Author: Consult Hyperion

The costs and benefits of PCI-DSS

18th February 2013by Consult Hyperion2 Comments

[Dave Birch] Now that I am officially the most influential European commentator on emerging payments, I suppose I am going to have to choose my words more carefully. So when I say that I am unconvinced about PCI-DSS as the best long term solution to the payment card fraud problem, I’d better explain myself…

There are, in essence, two ways that you can make it more difficult for criminals to use stolen cardholder data (card numbers, expiry dates billing addresses and the like). You can make it harder to steal cardholder data (the PCI-DSS route) or you can make it harder to use the stolen data by doing away with magnetic stripes in card-present (CP) transactions and one-factor card-not-present (CNP) transactions. In a world without the internet and mobile phones, the latter prescription would seem theoretical. Hence there was no choice for the industry in that world but to try and lock down cardholder data in all the places where it is stored. This led to the creation of the Payment Card Industry Data Security Standards. Let us put to one side what those standards actually are, because this isn’t relevant to the conversation.

Now, it is no secret that some people think that PCI has proven an expensive way to reduce fraud, if indeed it has. I would like to see some publicly-available statistics from a reputable source on this topic – pointers anyone? I don’t think I was breaking ranks or telling tales out of school when I mentioned that it might be time for a check point around the topic and perhaps some strategic refocusing. I stress this is not a new opinion. These, to give a specific example, are not my words.

“PCI has rapidly become a self-perpetuating, self-aggrandizing, profit-motivated authority. It has and will continue to stifle innovation by its often nonsensical rule making.”
[From StorefrontBacktalk » Blog Archive » Federal Reserve Listens To Security Vendor CEO Rip Into PCI]

On which topic, I was interested to see that my enjoyable and stimulating micro-debate with Jeremy King, the European Director of the PCI Security Standards Council, at the recent Westminister e-Forum on Mobile Wallets has attracted some attention. Jeremy got annoyed with me for saying that no-one cares much about card fraud. OK, I might have been exaggerating a bit. But come on – card fraud in the UK is a couple of hundred million quid, which is statistically not much different from zero, largely because of the money spent on EMV and 3D-Secure (3DS). I was arguing that that the costs of PCI-DSS are too high and that we (ie, the payment industry) should be looking for better solutions. For example: I don’t want my debit card to work in magnetic stripe ATMs or for CNP use and if it was blocked for these transactions then it wouldn’t matter is criminal gangs got hold of the card number and expiry date. Please, please, please Barclays — I couldn’t care less about the picture on my card, but I don’t want a stripe, I don’t want embossing, I don’t want my PAN printed on the card, I don’t want a signature strip and I don’t want my name, sort code and bank account number shown in the front of the card. And why can’t my credit card issuers just drop me a text when my cards are used outside of the UK. Or, for that matter, outside of England. Or, for that matter, at a merchant that I haven’t been to in the last year. Or whatever – surely that would be cheaper than phoning me up in the USA or writing off the chargebacks. I wasn’t arguing for this as a long-term solution either. t think that the industry should move from CP/CNP (EMV/3DS) to an identity-based “something present’ (SP) solution, but that’s an aside. Back to the debate.

Jeremy King, European director of the PCI Security Standards Council defended the standard, claiming that the average cost per record of cardholder data lost in the UK is £79 per record. If a company suffered a breach of 50,000 records – which is relatively small – it would therefore cost them £4 million. By comparison, the cost of PCI DSS is somewhere between $3 million and $4 million, depending on the size of the company.
[From PCI DSS: is the cure worse than the disease? | ITworld]

So a company is spending say $4m to avoid a potential loss of £4m? Surely it would make more sense, as one of the audience members pointed out during question time, for the company to just buy insurance instead? I don’t get it. As the representative of the British Retail Consortium pointed out, large retailers might finding themselves spending £50m on this but if they get hacked then they’ll still get fined. (Note that US retailers have started to file lawsuits around the rules and the fines.) It may well be worth it, but I haven’t yet seen the evidence that can help us to determine the right level of expenditure. Apart from anything else, despite the money spent on PCI-DSS in the UK, there were a third more data breaches in 2012 than there were in 2011.

Now, I accept that finding statistical evidence around this is difficult. For one thing, it is very difficult to attach any specific frauds to any specific breaches. It may well be that cardholder data stolen from Sony was used to create counterfeit magnetic stripe cards used in US ATMs, but how do prove it? How do you know that the specific card number was stolen from Sony or from somewhere else? Or that if the fraudsters hadn’t got the numbers from Sony they would have abandoned their criminal activities and not attempted to get the numbers elsewhere. This is a complex topic, well beyond the scope of this blog.

Often they risk confusing correlation with causality – ignoring the fact that, for any observed change in fraud levels, there may be explanations other than the breach at issue.
[From Analyzing Causation, Damages in Data Breaches, causation analysis in data breach matters, damages analysis in data breach matters, the role of statistics in data breach matters]

Some big acquirers are working hard to try and reduce the costs and complexity of compliance. Barclaycard, for example, have their new Risk Reduction Programme, which attempts to shift towards sliding scales that more closely link the expenditure to the likely risks. As an aside, when I interviewed Neira Jones (the head of security at Barclaycard, who incidentally made an excellent presentation about all this in January) for a podcast recently she made a very good point about all of this: much of what is required by PCI-DSS is required for any sound information security strategy so the incremental costs of PCI-DSS over “normal” security measures ought to be limited. Perhaps one of the reasons why the costs are high is that the security baseline in many organisations is just not good enough.

