Tag: Senior Advisor

What has this world come to

When we listen to the news, we must think first of the bias of the reporter. This unfortunate truth is troubling in a world where the United States leader speaks of fake news and uses Twitter to stir up the masses. This body of citizens struggles with truth and is easily bent to believe what the leader says.

This particular charismatic leader, like many others in the past, can cause people to believe anything. The challenge, these same people will follow both those with high morals and those without.

Jesus Christ, Siddhartha Gautama, Confucius, Laozi, and a few others spoke wisely and became spiritual leaders many continue to follow.

To name one well remembered, Hitler, like the recent President of this great country, spread lies, and fermented hatred.

How can we rise above when so many are unwilling or unable to see the truth.  We must rise above the madness these charismatic immoral individuals ferment.

That is the concern I have felt since first I looked upon the control a church exerts upon the mass.

EMVCo Good or Evil

https://www.securepaymentspartnership.com/wp-content/uploads/2019/12/Payment_Insecurity_Final.pdf

In 1993, I was asked by the then CEO of Europay International to establish a relationship with Mastercard, and Visa focused on developing the specifications necessary to assure the interoperability of chip card-based security for credit and debit payment cards. The result published in 1996 was the “EMV Integrated Circuit Card Specifications for Payment Systems.”

From these humble beginnings, EMVCo has emerged as a key organization in managing the standards behind card payment systems.  In the white paper Payment Insecurity, commissioned by the Secure Payment Partnership, the author reminds us of the difference between standards managed by an open body and those tightly controlled by an exclusive group of competitors. One wonders if the owners of EMVCo will listen and strive to open up their membership or continue to use this entity to protect their proprietary interests.

In the introduction, the author speaks of a series of questions he intends to address.  The first question of the paper

Is EMVCo furthering the entire U.S. payments industry or simply protecting Visa and Mastercard’s market share? page 5

begs the question, why limit the discussion to the USA?

This American only focus is driven by the desires of the Unaffiliated Debit Networks and a set of merchants.  The paper ignores fundamental and, yes, anti-competitive elements of the EMV specification – the AID or the Application Identifier.  It was and is directly related to the Brand responsible for the underlining technology incorporated into the Chip.

I then read the following complaint and am driven to ask how the consumer interpreted the prior Debit versus Credit prompts.

Visa’s response to this solution was to require merchants to display to consumers a choice between “Visa Debit” and “U.S.
Debit” at checkout. – page 13

In essence, what Visa required was simple, the terminal should comply with the EMV specification for “application selection,” key and inherent in the multi-application design of EMV and the underlining ISO 7816.

Moving further into the document in Section 6.1, the author attempts to document the history leading to the creation of EMVCo.  As one of the founding members, the author’s sources were not involved and did not understand the history.

First, only France had a smart card solution designed to address Credit and Debit card fraud.  They referred to their implementation as B Zero Prime.

Second, the UK in 1995 was driven by Visa to embrace an earlier version of the Visa specifications adapted to the unique requirements of the UK market and branded UKIS.  UKIS and the unique UK requirements are responsible for changing many of the shall’s in the EMV 2.0 version of the specifications to should’s in the EMV 3.0 version.  This accommodation was the result of legacy limitation within the X25 network the United Kingdom depended on for card authorizations.

To further identify issues with his record of history, the statement on page 22

EMVCo developed standards for chip cards that could work with credit, debit and stored-value cards

It is fair to suggest EMV attempted to incorporate Stored-Value cards in the specification.  But as a result of the competitive realities of Europay’s Clip, Mastercard’s Mondex, and Visa Visa Cash stored value solutions, they agreed to exclude stored value cards from the specifications.

It then goes on to suggest EMV compromised and offered a Signature option.  There was not a compromise; it was intentional.  The goal, afford the Issuer the ability to determine, by Cardholder, which cardholder verification method they could be configured for.  One need was to address issues of the disabled, e.g., the Blind.

Debit Routing as a result of the Durbin amendment.  One might wonder why EMV did not consider this idea of multiple networks associated with a card.

EMVCo was unable and unwilling to resolve the lack of a debit AID because EMV was never designed for the U.S. market.

I sense that there is another front coming out of the Debit Networks seeking to argue the anti-competitive nature of EMV.  The paper, link below, draws me to wonder about the argumentation surrounding “Application Selection.”  Please let’s get back to basics – the “AID=Brand=Payment Scheme” drives “Routing.”

On page 13, it argues consumer confusion.   I would argue it ignores the past.  The EMV default user prompts of “Visa Debit” and “US Debit” are no more confusing than the historic “Credit,” and “Debit” prompts.  I would argue consumer confusion already existed.  The EMV specification for Application Selection simply afforded the Issuer the ability to provide more descriptive prompts by employing the “Application Preferred Name” instead of the default “Application Label.”

