sarah Grotta. As I wrote the message crystallized in my head and maybe as this prior post already discussed, this idea of tokenization made me cringe.

I contend that Tokens exist because we turned the PAN Personal / Primary Account Number, like we turned the SSN Social Security Number, into an authenticator. One can must ask the question. How can a random value (an identifier) become an authenticator and remain secure?

EMV works because it renders the Card unique, hence addressing the question of counterfeit, by employing the first factor of the classic MFA Multi-Factor Authentication concept “What You Have”. EMV defined a common set of secrets and digital credentials; securely stored in a Secure Element or Chip Card.

We here in the United States decided not to implement the second factor, the Personal Identification Number or PIN, for a variety of reasons. Hence, why Lost and Stolen remains an issue or weakness in the American Card Payment environment.

Biometrics are emerging and could solve for the assurance of cardholder presence. The challenge is how to effectively (cost and convenience) locate the biometric sensor and facilitate the matching of the sensors output to the persons registered biometric. Let alone, how does one make sure the right persons biometric was registered and associated with the device.

In the mail order / telephone order, now cyberspace, we did not replicate merchant authentication, the first factor – “What You Have. The card, once was secured with things like the magnetic stripe, using CVV1, the Hologram and the other physical features. We simply shifted the liability to the merchant and called it a “card not present” transaction.

People can claim all sorts of goodness because of tokenization. They can talk about how the EMVCo’s tokenization framework describes the use of tokens in device and domain specific scenarios. All of this, an issuer, could have done; if they, like some did, simply issued another number, a PAN, to the wife, bracelet, watch, ring or whatever other permutation they deemed appropriate. They can talk about dynamic data. yet what they often forget to include when they use the words “Dynamic Data” they are really talking about a cryptographic value as described in EMVCo Book 2.

Yes, this does mean the question of how the PAN and its digital credentials get deployed; has to be addressed. This said, GSMA with EPC did offer some thoughts, last decade, when they described the Trusted Service Manager

Instead handset oligopolies replaced the MNO with the their Mobile Pay wallets. They working with the Payment Networks and focused on control and the creation of income. They, as monopolist will, have created barriers, restricting others from offering comparable services. The TSP now becomes this restrictive service that guarantees the power of companies like Apple and Google, supported by their friends, the payment network operators.

The original article also spoke of the PAR; another data element merchants, processors and the industry, will have to invest in supporting.

I ask the question.

If we had assured the authentication and verification of every payment transaction
Using Multi-Factor Authentication
Why did we need to turn the PAN into a dynamic value?

My contention, simply use the appropriate level of cryptography.

If the Issuer or their processor is in control and understands basic EMV and Cryptography, then securing the PAN is not an issue.

Consider household financial management. If each member of a household has a unique PAN; budget, tax preparation and understanding who spent what where is a lot easier. The husband,wife and children should have their own unique PAN, stored in the clear in their devices and on their card.

The real requirement, my personal devices, including my payment card, simply need to be linked to one PAN their Personal Account Number, associated with the individual. The PAN Sequence number could easily allows each device to be uniquely identified, if necessary. The card and devices becomes the carrier of your identifier. A thing that can be authentication as something you have.

Here is where the second factor comes in. Is the person presenting the PAN the rightful and authorized individual? All this required, is assurance to the shareholders that the presentment of the PAN is a unique and authorized event. This is best achieve by using either something you know or something you are to bind the individual to the instrument carrying the Identifier.

Yes, a bit of friction to assure the consumer they are securely paying for what they want to buy

Since the World Wide Web came of age and merchants saw its potential. The question of how to secure the Card Not Present space, this question of cardholder presence, has not been properly addressed. Visa and MasterCard (when they were not for profit associations) created the utility of the Card Verification Result CVV2, CID or CVC2 which would be printed on on the card and not part of the magnetic stripe, the problem the bad guys could still steal the card or get hte card number and capture CVV2.. MasterCard and Visa then created SET, 3D-Secure and now, as for profit owners of EMVCo, are proposing, maybe even will mandate, the industry implement EMV 3D-Secure.

Each, an attempt to provide some means of Authentication and Verification.

Each introducing a level of friction as a means of security.

This is the problem. The market did not start by emphasizing the need for security by educating the consumer. The industry needed to help the consumer understand they should care and want to securely pay for what they intend to buy.

Instead:

The Zero Liability Policy was adopted.
The merchant was more than happy to sustain a degree of lose (fraud) in exchange for sales and profits.

