Digital Money Forum

Dominique Buysschaert, PayFair

[Dave Birch] Dominique Buysschaert is the man behind PayFair, a candidate for the proposed "third scheme" in European debit and co-founder and CEO of European Payment Solutions, the company set up to deliver it. He was a member of the Brussels bar for 20 years (1978 – 1998), as partner in different major law firms, and then became General Counsel for Carrefour Belgium (1998 – 2006), secretary of the board of directors and member of the management committee. He represented Carrefour at FEDIS, the Belgian federation of large retailers. In this podcast he explains how PayFair works and why retailers might be attracted to it.

Listen here in either [Podcast MPEG4] or [Sound-only MP3] format.

More on Payez Mobile

[Dave Birch] I've been particularly interested in the French national NFC payments "experiment", not just because of the practical insight it delivers but also because it is a laboratory for co-ordinated specification development involving both bank and mobile operators. For many of our customers, this bank-operator interface is an important driver and/or barrier in their medium-term strategy, so it's important to understand it.

AEPM, the Association Européenne Payez Mobile, has updated the technical specifications for Payez Mobile, the NFC solution developed by the leading French banks and mobile operators that has been on test in the French towns of Caen and Strasbourg since November 2007. The new Version 2.1 of the Payez Mobile specification incorporates the latest GlobalPlatform specifications and follows the signing of a Memorandum of Understanding between AEPM and GlobalPlatform in July.

[From Payez Mobile updates NFC specifications • Near Field Communications World]

Since I think these specifications are important, I asked my colleague Neil Livingston (who has been leading some of our work in this area) if he could provide a more detailed introduction to the specifications for blog readers, and he has kindly provided the overview that follows. If you're interested in understanding how NFC is evolving in the payments space, it's well worth you taking a few minutes to read through.

contactless and nfc, EMV, mobile

Window pain

[Dave Birch] In "Tough Guy", the autobiography of mafia criminal Louis Ferrante -- which is an excellent book, by the way, even for someone like me who doesn't normally care for crime books -- I came across a poetic description of card fraud in an early incarnation. Louis' enterprising confederates in the New York mob had discovered that you didn't need to be able to forge cards terribly well to enter the counterfeiting business, provided you have collaborators.

For years I made big wood with Sonny's "dupes", phony credit cards with real numbers. He sold them to me for a hundred bucks a piece. Sonny had salespeople in retail stores on the take, boosting charge card receipts... I'd visit a jeweller who was in on the scam and buy a Rolex. If the watch retailed for five grand, I'd tell him to hit the card for ten. I'd leave with the watch. He'd made money. Both of us happy.

What the wise guys, as I believe they are know, really wanted though, rather than Rolex watches and the like, was cash. Card fraud was also a means to that end.

If I knew a guy who sold stuff I didn't want, like Paulie Flowers, I'd work out a cash split. I'd show up and tell him "hit my card for four grand, keep two and give me two when you get paid". He'd tell the card company he'd delivered arrangements to a wedding, and send them a phony bill of sale, and that was that.

Things have changed since then. That kind of card fraud was a sort of cottage industry, almost quaint. Today the fraudsters have followed the banks and the rest of the business world and globalised. It's no longer about getting a Rolex and a few thousand to spend, it's about investment and return on investment. Moises Naim's book "Illicit: How Smugglers, Traffickers and Copycats are Hijacking the Global Economy" talks about the new cross-border, enterprise-scale organised crime. Card fraud is part of this, and that's a big problem. From being a minor branch of mafia robbery, it's become easy money for funding drug dealing, trafficking and even terrorism. This is why, even though the business case for the transition to chip and PIN was marginal from the bank point of view, the government were keen to see it go ahead.

Today card fraud is a cost of doing business, a few basis points. In the UK, that's more than six hundred million pounds, which isn't that much compared with total card spending, so it's not surprising that it may not be the banks absolute no.1 priority at a time when chargeoffs are running at a hundred times the rate of chargebacks. I'm not bad mouthing the UK card industry: card fraud is a global problem.

Australian Payments Clearing Association data for last year shows fraud remains a fraction of overall payments: 44.5 cents in every $1000 of transactions in the case of credit and charge card fraud, 7.1 cents in every $1000 for debit cards and less than one cent in every $1000 for cheques. However, while cheque and debit card fraud are falling, credit and charge card fraud are rising - up from 36.9 cents the previous year. About 70 per cent of that increase relates to cardholders making purchases overseas via the internet and telephone.