Anyway, the bottom line is this. Even if new approaches from the acquirers do help to reduce PCI compliance costs, and even if those costs were reducing data breaches, it still might be time for the payments industry to make safer, more secure products so that it doesn’t matter if teenage hackers can get into the Xbox network or not, because they can’t use the credentials that they steal. There’s an obvious way to do this, which is to switch to 2FA+ solutions that demand tamper-resistant hardware. Preferably solutions that are part of a generalised identity and authentication infrastructure, not something constructed solely for payments. Now, if only consumers had a portable device of some kind that contained some kind of smart chip together with some communications channels and perhaps a simple keyboard and screen…

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers

Will mobile payments be safer? They are already are

14th February 2013by Consult Hyperion1 Comment

[Dave Birch] At the Westminster e-Forum, one of the journalists asked me “are mobiles more or less secure than cards?”. It is very difficult to answer this kind of what seems to (but isn’t) a straightforward question. Someone else asked me”are mobile NFC payments secure?”. Well, we are experts in the field and have carried out risk analysis on a number of different systems, so we can only answer “compared to what?”. Anyone who claims that any system is 100% secure hasn’t done their homework, but no-one developing a new payment system would start out with that goal (for the obvious reason that it would be too expensive). What should we compare mobile NFC payments to? I suppose the journalist was right in current circumstances and the benchmark should be plastic cards. In which case, I think the answer is clear.

If the level of fraud around plastic cards is at a some level considered tolerable, then we should aim to make mobile NFC payments more secure than that. This was in the back of my mind while reading an article on the topic that had been sent to me by a journalist asking for comment. The threats set out in this article (and my take on them) are:

1. The threat of having your smartphone stolen, and then used to purchase goods

This is the same as the threat of having your credit card stolen and then used to purchase goods except that people don’t notice when their credit card is stolen, but they do notice when their phone is stolen.

2. The threat of a criminal placing an NFC receptor in close proximity to your smartphone in order to steal your funds. For example, a criminal placing a receptor near your phone while it is in your pocket and you are in a crowded elevator or subway.

This is a wholly non-threat. Even if I could sneak my phone to your back pocket, all it would read would be the same card number and expiry date that you show everyone when you use your card anyway.

3. The threat of intercepting the NFC signal by eavesdropping while you are undertaking a transaction and then altering the signal so that the funds are transferred elsewhere.

This is an non-issue. The digital signature attached to contactless card transactions stops merchants (or anyone else) from altering (or replaying) transactions.

4. Malware on the smartphone.

This is a genuine threat to transaction systems based on mobile phones, but is nothing to do with NFC.
[From How secure is NFC? « Dave Waterson on Security]

My overall take on all this? Mobile NFC payments are safer than than payment cards. Davey Winder was kind enough to quote me making a similar point in an interesting article about the security of contactless payments.

Birch insists that while current contactless payment cards are just as secure as other card payment technologies, contactless mobile phone payments have the potential to be “significantly more secure, since there are a number of characteristics of mobile that make it much harder to defraud people”,
[From Infosecurity – How Secure Are Contactless Payments?]

It’s hard to say definitively that “mobile” is more secure than “cards” because obviously there are lots of different kinds of mobile payments and lots of different types of card (well, two, really, stripe and chip). There was a recent report from the Boston Fed looking at these security issues and comparing the different mobile payment technologies to contrast the vulnerabilities of each.

This report examines in detail how near field communication (NFC) and cloud technologies address security for mobile payments at the retail point-of-sale (POS). It also provides a brief overview of security for two other mobile technology platforms, QR code, and direct carrier billing (DCB). Each technology manages and processes information uniquely; hence security practices and issues will vary with the technology deployed by each payments platform provider.
[From Mobile Phone Technology: “Smarter Than We Thought” – Boston Fed]

The report makes an interesting distinction between a mobile wallet, where the payment credentials are stored on the mobile device, and a digital wallet, where the payment credentials are stored in the cloud. I think these connect with the final point above about malware and the distinction is important, especially as we are moving from a world of mobile payments to a world of mobile wallets, with lots of software running in the handset.

In the cloud, on the other hand, the threat of mobile malware is strong enough that wallet providers will need to make absolute certain that they understand the nuts and bolts of each mobile platform and operating system for the phones that will carry the wallet.
[From The Issue of Security and Fraud Risk in the Cloud vs. Contactless Mobile Wallet Debate – PaymentsJournal]

There is another way. Suppose the phone just stores the keys to the payment credentials in the cloud? Then the problem resolves to the more manageable (and well-understood) issue of managing keys. Since the keys are small, relative to the data, they can be stored in a Secure Element (SE) or Trusted Execution Environment (TEE) on a mobile handset and then we can ignore all of the nodes and links between the counterparties to a transaction and move to end-to-end security. I think we’re on that track: so not only are mobile phones already more secure than plastic cards, the gap is going to widen.

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers

“Identity is the new Money”. Brilliant – I wish I’d said that

12th February 2013by Consult Hyperion9 Comments

[Dave Birch] Sebastien Taveau, the CTO of Validity Inc. (who will be speaking at our Tomorrow’s Transactions Forum in March, by the way), was kind enough to quote me in his review of 2012.

He coined the following statement that has become my favorite of the year.

“Identity is the new money”.