This whole fight surrounding EMV and Payment Security is really a fight about the future of Card Payments.  On one face, they argue the Payment Networks did not assure the security of the card payments to protect revenue. On the other hand, they argue EMVCo is a closed standards organization designed to protect and assure the interests of its shareholders, without consideration for the other stakeholders in the payment, e.g., the merchant.

In the end, the argument comes down to the role, definition, and control.   How we structure the underlining payment transaction is what we need to talk about.  Who provides the mechanism, guarantee, and support for a particular mechanism decides the rules.

The Surveillance State Exists for Profit

I hope we all understand the data collected on each of us

https://www.nytimes.com/interactive/2019/opinion/internet-privacy-project.html

https://www.nytimes.com/interactive/2019/12/19/opinion/location-tracking-cell-phone.html

As a technologist, the revelation of what is available did not surprise me. I understood how location can easily be captured from all of the electronic devices I use. Be it the GPS chip, the triangulation of Cell Towers or the IP address of the router I am using to access the Internet. Where I am is easily acquired by any application or server I am employing.

What bothered me is that “We the People” have not pushed our governments to regulate the capture and use of this very personal information and data. What bothers me is that most of the citizens of this country or this world do not take the time to read the terms and conditions or the privacy statements provided to us and so often simply consented to them without a thought. And, if they did read them, most of us would not appreciate the language and therefore the meaning of these legal documents.

The surveillance state is real. Marketing companies, employers and so many others are buying the data and using it to improve their delivery of services, advertisements and so much more.

https://www.linkedin.com/pulse/i-hope-we-all-understand-data-collected-each-us-philip-andreae/

 

The Identifier should not be the Authenticator

I was asked to look into the value of the EMV Secure Remote Commerce Specifications.  In the first section they wrote:

“1.1 Background … While security of payments in the physical terminal environment have improved with the introduction of EMV specifications, there have been no such specifications for the remote commerce environment. …”

This statement caused a bit of angst.  It caused me to think of the work to create SET and Visa’s efforts to promote the original version of 3D-Secure.  I was further reminded of how difficult it has been to find the balance between convenience and fraud and how merchants are more worried about abandonment than they are about the cost of fraud. Ultimately, it caused me to wonder about the goal of the EMV 3-D Secure specification.

“To reflect current and future market requirements, the payments industry recognised the need to create a new 3-D Secure specification that would support app-based authentication and integration with digital wallets, as well as traditional browser-based e-commerce transactions. This led to the development and publication of the EMV® 3-D Secure – Protocol and Core Functions Specification. The specification takes into account these new payment channels and supports the delivery of industry leading security, performance and user experience.”

The keywords found in the last sentence “the delivery of industry leading security, performance and user experience” suggest these two specifications are searching to solve the same problem.

According to the Oxford dictionary

Security is

    • “The state of being free from danger or threat.”
    • “Procedures followed or measures taken to ensure the security of a state or organization.”

Authentication is

    • “The process or action of proving or showing something to be true, genuine, or valid.”
    • “Computing The process or action of verifying the identity of a user or process.“

On this same page, the authors go on to make the following statement

“… there is no common specification to address the functional interactions and transmission of data between the participants.”

This then causes me to wonder about the original ISO 8583 specification, the current ISO 20022 specification, and the subsequent concept of the three-domain model within the 3D-Secure specification.  All three of these specifications define the interaction between the participants while not restricting the method of transmitting the data.  It seems the authors of the SRC specifications have forgotten history.  Or, are they trying to rewrite history.

At this stage, Authentication seems to the most important part of what EMV is attempting to address.  But,  the focus seems to be more about rewriting history that solving the fundamental problem.  We seem to have this desire to take public identifiers and convert them into secrets.

“An industry transition from a dependency on Consumer entry of PAN data can be accomplished by providing an SRC specification that meets the needs of all stakeholders involved.”

These intriguing contradictions beg the question.  Why did the authors of the Secure Remote Commerce specification not reference the good work of those that created the 3D-Secure specification and propose an approach unlike EMV?  They all are part of the same organization!

Is the goal not to address authentication and Security of the payment transactions, be they instore or on the Internet.  I would argue

We allowed the PAN, the payment card identifier, to become a means of authentication

This use of the PAN as both an identifier and an authenticator; reminds me of a hearing of the United States House Committee on Ways and Means May 17th, 2018 hearing on “Securing Americans’ Identities: The Future of the Social Security Number”.

“House Ways and Means Social Security Subcommittee Chairman Sam Johnson (R-TX) announced today that the Subcommittee will hold a hearing entitled “Securing Americans’ Identities: The Future of the Social Security Number.” The hearing will focus on the dangers of the use of the Social Security number (SSN) as both an identifier and authenticator, and examine policy considerations and possible solutions to mitigate the consequences of SSN loss or theft.”

