Digital Money Forum

Over seas fraud

[Dave Birch] Strange. I had an odd phone call from my (UK high street bank) card issuer. My wife had tried to buy a kitchen appliance online and the transaction had been declined. I got an automated call from the issuer: essentially it read me details of some transactions and then said something along the lines of "press 1 if these are really you, press 2 if you suspect fraud". I pressed "1" but called the bank anyway because I was curious.

I could understand why an online transaction for a grand to a merchant that we'd never purchased from before would set off an alarm bell. The very polite lady at the call centre apologise for the inconvenience. I told her that I didn't mind in the least and was happy that they were looking out for me. I suggested that they update their neural network fraud detection software, since if my wife's card were stolen by an Eastern European criminal gang, the system would note an immediate drop in spending (boom! boom! -- the old ones are the best aren't they) but not a titter. Their call centre staff are clearly not well-versed in the more traditional aspects of English humour.

But there were two rather odd things about this call. First of all, the bank told me that in future if I expect to make a purchase in excess of £500, I should call them in advance to help them to manage the account. What a hassle. Maybe I could help them further by going to a bank branch and drawing out the cash then driving to the shops and buying everything in person, but whatever.

So I call the bank to alert them that I’m off to Moscow and the bank says: “calling us makes no odds I’m afraid. The fraud alert may still occur. It’s built into the system.”

[From The Financial Services Club's Blog: From Russia with Love]

Secondly, two of the transactions that I was asked to verify were card-present, chip and PIN transactions at UK chain retailers (Tesco and Waitrose). Why on earth would the neural network supercomputer suspect that chip and PIN transactions -- with the correct card in the terminal and the correct PIN entered -- might be fraudulent?

What's the alternative?

[Dave Birch] There are plenty of extinct "alternative" payment mechanisms already: c2it, Yahoo PayDirect, Billpoint, eMailMoney and so on. And there are a few that survive. But where does the label come from? I saw the comedian/musician Tim Minchin tell an excellent joke when I went to see him earlier this year. I paraphrase, but the joke was essentially:

Q. What do you call an alternative medicine that he been tested and shown to work in double-blind clinical trials?

A. Medicine.

Quite. So when we call something an "alternative" payment method, what do we mean? What is it the alternative to? I made a note to ask a couple of people about this last year, when I read that

During this year’s holiday shopping season we project $7.8 billion will come from alternative payments versus $35 billion from traditional online payment methods.

[From Payments News: Javelin's 2008 Online Retail Payments Forecast - November 10, 2008]

The forecasts for the coming holiday season will be out soon, and they'll be even bigger despite the recession, and I never got round to asking the question then, so I'm going to ask it now. How are payment methods that account for more than 20% of the market "alternative" in any sense?

Not on the money

[Dave Birch] I'm always keen to try out innovative new payment products. And I'm an O2 Premium Customer, or whatever it's called. So when I was idling around in London yesterday and happened past an O2 outlet offering the new "O2 Money" prepaid card, I thought I'd pop in a get one. Since it's a prepaid card, I assumed it would be a bit like getting one at the newsagent or supermarket. I wandered in, expecting to hand over £50 and walk out with a card with £50 on it. But it turns out that despite the big advertising poster in the shop window, the doesn't actually sell them. The guy told me I had to go home and apply on the interweb. Oh well. One night I was bored enough at home to try and do this, so I went to the O2 Money web site. I thought I'd get a card for my son to use. The web site asks you to put the mobile number in and sends you a code. I did this, and got the code. I typed it in expecting to see a screen saying "congratulations" but instead I got another form asking me to top up the phone using one of my other cards. Naturally I couldn't be bothered to do this, so I still don't have a card and nor does my son.

Since O2 already know my address, phone number and bank account details, and have a decade-long credit history on me, Wouldn't it have been cheaper and simpler to have a "text 'yes' to XXXXX and we'll post you a card" option? Why no integration?

Dominique Buysschaert, PayFair

[Dave Birch] Dominique Buysschaert is the man behind PayFair, a candidate for the proposed "third scheme" in European debit and co-founder and CEO of European Payment Solutions, the company set up to deliver it. He was a member of the Brussels bar for 20 years (1978 – 1998), as partner in different major law firms, and then became General Counsel for Carrefour Belgium (1998 – 2006), secretary of the board of directors and member of the management committee. He represented Carrefour at FEDIS, the Belgian federation of large retailers. In this podcast he explains how PayFair works and why retailers might be attracted to it.

Listen here in either [Podcast MPEG4] or [Sound-only MP3] format.

Cross-bored

[Dave Birch] Just as the discussion about whether to start using "chip and PIN" in the US is starting to get under way (more on this in a future post), and people are beginning to find it harder to use stripe cards at some European acceptance points, it's also getting harder to use chip cards over there. This is because the introduction of chip and PIN cards -- without any corresponding enhancement to terminal security or CNP security -- has caused a massive increase in card fraud (it's now triple what it was when the migration started). A lot of this fraud has been exported to places without chip and PIN infrastructure and, in particular, without chip and PIN ATMs. In a perverse way it also seems to have nudged criminals towards the Internet, and once they get there they go nuts because it's so easy.

A spokesman for the UK Cards Association trade body said the figures were 'not good', but insisted they should be seen in the context of the massive rise in on-line shopping.

[From 'Dynamic' security system developed as cash card fraud spirals out of control | Mail Online]

Fair point. The figures are not good (and getting worse) but they are not growing as fast as overall e-commerce. This is no comfort. The absolute level of card fraud, already a billion dollar business in the UK, is an unacceptable subsidy to the criminal fraternity. And law-abiding citizens are collateral damage (damn, I am spending too much time watching The Wire).

Third men

[Dave Birch] Way back in 2007, Peter Jones of Payment Systems Europe published a typically perceptive paper on the potential for European ATM networks to form the basis of the European Commission's "third scheme" for debit cards. This has become a reality, at least in embryo, through the Euro-Alliance of Payment Schemes (EAPS). So will the existing banks and the existing switches become the unopposed third way? I suspect not, because more possibilities already exist. I wrote some time ago about First Data's moves in that area and the possibilities that might emerge as they push their FirstNet offering in this direction. Now, with the landscape becoming richer -- additional third scheme candidates Monnet and PayFair are in town (by which I mean Brussels, of course) -- and the Commission continuing to press for a "European" SCF debit scheme, it looks as if things might get interesting. PayFair, a private initiative that is targeting merchants, is already trying to get off of the ground with a Belgian pilot in the autumn and Monnet has said that it intends to form a company in the not too-distant future:

However, Hermann-Josef Lamberti, COO of Deutsche Bank, is again talking up the prospect of a third pan-European debit scheme, telling a conference in Frankfurt that several financial institutions, including Société Générale and BNP Paribas, are planning to formally establish a group of banks by October 2009 to move ahead with the Monnet scheme.

[From CardsInternational.com - VRL KnowledgeBank]

Despite the economic circumstances, now is a pretty good time to be thinking about launching a new debit scheme, since customers are moving away from credit and toward debit in a big way in the US and Europe.

Quantitative consumer data indicates as a shift from “pay later” options (credit card) to “pay now” or even “pay before” options (debit cards and prepaid cards).

[From Javelin Strategy and Research » Thoughts on “Premium Debit” as a Component of an Enterprise Payment Strategy]

And whatever the rights or wrongs of the interchange debate, now isn't a bad time to approach merchants with lower-cost alternatives either. So the European debit marketplace looks like it's going to get interesting.

debit cards, SEPA

United we fall

[Dave Birch] I think that the decision by United Airlines to make some smaller travel agents process ticket sales on their own merchant accounts (and therefore pay the merchant service charge, or MSC) is one of those developments that seems on the margins at the time but actually signals the start of the supertanker's turn. United's new policy, starting 20th July, is for one reason: cost.

United would say only that the move was prompted by rising card-acceptance costs. “Credit card processing costs are escalating at a high rate and represent several hundred million dollars of cost each year,”... All travel-agent ticket sales on cards in 2008 totaled $79 billion, according to ASTA estimates, with an average discount rate of 3%.

[From News]

Never mind the average 3% MSC, the figure I thought was really shocking in this report was that brick-and-mortar agents account for nearly half of all airline ticket sales. I haven't been in a travel agency for years (except to buy prepaid payment cards), all my personal travel is bought via web sites and all our corporate purchases go through invoices, so I was genuinely surprised to read that....

At the same time, airlines depend on so-called traditional, or brick-and-mortar, agents for somewhere between 40% and 50% of their ticket sales, with online agencies accounting for another 20% to 25%,

[From News]

Wow. To me, that was a genuinely surprising statistic. Anyway, that led me to wonder if people buy airline tickets with debit card given the price incentive -- many airlines make an explicit charge for credit cards, but no charge for debit cards -- or if the benefits of a credit card in these circumstances are seen as being sufficient to outweigh any surcharge.