It is simple, powerful and summarizes exactly where the ecosystem is going.
[From Looking Back Forward | Validity Inc. | Biometric Sensors for Mobile Devices]

Seb is much too kind. I may well be guilty of popularising the aphorism in the context of payments and organisational strategies towards secure electronic transactions in the retail space, but I didn’t invent it. I heard it for the first time a few years ago in connection with the ill-fated UK national identity card scheme. I was at the time a member of the Home Office’s Advisory Forum and was interviewed by Sir James Crobsy, who had been called in by the then-Chancellor Gordon Brown to prepare a report on the scheme. It was Sir James who brought the phrase to my attention.

If, as Sir James Crosby said in his report on the U.K. ID card scheme, “identity is the new money”, then banks should already have generated strategic plans to accumulate the former, now that they’ve run out of the latter.
[From Digital Identity: I’m sure banks have a strategy for this kind of thing]

As time has gone by, I have become more convinced that there is a deep truth in the apparently simple statement and I’d like to explain why. But to do that, we have to first explore what money means. One of the problems that always comes up when discussing money is that the word means several different things. I want to focus on just two here: money as a generalised means of exchange between buyer and seller and money the subset of means of exchange that do not involve credit. In other word, cash. Identity changes the requirements for and use of both kinds of money.

If you know who all of the counterparties to a transaction are, and can establish their “credit” then there is no need for cash. Identity substitutes for cash: when I go into Waitrose and pay with my John Lewis MasterCard, it’s an identity transaction. The terminal in Waitrose establishes that I have access to a line of credit that means that Waitrose will be paid. No actual money moves between my card and the Waitrose till. On the other hand, when I buy an apple from a market stall and pay for it with a pound coin, the stallholder doesn’t need to waste any time or money trying to establish who I am, because he doesn’t need to trust me. He just needs to trust the pound coin, which he self-assays. It’s not that there are no counterfeit pound coins, because there are, but that there are too few of them to disrupt commerce (and, to be honest, if you give the smallholder a counterfeit coin and he later detects the fraud, he will probably just palm it off on someone else).

As a thought experiment, then, imagine that cash vanishes and we interact through identity. In that case, identity becomes the key to transactions and a crucial individual resource that needs to be looked after by responsible organisations. This is the idea behind the Digital Asset Grid put forward by the Innotribe team at SWIFT, the worldwide interbank messaging service, at last year’s SIBOS. Whether you think DAG is the right specific approach or not, there’s something to be said for begin strategic planning around the transition to identity-based transactions.

What does all this mean at a macro level? It means that the action in the payments world will shift further toward identity over the coming year. One of the reasons why the Single European Payment Area (SEPA) hasn’t transformed cross-border commerce in the way that had been hoped is that a great deal of cross-border commerce rests on identity, which is undoubtedly why the Commission has switched its attention and proposed new rules to enable cross-border and secure electronic transactions in Europe.

The proposed Regulation will ensure people and businesses can use their own national electronic identification schemes (e-IDs) to access public services in other EU countries where e-IDs are available. It also creates an internal market for e-Signatures and related online trust services across borders, by ensuring these services will work across borders and have the same legal status as traditional paper based processes.
[From EUROPA – Press Releases – Digital Agenda: new Regulation to enable cross-border electronic signatures and to get more value out of electronic identification in Digital Single Market]

You can see where they are coming from. The UK, however, does not have a national e-ID and is unlikely to have one for the foreseeable future. We’ve taken another path, using a framework approach and private sector identities, so a pan-European solution will have to work with public and private sector identities in a single framework. This line of thinking suggests that a fruitful line of enquiry might be to look into a pan-European trust framework that these identities can belong to.

In digital identity systems, a trust framework is a certification program that enables a party who accepts a digital identity credential (called the relying party) to trust the identity, security, and privacy policies of the party who issues the credential (called the identity service provider) and vice versa
[From What is a Trust Framework? | Open Identity Exchange]

Let’s hope that the Commission can help something like this to develop, because the real barrier to cross-border trade within the Single Market is not money, but identity.

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers

The triumph of the nerd (for one day, at least)

8th February 2013by Consult Hyperion1 Comment

[Dave Birch] Are mobile payments taking off or not? In the US I mean. Not in places like Kenya where there is no banking infrastructure or cards infrastructure or alternatives, but in the US, where a quarter of the world’s card volume is transacted (and half of the world’s card fraud is executed). How is mobile doing there? It’s early stages, that’s for sure, but interesting times. The Isis mobile payment scheme has launched and the first feedback is surfacing.

Isis may just be in its infancy, but the mobile payment consortium’s Chief Sales Officer Jim Stapleton said that its trial in Salt Lake City is producing positive results from both consumers and merchants.
[From Isis: Salt Lake City mobile wallet users average 5 transactions a week — Tech News and Analysis]

Five transactions per week isn’t a bad start, but it is only start. The question is – where’s the inflexion point? Will mobile payments remain an interesting nice or will they become part of the mainstream inside any strategic planning horizon for organisations developing their strategies right now.

Karen Webster, founder of PYMTS.com, wrote at year end 2012 that the ability to use smartphones for the majority of our transactions is likely “a decade at least” away.
[From Game of Darts: Timing Mobile Wallet Adoption Gets Wonky | Bank Innovation]

A decade away? Maybe in the US, but not on this sceptered isle, this earth of majesty, this seat of Mars etc. Here, the future’s so bright I gotta wear shades. On Monday, just as I was leaving the house, our cleaner reminded me that I had paid her for January, so I used my excellent Barclays mobile payment application to execute an FPS transaction and send the money from my bank account directly to hers in a matter of seconds [Smartphones 1, Non-Smartphones 0]. I drove to the station and used my smartphone to pay for the parking [Smartphones 2, Non-Smartphones 0]. Then I went to buy a ticket. Here is the scene at our station. This is not photoshopped for effect. I really did have to stand in that line.

