Security matters, but why?

[Dave Birch] At the M-Payments and M-Banking conference in Madrid there was a super presentation by Karin Huber on Mobicom’s experiences with mobile payments, ticketing and related value-added services in Austria. One thing that Karin mentioned in passing was that, in the Austrian market, it seemed as if consumers were using fears about security as a means to rationalise their concerns about mobile in general: they didn’t like registration and other aspects of the service. In a way, they weren’t really concerned about security at all. This factors in with something else I’d been thinking, which is that consumers don’t really understand security and they certainly don’t understand risk (all poll evidence confirms this in spades). Therefore, what consumers want is for their bank, payments providers and merchant to give the appearance of security, which is something different.

I had to phone up to activate a credit card recently, and when I called the activation “hotline” advertised by the sticker on the card, I was put through to someone who tried to sell me identity theft insurance. “Are you concerned about identity theft” they asked me. I said that I wasn’t, and the reason that I wanted a credit card was precisely so that if anything went wrong, it was the bank’s problem and not mine. This, incidentally, is why I never use my debit card except at ATMs. But after I hung up, I wondered if that is the right image to deliver to credit card customers. Isn’t reminding them that card fraud is massive going to drive them away from using their cards rather than reassuring them? Are there any psychologists out there who can help? If people don’t, indeed, understand security but are using it is a placeholder for all sorts of other concerns, then it is possible that the payments industry may be making some bad decisions about how much security to implement and how to implement it. Perhaps people might feel more comfortable using their mobile phones (which are perceived as personal devices) rather than dongles, widgets, passwords and PINs and so even if the actual security might be lower than in another device, the overall security of the system goes up because more people use them rather than wholly insecure means such as passwords.

As an aside, for m-payment nerds, Karin also said some very interesting things about Mobilcom’s decision to fold TSM functionality into the infrastructure. But that’s another story.

Another key lesson from Austria was that the removal of a registration process doubled the customer base of mobile payment services. I can see exactly why this is. One of my children was going to Europe for a few days last month and as I was walking past a travel agency I saw an advert in the window for a prepaid euro MasterCard and I thought that it would be better to get him one of those rather than give him cash. I wandered in, expecting to wander out with a card. But when I presented my debit card and asked for a travel card with a 100 euros on it, the woman in the shop told me that I had to fill out a form. So I just got some euros instead. This wasn’t because I had some fundamental concerns about the privacy of personal data (although I do), but because I couldn’t be bothered. Am I representative? Well, the figures seem to indicate yes.

I note with interest that DoCoMo share the same philosophy. Their new mobile payments service does not require a new account to be created: buying their phone service is enough. They already know your bank account details, your creditworthiness, your location and everything else. So it’s simple to do something like this:

DoCoMo has announced they will launch a new mobile banking service on 21 July allowing users to transfer up to approx. $200 per transaction and $2,000 per month to any other DoCoMo customer. The mobile remittance does not require a new bank account and the total fee per transaction is set at $1.65 The funds can be sent to recipients personal bank account or credited to their DoCoMo monthly phone bill.

[From New Mobile Banking Service by DoCoMo by Wireless Watch Japan]

Is this something specifically Japanese that could never work anywhere else? Well, it may be in terms of regulation — such a service in the EU would need licensing under the upcoming Payment Services Directive (PSD) — but not in terms of market surely. If I could simply send my son the £29 he needed for a school trip this morning by selecting a menu on my phone, punching in a PIN and then choosing him from the contact book, I would. Would I pay 50p to do it? Unhesitatingly. Remember that the cost of anything is the foregone alternative: in this case, me spending twenty minutes I could ill afford searching round the house for the cheque book and then writing out a cheque for him to take to school. That’s why I’m late for work today.

These opinions are my own (I think) and presented solely in my capacity as an interested member of the general public [posted with ecto]