Personally, I never buy airline tickets using anything other than a credit card, even though many airlines surcharge and try to get you to use debit cards. That's because if anything goes wrong -- let's say the airline goes bankrupt, for example -- then if you paid with a credit card you'll get your money back. I'm more than happy to pay for the peace of mind. My top tips for avoiding fraud: use a credit card for everything in all circumstances and never use your debit card for anything except ATM withdrawals.

credit cards, debit cards, retail

Petrol and paranoia

[Dave Birch] I stopped at the Reading services on the M4 to get some petrol and a coffee. I went into the shop and presented my excellent Barclays MasterCard with cashback and PayPass. The Eastern European woman at the counter told me that the chip and PIN machine didn't work, promptly took my card and ran it through a stripe reader, then presented me with a slip for signature. I duly signed and wandered off. Once I got in my car and drove off, I started to wonder about this incident. Because I'm not normal (normal people don't care about payments), the paranoia set in... Now I naturally assume that I have been the victim of a clever card fraud scam: the fraudsters recognised my card and they know that those cards have ICVV, so the details from the chip cannot be used to create a counterfeit magnetic stripe card, so they read the stripe details directly. Even now, I imagine a copy of my card is being used in a Tiranan jewellers. Had this not been late at night, and had I been more alert, I would have gone to the ATM and drawn out cash to pay for the petrol.

Shouldn't a modern payment system free me from these paranoid concerns?

Security matters, but why?

[Dave Birch] At the M-Payments and M-Banking conference in Madrid there was a super presentation by Karin Huber on Mobicom's experiences with mobile payments, ticketing and related value-added services in Austria. One thing that Karin mentioned in passing was that, in the Austrian market, it seemed as if consumers were using fears about security as a means to rationalise their concerns about mobile in general: they didn’t like registration and other aspects of the service. In a way, they weren’t really concerned about security at all. This factors in with something else I'd been thinking, which is that consumers don't really understand security and they certainly don't understand risk (all poll evidence confirms this in spades). Therefore, what consumers want is for their bank, payments providers and merchant to give the appearance of security, which is something different.

I had to phone up to activate a credit card recently, and when I called the activation "hotline" advertised by the sticker on the card, I was put through to someone who tried to sell me identity theft insurance. "Are you concerned about identity theft" they asked me. I said that I wasn't, and the reason that I wanted a credit card was precisely so that if anything went wrong, it was the bank's problem and not mine. This, incidentally, is why I never use my debit card except at ATMs. But after I hung up, I wondered if that is the right image to deliver to credit card customers. Isn't reminding them that card fraud is massive going to drive them away from using their cards rather than reassuring them? Are there any psychologists out there who can help? If people don't, indeed, understand security but are using it is a placeholder for all sorts of other concerns, then it is possible that the payments industry may be making some bad decisions about how much security to implement and how to implement it. Perhaps people might feel more comfortable using their mobile phones (which are perceived as personal devices) rather than dongles, widgets, passwords and PINs and so even if the actual security might be lower than in another device, the overall security of the system goes up because more people use them rather than wholly insecure means such as passwords.

As an aside, for m-payment nerds, Karin also said some very interesting things about Mobilcom's decision to fold TSM functionality into the infrastructure. But that's another story.

2.5D Secure

[Dave Birch] The 3D Secure (3DS) schemes -- Visa's Verified by Visa and MasterCard's SecureCode -- have come in for a lot of criticism (from, eg, me) and it's been getting worse recently. Card-not-present (CNP) fraud continues to climb

According to the latest statistics from banking association APACS late last month, more than 25 million UK-issued credit and debit cards are registered with either Verified by Visa or MasterCard SecureCode,

[From Merchants and punters cry foul over Verified by Visa • The Register]

I have to say that, personally, I've never bothered to register either of my credit cards, but plenty of people have. Here's the issue, from my perspective as a rational consumer. I'm protected from fraud by my credit card issuer, so I have no incentive to use 3DS of any kind. Any 3DS means more hassle for me for no return. The people who do benefit from 3DS -- merchants, since merchants are protected against fraud by offering me 3DS even if I don't use it -- don't insist on it and, crucially in my opinion, don't incentivise me to use it. If I got air miles for using 3DS, I'd use it.