All the witnesses and most of our members of congress accepted and understood the problem.  We allowed a simple government-issued identifier to become a means of authentication, in other words, an authenticator.  Like allowing the social security number and now also the PAN to become part of how we authentic someone’s identity.  We caused these publically available identifiers to become valuable and sensitive PII data.

Cardholder Authentication and Consumer Device Identification

What is clear, as one continues reading the SRC specifications, is the goal is to reduce the frequency of presenting payment credentials on merchant websites.

“Minimising the number of times Consumers enter their Payment Data by enabling consistent identification of the Consumer and/or the Consumer Device”

A very different approach to what the payment schemes do with the EMV based payment process.  The authors of EMV saw the PAN as public data, they architected something designed to assure the uniqueness of the card and the ability to positively verify cardholder.  Card Authentication and Cardholder Verification.

Why not simply think and focus on the same architecture?  Simply change the word “card” to “device” and focus on Device Authentication and Cardholder Verification or as everyone is promoting Multi-Factor Authentication.  We simply need to make sure the thing is genuine and the right individual is using the thing.  The thing is what the cardholder has – The “what you have” factor.  Add a pin/password or better still a biometric to be the second factor the “what you know” or “what you are” factor.

EMV 3D-Secure creates the ability to exploit the “what you have” factor by offering Device fingerprint data to the issuer’s authentication process.

 

Pay to be Paid

An interesting concern and a telling phrase. When one Googles the phrase “Pay to the Paid” the result takes us into the contracts associated with Protection and Indemnity insurance P&I.

When I entered the search term, I was thinking about how financial institutions see ‘payments’ as a revenue source. In particular, the word ‘Interchange’ springs to mind. I remember sitting in a management meeting in Foster City, at the Visa International offices, as we discussed the results of a McKinsey study this study stated the banks were not earning from their most frequent activity – processing payments.

We then as Visa saw a need to help our members appreciate the breadth and complexity of this simple word “Payment”. Payment Zsars and Gurus were all the rage. International Banks spent millions to create payment factories capable of supporting ACH, WIRE, Swift and card payment. Was the goal to streamline the process? For some, yes!  For others, the focus was on reducing costs. For others, they focused on creating a sticky proposition capable of assuring long term relationships with their corporate clientele. For all, increase revenue and profit.

Did any actually think to focus on streamlining the mechanical process of moving money between two individuals or entities? Many will argue yes. Why did they not seek to develop Real-time Gross Settlement Systems, RTGS? Why is it only new economies that saw these opportunities?

The answer often comes back to the fear of cannibalizing existing sources of revenue or even worse making a legacy solution redundant.

It is time to move to Multi-Factor Authentication built on a Restricted Operating Environment

Passwords should become a thing of the past. Here’s why

This morning one of my Google alerts found a blog coming from the World Economic Forum.  It reminds us of the inventor of the password Fernando Corbato.  In an interview with the Wall Street Journal, he said passwords have become “a nightmare”.

The open question is how do we solve for the nightmare of password management we have created that is both effortless and secure.

This article calls for private enterprise and our governments to find answers.  I hope in finding these answers capitalism and profit do not become the reason to act.  I hope social responsibility and community action drive all to find answers that are affordable, convenient, secure and more importantly consumer-friendly.

Where are we

Today.

How many passwords are you trying to manage!  Does your LinkedIn contact list connecting you to more than  4,000 individuals?  Does Facebook, Instagram, and other social media websites inundating you with news and stories about your friends, colleagues and interesting people?

How many cookies have your computers accumulated?  How many databases have more information about you than they need?  If we search the dark web, how valuable is your data?

Cando seeks to help you manage your data, identity, assets, and relationships.

Philip lives on Sea Island with his 93-year-old father, the Doctor.  They pursue travel and Philip keeps his head into what is happening in financial services, blockchain, authentication, digital identity, and, whatever else people seeking to understand the transformation; particularly those in the identity and payments space.

What is happening means we can unlock our hotel rooms, cars, and homes from our phones. Our security system iwill be another app we have to find on our phone.

Instead, we need an intuitive assistant seeking to simplify our lives by taking on repetitive tasks like driving, working inside a data table or simply opening up the house for the season.

Normalizing data and performing the analysis capable of earning value is the name of the game.  Management is about stimulating a team to work in the mutual interest of the organization.  Executives define the strategy and articulate the vision in a manner conducive to success.

Cando seeks to help you manage your assets and relationships.  Assets those places and things you use doing your daily life and those interactions you have with people and entities seeking to serve, sell and partner with you.

Then there are friends who we expect to be part of our lives and therefore have privileges and access capabilities.

All of this with a target of selling integration services to the top million and simply assuring each person has an identity thus serving the bottom billion.  ultimately earning $1 per year per user to simply be there when it all breaks and you wish to restore your digital life.