[From Card crime jumps, so don't get caught - Banking - Money - Business - Home]

A few basis points of turnover is a tiny fraction of the money spent on cards, but a big income for organised crime. So even though the crime is tolerated by the payment industry, it shouldn't be. As Scott Loftesness said on Twitter when we were discussing this, we need to remember the "broken window" theory of policing. Tolerating crime that we can tolerate because it doesn't stop us from doing business is a bad policy.

credit cards, debit cards, EMV, future, SEPA

Steven Murdoch, Cambridge University

[Dave Birch] Steven J. Murdoch is a researcher in the Security Group of the University of Cambridge, based in the Computer Laboratory, a fellow of Christ's College and a member of the Tor project. In this podcast, he discusses a number of security issues around "chip and PIN" in the UK and makes some helpful suggestions for improving security in the next generation of retail payment systems.

Listen here in either [Podcast MPEG4] or [Sound-only MP3] format.

Help! I can't stop posting about SEPA

[Dave Birch] I saw a very good talk by Gerard Hartsink, Chairman of the European Payments Council. He was talking about SEPA and the evolution of the European payments sector. The context isn't important, but I did want to highlight one comment he made -- which caused some passionate discussion -- about the future of payment cards. He said that he could see a situation in 2011 or 2012 when magnetic stripe transactions would be banned in SEPA and only chip transactions would be allowed at ATM and POS. Now, before we launch into a debate on this, let me point out that he is not the only person of influence who is thinking this way.

Tony Chew, head of the technology risk supervision division of the Monetary Authority of Singapore, is advocating for a concerted global effort to phase out magnetic stripe technology entirely. “We can all go chip and PIN which will be a more effective method of combating counterfeit card fraud,” says Chew.

[From Vendor Articles: 12/6/2009 Credit card fraud rising]

It's the rise in fraud that is causing this kind of thinking. Far from shrinking card fraud, the introduction of chip & PIN in the UK has multiplied a thousandfold the number of places where people use PINs and therefore where PINs can be stolen from. So long as there are places where easy-to-copy magnetic stripes can be used, the incentive for criminals is clear. Things are getting worse.

It is my belief - and feel free to come back and tell me that it's me that is the idiot - that after a number of years of declining card present fraud (magnetic stripe cloning is so much easier, and a gift from the card issuers), we are now going to see a dramatic increase, and there is nothing we can do about it!

[From 2009 - is that the year we all went online?]

I happened to be reading this month's Fraud Watch, and one of the front page stories is "ATM fraud threatens global acceptance". The story says that "several issuers are considering blocking major cities and possibly whole countries where international card fraud is high, because there is no chance for reimbursement for those losses even though the original cards are EMV chip and PIN compliant". (There are, as I understand, no plans for a liability shift to rectify this, particularly in the USA.) Oh dear. Incidentally, the top three destinations for ATM fraud on UK-issued cards last month were.... 1. Canada, 2. Italy and 3. the USA.

Suppose Gerrard is right? What will happen in 2012 when travellers from the USA arrive in Paris and discover the shops, hotels and ticket machines won't accept their cards any more?

Straight banannas

[Dave Birch] Normally the only stories about European standards that you read in the newspapers here in Britain are the ones about straight bananas (actually, I think that the rules on banana curvature were recently relaxed) or people going to jail for advertising brussels sprouts in imperial measures (although, once again, the EU's stringent policy appears to have been abandoned). But I read in last month's Cards & Payments that the European Commission are upset about EMV being chosen as the standard for the SEPA Cards Framework (SCF) because they view it as "non-European” (worse still, and more specifically, they view it as American). The EU Competition Commissioner, Neelie Kroes, recently labelled the worldwide standard for card payments as “proprietary”.

Perhaps there is some displacement going on here. Perhaps the Commission are upset because they pushed for SEPA and SCF. It is now clear that SCF will lead to an increase in the average merchant service charge in Europe as low-cost domestic debit schemes are replaced by more expensive international credit and debit schemes (ie, Visa and MasterCard branded cards). But it's an interesting development to move on and begin the attack on EMV.

Cards at QSR

[Paul Makin] I recently got hold of my very own contactless card, and I've been keen to try it out - but I haven't seen that many suitably-equipped terminals, and those I tried at unattended POS just ignored me.

But last week, I was at Heathrow Airport, desperate for a coffee. So I joined the (long) queue at Caffe Nero, which was taking an age to edge its way along the counter. Watching what was going on, it was obvious that the main reason for the delay was the payment process - at least half of the customers were paying with cards, all Chip & PIN, and each transaction involved the passing back and forth of chunky PIN pads on long wires, a lot of peering at tiny screens, and waiting.