Sadly, due to the Victorian nature of our railway service, I could not buy a train ticket using my smartphone (either remotely or using NFC) so I was forced to stand in line to purchase a paper ticket, much as our forefathers did when the station was first opened (as “Woking Common”, because it was all fields round here then, see below) in May 1838 except that I was able to use one of those new-fangled “cards” [Smartphones 2, Non-Smartphones 1].

If you ask me, the best bit in H.G. Wells landmark of science fiction, “The War of the Worlds“, was when the Martians destroyed Woking station. Anyway, off to the Big Smoke, where I went to the MacDonalds at Waterloo (they are located near the Jubilee Line entrance and I like their coffee) and I paid with my smartphone.

OK, it didn’t work, but you can’t have everything. So I tapped my contactless Barclaycard instead and went on my way [Smartphones 2, Non-Smartphones 2]. After the meeting I met up with a colleague in a nearby Pret, where I paid with my smartphone (NFC) and went off to the next meeting [Smartphones 3, Non-Smartphones 2]. After the meeting, I headed back home with Jonathan Jensen from UKash and we needed to catch up on a few things for half an hour so we went to the coffee shop on Clapham Junction station. Naturally, I paid there with my Barclaycard QuickTap [Smartphones 4, Non-Smartphones 2].

And so off home to regale my wife with interesting payments stories of the day. The tally for the day: smartphone payments 4, non-smartphone payments 2. Not only did I make the majority of my transactions using my smartphone, I made twice as many smartphone transactions as non-smartphone transactions. The statistics don’t lie, so I shall mention this triumph of technology to Karen next time I see her. I expect she’ll really enjoy my accompanying slide show of POS terminals from around the world.

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers

EMV and CNP

7th February 2013by Consult Hyperion5 Comments

[Dave Birch] Here's a rather obvious question to ask: will shifting to chip cards reduce the amount of card fraud in the US? You would think so. And it probably will. But it won't reduce all fraud. It will reduce "card present" (CP) face-to-face and automatic vending fraud, but it will increase pressure on "card not present" (CNP) fraud. This inevitable as the criminal classes will not simply abandon their activities in the face of technological change but instead, as they have always done, start probing for weaker links in the payment security fence.

Both Visa and MasterCard stated during today’s event that Oct. 1, 2015 is the date when the responsibility for fraudulent transactions regarding point-of-sale (POS) transactions shifts from the credit card company to the retailer… The liability shift differs among the top two credit card processors when it comes to ATM and automatic fuel dispenser transactions. Retailers will bear the brunt of the liability for such MasterCard transactions starting in 2016, while the liability for such Visa transactions shifts in 2017.

[From Confusion Surrounding EMV Begins to Dissipate – Retail Tech – CSNewsRetailTechnology]

Now that migration to chip is on a firm timetable in the US it is useful, I think, to review the earliest chip migrations that took place and with the wisdom obtained from experience look at ways to make the US migration process smoother, more efficient and better value for the stakeholders.

Chip and PIN, doesn't, of course, get rid of fraud. It is demonstrably successful at reducing certain kinds of fraud and it certainly met its goals for bringing fraud under control. Remember, the UK business case for chip and PIN migration was not based on the level of fraud at the time (although there was an issue with the extent to which the proceeds of that fraud were used to fuel other criminal enterprises, and I accept that the police had a valid point on this) but on what the levels of fraud would rise to in the future unless action was taken. What has actually happened is that UK card fraud peaked back in 2008 (at £610 million) and have since fallen by around half. Without chip and PIN, card fraud might have broken the £1 billion barrier by now.

The figures speak for themselves. UK card fraud in 2010 was the lowest for a decade and is still going down. Counterfeit fraud is down considerably. But what the figures also show is that while overall fraud continues to fall, CNP fraud continues to rise. CNP hasn't shared in the benefits of the infrastructure spending on implementing EMV. When we made the transition to EMV in the UK we had the opportunity to use chip-based security for online transactions as well, but we never took it. Here's what I mean: when I login to my Barclays home banking service, I put my chip and PIN debit card into a little calculator thing that the bank sent me, enter my pin and the device displays a one-time password for use on the web. I only use this for access to home banking but there's no reason (apart from inconvenience – more on this later) that I couldn't use this online for all transactions and therefore obtain significant reductions in online fraud as well as in off-line fraught. That two-factor authentication mechanism could, for example, used for 3D-Secure (3DS) transactions instead of a static password.

So will chip and PIN cause a net increase in US CNP fraud, since it will transfer from the face-to-face environment to the online environment without providing suitable countermeasures? Should the US use chip and PIN online? A few years ago, I thought this would be a good idea (in fact, I worked on a strategy for a US issuer looking at this around five years ago), but the window has been closing. In fact, as technology has moved on, I'd say it's clear that this will now never happen. We're not going to add smart card readers to our laptops or mobile phones and we're not going to use chip and PIN cards in them to transact online. We going to use the smart phone instead. The security that having tamper-resistant hardware in the loop brings to transactional environments applies just as much to the SIM card in a mobile phone as it does to the EMV chip on my bank card.

