Digital Money Forum

Because that's where the money is

[Dave Birch] The electronification, virtualising and dematerialising of money means the electronification, virtualising and dematerialising of crime, because (naturally) criminals go where the money is.

FBI officials say a mix of banking Trojans and phishing attacks has plagued victims - mainly public institutions and small and midsize businesses - to the tune of $100 million in attempted losses as of October.

[From FBI: Online Banking Attacks Reach $100 Million Mark]

Note, by way of comparison, that about $60m was stolen in physical bank robberies throughout the USA in the whole of 2008. How stupid do you have to be to walk into a bank with a gun when you could just stay at home and send out some e-mails? We must find a way to accelerate the transition to e-payments and at the same time make e-money more crime-resistant than cash.

Has cash jumped the shark?

[Dave Birch] The internet generation (Generation Y, or in my household, Generation Whatever) have a lovely phrase for deriding something that has outlived it usefulness, something that is going through the motions without contributing creative or positive to society. They say it has "jumped the shark", a phrase that comes from television criticism. A show jumps the shark at a point

where a show with falling ratings apparently becomes more desperate to draw in viewers. In the process of undergoing these changes, the TV or movie series loses its original appeal. Shows that have "jumped the shark" are typically deemed to have passed their peak.

[From Jumping the shark - Wikipedia, the free encyclopedia]

The origin of the phrase is an episode of the popular television programme "Happy Days". I'm sure you will all recall the engaging and innocent teenage antics of Ritchie Cunningham, Arthur Fonzarelli and their chums. I never liked it that much, personally, because it portrayed a world that seemed a little remote from my Swindon council estate, but that's by the by. Anyway, in an episode first broadcast on September 20, 1977, "Fonzie" wearing swim trunks and his trademark leather jacket, jumps over a shark while water skiing, for reasons that need not detain us.

The phrase has been used more recently [when?] outside the realm of popular culture, representing anything that has reached its peak and has declined in quality.

[From Jumping the shark - Wikipedia, the free encyclopedia]

This is the sense I mean in the title of this post.

Has cash jumped the shark? Cash use is certainly declining, and it's hard to say that cash is of the same quality (ie, purchasing power). It certainly doesn't contribute anything to the world around it. Look at the evidence. It subsidises organised crime, encourages tax evasion and wastes resources. The private costs are not aligned with the social costs, and the social costs are distributed very unfairly so that the poorest people pay the highest transaction costs. Lots of reasons to dislike it, but because I've become a major fan of the unbelievably brilliant television series The Wire, it's cash's promotion of crime that I'm concerned with most this week.

cashless, crime and fraud, notes and coins

Petrol and paranoia

[Dave Birch] I stopped at the Reading services on the M4 to get some petrol and a coffee. I went into the shop and presented my excellent Barclays MasterCard with cashback and PayPass. The Eastern European woman at the counter told me that the chip and PIN machine didn't work, promptly took my card and ran it through a stripe reader, then presented me with a slip for signature. I duly signed and wandered off. Once I got in my car and drove off, I started to wonder about this incident. Because I'm not normal (normal people don't care about payments), the paranoia set in... Now I naturally assume that I have been the victim of a clever card fraud scam: the fraudsters recognised my card and they know that those cards have ICVV, so the details from the chip cannot be used to create a counterfeit magnetic stripe card, so they read the stripe details directly. Even now, I imagine a copy of my card is being used in a Tiranan jewellers. Had this not been late at night, and had I been more alert, I would have gone to the ATM and drawn out cash to pay for the petrol.

Shouldn't a modern payment system free me from these paranoid concerns?

Help! I can't stop posting about SEPA

[Dave Birch] I saw a very good talk by Gerard Hartsink, Chairman of the European Payments Council. He was talking about SEPA and the evolution of the European payments sector. The context isn't important, but I did want to highlight one comment he made -- which caused some passionate discussion -- about the future of payment cards. He said that he could see a situation in 2011 or 2012 when magnetic stripe transactions would be banned in SEPA and only chip transactions would be allowed at ATM and POS. Now, before we launch into a debate on this, let me point out that he is not the only person of influence who is thinking this way.

Tony Chew, head of the technology risk supervision division of the Monetary Authority of Singapore, is advocating for a concerted global effort to phase out magnetic stripe technology entirely. “We can all go chip and PIN which will be a more effective method of combating counterfeit card fraud,” says Chew.

[From Vendor Articles: 12/6/2009 Credit card fraud rising]

It's the rise in fraud that is causing this kind of thinking. Far from shrinking card fraud, the introduction of chip & PIN in the UK has multiplied a thousandfold the number of places where people use PINs and therefore where PINs can be stolen from. So long as there are places where easy-to-copy magnetic stripes can be used, the incentive for criminals is clear. Things are getting worse.