So I reach the front of the queue, and spot a contactless pad. I give my order, and watch the resigned look from the guy as I produce my card. He brightened up when I pointed at the contactless pad, then asked me to wait while he turned it on. After a couple of taps on the till, a light came on the contactless pad, I flashed my card and 'APPROVED' came up almost instantly. Success! The guy was clearly pleased, mostly (I think) because of the speed of the transaction, and shouted to his boss 'Hey, this thing works!'.

The lessons? Well, first is that contactless is great for so-called 'quick service' retailers, not necessarily because it displaces cash, but because it's so much faster than Chip & PIN - a key issue, when more and more people, including me, try and use a card for EVERY transaction! Secondly, the transaction was slowed by a few seconds because the contactless pad isn't on by default. As the cards become more prevalent, this is going to become ever more of an issue.

contactless, credit cards, debit cards, EMV, payments

I didn't want to write about fraud yet again, but...

[Dave Birch] The U.K. remain Europe's largest exporter of card fraud, and it looks as if this year we're going to do even better than last year. Total card fraud last year was UKP 535 million (about a billion dollars) but the half-yearly figures for 2008 are predicting a full year well in excess of UKP 600 million. The prospects of fraud reducing remain, I think, slightly gloomy. SDA clones (of French cards, luckily) have already been found in Europe and I would imagine that we'll begin to see SDA cloning on a large scale over the next twelve months as the ICVV base expands. When you add this to the lack of a mass market solution for EMV in the Internet/MOTO environment, there is no possibility of U.K card fraud falling over the next year. 3D-Secure technology (Verified by Visa and MasterCard SecureCode) has not even dented the problem. Despite the fact that nearly 20 million cards have been registered for 3DS in the U.K., and the fact that a tenth of e-commerce transactions are already 3DS verified, the CNP fraud figures are increasing remorselessly. I have heard some anecdotal evidence that some customers are switching from cards that are 3DS to cards that are not, simply because they can't be bothered with the 3DS authentication when they're buying online. And, rationally, why should they even care? Consumers are protected whether the transaction is 3DS or not so unless the retailers the incentivise them to use 3DS instruments, why would they bother?

At some point, I assume, fraud will get so bad that banks will be worried about it. That's some way away, of course, since in the U.S. fraud is well under 1% in card portfolios that have bad debt well in excess of 6%, so I know which area will be attracting most management attention for the foreseeable future. It's clear that chip and PIN isn't going to crack the problem by itself, so we'll have to start looking around for the next generation of card technology. Since the cards themselves will be disappearing into mobile phones, that would suggest that the banking sector begin ramping up their efforts in mobile. Which, of course, they already are.

Remember "off line"?

[Dave Birch] For reasons not germane to the post, I'm wondering if I can detect the first pangs of crisis in the world of EMV. Have we been rolling out the wrong system? This horrible suspicion obtains vitality from a big picture perspective which says that, in essence, it was mad to start rolling out a system that was designed to allow secure offline payments at the very inflexion point in human history when the whole world went online.

Most consumers still pay offline, like in restaurants or stores. But I have no doubt that in future all these businesses will be connected to the Internet and then, virtually all payments will be made online.

[From Globes [online] - Israel business news - For PayPal, it is only the beginning]

Gulp. We've spent billions installing a legacy payment system and it isn't even finished yet. Everything else is going online, bank-issued cards are going offline.

EMVCo, the EMV standards body owned by JCB International, MasterCard Worldwide and Visa Inc., has today announced plans to broaden industry participation in the development work of the organisation and establish a regular, formal dialogue between EMVCo and the global payments industry, through the launch of a new website subscription programme and annual user meeting.

[From Finextra: EMVCo looks to broaden industry participation]

Learning from the UK EMV deployment

[Dave Birch] There's a great podcast here if you're interested in learning lessons from the U.K.'s "chip and PIN" rollout...

With Chip & PIN in full well established across the UK, fraud figures are painting an interesting picture of its impacts. Is it really making a difference when it comes to the never-ending battle against fraud? Consult Hyperion's Richard Allen discusses card fraud in an EMV world with AVISIAN Executive Editor Chris Corum.

[From re:ID Podcast]

Richard makes the point that the rise in fraud on the cards here is not "chip and PIN" fraud, it's "PIN" fraud. Since criminals can use data from the chip to make counterfeit magnetic stripe cards (not for too much longer, hopefully), fraud is still going up.