The U.S. currently accounts for 47% of global credit and debit card fraud even though it generates only 27% of the total volume of purchases and cash

[From U.S. Leads the World in Credit Card Fraud, states The Nilson Report | Business Wire]

As other countries continue their EMV migration, card fraud in the US will continue to increase. What does this mean for the assault on CNP fraud in the US? Clearly the industry needs to take action. But what? I think we have to look outside the financial sector to develop the roadmap. The solution is to adopt identity management frameworks and standardised authentication techniques that are cross-sector and not to spend any more time on developing industry-specific solutions such as 3D Secure (3DS). If we can decouple the issue of identifying the counterparties to a transaction and authenticating them in a convenient fashion from the issue of executing the payment between them, I think we get the best of both worlds. Yes, CNP fraud is too high in the US and imposes costs on that that stop it from reaching its potential, but new technology is going to help.

If we really want to cut down card fraud then we need to start taking the stripes off of the back of cards and the numbers off of the front of them.

[From Counterfeit card fraud in the US will fall, eventually]

An excellent first step, but in my opinion we need a concerted and infrastructural approach to the problem. Yes, make the cards safer but that not enough if fraudsters can simply take the card numbers and use them online anyway. If you look at what analysts such as Gartner and Forrester are saying, then banks should be looking at OpenIDConnect and NSTIC to plug payments into national infrastructure (an approach which, it seems to me, offers both cost reduction and opportunities for new revenues because card issuers can become identity issuers).

These are the kinds of innovative solution that I'm looking forward to hearing about at the CNP Expo in Orlando, Florida on May 20th-23rd 2013. They've got a great speaker line up with a variety of industry experts (and me) in place. What's more, the good people at CardNotPresent.com, who are behind the expo, have given us a complimentary delegate place to give away on this blog! So if you're going to be in Orlando on 20th-23rd May and would like to come along as a guest of the Tomorrow's Transactions blog, all you have to do is to be the first person to comment on this post with the name of one of the two banks involved as issuer and acquirer and the year of the pilot for Visa and MasterCard's predecessor to 3DS.

Blog readers can also get a 10% discount on registering at CNP Expo with the code 'hyperion10off'.

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers

Tubular bells and whistles

4th February 2013by Consult Hyperion1 Comment

[Dave Birch] As I’ve written before, there are reasons for preferring an identity and authentication infrastructure that is based on tamper-resistant hardware with local authentication rather than passive identification technologies, largely because it allow the individual control over multiple identities, which I regard as an important contribution to the “privacy settlement” that we are going to need to negotiate in the online future, so naturally I was pleased to see that some security experts at Google have come to the same conclusion, albeit a few years later.

In a research paper, two security experts at the web giant have outlined a future in which the main way of guaranteeing we are who we say we are online will be possession of a physical token, perhaps embedded in smartphones or even jewellery.
[From Google aims to replace passwords with ID ring – Telegraph]

Whatever will they think of next 🙂

I can’t resist flagging up this example because some years ago we worked on a project for a client in the financial services sector who was looking at combining RFID tokens with passwords to make effective two-factor authentication (2FA). The idea was that the, for example, ATM would contain an RFID reader based on ISO 15693 using read-only tags with a range of around two metres. So as you walk up to the ATM it recognises that you are nearby. Then you key in a PIN or a password and the ATM checks this online against the tags that it has lit up. If there’s a match, you get the cash. Anyway, the reason I’m mentioning this (and I’m sure that the client won’t mind me saying it) is because one of the storyboard ideas that we wanted to prototype was jewellery. We went off to talk to a company that had already put tiny RIFD tags in jewellery (it was used for stock management and tracking) and established that the idea was feasible but for one reason or another the client decided that it would be better to make a custom dongle for online use only and leave the ATMs and branch counters alone. These have met a mixed reaction from customers.

the only thing is these blasted little security fobs that you have to keep keying in. I used mine so much that the battery ran out so I had to go and find a replacement locally.
[From Mike Oldfield: ‘Tubular Bells made me a million but the tax bill came to £860,000’ – Telegraph]

That’s why the Google researchers’ other futuristic plan, which is to embed the token in a smartphone, is certain to take off. I’ve even thought of a good name for it: the “secure element”. Not very sexy, but perhaps the marketing wallahs will salvage something from it. The device formerly-known-as-the-mobile-phone is the obvious choice for the remote control to cloud identity. No-one wants another dongle when they’ve already got their phone with them all the time. I know it sounds far-fetched, but I have a dream that one day I’ll be able to log in to my bank by simple tapping my contactless bank card against my laptop or smartphone…

By the way, thinking about futuristic businesses at Google, I remembered reading about another ground-breaking enterprise that they are involved in.

Last week, it was reported that Google founders Larry Page and Sergey Brin and others are investing in a new company called “Planetary Resources” that wants to mine asteroids.
[From Here’s How Google’s Founders Can Mine Asteroids And Become Trillionaires… – Business Insider]

How can they not call this the Weyland-Yutani Corporation?

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers

Real data on contactless EMV in transit

30th January 2013by Consult Hyperion1 Comment

[Dave Birch] At the excellent, and well-attended, Transport Ticketing 2013 event in London I saw a terrific presentation from John Hill of CUBIC reporting some early data from Transport for London (TfL’s) migration to open-loop payments. In the first instance, as you will recall, TfL began to accept contactless EMV cards on the buses and later this year they will begin to accept contactless EMV cards on the underground as well. It’s all a long way from Reg Varney and his clippies!