It is my belief - and feel free to come back and tell me that it's me that is the idiot - that after a number of years of declining card present fraud (magnetic stripe cloning is so much easier, and a gift from the card issuers), we are now going to see a dramatic increase, and there is nothing we can do about it!

[From 2009 - is that the year we all went online?]

I happened to be reading this month's Fraud Watch, and one of the front page stories is "ATM fraud threatens global acceptance". The story says that "several issuers are considering blocking major cities and possibly whole countries where international card fraud is high, because there is no chance for reimbursement for those losses even though the original cards are EMV chip and PIN compliant". (There are, as I understand, no plans for a liability shift to rectify this, particularly in the USA.) Oh dear. Incidentally, the top three destinations for ATM fraud on UK-issued cards last month were.... 1. Canada, 2. Italy and 3. the USA.

Suppose Gerrard is right? What will happen in 2012 when travellers from the USA arrive in Paris and discover the shops, hotels and ticket machines won't accept their cards any more?

Police and thieves

[Dave Birch] I don't usually read the newspapers -- in the UK they are full of stories that cause professional satirists to weep with shame and retreat to Hebridean monasteries, no longer able to compete -- but I had a free Daily Mail to hand on a plane this week and found myself gasping in astonishment at the news that police in some parts of London have set up a hotline for people to call when they want to withdraw cash from an ATM. The police will then meet you at the ATM and a uniformed officer will follow you home a "a safe distance to not draw attention".

Warning: I am not making this up. If you are a UK taxpayer, you may wish to seek a doctor's advice before reading any more of this story...

PENSIONERS and shoppers concerned about being mugged after withdrawing cash from the bank are being offered a police escort home in a district of east London. Posters displayed near banks and post offices explain residents can call up and arrange for a uniformed officer to see them safely home.

[From Police escort for elderly ATM users | The Daily Telegraph]

Yet again, the hidden cost of cash rachets upwards. Who is paying for these policemen? Is it the merchants who say that cash is the cheapest form of payment? Is the the customers who use the ATMs? No, of course not, it's the taxpayers. And as long as the social costs of cash remain unaligned with the private costs, we'll carry on paying.

Pounded

[Dave Birch] A few weeks ago at a conference I said in passing that I thought that about 1 in 50 pound coins in the UK is counterfeit but it turned out that I was way off of the mark and the actual figure may be close to 1 in 20! The economics are worth noting. It costs 10p-20p to make a fake coin, and these fakes are bought by criminals for 70p, so the forgers make 50p per pound. Not a bad return. And he's another interesting fact I learned about counterfeiting: it's harder to forge euro coins because they have a magnetised stripe running through them and this makes it easier for machines to spot the fakes.

The reported dynamic is of mass collusion. If you find yourself with a pound coin that you believe to be fake, then you will not report it (because then you are out a pound) but will instead attempt to pass it on to someone else in a Gresham's Law dance. Thus, they stay in circulation. Instead of just scrapping one- and two-pound coins and getting people to use cards or mobile phones instead, the Royal Mint are "working with banks etc" to remove counterfeit coins before they reach members of the public.

Virtual washing machines

[Dave Birch] I have from time to time expressed some concern that the cost of complying with money laundering laws, policies and regulations increases the net welfare because, as far as I can see, there is just as much money laundering going on in the world now as there was before. But I may be wrong because I don't have access to any exact figures for how much money is being laundered. Except in the UK, where we know the precise amount:

In other words, we have over £82,000 of money laundering where notes were accidentally washed through washing machines;

[From The Financial Services Club's Blog: Sorry sir, the dog ate my lunch money]

Yet another problem with notes and coins duly recorded.

Good vs. bad

[Dave Birch] A thought experiment. Suppose you found a flaw in a widely-used payment scheme, such as EMV. Suppose the flaw had come about because of a mistaken interpretation of a specification and would take some time to fix. Would you keep the flaw secret, and hope that the criminals didn't find it, or would you tell the banks, or would you tell the banks about the flaw and tell them that the flaw will be made public in six months. I'm genuinely curious: what would you do? I'm sure that the first option is the most wrong: not exploring how to break a payment scheme means that the criminals will break it and you won't know what to do. Consider the recent example of SIM card cloning in India, which the police apparently had difficulty responding to:

The experts said no one has actually done any research on SIM card cloning because the activity is illegal in the country.

If the good guys can't even participate, the bad guys will always win.