The result, as all anticipated would happen, was blissfully ignored and eventually they cried out about.

Fraud migrated to the weakest point
Just like water finds its way to the lowest point.

EMV, introduced in the Face to Face card present environment, pushing the bad guys: be they criminals, state actors and terrorists to find alternate another channels for their financial gain.

EMV and now the recently published WebAuthN and FIDO specifications create effective mechanisms for Consumer Authentication.

Let us please remember – the PAN, a user name, your social security number or your email address are excellent Identifiers. They should not be authenticators and they are not a means of “Identification”.

Let us also remember, the term Identification means that one is assured of the irrefutability of identity.

The big question:

Why did we have to get rid of or replace the PAN?
Why did we and continue to need to invent and invest in all this addition overhead?
Why did we not simply address authentication?

Some will argue the challenge of using the PIN or a Password, as a means of Verification, is because it is to hard to remember. Especially, if each password people use to access website, services, building, has to be unique. Some will argue imposing friction to add security is not convenient. Others will remind us that security is and has been a necessity since the beginning of time.

Why didn’t we when we created this great new digital shopping mall?

Bottom line each of the devices used to present or acquire the PAN, must be capable of authenticating the identity of the authorized presenter, in both the physical and virtual world.

At least these are the views of someone who believe history provides a baseline for tomorrow and tomorrow must be designed as a function of where you want to be, knowing where things came from.

Of NFC, Mobile and History

Today I read Karen Augustine’s Mobile Payments Use in the U.S. Lags

As I read and reflected on what Karen wrote, I reflected on my experiences as a sagged payment consultant and executive, with international experience.

What I see is an issue of legacy and muscle memory – setting a pattern for the future. Said another way – our history defines the boundaries of our future.

Asia did not have electronic payments. I am sure did not want to embrace the globally dominate American solution. Therefore, they had the opportunity to start fresh. It is very much like what Spain went through, went they moved from cash to electronic card-based payments. They bypassed the check.

Her article brings back memories of life in Belgium in the 90’s. Writing a check was a rare occurrence. Direct debit mandates, a MisterCash card and a Eurocard was all we needed to buy and enjoy life. Electronic payments was the norm, paper checks were a rare oddity and cash, well yes there was a very present grey economy.

Here in the USA we developed our payment systems off the back of regional or state banks with acceptance networks limited to a local domain. Moving to a national system required early adoption of a common national currency. We then went on to replace IOUs with paper checks and store cards with credit cards. In time we enhances the ACH system and developed support for remote deposit and check capture.

Why do we need to move the card into the wallet? Why change habits that are comfortable and work? Most of us drive to shop and therefore must have our drivers license. We must carry a physical document with us. We simply carry two or more ID-1 sized cards.

You make the statement and was once again reminded of times past.

“… universal mobile wallets and more often driven from merchant based applications that often incorporate loyalty and rewards, which to date still remain nascent in universal mobile wallets.”

When I produced this rendering, back in 1996, I was on stage talking about a world where leather and technology converged. I imaged Bluetooth, NFC, secure elements, GPS and our various credentials converging into this personal device. Those credentials grouped into: travel, identity, membership, loyalty and payments; easy to find and present.

When contactless payments were introduced, in 2004, by Visa’s with PayWave and MasterCard’s PayPass; I argued why contactless cards – how can the issuer afford the extra dollar per card (cost of the antenna and inlay) and the merchant the extra 60 dollars to enable the NFC reader? The way Issuer income works, “Interchange”, the consumer would need to spend more on that issuer’s card. For the merchant to justify the necessary POS investment, meant the retailer believed the consumers would spend more, because it was “easier”. Was Tap To Pay going to make me spend more. Maybe for small ticket purchases, I may use cash less; but at the merchants expense! We argued the cost of cash was more than the Merchant Discount. Some agreed. Many wondered what the blank are they trying to sell us!

Around the same time America was exploring this contactless experience, the European Payment Council and GSMA debated and ultimately offered an approach for mobile card based contactless payments https://www.europeanpaymentscouncil.eu/sites/default/files/KB/files/EPC220-08-EPC-GSMA-TSM-WP-V1.pdf . Handset manufactures like Nokia had already added NFC Antenna’s to their mobile phones and mobile network operators, the MNO, saw the SIM as the secure element capable of holding payment credentials.

Some tried, the Trusted Service Manager as a service was developed and deployed. The challenge, the economics of the model. In this case the MNO saw revenue and wanted to charge fees to load the payment credential into the phone and better yet charge rent to store these payment cards in our phones. Again I ask the question, by changing the way we pay, do I cause us to want to spend more? I think not!

Maybe some would argue, with a credit card people am able to buy things today that they cannot afford. Let them end up in debt. This is true. But then is debt at 18% a good thing? Europeans simply decided to establish a line of credit, as a feature of a Current Account, at reasonable interest rates.

We could go on and talk about how Apple saw the possibility of a 0.15% income stream from ApplePay based mobile payments and how the EMVCo tokenization framework evolved to support their desire to protect the Apple Brand.

What is clear, we could solve George’s problem and replace his Full Grain Vegetable Tanned Cow Leather leather wallet with a Mobile Wallet managed by Apple, Google, Samsung or …

Or, we could think about the consumer and what they really want?

As your article made clear, and so many others have shared, Asia leaped forward. Be it AliPay or WeChat, the device, the mobile phone, became the consumers wallet, their method of engaging, shopping, learning and exploring.

We need to accept to simply replace what we are comfortable with, with something new; which does not enhance our experience, is simply not worth it!

Many of us, like Karen, would argue the experience of shopping is what the mobile phone can enhance and let the act of payment become the afterthought. A simple click to say – yes, I agree to pay.

Amazon got it right with One Click. Others, as the patent expires, are embracing the same technique to simplify payment to a friction-less act of satisfaction. When my favorite stores offer me an mobile app designed to enhance my shopping experience, to thrill me with offers and entice me with things I want; then yes I will become more loyal, I will shop at their store more frequently and maybe even buy a few things I did not intend to buy.

Many years ago while attending conference of groceries in Abu Dhabi – one of the speakers share an experience. when that supermarket executive instructed each store to put the beer across from the diapers, the intended result occurred. The husband, sent to get the diapers, ended up buying a six pack too.

Maybe, like this experience reveals, if we focus on the consumer experience and on delighting them. They will embrace change.

If there is no value why should we?

Years ago I prepared and published an idea. I called it Cando. I was still committed to the idea of the mobile wallet. I was an early adopter of the smart phone and saw its potential.

Block Chain a Conversation with Doug King at the SRPC event at the Federal Reserve of Atlanta

Blockchain_State of Retail Payments_04252018

Payment Card Construct and Dual Interface Deployment

Payment Card Construction

The discussion focused on the construction of the sandwich. Four layers. Clear front laminate to protect the ink, front with the banks design and brand logo, back with the banks back design and a clear laminate with the magnetic stripe integrated into it.

To enhance design additional layers may be added, such a metal foil.

These four sheets are then bonded together, at 120 degrees, in sheets of 21, 36 or 48 or other various sheet sizes. Next step punch out cards, add hologram and signature panel.

For a standard EMV card the next phase is to mill and embed the module with the chip inside. Last, the manufacturer typically loads the O/S & EMV application into the integrated circuit card.

When we move to dual interface caed, this process is modified to add an inlay, with the antenna embedded within. This inlay is inserted in the middle of the sandwich and during the embedded process the contacts exposed on the base of the module are connected to the antenna in the inlay.

Next step, personalization, when the appropriate data is loaded into the chip, along with the encoding of the magnetic strip and printing and/or embossing of the cardholders, name, expiry date, cvv2 and other information onto the card.

Contactless or Not That is a Question

Contactless NFC acceptance and dual interface issuance is all about the chicken and the egg. Who will go first? The merchant or the issuer? Each need each other. Both are wondering about the incremental value.

Faster transactions – Yes
Less cash – maybe
More revenue – good question!

In other parts of the world, transit and their choice of contactless, as the right answer to a more efficient fare collection solution is driving conversion. In other, markets a group decision to adopt or a desire to find the next great thing drives the market. Here in the USA, we have a less than successful history of contactless. Let’s not forget PayPass and PayWave, it was tried the middle of the last decade, to little or no success.

We have Google and the FinTech world looking to mobile payments as the next great adventure. Merchants, like Wal-Mart, are resisting NFC acceptance given their own plans for QR based wallets and desire to limit the sharing of data with competitors.

Given these questions and observations, one can only wonder.

The management of our identity

A few weeks ago I learned of the Sovrin Foundation a foundation interested in establish a concept to support the idea of a self Sovereign means of identity.

As an advocate for stronger forms of identification and more important Authentication I am pleased to have received your response today.

Back in 1993 I was part of Europay and drove the creation of the EMV specifications as a form of Authentication and frankly reflecting back a strong form of Identification with the Trust Anchor being the Financial institution issuing the card and the foundation anchor being the payment network that the issuer used to assure acceptance globally.

In 2013 I joined the Board of the FIDO Alliance and eventually become the Secretary of that Board.

Today I am engaged with a company called IPSIDY, that is promoting and selling Identity as a solution.

Clear the conversations we are having include:

Device based versus centralized biometric authentication
Identification based on a central repository of Biometrics or a simply identifier linked to a means of authentication
Claims and assertions one points (URL) to or those that one has in their own possession
Repositories or Distributed databases of information
Privacy of attributes and rights to defining what can be shared

When I ask about the future of Sovrin, I hear people saying great concept how does it scale to be useful.

This, as was my experience in the Payments world, is the challenge of a two sided market

Consumer – Merchant
Individual – Rely Party and those seeking attributes and proofs of identity

The challenge is developing a value proposition and more importantly critical mass that will excite both sides of the market to want to participate.

To further complicate developing the market is the challenge of the “Go To Market” strategy. Who does one partner with given that the usefulness to the citizen/consumer is predicated on the number of parties or places this solution, token or Identity with a set of sharable attributes can be usefully used.

This is the question this is the challenge.

A Shift from Check-out to Check-in will reshape the way merchants engage with their consumers

Think Uber, think order ahead, think account on file. With these ideas in your mind think engagement and Omni channel. Then consider the need of merchants to assure revenue by delighting and engaging with their customers in meaningful ways. Their focus, increasing basket size, more frequent visits and loyalty; in other words increased sales.

Then remember, Check-out is about friction, payments and long lines. These characteristics merchants seek to eliminate, reduce the cost of and enhance the experience around.

If we think Check-in, using big-data, geo-location, BLE, facial recognition, consumer centric apps and other techniques, we can image a world where human and device based personal assistants engage with the merchants loyal customers in a friendly, informed and satisfying way.

For payment people this means we need to remember that merchants want lower cost payments and friction-less check-out.

Bottom line, for loyal customers solutions that retain the payment credentials securely in the cloud. For one time and infrequent customers, they will look to incent loyalty and registration or simply accept classic means of payments e.g. cards.

This drive to move from recording a loyal customers visit to engaging when the customer arrives or better yet when they are doing their research is what we the consumer seek.

We are all about saving time, enjoying life and satisfying our needs and wants. Merchants that focus on the customer and their shopping experience will succeed and prosper./ Those that do not focus on delighting their customer will learn.

DIY the Cyber Guy a conversation about Bitcoin and EMV

https://www.voiceamerica.com/promo/episode/104814

A interesting discussion withDavid the the Cyber Guy. We spoke of the inherent risk of Bitcoins and the essential issue of the secret and a BitCoin folders resoponsibility to make sure they never lose the secret.

We then wandering off to talk about EMV or Chip and Pin.

Always a pleasure to work with David.

We must take care when we speak or sell the power of that which may not be

I always enjoy reading the words David writes.

This particular post creates a moment to reflect. As we consider the implications of the Fourth Industrial Revolution, we must remember the significance many have attributed to Artificial Intelligence. Those two letters AI are clearly key to the what, why and wherefore of the change ahead.

Clearly machines that work faster, search deeper and are capable of studying vast realms of data are changing the nature of so much. Simply consider the risks to our security cyber hackers and terrorists wrought on this world or the shenanigans many claim the Russians use to disrupt as they explore and exploit the power of social media.

Moreover as we look afield many industries are being disrupted: movies, books, music, news … to name few. Outsourcing and robotics is changing the nature of work and the skills necessary to compete and ultimately survive to enjoy the pleasures available in our increasingly digital world.

David makes the point that the intelligence Isaac Asimov and other science fiction envisioned has not yet emerged. I think he is right. The message I take aware -we who market these solutions should walk forward with care.

People are clearly feeling threatened by the change impacting their towns, families and livelihood.

We must be mindful that complexity breeds confusion. Confusion drives disillusion. This then causes people to react, often in nonsensical ways.

Take On Payments

Federal Reserve Bank of Atlanta

How Intelligent Is Artificial Intelligence?

Posted: Nov 27, 2017 10:51 am

At the recent Money20/20 conference, sessions on artificial intelligence (AI) joined those on friction in regulatory and technological innovation in dominating the agenda. A number of panels highlighted the competitive advantages AI tools offer companies. It didn’t matter if the topic was consumer marketing, fraud prevention, or product development—AI was the buzzword. One speaker noted the social good that could come from such technology, pointing to the work of a Stanford research team trying to identify individuals with a strong likelihood of developing diabetes by running an automated review of photographic images of their eyes. Another panel discussed the privacy and ethical issues around the use of artificial intelligence.

But do any of these applications marketed as AI pass Alan Turing’s 1950s now-famous Turing test defining true artificial intelligence? Turing was regarded as the father of computer science. It was his efforts during World War II that led a cryptographic team to break the Enigma code used by the Germans, as featured in the 2014 movie The Imitation Game. Turing once said, “A computer would deserve to be called intelligent if it could deceive a human into believing that it was human.” An annual competition held since 1991, aims to award a solid 18-karat gold medal and a monetary prize of $100,000 for the first computer whose responses are indistinguishable from a real human’s. To date, no one has received the gold medal, but every year, a bronze medal and smaller cash prize are given to the “most humanlike.”

Incidentally, many vendors seem to use artificial intelligence as a synonym for the terms deep learning and machine learning. Is this usage of AI mostly marketing hype for the neural network technology developed in the mid-1960s, now greatly improved thanks to the substantial increase in computing power? A 2016 Forbes article by Bernard Marr provides a good overview of the different terms and their applications.

My opinion is that none of the tools in the market today meet the threshold of true artificial intelligence based on Turing’s criteria. That isn’t to say the lack of this achievement should diminish the benefits that have already emerged and will continue to be generated in the future. Computing technology certainly has advanced to be able to handle complex mathematical and programmed instructions at a much faster rate than a human.

What are your thoughts?

By David Lott, a payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed

Will Wal-Mart Pay surpass Apple Pay, Samsung Pay and Android Pay

Walmart Pay to surpass from pymnts.com – from the Washington Post. – and another

To open the news and find more than a press release in fact true commentary describing the success of a merchant mobile payment solution. This is big news and speaks to the value of loyalty and the power of largest global merchants willingness to focus and innovate.

Thinking about cards

In 1991 I had to learn the difference between million dollar transactions and hundred dollar transactions. As I came to explain, when telling my life story, I had to shift my thinking from 100 transactions at a million to 1,000,000 for a hundred. This transition took me from capital markets to payment cards.

Today, I wonder about the future of the ID-1 based payment card? A piece of plastic 3 3/8 x 2 1/8 with rounded corners.

In another blog I spoke of how this ID-1 object became a token responsible to act as the first factor, something you have. Printed, encoded and embossed characteristics were the security features. Today, with EMV as the global standard for payment CARD security; cryptography and the “secure element” replace those physical security with digitally mastered circuitry embedded inside something capable of protecting those secrets cryptography requires. We digitized the payment card. What we now must do is shift our vocabulary to tokens and credentials.

We need to embrace a new way of speaking we need to think about our “Payment Credentials”.

Today, we now tap our phone to pay, we use our phone to browse the internet, we shop & book tickets with apps and we listen to music & watch movies all from this device we apparently use, thousands of times a day. For those of us who remember computers that filled floors, we now are capable of buying more powerful computers, similar in size to those same cards. Think about the Raspberry Pi, a computer almost as small as a card, not quite! Yet!

The embedded secure element integrated inside our payment cards are being integrated into phones, bracelets, rings and things. The question; will they replace the card we are now comfortable with? Yes – maybe? Will we embrace these objects as the new carriers of our payment credentials? Many hope so.

In oder to think about the probability of cards disappearing, one must begin by think about the number of cards now in circulation. In round numbers we can think about 1.2 billion debit and credit cards, 300 million prepaid cards and 300 million retail branded cards. In round numbers, 1.8 billion payment cards. We next must think about our population and how many people now carry cards – 115 million households and 242 million Americans over the age of 16, according to a recent census. We now has a numerator and a set of denominators.

The question then becomes, how many payment cards does an American want to carry and how many payment credentials will an American end up having.

I would argue a debit card and a credit card is all we need to carry in our leather wallet, purse or pockets. Those other payment credentials can easily be accessed from wallets in the cloud or in our digital objects.

Merchants can integrate payment capabilities and focus on factoring their consumer receivables, behind relationships designed to service, thrill and sell. In an App and API enables economy, cards become a burden as the experience becomes the essential component of our lives.

Deciphering Digital – Your Phone is Your Wallet

Today Wednesday October 18, 2017. I had the opportunity to provide the closing keynote to the EPCOR Annual Payments conference. Today, I was reminded of the reality that payments is not only about cards it is the engine that fuels the revenue of a financial institution. ACH, Wires, Cards, checks, transfers and even cash are revenue earning services; our community banks call payments.

My speach was about the future and focused on the evolution of our phone in this new digital age we all must learn to embrace.

A look at the actors that support Internet Payments

The payment landscape is a complex space with an array of stakeholders specializing a focusing on various aspects of the processing of a payment. This diagram is oneof several used to form a backdrop to various educational sessions Philip offers to organizations and executives seeking to identify and position themselves in the payments landscape.

This particular one seeks to help people understand who the key actors to a card not present eCommerce transactions.

IoT Payments Wednesday Morning

Continuation of my running thoughts as I listen and participate at the Secure Technology Alliance.

Role of the TSP

Wearables a small part of the IoT market and to scale the vendors need to not have to worry about “Payments”.
Should device manufactures understand payments? Can they?
The TSP must appreciate its role and what it is not.
As we look at IoT we need to recognize the scale of the shift from a issuer centric to a consumer centric model. The payment credential carrier no long belongs to the Issuer.

What is the role of the Token Requestor? It provides a consolidated view for the consumer. It consolidates rhe view of all the edge devices.
Who is the ultimate revenue source? The consumer? How does one create the consolidated view with so many instances of tokens?
What is the life of a token? This then leads to the question of the relationship with the manager (issuer) of the Means of Payment.
With the pre-provisioned credential how does one manage long term life cycle.

Root of Trust

Is PKi the right approach to the necessary level of trust this emerging environment requires.
We must remember the complexity of a PKi infrastructure.
In the payment space the use of secure devices e.g. HSM was mainly on the acquiring side. Now as a result of EMV issuers became much more concerned with keys and key management.
As we move into a mobile and more broadly connected world the need to assure trust in the software, device whatever.
This discussion is very much about the value and need for HSMs.
The question is raised as to the future of PKi given the US Gov’t perspective.
And, what of the introduction of Quantum Computing and the associated risk to the available cryptographic algorithms and keys?

In-Vehicle Payments

A car can be used a place to shop, it could pay for service rendered, it can be linked to service providers. NFC/BLE/In-app and Card on File.
The car can host merchant apps.
The idea of a POS device in the car leaves me lost. Who is the seller?

Smart Cities and Multi-Modal

To address smart cities one has to think across the wider context.
What are the roles the FTA can support, becomes a question of what the cities want.
Mobility on Demand driven by the needs to reduce congestion and improve life.
Built on local partnership within the community
A recognition that a multimodal approach is necessary. A focus on user centric approaches to transport.

Multimodal Payment Integration

The challenge begins with the fragmentation of the transit environment. It is not transit it is all about Mobility.
They want a brand and system agnostic solution that is intelligent and can help better manage spend.
How large is transit, public only, 6,500 transit operators supporting 1 trillion rides per year.
The roadmap is in development, it is early days.

Wearables – lessons learned

What ìs a wearable? Do define them based of feature and function. Cloths, jewelry…
We use a wearable when we need them. Athletic, climate, entertainment or work.
These electronic wearable needs to consider the use cases that should be integrated into a limited number of devices we would wear.
Three words – simple – connected – enablements
How will we enable more specifically load the various certificates we need to access, employ and pay for.
Interoperability will become the challenge. Do we imagine a world restricted by brand / manufacturer? Or, open to a wide array of designs and capabilities then how do we get there.
Secure element
Data management & personalization
Mobile device software integration
Device life cycle management

Tokenization as a methodology ans ecosystem is essential to the growth of payment in the IoT space.

BLE of IoT Payments

The cloud may restrict what could be communicated.
BLE is “local” allowing secure application management and secure transactions.

Managing Trust and Security

Identity is the key to much.
The next question therefore it trust in the Identifier.
Authentication with what, in what where?
Life cycle management. How do you know your device been wiped clean of all your credentials.

Philip Andreae & Associates is Open for Business

With decades of experience in public speaking, management, payments, information technology, cybersecurity, business development and marketing; Philip Andreae is available to help you and your team develop and implement your products and business strategies.