John was kind enough to share the detailed transaction timing data that we (i.e., Consult Hyperion) had previously seen as part of our work on the Future Ticketing Project (FTP) but were not able to share before it was made public. I’ve included John’s slide below with the kind permission of TfL. What this data shows is that the mean transaction time for bus taps is around 530ms. Of this 550ms, around 100ms goes on the terminal “polling” to determine which Oyster, ITSO (the UK’s national standard for contactless ticketing) and open-loop (EMV) products are on the customer’s card, so when you take this into account with some other overheads, it looks at if the overwhelming majority of contactless EMV transactions are taking 400ms. This is slower than Oyster (which takes about 350ms) but not a big deal. As John mentioned in his presentation, we are working with CUBIC and TfL to find ways to reduce the transaction times further so that 100ms polling is in our sights right now. Anyway, here is the key slide:

In addition to the 545ms mode peak, John’s figures clearly showed much smaller peaks at 420ms and 490ms as well as a long tail out over 900ms! This is clear evidence that different card families and form factors (ie, dual-interface vs. tags) take different times to process the transactions and that the fastest cards (at around 420ms) are twice as fast as the slowest cards. This is an unexpectedly wide variation. John politely resisted my calls from the floor for him to name and shame (!), but it boils down to this down: the fastest EMV cards are executing the transactions faster than the new Oyster card, but the majority of EMV cards are slower.

Another early learning from the TfL migration was put forward by Nick Mackie from Visa Europe in the panel (on open-loop migration in Europe) that I chaired at the event. As Nick pointed out, there’s been a problem with “collisions”. What this means is that customers who are used to waving a wallet or a purse or a pocket that has an Oyster card in it, they are now waving a wallet or a purse or a pocket that has both an Oyster and one of more contactless EMV cards in it. When the terminals see multiple cards, they (as currently configured) do nothing. There are currently far too many collisions being reported, so there’s a customer education issue here. Retailers (including transit operators) have to explain to people that if they present multiple valid cards, then nothing will happen (yet another reason for moving to mobile, where Nick pointed out that Barclaycard have “hundreds of thousands” of PayTag stickers out there and customers like them).

And here’s some more hard data from the event that might be useful: there are currently 9,000 open-loop transactions per day on the bus. This is a tiny fraction of the 6.3m transactions per day, but it is growing at 2% per annum. People seem to like it (a friend visiting from Scotland e-mailed me last weekend to say how great it was to be able just use her Barclays debit card while visiting instead of buying an Oyster card). It’s a good start.

Why does all this matter? Well, it’s because the transit experience, in many markets, is disproportionately important to the contatless trajectory. I’m might only use my contactless card twice per day on the bus, but because I use it on the bus it becomes the card in the my back pocket and I might then use it to buy coffee and lunch with contactless as well.

In any case, transit is one of the rare use cases where NFC payments add some real value to the user experience simply because it is more convenient to tap your phone as you rush through the rail gate or board the city bus rather than fumbling to find a contactless bank card or transit smart card.
[From NFC – Yes, NFC, That Speeding Train is Headed Your Way | PYMNTS.com]

Incidentally, while much of the talk yesterday was about the shift to open-loop in transit, that’s not the only model. There is indeed a completely opposite roadmap, whereby the contactless cards used for transit have such high penetration and are so well-established that it makes sense to use them instead of bank cards. Look at the Asia-Pacific region. Taiwan is following Hong Kong and Singapore in allowing the transit e-purse to be extended out into retail.

The EasyCard, a contactless smartcard system for use on the Taipei MRT system, will soon become an electronic purse that can be used to purchase small-value items… The new payment system, which will allow up to NT$10,000 (US$312.50) to be stored in the card, will be put in place a year after the Legislative Yuan passed an amendment to the Act Governing the Issuance of Electronic Stored Value Cards that paved the way for the new payment vehicle.
[From Electronic purse expected to become operational in March – Taiwan News Online]

It’s clear that, as we all know, transit is mass market, technically challenging, high profile, important and demanding. It’s at the intersection of NFC, mobile, payments and (soon) big data. I love it.

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers

Tomorrow’s Transactions: mobile wallets

28th January 2013by Consult HyperionLeave a comment

[Dave Birch] Looking at the long list of mobile wallets posted by the good people at pvments.com, you can't help but feel that this will be one of the hottest payment topics of 2013 and it's an especially fun topic because no-one really knows how it is going to pan out. There are a great many different opinions coming from all perspectives. For example, Anuj Nayar, PayPal’s senior director, global communications, recently wrote that:

The problem is that mobile wallets don’t solve any customer pain points by themselves. They don’t offer intrinsic advantages over swiping a credit card or heaven forbid, paying cash

[From Mobile Wallets – PayPal Exec: Mobile Wallets Address Non-Existent Problem | PYMNTS.com]

I hope that Anuj won't mind nipping down to the ATM for me next time I'm stuck in a taxi with no cash or popping home to pick up my wallet for me next time I forget it. After all, I'll have my phone with me so I can easily give him a call! But that wasn't what I wanted to focus on. What Anul actually went on to say was

To gain mass adoption it has to be better, not just different,

[From PayPal is not a mobile wallet company]

Indeed. This is what I mean when I talk to clients about "hyper wallets": not an emulation of the wallet in your back pocket but a re-imagnation of what a wallet should be in the always-on, hyper-connected world that RBS talk about in their new report "Four Technology Super Trends and their Impact on Retail Banking". An always-on, hyper-connected wallet should be something fantastic, not just another wrapper around your existing payment cards.