[From Schneier on Security: The Ill Effects of Banning Security Research]

Bruce is, as is generally the case, right. Banning research means that only the bad guys will do the research. Hoping that the bad guys won't find the flaw is a ridiculous strategy: it's much better to come clean, bite the bullet and then fix it. What does "fix" mean though?

It's criminal!

[Dave Birch] I went to a seminar on financial crime the other today. Not, as you might think, to look into the possibility of an alternative career if the whole consulting thing doesn't pan out, but because I'm always looking for ways to help our customers to develop new propositions that have a chance working because they solve genuine problems, perhaps in new and innovative ways. So, I thought, why not brush up on the key financial crimes and get an idea of where some of our clients might useful focus their efforts, while at the same time getting a sense on the priorities of law enforcement agencies, banks, regulators and so on. It turned out that some of it wasn't particularly relevant because financial crime is a wide-ranging (you might even say "catch all") term for a pretty diverse set of concerns. There were people at the seminar concerned with armed robbery, anti-money laundering (AML) activity, sanctions-busting and goodness knows what else. To me, this made seminar less useful than it might have been had it been more focused, but I still felt as if I was learning something, but there were to many different concerns being expressed and responded to. The particular issue of payment security was discussed, of course, but for many of the people there it wasn't as much of a concern (in terms of both financial and reputation loss) as you might think: if your bank has just lost a few billion quid, what's a few tens of millions in card fraud?

The seminar was held under Chatham House rules -- as, indeed, was the seminar that went to at Chatham House last week -- so I can't go into any details on organisational positions, but I will say that I found the strategic perspective limited. One recirculating meme was that of market failure. A couple of people said something like "the market hasn't produced secure solutions", which I think is a misunderstanding of what a market is. If banks wanted better security, they would already be paying for it. To some of the participants, particularly from law enforcement, this is evidence of a market failing, where to me it is evidence of a market working. If the law enforcement guys want, for example, better security for payment cards then they need to either transfer more of the cost of failure away from the public purse and on to the industry (which they've started to to in the UK by no longer treating card fraud as a crime) or incentivise the desired behaviour.

The Home Office has been accused of failing to take credit card fraud seriously after it was revealed the crime can no longer be reported by victims directly to the police.

[From Police News - Card Fraud 'Being Decriminalised']

There were some crimes being discussed, such as mortgage fraud, that are clearly of scale but unquantified. No-one seemed to know how much of it is going on or how it breaks down. Others, such as sanctions-busting, are very important but there is no obvious way that technology can help: if the tanks get loaded onto the ship labelled "Kenya" then dropped off in Sudan instead, I don't think that better passwords or chip cards will make much difference to be honest.

As to how technology could make a difference, someone asked a representative of the banking sector precisely that question, and we were told to improve the keys on JCBs! Apparently, every time one of these is driven through a bank wall to steal the ATM, the bank loses about a hundred grand on the ATM and the cash inside, together with five times as much to repair the bank branch. Since the incidence of this kind of crime is both seasonal (it rises towards the holiday season) and recession-enhanced, making mechnical diggers harder to steal would make all the difference!

It was 20 years ago today, again

[Dave Birch] You've probably already read about Visa Europe's new trial with "PIN cards".

The Visa PIN card features an alpha-numeric display and a 12-button keypad built into the back of a conventional credit, debit or prepaid card. The card, developed using technology from Australia-based Emue technologies, promises a three-year battery life, overcoming a potential stumbling block to such schemes in the past.

[From Finextra: Four banks to trial Visa PIN code cards]

I was playing around with one of these cards a few weeks ago, and I can tell you that they are as far as I can tell exactly the same thickness as "normal" chip cards and fit in a wallet properly (a key factor, if you ask me). Could I imagine using them? Yes, and clearly people at MBNA in the UK, Cornèr Bank in Switzerland, Cal in Israel and IW Bank in Italy are assuming that their customers will think the same, since each is to begin pilots of the PIN card in the next few months.

The cards contain two microprocessors, one of them containing the standard EMV application to support "chip and PIN" transactions, the other implementing a one-time-password (OTP) application that takes in the PIN from a keypad on the cards itself and presents the OTP on the screen that is also built in to the card itself. Thus, you can use the card to provide 2FA through the 3DS interface: instead of registering a password and then trying to remember it, you use the OTP from the card.

This isn't a perfectly secure solution -- it doesn't defend against certain kinds of man-in-the-middle attacks -- but it's certainly considerably more secure than using phisable passwords. If the banks could offer the OTP infrastructure as a cost-effective option to third parties (including their own internet banking services), it would be even better, as I'd much rather log on to the Inland Revenue and Barclays internet banking using a debit card that worked this way than passwords buried and at the bottom of draws or dongles that I always forget!