At the core, your digital security will be based on the use of cryptography and sophisticated matching algorithms designed to assure anyone that you are that one individual in the populatations of the universe.

Review of the IMF The rise of Digital Money

While reading the recent document produced by the IMF I am compelled to wonder.

What is the difference between what they call Bank Deposits and e-money.  My first question, ignoring the words bank deposit.  Both are electronic accounts of value, recorded in someone’s ledger.  These two diagrams extracted from a BIS paper offer a perspective.  

They then speak to four attributed to the “means of payment”

  1. The Type, be it a claim or an object.
  2. The value, be it fixed or variable.
  3. If it is a claim who is liable?
  4. The technology, be it centralized or decentralized


They then speak to the five ‘Means of payment”.

Object-Based

  1. Central Bank Money (cash)
  2. Crypto-currency (non-Bank Issued)

As we think of the evolution of these object-based means of payment, we need to reflect on a new term “Central Bank Digital Currency” CBDC.

As a historian, I then wonder where things like Digi-cash and Mondex fit into the classification.  The value was originated and then distributed into a personal and secure storage device (Wallet).  Redemption or better said the guarantee, was provided by a party.  Maybe not a bank or the central bank, yet, easily embraced by such an institution.  Somehow history seems to lose sight of the origins of money and assumes the existence of a central bank.  Here in the USA, the formation of a Central bank was one of many areas of political discourse.

Claim-Based

  1. b-money (Bank issued)
  2. e-money (Privately issued)
  3. i-money (Investment funds)

The magic word behind all of these discussions is “Liquidity”.  The bottom line does the receiver of the money appreciate the value of the unit of measure and is the receiver confident they will be able to convert that money into another form, of their preference

 

 

Blockchain made simple

Let’s start at the beginning, the transaction, the distributed ledger entry. Think about the content of the transaction as the payload. Next think of the payload as land deed, cryptocurrency value, record of ownership, journal entry, smart contract … marriage contract. Either two or more people seek to exchange and record. Another way to think about all of this is as a block of data, code or other digital representation of something duplicated in every participant’s copy of the current ledger. No matter what happens, a secure system must be established for a smooth cryptocurrency transaction to take place. Maybe look for the best vpn for crypto trading? Could be an option, but only in the later stages when the initial nitty-gritty of the process is established.

A governance model is required

What is essential, before anyone can do anything.

The parties seeking to exploit a distributed ledger must define how it will work.

It is what the community or parties seek to represent and manage, using distributed ledger technology, agree.

The whole process of defining the payload begins when the community agrees to and sets off to publish the processes, procedures, rules, functions, and purpose of their application. It is this act of governance we use to define how and what will be conveyed in the payload to be stored and recorded on a blockchain. Which blockchain, protocol, and cryptographic processes; obviously it is a decision of the community.

We need to be clear before we can do anything with the payload. Ourselves and ultimately others will have initially and subsequently defined the mechanics and processes designed to assure the integrity of the blockchain itself.

A Transaction is appended to the chain

There are two parties to each event recorded within these transactions. The agreed events, transactions and smart contracts are ultimately included in a block and properly extended onto the chain for everyone to see and read. More about Confidentiality in another post.

Once governance is established
People can now interact

Each party has an address and then addresses unique to each asset e.g. coin. The address, in most cases, is simply an asymmetric cryptographic public key.

    • The individual, as is always the case with cryptography, has their own private key(s); they must retain, never lose and keep secret.

When the two parties decide to record an event; the sale or transfer of the title to a car.

    • A formal record of a property, a transaction, ledger entry is created.
    • The basic data.
      • The seller’s public key
      • the buyers public key
      • the payload
      • a hash
      • the signature created by the seller using their private key.

The transactions are broadcast to the network, buying and selling included. These transactions can take place through various methods; for instance, digital currencies could be purchased online, whereas to sell, you may have to use Bitcoin ATM and other ideas, which you can learn on Coin Cloud or similar company blogs.

The nodes or miners continuously work to assemble a defined number of transactions and create the next block.

The chain’s role is to record the providence of an asset and the immutability of all the associated transactions.

    • Each active node or miner is attempting to create the next block.
    • The mathematics involved and the use of hashes to bind this new block to the existing blocks in the chain is beyond the scope of this blog.
    • Let us simply assume the mathematicians and cryptographers define as part of the original design of each chain an infallible solution to the issues of economics, security, integrity, and immutability.
    • These specifications will define the hash game and how one adds the next block to the chain retaining the immutability of the present and the past

By being the first to calculate the cryptographic nonce

The winner receives a reward.

    • Hopefully proportional to the cost of work or other discernable and agreed method of reward.
    • The other active nodes then test to see if they agree the first got it right.
    • If consensus is reached the new block is appended to the chain.
    • This all assumes 51% or more of the miners or nodes reach consensus on the winner’s answer. And no one can control 51% or anything closer than 33%.

Around and around the game continues, as transactions are added and immutably recorded on the chain.

This whole process fundamentally assures history cannot be altered.

Chains split and fun things happen

If the process is not elegantly managed in full sight of all the participants.

Going Cashless

For some twenty plus years, I can remember hearing people speak of the dream of an economy without coin and paper money.  A dream, driven by the desire to promote the use of electronic payments.

Over the last months, a number of articles focus on promoting the idea of a cashless society.  They all speak to the advantages and attempt to promote the concept, arguing we can:

  • Eliminate the concern of thugs insisting at gunpoint for the cash
  • Reduce the risk of employee theft
  • Stop paying people to count all those dirty coins
  • Remove the need for an expensive safes
  • Stop paying to have a specialist truck take the money to the bank
  • Eliminate the grey market

The business case for a merchant to eliminate cash seems to be beneficial.   Many have tried and succeeded to no longer accept cash.

At the same time articles report on the new regulations; various cities and states are implementing and considering.  These regulations are intent on outlawing merchants from going cashless.  The argument often focuses on how eliminating cash disadvantage the underbanked.

Then there is a reality! As a consumer, I recently have been surprised at the need to carry cash and the unsettling pleasure of finding out I still had cash in my leather wallet.

The first wake up to this reality took place while driving from St Simons, GA to the Orlando International Airport. In the trusting hands of Google Maps, I traveled down I-95, across I-4 and was directed to the FL-417. Suddenly a road sign informed me that I was on one of the various Florida toll roads.  Above my head was a road sign indicating which lane, based on my preferred method of payment, to move into. Driving a car that was not mine and knowing it did not possess a PeachPass, my only option was cash.

Fortunately, I had cash and was able to continue my journey.

The following Friday my father and I went to The Lodge to play Sniff, a dominoes game. The game was competitive and cash was the only method to settle. With a bit of cash in my pocket, I was able to pay the few dollars I lost.

One Saturday a street vendor in front of the local Harris Teeter was selling spare ribs. When I went to pay they informed me, they only accepted cash. Once again I was fortunate, I had enough cash and was able to buy those delicious ribs for dinner.

On various Sundays, when the collection plate came around, I’ve had a check or a bit of cash and was able to leave my tithing.

On a number of occasions, the valet, tour guide or other service individual deserved a tip and I’ve had a few dollars in my wallet.

Two more events brought the reality of how society does not want cash to disappear.

One morning, I wanted to enjoy a pastry. Not having $2.75 to pay for the Danish, Sweet Mama’s, a local baker, charged me $0.50, an eighteen percent surcharge, simply to use a credit card

Finally, yesterday as a guest for lunch at the local Rotary Club, I was confronted with a series of cash only events. This time I did not have any cash and was not in a position to contribute to various worthy causes.

We dream of a cashless society. Yet churches, valets, toll booths, street vendors and the Rotary all continue to desire or require cash. Some are not even willing to accept anything but cash.

Looking at our society from two different angles, we must accept the continuing need for cash.  Be it the underbanked, unable to acquire a credit or debit card; or those who carry many credit cards, both need to use cash simply to eat or enjoy life.

Later today I will have to visit the ATM and make sure I have a bit of cash in my wallet.

 

https://www.paymentssource.com/news/target-outages-show-the-failings-of-cash-as-backup

Cash is King especially when the battery dies or the power goes off

Digital payments are growing, but consumers aren’t ready to abandon real money

Cash is king let us never forget it. Cash has always been the primary form of payment.  It was until very recently accepted everywhere.  Most likely will once again be accepted everywhere especially given the need to make sure we do not disenfranchise the unbanked and underbanked will remain the default form of payment

This said, what always amazes me is how so many authors forget Apple Pay, Google Pay and the other NFC based mobile phone based payment solutions are simply another device capable of carrying your debit and / or credit card credentials.

What many of these authors are starting to  remember is how much it costs a merchant to accept these alternate forms of payment.  I wonder when they will also begin to appreciate how many if not all of these alternate forms of payment only work when the power is on.  Our always on society assumes power never goes off.  We dream of everything in our mobile phone and forget when we last could not use our phone because the battery was empty.  Or the store clerk who could read your card because the power went down.

This is one of the redemining facts about cash.  Cash exists without power and can be used whenever.

Are we in Need of Faster Payments – a question of speed and instant gratification

When I started to read this article, https://www.pymnts.com/news/b2b-payments/2019/wespay-corporate-faster-payment-adoption/ , my first thought, why would anyone in accounts payable want to pay a bill sooner than it is due.  Clearly someone in accounts receivable, the CFO and the treasurer, is in need of a strong cash position.  Therefore  therefore, wants to bring cash in as fast as possible.  This classic struggle between the buyer (accounts receivable) and the seller (accounts payable) begs the question – Who gains from faster payments and who loses?

Clearly the financial institutions are stuck in the middle.

    • On one side their clients want moneys to flow into their accounts, oh so fast.
    • While on the other hand those same companies would prefer moneys moved out of their accounts at a snail’s pace.

If the competition offers the service, then, the financial institution simply must decide if faster Payments creates a competitive disadvantage.
The question is not if – it is when.

Do we the consumer care?  Today we have credit and debit cards which allow us to pace the movement of money.  In the case of debit – today.  In the case of Credit – some number of days after we get the bill.  We can set up autopay facilities for those every month payments.  We can schedule money transfers to occur on the day we desire.

From a business and technical perspective the movement of funds immediately upon instruction, makes good sense.  We the receiver are assured those funds are good funds.  We the sender know the moneys have been sent and received.  Therefore, whatever subsequent result can be expected, now!

365/7/24 seems to be what instant gratification is all about.  We want everything now and have lost the excitement of expectation.

All this said, there are risks we must consider when deciding to employ faster payments.  There is no recourse.  Once the moneys have been authorized the moneys are in the hands of the party you transferred them to.  Only if they so desire, will you be able to recover from a mistake.

Worse still, if someone is able to assume your identity then an even greater risk exists.  The funds are gone. The party receiving them will have no interest in addressing your lose.

Therefore Strong Authentication is the essential requirement.

 

Smart Cards with Fingerprint Scanners

Over the last couple of years the reality of fingerprint cards is a hot topic in conversation, white papers and press articles.  It led me to think about the challenges and opportunities associated with this intriguing convergence of technologies.

My purpose is not to determine which solution is best or which companies are developing and selling them.  My goal is simply to explore.

The first consideration begins when the card is constructed.  Here we must ask the mechanical question relative to how the electronics are integrated into the strata of an ID-1 card.  This then begs the question of making sure this new card conforms to the specifications dictated by Payment, Networks, Governments or other bodies who define the use of these branded cards.  If we continue to think about the card manufacturing process we need to think about electronics and the use of heat in the typical lamination process or the inclusion of metallic materials used to create a particular look.  One needs to think about the method of connecting the various internal components to the other electronic elements  as the fingerprint scanner, antenna(s)m LEDs, batteries, the EMV chip or contact plate on the face of the card.

The second set of concerns must be related to the personalization of the card.  First question is where will it be personalized? in a branch or within a bureau?  How will it be personalized? With a thermal printer, laser engraver or embossing machine?  Will any of the  personalization processes adversely affect the electronic?. Similarly it will be appropriate to confirm whether any of the various card transport mechanisms will disrupt or damage the sensor and related electronics.

At some point in the processes the consumer must register their fingerprint and the resulting template must be instantiated into the card.  How will this be done?  Some speak of an in branch process.  Others talk about some type of first time cardholder activation process performed when they receive the card in the mail.

Clearly there are a lot more questions the issuer, card manufacturer and personalization provider need to address.  Let alone the method of making sure the cardholder knows how to use the card at the point of sale or ATM

The key question is the cost of the card, is it worth it?

Where are we going

Each morning I read trade articles on Blockchain, Faster Payments, Mobile Wallets, Authentication, Identity and other alerts & subjects of interest. Each day the writers leave me thinking about the future of society, howbwe will address cyber security, what we can do to funally eliminate fraud and which solutions will help us to mitigate risk. These then drives concern about where we will end up, as we drive to define effective means of identity and authentication, capable of supporting the individual desire for convenience and gratification.

Facial recognition deployed to speed up entry and exit to and from countries and through airports are here. The surveillance state is emerging at alarming speed. These same cabilities could potentially deliver a safer environment. Which will it be?

Physical and behavioral biometrics many feel should become the primary means of authentication. Yet, false acceptance and more importantly false rejection will result in inconvenience some expect the consumer to tolerate while other remember friction typically ends up with the consumer abandoning the journey.

The cost of payments, the escalating concern of the retail sector, remund us thatnpayments are sourcesnof revenue for some and friction for others.

Identity theft and the ability to create synthetic identifies are the fears of many. Consumers whose identity is stolen struggle to regain their standing.

In the end all we seek is:

  • Pay for something
  • Identify ourselves
  • Protect our hard earned money
  • Live a safe and productive life
  • Be assured you are you and not someone else

A world between yeaterday and tomorrow

The week of March 25, 2019 I had the opportunity to visit with a room full of community banks with assets in the 100 million to billion range. Organization with 25 to maybe 300 staff.

The presentations taught me more about the difference between what large International Organizations worry about and what these small community banks need to learn. Faster Payments, Zelle, same day ACH all new services these organizations must integrate into their organization, both technically and procedurally.

Things I have been exposed to are new challenges for these small town banks.

Words like liquidity risk clearly top of mind. Yet, as we move from over night settlement to real time settlement.

Phone fraud, risk mitigation all greater challenges not necessarily appreciated yet alone understood.

In the end what is clear these community banks exist because of the small towns they understand and work within. Do those of us exposed to a larger world understand what drives these communities banks, at least not I.

Account TakeOver should be the Bankers concern

FASTER PAYMENTS, FASTER FRAUDSTERS

Another article published by PYMNTS.COM causes me to reflect on a discussion I had last we at the Payment Summit organized by the Secure Technology Alliance.  When the US Faster Payments work groups where stood up on e of the working groups focuses on security, yet no particular drive exists to protect the consumer of the corporate treasure from their account being hacked into by some phishing, vishing or other criminal act.  Account takeover will become a much more interesting attack vector.  Moneys will irrevocably flow out of the hacked account and to whatever account the criminal so directs them.

Key word real time gross settlement and faster payments depend on the irrefutability of the funds.  once executed they instantaneously transfer to the receiving party.  What is required is a concerted effort to implement strong multi-factor authentication, at least at the time the transaction is authorized by the sending party.  Some will say the risk is no greater than what exists today when a consumer or treasurer executes a Wire Transfer or any form of transfer between two financial institutions.  This maybe true.  the availability and assumed convenience will as the article described lead to heightened risk.

As I have written in other blogs we need to embrace strong Multi-Factor Authentication.  The standards exist, the security of the device in many case is present.  Relaying parties need to decide security is worth the investment.  They need to recognize the value of  satisfying the consumers’ need to have access to their funds properly protected.

Multi-Factor Authentication – Faster Payments and the Immutability of a Transaction

Distributed Ledger and Things

As I sat to write, I was drawn to the Wikipedia’ Bitcoin article. As I read the story of how it all happened memories and concerns once again flowed through the neurons of my mind. Silk Road and their involvement and the evolution of the value of a Bitcoin, struck me as a magical mystery tour through a world of mathematicians, anarchists, profiteers and speculators.

I then remember reading

an element of a report from the Bank of International Settlement on crypto currency. The picture above is intriguing for those of us who appreciate the complexity of payments. The article gets ever so intriguing when one continues to read and finds this interesting illustration of

the difference between what we all are familiar with and what those who understand DLT and Bitcoin appreciate. The central focus of this new technology is to address one and only one concern. Trust in the intermediary.

I must admit this particular article is not the one I originally intended to speak to. I do though recommend reading it.

The article I had intended to reflect on is Central Bank Cryptocurrencies. In this document they speak to the possibility of the banks issuing a stablecoin. The recent announcement of JPMorgan Chase is one example of such.

This then causes me to reflect on the various use cases and conversations with people about the potential of DLT. I wonder why, at least here in the USA with our judicial and regulatory framework and the rule of law; we would seek to replace the existing intermediaries with a permissionless distributed ledger and the associated consensus mechanisms of a public ledger. There is enormous and growing cost in consensus built on “Proof of Work” and massive duplication of the ledger or as most call it the chain. Be it the electrical cost, the cost of a data center or the specialized computers necessary. The people and companies, the nodes and miners, will expect a reward for their effort.

Which is cheaper, if a reasonable level of trust exists?

Where are we going from here

This is the question. There are those that believe Block-chain and all of the other distributed ledger technologies are the answer to everything. I would suggest one much consider:

    • The level of trust the various parties have in each other.
    • The cost of multiple copies of the distributed ledger.
    • The cost of the consensus mechanism versus a trusted intermediary.
    • The governance required to maintain security, software and specifications.
    • The value and ethical issues of anonymity.

This then begs the question of a permissioned or a permissionless ledger. Which then begs the question of governance and who is responsible to establish the rules.

It is clear there is value in the idea of a distributed ledger. I would suggest caution in deciding if it makes sense for your use case.

      • What are the goals and objectives of the solution?
      • What are the economics of the various approaches?
      • Who are the stakeholders?
      • Who determines the rules and manages change?
      • Can the participants trust an intermediary?
      • Does everyone fear what another could do?

Helping you to understand the answers to these questions is what we do.

Disruption or the Reality of Legacy

Often times people speak of disruption as this traumatic thing being imposed upon them, their industry or society. Yet, if we look under the covers disruption more than likely is all about a competitor, not locked into a legacy approach, approaching the market with different tools.

The world of payments, as so many others, have implemented technology then gone on to enhance or update multiple times. Each time, someone or some group of people, had to adapt therefore invest to keep up. More often than not, a community would decide to hold on to what they built, sometime ago, hoping no one tried to disrupt the status quo.

With payment, the need to embrace more effective approaches parallels the robustness and frequency of transactions. It also parallels the desire of sellers to do business with anonymous buyers. A lack of trust and a need to reduce the amount of cash we carry drove markets to promissory notes. These promissory notes further evolved, as trusted intermediaries entered the market and created more efficient methods of providing that guarantee of payment. If you are still a little in the dark about what these are, you can Google questions such as “what is a promissory note?” “What are the elements of a promissory note?”, etc. so you are fully up-to-date with the information that you need.

Not wanting to duplicate what is already written about the history of money and payments we can jump forward through the paper phase to where we are in North America: Cash, cards, some checks and electronic debits & credits.

If we look inside the evolution of legacy. We find what we have, is a stumbling block, holding innovation back. We need to decide to adapt what exists or remove and replace.

Dual Interface Construction

When we think about the migration to contactless or Dual Interface cards it is important to have a general understanding of what goes into creating the card and the constraints one has to think about, as they work with their marketing teams to design these cards.

The design of a payment card involves assembling multiple of PVC into a sandwich that will be bonded and then punched out to form the card body.

  • On the face of the card: a clear laminate to protect the surface
  • On the back a clear laminate with the magnetic stripe affixed to it

In the middle two printed sheets

  • The front
  • The back

In the middle of the card body, your manufacturer will need to insert an antenna.   The antenna is typically provided to the card manufacturer as an inlay, as seen on the left.  The inlay is a sheet of plastic with the copper antenna, sometimes aluminum embedded within.  The card manufacture will add this inlay into the middle of sandwich.

On the right is an example of a six layer card construction including one element as an example, a metal foil.  This has been included given it has an impact on the effectiveness of the radio signal.  More about this a little later.  Using pressure and heat, the layers of the sandwich are bonded together in a process called lamination.  The bonded sandwich is then run through a series of additional processes designed to create an ID-1 card as specified in the ISO 7810 specifications supplemented by the additional payment network requires, such as the signature panel and the hologram.

After quality inspection the next step is to mill and embedded chip into the card body and simultaneously assure a connection between the contacts on the back of the chip and the antenna.  There are various means of connecting the chip to the antenna.  These different methodologies for connecting the chip to the antenna is a specific skill and is the responsibility of your card manufacturer.  Look to your manufacturers to propose, construct and certify your card to your requirements and employing their unique processes, techniques and technologies.

One thing you will need to be aware of is how the use of the antenna affects the certification process.  It is important to understand that the combination of ink, materials and methods of construct means; each construction will need to go through a unique certification.  This need for certification is a result of the use of radio frequency to communicate between the card and the terminal.  Think of your cell phone when your inside a big building or within an elevator and how the conversation maybe disrupted.  It is this possibility of the radio signal to be disruption based on the materials employed and the method of construction.

When metal elements like metallic foils and layers are used in card construction, the challenge increases.  Eddy currents are emitted by the metal and will interfere with the level of power and quality of communications emanated by the antenna and radio in the POS  received by the antenna and the computer in the card.

So far we have spoken only of the hardware.  The chip in the card is a computer and needs an operating environment, application and data in-order to function.  The introduction of the contactless interface alters the operating environment, the payment applications and the data which is loaded into the card.  All of this impacts the card manufacturing and card personalization process.

 

Will the US truly embrace dual interface cards or is our phone the future

When the US decided to migrate to EMV, it took the safe course

When it was time to migrate to EMV here in the USA, both issuers and acquirers focused on addressing the market and the required technology, one step at a time.  They recognized the confusion created by the Durbin Amendment, the reality of the competitive US debit market, the complexity of the merchant environment and the legacy infrastructure underneath the American card payment system.  Unfortunately unlike in other parts of the world the American merchants tended to migration to  EMV in the following order credit & debit, Common AID, contactless (MSD mode), Mobile Pays and finally contactless (EMV mode).  This journey is still a long way from complete with less than 25% of the terminal base contactless enabled, let alone in EMV contactless mode.

The larger and most invested merchants also worried about the impact of sharing data with the likes of Amazon, Google and Apple.  The “honor all card” rule is also the “honor all wallet” requirement.  Wal-Mart, Target and Home Depot were clear, they did not intend to expose the NFC antenna to the various NFC Mobile Wallets.  Instead they are implementing solutions, post MCX, based on their mobile apps using QR codes and often times enabled to support frictionless payment.

We are now looking at the second wave of card issuance and Issuers are wondering what merchants will finally do about enabling contactless.    As the Issuers prepare to issue their cardholders with their second EMV enabled card they must also think about the future of the card in the context of the future of mobile payments.

Are the payment credentials carried in the mobile wallet the companion of the card
or
Is the card the companion (fallback) for the payment credential carried in mobile wallet / device

Or
Are we on a journey to a new paradigm
Where facial recognition, loyalty, geolocation
Enabled by the always connected devices

We surround ourselves with
Help merchants to focus on
the shopping experience
And
Turn the Payment into

A frictionless “thank you”