A hyper wallet doesn't try and simulate a physical wallet: it meet the requirements for a wallet in the modern, online world. It doesn't emulate the leather wallet, it blows the leather wallet away.

[From Wallets, mobile wallets and hyper wallets]

Since wallets are such a hot topic, we're going to have an expert panel on the topic at Tomorrow's Transactions, the 16th annual Consult Hyperion Forum, which will be held in London on 13th and 14th March 2013. In case you are wondering: yes, this did used to be called the "Digital Money Forum", but we decided to change the name this year for two reasons:

Technology changes around identity and authentication are as integral to the future of retail transactions as technology changes around payments and the two are inter-related.
It makes sense to bring all of Consult Hyperion's thought leadership activities together under the single "Tomorrow's Transactions" brand. Tomorrow's transactions are where our thought leadership is focused, securing tomorrow's transactions is where our day-to-day work with clients is focused.

The name has changed, but the fun hasn't. The Forum once again promises the combination of discussion and debate, learning and fun, that has earned it the reputation as the place to be for people interested in the future of retail electronic transactions. It continues to be a unique event, where interaction and invention replace product announcements and “death by Powerpoint” sales pitches. This year we are again moving the agenda forwards to look at the leading edge in mobile transactions, Islamic e-finance, cashlessness and financial inclusion, amongst other topics, all in a relaxed environment where experts can explore the boundaries of strategy for banks, mobile operators, retailers, charities and government.

All delegates will receive a complimentary copy of the Tomorrow’s Transactions 2013 "blook" as well as Barrie Cook's "Angels & Ducats: Shakespeare's Money & Medals". The Forum is a not-for-profit event and any surplus generated will go to BUFFER (which provides specialist diagnostic equipment for breast cancer), Jubilee Action and Action Medical Research. The Forum is sponsored by Visa Europe and WorldPay with support from Olswang and ACI Worldwide.

The Forum will be limited a maximum of 100 people as always, and we have confirmed chairs, speakers and panelists from The Economist, University of Bangor, Gates Foundation, Mobile Industry Review, Yandex Money, InsideOps, We've, Visa Europe, Olswang, Validity Inc., MyBank, Droplet, Maris Strategies, British Museum, Department of Work and Pensions, Comic Relief, Toynbee Hall, the Cabinet Office, London Rebuilding Society, Verizon, ACI Worldwide and WorldPay and others. Book yourself a place now.

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers

Incumbent vs. disruptor smackdown

25th January 2013by Consult HyperionLeave a comment

[Dave Birch] The excellent Payments Forward series of afternoon tea debates continued with some delicious green tea with honey, some first-class carrot cake complete with marzipan carrot on top and a first-class discussion about the nature of competition in the payments industry.

This time the debate was about (essentially) banks and non-banks in the payments sector. The motion was “This house believes that banking incumbents can keep non-banking disrupters at bay in the new payments paradigm”.

For the motion:
- Graham Peacop, Managing Director, The UK Cards Association
- Sean Gilchrist, Managing Director, Digital Banking, Barclays Bank
Chaired by: Roger Alexander, Director, Accourt
Against the motion:
- Jon Prideaux, Chief Business Officer, BOKU
- Stewart Roberts, Managing Director UK, iZettle

Forum friend Jon Prideaux, well-placed to deliver perspective because of his many years at Visa Europe as well as his role at Boku, went for the jugular by pointing out that all of the inventions claimed by banks were made by other people and that banks are already nothing more than a thin veneer over services provided by third-parties who are non-banks. He said that banks are “johnny-come-latelys” in payments who never wanted to deliver such services for more than the elite and that they will move away from payments again in the future. He may have been a little harsh in places, but surely there’s a grain of truth to this?

Sean Gilchrist highlighted the historic position of banks and reminded us that (I paraphrase) while people may not like banks they do trust them. He also pointed out that banks actually do have a historic track record in innovation. I might add on behalf of Sean that Barclays in particular have a track record to be envied: the first ATM in the UK, the first credit card (Barclaycard), the first mass roll-out of contactless, the introduction of PingIt and so on. Does this means that banks can continue to be the innovators? PingIt is definitely food for thought. Matt Kingdon, from our friends at WhatIf (an innovation consultancy based in London) writes about the PingIt case study in his new book “The Science of Serendipity”, contrasting the “traditional” programme management approach to developing new products in the banking sector with the “war room” approach that Barclays adopted to get PingIt into the market in a very short time. Barclays put marketers, technologists, lawyers and others all in the same room and told them to get on with it. Maybe it is the exception that proves the rule, to hopelessly misunderstand the old saying. I hope I’m not treading on any toes by deliberately contrasting the development of PingIt with its spiritual progenitor, the Payments Council’s mobile front-end to FPS (which is now due to go live in 2014) and the RBS iPhone 4 payment app that went live a week after the iPhone 5 launched.

Graham Peacop emphasised the incumbents historic ability to adapt and innovate but also introduced the issue of regulation. Obviously, the purpose of the evening wasn’t to talk about regulation in particular, but I think that the regulation will resolve this debate — technology cannot. When he said, by the way, that the UK has no successful P2P solution, he must have annoyed PayPal. I used it twice today, and it worked perfectly both times (as did iZettle too).

Stewart Roberts, who again has considerable experience of the “conventional” payments world as well as roles with disruptors, focused on the “few tortoises versus hundreds of hares” approach. He seemed to be saying that the timetable for banking innovation is so at odds with the rest of the business world that it simply cannot deliver the services that they require.

I thought it was interesting that the issue of whether banks are in payments for strategic reasons or whether they (as Kevin Coles said) had fallen into them came up again in the questioning. The assumption is, I think, that payments are a gateway to banking and that without payments relationships, banks will find it harder (i.e., more expensive) to develop banking relationships but this may well an outdated perspective. After all, as a customer I’ll still go to the bank for a loan, even if I use a payment institution for transactions, right?

My undercover agents at the event tell me that in the end the disruptors won the debate, although everyone knows that the reality will be more nuanced. Jon, in passing, referred to the new regulatory regime in Europe and, as I said, I’m pretty sure this will be the driver that shapes the emerging competitive landscape. At the Smartex Smart Payment Forum I chaired last July, I remember Adrian Cannon from Edgar Dunn giving a presentation on the challenges to innovation in payments. He focused on regulation as a significant barrier to change (the results of an Edgar Dunn survey of payment professionals showed that they still felt regulation was the single most significant issue facing their organisations), and he was absolutely right, but I thought it was interesting that he also talked about the “freedom to innovate”.

There is a “third way”, to use an infamous phrase, that I think can provide the freedom to innovate in a sound regulatory framework. A bank could create a payment institution / electronic money institution subsidiary and put it at a distance to foster a different corporate ethos, more focused on innovation. Even the banks who do make the strategic decision to stay in the payments business might be tempted to do so through such non-bank payment institution subsidiaries (while some of the non-bank entrants will go down the PayPal route and get banking licences). Either way, at least there will be some real competition, and that will be good for the rest of us.

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers

Identity is an opportunity for mobile operators in an API world

22nd January 2013by Consult Hyperion1 Comment

[Dave Birch] Yesterday I was invited along to a pleasant get-together amongst payment luminaries. It turned out to be an excellent evening and gave me an opportunity to bore some important people at great length.

Explaining the offside rule to Sean Park from Anthemis.

After a couple of glasses of champagne I found myself talking to a senior payments executive. He asked me what I thought the next big things in payments would be: I said identity is the new money (as I always do), payments data is worth more than payments (as everyone always does), and that APIs were the new competitive front (as I have begun to in last few months). I was working on a report on APIs for one of our clients this morning, and I googled something and discovered just how unoriginal my perspective is:

At the Defrag conference in Broomfield, Colo., this week, three themes came in the forefront: APIs, identity and data.
[From 3 Pillars Of The New Business World: APIs, Identity, and Data | TechCrunch]

I agree with this analysis wholeheartedly and I will be posting endlessly about all three in the year to come, naturally, but first I want to make a point about APIs. We need more than just payment APIs to make mobile commerce work. The December 2012 edition of the TM Forum‘s Digital Life report has a nice piece by Annie Turner looking at ten hot areas for innovation (focusing on the telecommunications industry, of course) across the coming year. A couple of them I agree with very strongly, such as the transition to prosumer networks and the rise of the machine-to-machine business opportunities. Some I’m not sure about, such as the need for innovation in execution. But it’s her last point that interests me the most. She says that communications service providers (CSPs), just like a great many other businesses, will find themselves in API-based businesses. Observers are already saying that this will be $100 billion plus business within a couple of years, so learning how to compete in an API world is an immediate priority for a great many organisations and, I have to say, a great many of our clients. It’s particularly interesting to me that the second-largest category of API in the market projections she uses (in this case, from Alan Quayle’s webcast) is the billing of non-digital goods by CSPs.

Given that many of us think that mobile wallets are going to be hot, and that these mobile wallets will want to access fairly standard APIs, I think the track record in the telecommunications sector is fairly poor the moment. The GSMAs “OneAPI” initiative hasn’t really taken off yet and the other Tier 1 operator’s own API programs (such as those from AT&T and Telefonica) are in their early phases. Naturally, given my perspective, I see the API-powered smart pipe in simple terms, exposing digital identity, digital money and digital network APIs. It’s another matter whether the CSP or third-parties provide the services that sit behind those APIs.

We already have carrier billing and location-based services, so we can imagine what the digital money and digital network APIs might look like, but we don’t yet have any identity-based services, which might suggest to some observers that for the CSPs at least, a strategy toward identity ought to be a priority. It might be preferable to have a sector-wide approach that helps mobile operators, in particular, to provide network-centric identity services. Actually, I’ve already one such approach put forward: Operator-ID. Operator-ID was proposed at the GSMA Mobile Identity meeting in Nice last year. The proposal is based on the use of OpenID Connect to deliver a basic, practical and interoperable federated identity solution for mobile operators.

OpenID Connect performs many of the same tasks as OpenID 2.0, but does so in a way that is API-friendly. OpenID Connect can also be extended to include more robust mechanisms for signing and encryption. Integration of OAuth 1.0a and OpenID 2.0 required an extension (called the OpenID/OAuth hybrid); in OpenID Connect, OAuth 2.0 capability is built into the protocol itself.
[From Connect | OpenID]

The GSMA have very kindly invited me to chair a panel on “Mobile Identity: Opportunities and Challenges for Service Providers” at the Mobile World Congress in Barcelona next month (at 2pm on Tuesday 25th February) and I’m delighted to say that Patrick Fischer, who presented the Operator ID proposal in Nice, has kindly agreed to one of my panelists, along with representatives from Verizon, Citi and Nokia Siemens Networks. Look forward to seeing you there.

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers