Category: Markets

Mobile identity on the move

Posted on by 3 Comments
Greyscale backing image
[Dave Birch] I recently posted about the need for a cross-sector identity management infrastructure in the financial services world and suggested that banks need to get on and start working on it. I didn’t mean to imply that banks should be the exclusive providers of that kind of infrastructure, since there are other organisations who might do a better job. One part of a spectrum of possible future might, for example, involve mobile operators providing both the infrastructure and one class of identity and attribute provision businesses.

Now, one of the obvious reasons why mobile operators are well-placed to provide infrastructure in the identity space is that they have the SIM. I’ve written countless times before, going back many years, that the SIM might be a good place to store digital identities. In fact, way back in 2006…

I said a long time ago that “SimID” might be more profitable than Simpay!

[From Digital Identity: Norwegians would]

I still have a presentation on my laptop that was a proposal for an identity play (then known as the “Genie Passport”) for Cellnet two recessions ago, but I can hardly claim to be the only person with that idea. It was common currency more than a decade ago in the days of Wireless PKI and Raddichio.

If the operators provide SIM-based PKI and then rent it out on reasonable terms, banks will be only the first mass market to shift identity and authentication out of the cloud and on to the handsets.

[From Digital Identity: Cloudy with a chance of PKI]

The point was made repeatedly, by multiple speakers, that the operators should work together to create an infrastructure. I agree with this, but I think it is a reasonable point to make that this co-operation needs a shared narrative to animate it. In other words, what’s the story? It’s one thing to say that the SIM should store identity, but quite another to say what exactly this “identity” is, how it ail work in prosaic cases and what infrastructure needs to be developed to make all of it possible. But this post isn’t about that narrative.

Last month the GSMA invited me down to Nice for their Mobile Identity meeting. The meeting was held under the Chatham House rule so I’m not going to say who said what, but I will say that it was interesting to see a group of mobile operators from around the world taking the business of identity seriously and looking at launching commercial services. A concrete proposition for a standard “Operator-ID” was put forward by one of the MNOs and I have to say that I thought it was pretty good. The idea is simply to provide a generalised SSO that all service providers can use: your login menu at a web site would be “Facebook/Twitter/Your Mobile Operator”. There were five reasons to provide this service put forward by the protagonists:

  1. Reach. The operators have a lot of customers, and using OpenIDConnect the operators can deliver this large customer base to service providers in a standardised way. They can then combine this with SIM-based PKI to provide strongly authenticated identities (set aside what the operators mean by “identity” in this instance). Moving from unverified to verified users is a good idea, even if the operator doesn’t know who the “real” identity is, if you see what I mean.
  2. User insight. What I would call reputation, this is a crucial dataset for monetizing the proposition. Once again, the operator does not need to know who you really are in order to know that you go to Waterloo station every day, or visit Subway every week or travel to France every month.
  3. Business model. The idea of some kind of freemium service, free for personal use but with paid-for value-added services to business, seems plausible to me.  The idea that operators will be able to charge per-login to make a profit is possible, but I wouldn’t bet on it. But suppose banks, for example, said that they would accept OpenIDConnect logins but only from 2FA identity providers that meant certain minimums (what we call “qualified digital signatures” in Europe) then they could save money messing about with dongles and switch quickly.
  4. Seamless bundles. The operators already provide their own services (e.g., Joyn) that could switch immediately to eat their own dog food, as our transatlantic cousins would have it. It’s a pain in the arse right now for me to log in to O2, Orange and 3 with different usernames and different passwords. If Orange gave me an OpenIDConnect service through my iPad, I’d use it to log on to O2, Virgin and 3 as well and not have to keep going through the “forgot your password?” loop.
  5. Processes. Many of the practicalities of mass-market identity mean that the scale processes of operators deliver a competitive advantage. The proposal for a cross-operator discovery layer, for example, solves the problem of having to know which operator a particular number corresponds to.

I liked this presentation a lot, partly because I knew that it would support some of the conclusions of my subsequent presentation but mainly because it covered some details that I hadn’t really been thinking about: the integration with operators processes and back-end systems. The key point of the proposal — using OpenIDConnect — was music to my ears. Here’s what I wrote a couple of years ago:

Nevertheless technology is an important part of the equation, and we need to pay attention to the emerging technologies, because it will take some real effort by a coordinated industry grouping in order to get worthwhile (ie, involving tamper-resistant hardware) authentication deployed and this will need to be linked to a framework (such as the new OpenID Connect) that can easily be adopted by web sites, mobile services and across other channels.

[From Digital Identity: Identity is the new money]

I don’t understand why MNOs don’t provide this service already: I’ve lost count of the presentations I’ve made to different groups in different operators on the topic. It seems as if each of the operators that I deal with as a customer has spent money on their own SSO  and this doesn’t seem particularly cost-effective to me. If they don’t get together on this, then eventually some form of handset trusted execution environment (TEE) will become the home of the mobile PKI and they will be bypassed. Why not try and make something of the SIM or the SIM-based secure element (SE) while they still can?

The best way to to this is to engage with the rest of the digital identity community that tries to solves these problems globally (see earlier post), and add the MNO assets, the mobile device and the SIM to it, and not to treat it as a stand-alone service.

[From What about mobile ID | It’s all about ID]

So, we all agree, it’s a good idea. Why now? Well, one driver that was discussed in Nice was Europe. As you may know, the EU has put out a proposed Regulation COM(212) 238 (final 4th June 2012) on electronic identification and trust services which will call for, amongst other things, interoperability between certain kinds of electronic identity. They are thinking primarily about access to public services, banking and the like.  Right now there are 13m EU citizens working outside their home country and the cross-border use of electronic identities would make life much easier. The idea is that member states will “notify” European Commission of identity services for access to public services and then all member states will have to allow access to public services by “notified” providers. (Note that as part of this, the notified providers must provide free authentication services).

As far as I understand it, suitable identities will be ones that can form “qualified” digital signatures. There are around 100 CAs in the EU offering such qualified digital signatures but they tend to be rooted in national systems so even where there is cross-border interoperability at the technical level, there is none at the application layer. This is an old and well-known problem, and there has been some progress exploring ways to make it work, yet the current situation shows little sign of change. However, given the EU’s desire to see change, it may be that the MNOs have a particular window to provide infrastructure for notified providers and make it easy for those providers to offer interoperability through that infrastructure at little cost to themselves. And the MNOs, like the EU, want to see a Europe-wide solution so there is an alignment of interests there.

There was one particularly interesting discussion during the GSMA’s morning session covering the “problem” of multiple SIMs and multiple devices. For example: in my house I have a phone with an O2 SIM, an iPad with an Orange SIM and a dongle with a 3 SIM. There are multiple SIM phones. So how would mobile ID work in this environment? In my mental model this isn’t a problem because I assume that the digital identities in each SIM will be bound to the same real identity, because I separate the binding of the digital identities to the “real” identities and the binding of the digital identities to the virtual identities used on line. And I should be able to link any or all of these virtual identities to the services I want to access online.

The bottom line is that, to my mind, the technologies to do something about identity in the mobile space not only exist but are well understood. The idea of using PKI with SIM-based key pairs has been around for many years and the Mobile Signature Service Platform (MSSP) is already standardised (ETSI TS 102 203 and 102 204) and companies such as Valimo provide off-the-shelf products. The Open Mobile API (a mandatory part of the GSMA NFC handset requirements) provides an route forward for storing and manipulating digital identities that can be used in physical as well as virtual interactions. The services provided using these standards are probably not rich enough and I suspect that they will need another layer on top so that they can fit inside the industry frameworks that are being developed right now (NSTIC, IDA and such like). 

The best way to to this is to engage with the rest of the digital identity community that tries to solves these problems globally, and add the MNO assets, the mobile device and the SIM to it, and not to treat it as a stand-alone service.

[From What about mobile ID | It’s all about ID]

Assaf Bielski is surely right about this. Perhaps, as I’ve suggested in the context of Project Oscar and ISIS, a place to focus might be digital identity services for wallets. Everyone loves wallets and everyone and his brother are developing one at the moment. Why not provide an identity API for wallet developers to use so that customers can have a shared and stable identity and authentication process across handsets and operators? The GSMA could co-ordinate industry requirements here and develop a narrative vision that might make it easier for the MNOs to develop an API in a reasonable (i.e., months rather than years) time. This would be a genuine win-win: a value-added service from the operators that keeps them in the loop and a significant cost-saving to banks, retailers and others.

A final observation: I think I did detect a sense of urgency that I hadn’t seen before. The operators (correctly) think that if they don’t do something about identity quickly, then the FAGs (Facebook–Apple–Google and other scary OTT providers) will shift to 2FA (using TEE or whatever) and bypass the operators completely.

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers

Two pints of lager and a packet of crisps, please

Posted on by Leave a comment
Greyscale backing image
[Dave Birch] My favourite pub in the entire world which, coincidentally, is the nearest pub in the entire world to Tweed House, is the wonderful Keystone. On any given day, it is statistically probable that there will be a least one person from Consult Hyperion in the Keystone and a reasonable statistical chance that one of our clients will be there too. The food there is outstanding. I highly recommend the ham and egg and chips: proper food, cooked properly. And now I have one more reason to go there: as of today, the Keystone has gone contactless! Naturally, ever active on your behalf to reconnoitre the borders of payment possibilities, I went with a crack team of thirsty Consult Hyperion beer payment experts to explore the new territory.

Untitled

The results? Everything worked perfectly. The QuickTap with a BarclayCard MasterCard pre-paid PayPass application worked perfectly and forced the terminal online for authorisation:

The Samsung S3 with a prepaid Visa card was offline authorised for an excellent user experience:

And, of course, a boring old-fashioned Barclays debit card, which doesn’t even have a custom picture on it, works excellently in a pub-friendly tap-and-go with offline authorisation:

This was a great day for me. Once again, I forgot my wallet. But today, it didn’t matter. Because I got a coffee in Costa and lunch in the pub and I paid with my NFC phone in both. As soon as Marks & Spencer in Guildford chuck their stupid new unattended checkouts that take cash but not contactless, I won’t bother taking my wallet to work at all.

Eliminating the need to carry a credit card does not remove the leather wallet’s value as a central location to keep cash, ID cards (e.g., driver’s license, public transportation cards, and insurance cards), and more.

[From Are Mobile Payments Really More Convenient? – PaymentsJournal]

This is, of course, an extremely good point. But when I nip out of the office to grab a sandwich at lunch time, I don’t want to carry cash, insurance cards or ID with me either (I don’t live in a country where you need an ID to buy a sandwich, yet). Similarly when I’m standing waiting for a bus in London, I already have my phone in my hand. When I’m in line at Starbucks I have my phone in my hand. When I’m watching TV I have my iPad on my lap (and my iPhone next to me). The goal of the m-commerce mavens shouldn’t be to make an expensive simulation of the wallet in my back pocket, but a new way of transacting based on the fact that my phone is always with me.

Given all of the bad press that mobile NFC payments have been getting recently, I thought it was worth pointing out than when it works, it’s cool. Cool enough to replace contactless cards I couldn’t say, but contactless makes sense in a busy pub. The average basket size is less than £20, lots of people want to pay with cards, everyone in our office at least never goes to the pub without a smartphone, and a 10-second tap-and-offline payment saves time (and is faster than cash) so the bar staff can get on with the more profitable task of serving customers. If you don’t believe me, then take the opportunity to come and and try out the technological marvel of paying with your phone down the pub and you might even get a pint out of me too!

I have no idea what the money of 2050 will look like, but I can bore for Britain about what it might look like. And I can prove it to you in person if you come along to my favourite pub in the entire world, The Keystone, for a currey and a pint on Monday 19th November at 7pm for the Cafe Scientifique evening talk on “The Future of Money: The Galactic Guilder or the Guildford Groat?” by me.

[From These are a few of my favourite things]

See you there. Incidentally, if you want a status report on world mobile payments, my UK mobile Barclaycard and my US mobile Google wallet both failed at the contactless terminal in Tim Horton’s in Toronto last week.

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers

E-ASS about face

Posted on by Leave a comment
Greyscale backing image
[Dave Birch] The Payments Council “Enhanced Account Switching Service” (yes, that’s E-ASS) means that from September 2013 there will be a guaranteed one week bank service for retail customers who want to switch their current account from one bank to another.

The Payments Council is to introduce an enhanced account switching service which will enable consumers to switch all aspects of a current account within one week. The enhanced service will be introduced in September 2013.

[From Payments Council to enhance account switching service – Transact]

This is going to cost the industry something in the region of £750m. A waste of money to my mind. I’ve written before about what the industry should have done, which is to create a virtual sort code and account number that customers can switch to wherever they like: that way, they give their employers and whoever else a single sort code and account number which never, ever changes, Then, if they want to switch bank, they re-route the virtual account and there’s no need to notify billers, counter parties etc to update their databases. Much simpler. But whatever.

Meanwhile, The Payments Council are working on a more interesting and potentially useful project linking bank accounts to another identifier. They say that market research suggests that one in four UK adults would use something like PingIt, so they are planning to go ahead with the central database to link sort codes and account numbers with mobile phone numbers towards the end of this year. I still think the basic architecture is wrong — the central database should map a unique financial services identifier (“Pay Name” or whatever) to sort code and account number as well as mobile phone number — but nevertheless a universal PingIt will be an important addition to the toolbox.

The easiest way to do this would be to assign a unique financial services identifier (FSI) to a person or other legal entity the first time that they go through a KYC process

[From Could bank account numbers be portable like mobile numbers?]

In the general case, payers should enter the payee’s “Pay Name” (e.g., £dgwbirch or £chip.com or £donations@oxfam or whatever) rather than a mobile phone number. The Payments Council should sell vanity Pay Names to fund the development of the system and to keep it free to users. I’m sure some far eastern oligarch will cheerfully stump up a million or two to own £007 and I’m sure that even in these straightened time the forward-thinking finance director of Consult Hyperion could be persuaded to spend a few quid on £chip.com and so on.

I remember talking with a couple of bankers at the Experian Payment Strategies Conference earlier this year and they agreed with me (otherwise I wouldn’t, naturally, be reporting their opinions) that it makes more long term sense to build the Financial Identifier Database (FID) and use mobile account-to-account (A2A) as the first application than to build the mobile phone database and then scrap it again downstream, but I suppose it’s natural that the idea of the mobile phone number as an identifier is the dominant meme right now and therefore it has been a strange attractor for identity proxies.

Fighting technology with technology seems most promising—by replacing ID cards with phones.

[From Fake ID cards: Identity crisis | The Economist]

Yes, the mobile phone is set to be the remote control for cloud identity, the mobile is a vehicle, a carrier for personal identity (identities, in fact) not the identity itself. It provides an excellent authentication mechanism and a super place to store keys in tamper-resistant hardware, but your mobile isn’t you.

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers

Quick response

Posted on by Leave a comment
Greyscale backing image
[Dave Birch] A couple of interesting discussions about QR codes at Money 2020 earlier today. Well, I’ve been looking at some technology roadmaps around NFC and QR codes again in connection with a couple of projects we’re involved in and I think I’ve got at least an interim conclusion. While I have no inside information on the subject, I do expect a future iPhone (and, for that matter, iPad) to have NFC. NFC is a convenience technology, and Apple loves convenience. As, it seems, do customers.

In fact, in the tests that were held by Kraft, NFC experienced an engagement level that was twelve times greater than the results that were achieved by QR codes… However, at the same time, NFC did have its own drawbacks, which Kraft found to be rather significant for the moment. To start, most older phones do not have this technology and therefore cannot take advantage of its availability in a store or on a product, even if the consumer is interested. Moreover, the technology is also absent in all Apple products that have been released to date… This means that NFC automatically ignores the largest segment of the mcommerce marketplace.

[From QR codes and NFC tested by Kraft in mobile commerce trials]

In other words, NFC is great but not yet relevant. This, to be honest, seem like a pretty reasonable assessment of the current situation and contains both good and bad news. The bad news is that the money that the payments industry is spending on NFC will have a much longer payback time than had been hoped. The good news is that we (consumers) end up with something that is simple and quick and secure.

Osama Bedier, VP of Wallet & Payments… believes that [NFC is] a better technical solution than the QR codes that Apple uses on Passbook, calling them one of “many bridge technologies between now and what is a destination solution.” He pointed out that “you still have to futz” with QR codes.

[From Google still believes in NFC for mobile payments, doesn’t see ‘eye to eye’ with Verizon | The Verge]

As far as transactional applications go, though, I think it fair to observe that there will be developments beyond the initial conflation of NFC with payments at the EMV nexus. While not the topic of this post, a key message coming out of Money 2020 has been that the complex ecosystem assembled by handset manufacturers, SIM suppliers, TSM operators, the GSMA, bank issuers and schemes may well be bypassed in the longer run but in the short run is actively holding bad NFC evolution!

Incidentally, while we’re on the topic of NFC vs. QR again, I wanted to mention a related issue. There is a slight problem with the writing of a blog such as this one. The nature of Consult Hyperion’s work with clients around the world is such that we are, from time to time, privy to commercially confidential information. This is true for most companies, naturally. But it means that sometimes I write things on the blog that I know aren’t quite correct. Here’s an example. Earlier in the year I wrote about hypothetical attacks on NFC tags and QR codes because of the lack of identity infrastructure, saying that

It’s simply impossible to tell whether a QR code is “real” or not.

[From A quick response to the problem]

At the time I wrote this, I knew perfectly well that the attacks on both QR codes and NFC tags discussed in the piece were not hypothetical but had actually occurred. It would not have been appropriate to mention, at the that time, that I knew that attacks had occurred or who the victims were. So I’m glad to say that (although I won’t point at the victims) I have heard the attacks discussed at a couple of recent events so now I think it’s OK to at least talk about what the attacks were.

In both cases the same vulnerability was exploited: when a consumer uses a smartphone to either read a QR or an NFC tag, they have no idea whether what they are reading indeed comes from the poster, advertisement, magazine or whatever else they are looking at:

  • In the attack on a travel-related NFC poster, the attackers stuck their own NFC tags on the posters. Instead of pushing the number to call for more information about travel products, the number was for a reverse-charge premium-rate phone call to South America.
  • In the attack on bank advert with a QR code, the attackers had printed their own version of the QR code and stuck them over adverts in public places in London. Customers who scanned the code in order to get more information about a bank product instead got malware downloaded to their phone. At least 4,000 customers were fooled this way.

We already know what the solution to the NFC problem is, since a standard for digitally-signing the data content of an NFC tag has existed for a couple of years (although no-one seems to have implemented it) and we also know how to manage the keys and certificates that would be needed to make this all work in the mass market. For QR codes there is no such standard, although there are companies out there (e.g., Ensygnia) who have been developing proprietary solutions.

The real problem with this large number of QR code scans is that consumers have no way to detect the presence of malware in the code before it is too late.

[From Portals and Rails]

Quite. All in all, this proves a point that I’ve made many times in the past: connection is easy, disconnection is hard. In this case, I think that shifts the dynamic toward NFC. You could imagine a situation in which a powerful player like Apple, using Passbook, forces a scheme for digitally-signing QR codes and sets up a structure for key and certificate management, in which case the operators and banks will be kicking themselves for not setting up an industry-wide digital signature scheme and implementing the NFC standards for tag security. If customers and retailers could be sure that NFC tags 

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers

Labels and libels

Posted on by Leave a comment
Greyscale backing image
[Dave Birch] I hate this. You wander off with a colleague to find a nice restaurant after a long day, you have a very nice meal and review the days events, then you ask for the bill and proffer your favourite payment card, only to be told that the restaurant is cash only. Thus I had no choice but to handle the filthy lucre and pass it over and I reject utterly the libel that I in any way opted to take part in this antiquated ritual.

Untitled

It’s none of my business why any restaurant wants cash only — I generally assume that they are attempting some decentralised tax minimisation or are a mafia front — but they should be forced to display a prominent notice at the entrance if they are cash only. And if they are going to be cash-only, they might at least install an ATM, as the enterprising owner of “Friendly Toast” has done.

Many customers use the ATM machine to get more cash than they need to spend at the Friendly Toast and according to Melissa, stocking the machine isn’t difficult or time consuming. “We have to put about $10,000 in each week to keep it stocked, which has only made about a 20% dent in our overall credit card usage, but saving $12,000 a year or so in fees is a start”.

[From Commerce 3.0 – Restaurant Saves Money With Cash | PYMNTS.com]

Naturally, I started to wonder why, if this is so simple and saves so much money, they why don’t all retailers don’t just install an ATM next to the cash register and stop accepting cards. After all, in the example given, this would generate $60,000 additional profit per annum. It makes sense for retailers to transfer the cost of accepting payments away from themselves and on to customers in this way. And why would customers care, since there are no ATM fees, according to the article. In fact, surely customers would come in to use the free ATM instead of going to a bank ATM, and that might generate additional footfall. I would have thought, overall, that the disadvantages of cash (counting it, managing it, banking it, guarding it) are still substantial. And it’s also slower than paying with a quick swipe or a tap.

It turns out, Chipotle was rounding totals — both up and down depending on the price — in high traffic restaurants in New Jersey, New York, locations in Boston and elsewhere. The rationale: counting pennies takes time, and in restaurants that often have people lined up out the door, why not just round to speed the line along?

[From Chipotle Rounded Up on Purchases | Moneyland | TIME.com]

A much better option, of course, would be to stop taking cash altogether. And since almost all purchases would be under the “no signature” scheme exemption for online authorised transactions, either a quick swipe or a quick tap should suffice in almost all transactions. It’s time for action. Fifty years ago it made sense to presume that restaurants took cash and so they needed to put scheme logos on their windows to alert card holders that they were welcome. But this is the 21st century, and the presumption ought to be reversed. If food trucks can take cards, then for goodness sake restaurants have no excuse.

In the past, food trucks were cash-only operations. But today, they wield tablets and smartphones capable of accepting credit card payments and e-mailing receipts to customers at the point of sale.

“We figured that given our price point, we were going to have to accept credit cards from the beginning,” Doug Povich, co-owner and operator of the Red Hook Lobster Pound Truck says. “People really get excited when they come to the truck and see us using the latest technology. It’s not the typical POS that they see in a restaurant.”

[From Payment Industry Insights: Food Trucks: Where Mobile Payments Meet Mobile Food]

I think New York should set a lead, as Mayor Bloomberg has repeatedly demonstrated that he is prepared to legislate for the public good. I shall write to him about my poor restaurant experience there:

When I went to pay, I was told “we don’t take cards, cash only” and was directed to an ATM at the back of the restaurant. The check was almost exactly $100, so I drew $100 from the ATM, for which I was charged a $2.75 fee

[From Sign language]

And I’m not the only person who finds this odd. While googling for something else, I spotted this comment about New York restaurant payment habits on TripAdvisor.

Maybe I’m not used to NYC, but cash only in an upscale Manhattan restaurant? A serious pain in the butt for business travel and a forthcoming hassle with expenses. I should have left but was tired of looking.

[From Cash only! – Review of Sette Mezzo, New York City, NY – TripAdvisor]

As it happens, the restaurant that he’s talking about here is a very well-established and popular place that caters mainly to repeat customers and around 85% of the checks go on account and are settled monthly (thanks Quora!). Anyway, when I got annoyed about this last year, I said at the time that a prominent “cash only” sign on restaurant doors was the solution, but I’ve changed my mind.

Cash leaves much less of a paper trail. Waiters love cash, because it means they will be taxed based on seven percent of their sales, not the 15+ percent people usually tip. And that means more money

[From (223) Restaurants in New York City: Why are so many restaurants and stores in New York City cash-only? – Quora]

Aha. Isn’t this tax evasion? And, strictly speaking, illegal? Surely waitpersons are supposed to pay tax on tips?

I will tell Mayor Bloomberg that New York should become a beacon to the nations by enforcing a different payment paradigm. In order to obtain a licence to operate, a restaurant must by law accept debit cards without a surcharge and with no minimum spend. They should be free to surcharge for any and all other payment mechanisms, including cash, and they should be given some kind of tax break if more than 75% of their takings are non-cash (thus providing a compliance carrot, as is done in some other countries). This would be of great benefit to all law-abiding New Yorkers and their visitors from around the world.

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers

The next infrastructure

Posted on by 2 Comments
Greyscale backing image
[Dave Birch] Back in August, the UK technology sector’s trade association Intellect published a report called “Biting the bullet — why now is the time to rebuild the foundations of the financial system” that put forward an urgent case for infrastructure renewal in the financial sector. Now, one the one hand, you might reasonably expect an organisation of IT suppliers to recommend IT spending as a natural course of action but, on the other hand, they’ve got a point. Members of the general public are understandably concerned when they can’t get money out of an ATM, can’t access their bank accounts and can’t use their cards in shops. Given the amount of money that banks have, they wonder, how come that a bank can’t do a simple software upgrade?

The error is understood to have occurred after a software update froze part of the banks’ computer systems last Wednesday, affecting 17 million customers.

[From RBS computer failure ’caused by inexperienced operative in India’ – Telegraph]

The central thrust of the Intellect report, on my reading, is that banks have tended to under-invest in infrastructure because it doesn’t deliver an immediate investment return (as their investments in sub-prime mortgages, payment protection insurance and interest-rate swaps did). I’m sure we’ve all come across the logic in our careers. Given an infrastructure solution that costs £10m and will take three years to implement, the head of IT will always go for the £2m band-aid that will be done in a year. If the system collapses five years downstream, he or she will reason, so what? They will be long gone and their performance bonuses will be safely tucked away. (I’ve seen a fair bit of comment about the RBS collapse much in that mould.)

Mr Ramji says the average large bank would spend up to 7 to 10 per cent of turnover on IT systems annually. He believes RBS was at the low end of that range… senior RBS executives admit the retail business suffered under-investment in the years leading up to the credit crunch, when the former management under Fred Goodwin, chief executive, was fixated on expanding the investment bank.

[From Banking: Finance’s fifth column – FT.com]

Another constraint of infrastructure renewal, again as we have all experienced, is that the overwhelming majority of IT spending in European (and North American) banks goes on managing and maintaining the legacy systems. There isn’t really a lot of money available for renewal despite multi-billion spends on IT across the sector as a whole. This might well be another reason why even banks should consider creating payment subsidiaries and running them as separate units as Payment Institutions (PI) rather than banks, because payment innovation is a lower priority than keeping the ATMs working when it comes to the budget competition. This is why, in the UK, Barclays’ PingIt has become such an interesting case study of payment innovation within the retail bank.

Fast, simple and easy … and innovative. I hadn’t seen such stuff before and certainly not from a UK bank.

[From The Financial Services Club’s Blog: Case Study: Barclays Pingit for Consumers and Corporates]

The report isn’t solely about the banks’ own internal infrastructure, of course, but also talks about cross-industry infrastructure that needs to be created, such as the account number portability system (which, personally, I suspect will be a waste of time and money) and a mobile front-end to FPS (which, personally, I suspect will lead to some very creative new products and services). Incidentally, before anyone e-mails, and in a spirit of full disclosure I suppose I ought to say that I am Chair of Intellect’s Payments Group and therefore much more interested in new investment in the payment space anyway…

One rather obvious way to reduce the costs to individual banks and make the IT infrastructure renewal more attractive would be to shift more IT out of banks and into cross-sector utilities (which the report calls a “system of systems” and uses FPS as a case study). I wonder if there might be an opportunity coming along in the identity space? It’s bonkers for each bank to have non-interoperable dongles to authenticate customers against non-federatable identities. The Intellect report mentions in passing that KYC might be a process suitable for utility implementation but I would go further and look at some sort of “financial services passport” as was discussed from time to time at the CSFI. Why? Well, under the new, expensive and (as I mentioned above) largely pointless plans to make account-switching easier in the UK, customers will still have to undergo a KYC check at the target bank. So even though you already have a bank account, in order to switch it you have go through KYC/AML again. Having had a Barclays account for 35 years, if I want to open an RBS account they treat me as if I’d just got off the boat. Why can’t RBS just have me log in using my Barclays dongle, or whatever?

There can’t be many more obvious business cases for the short term than a cross-sector identity management system that is part of the government’s Identity Assurance (IDA) framework with two-factor authentication and scheme rules for mutual recognition within, initially, the UK financial services sector and then downstream in a European-wide service. Let’s start with some new infrastructure, as well as rebuilding the old stuff.

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers

Who wants low-cost bank accounts?

Posted on by 5 Comments
Greyscale backing image
[Dave Birch] Once or twice I’ve had e-mails from people who say, to paraphrase, “you only hate cash because you work for electronic payment companies who would benefit from the end of cash”. This is partly true: Consult Hyperion, I’m proud to say, has been chosen by many of the world’s leading electronic payment companies to provide consultancy support and advice. But it is wrong to say that I only hate cash because of that. I hate cash for a variety of reasons and only some of them relate to boosting the business of our customers. There are moral reasons for hating cash too, and one of them is that it discriminates against that least well-off in society.

A group of development organisations, foundations and private companies, including Citi and Visa, have formed the ‘Better Than Cash Alliance’ to lobby for a shift towards electronic payments in the fight against global poverty. The alliance – comprising the UN Capital Development Fund (UNCDF), US Agency for International Development (USAID), Bill & Melinda Gates Foundation, Citi, Ford Foundation, Omidyar Network, and Visa – is calling on governments, the development community and private sector to adopt the use of e-payments for programmes that support people living in poverty.

[From Finextra: ‘Better Than Cash Alliance’ to push e-payments in fight against poverty]

Now, this is a matter very close to my heart, so I can hardly be expected to be a dispassionate observer. As I have long maintained, the poor are the chief victims of cash. People trapped in a cash economy pay higher transactions costs, their money is lost and stolen, they lack access to basic financial services such as a savings and insurance and so on. So I am wholly in favour of this initiative. But what should its goal be? Generally speaking, in the US and the UK, insofar as the government has any policy toward financial inclusion it is based on bank accounts and starts with the observation that lots of people don’t have them.

About 8.2% of U.S. households, or nearly 10 million, lack a bank account, according to survey results released Wednesday by the Federal Deposit Insurance Corporation. That’s up from 7.7%, or about 9 million households, in 2009

[From 10 million households don’t have bank accounts – Sep. 12, 2012]

This issue is wider than the unbanked, though. There are other categories of mismatch between the conventional banking products on offer in our economy and the needs of substantial fractions of the population. There are, for example, people who are underbanked, people who have some banking products but they don’t really use them or use the most appropriate ones.

By underbanked, Javelin is referring to those who don’t have a checking account or a primary banking relationship. They may have a prepaid card. (The unbanked have no bank relationship at all.) They tend to be young — 36% are 18 to 24 years old.

[From Who Are the Underbanked? – American Banker Article]

The underbanked that Javelin surveyed (they are around 15% of the adult population of the US) had mobile phones and an average income of more than $50,000 per annum. This is a sizeable target market for “near bank” services that I’ve written about before, but I imagine that there are at least another 15% (and probably more) of the adult population who are overbanked. These are the great many people who have bank accounts but don’t really need them. This group are either paying for banking services that they don’t need or are losing banks’ money on “free” services. Therefore, I feel that the “near bank” market could account for around a third of the population. If we take the unbanked, underbanked and overbanked together, then, I would strongly argue that bank accounts are the problem, not the solution.

Such customers with balances under $100,000 are, in the words of JP Morgan Chase CEO Jamie Dimon, “no longer profitable,” in most cases.

[From 3 Ways Dodd-Frank Made Banking Worse For Consumers – Business Insider]

You can’t really blame the banks for this. They exist inside a regulatory framework, with legacy infrastructure and cost structures that mean they simply cannot provide free or really low-cost services and furthermore can no longer cross-subsidise. Therefore it makes no sense for governments to enforce a ridiculous “lose-lose” settlement on the market, whereby banks are forced to provide an unprofitable “basic bank account” product of some kind to people who don’t want or need them. That is unsustainable.

The five biggest banks – Wells Fargo, Bank of America, JPMorgan Chase, Citibank and US Bank – have raised fees on their checking accounts so that customers who do not hold a combined minimum balance with the banks (sometimes as high as $1,500 a month) or have direct deposit are paying anywhere from $84 to $144 a year for basic services.

[From Big Banks Should Offer Low-Cost Bank Accounts – Bank Think Article – American Banker]

If bank accounts aren’t the solution, then what is? In recent times, the prepaid card has become the main alternative to a bank account and, indeed, for the majority of unbanked and overbanked people, prepaid card products are a decent alternative.

Budget-minded people fare slightly better with checking accounts; the average monthly service fees come to $3.99 for a checking account, versus $4.50 for a prepaid card. For everybody else, though, even people who handle their money responsibly most of the time, prepaid debit is cheaper.

[From Checking Accounts More Costly Than Prepaid Debit Cards | Moneyland | TIME.com]

This has been a recurrent theme on this blog too. Often, when I speak to an audience of “banked” people, they don’t understand why anyone would want to use a prepaid card product instead of just going and getting a basic bank account (which in the UK is still free). But there are lots of reasons why prepaid cards are useful, even to the banked, when conventional bank accounts are not, especially when they are energised by the connection with mobile. Just being able to see the card balance on your mobile is sufficient to transform the usability.

a psychological and experiential disconnect between those who have traditional, full-service bank accounts and those who don’t. Hard-core bank customers may never understand how, to the unbanked and the underbanked, prepaid cards can look great-even honest.

[From Trying to Understand the Unbanked s Acceptance of Prepaid Cards – American Banker Magazine Article]

This is a great point and the article makes it well, but it does miss one aspect of this market. I have a full-service bank account, yet I also have an number of prepaid cards. I have my prepaid US dollar and prepaid Euro cards that I use when travelling, I have a prepaid Visa card (from O2 Money) that is the “house” card that the kids use when they go to the store to get groceries or school supplies or go on a trip and I have a prepaid Mastercard in my Google Wallet, although that’s getting switched off shortly.

So. prepaid looks like it might be a better solution than a basic bank account. Prepaid cards as they stand now, though, don’t fulfil all of the requirements for a near-bank account. Where are the standing orders and direct debits, for example? In the UK, this isn’t an idle speculation but one of great interest to many of our clients who have been looking at this for some time because there’s about to be a big change in the UK and it will stimulate demand for near-bank services. The welfare system in the UK is switching to a new “universal credit” system where all benefits will be unified and paid monthly in arrears.

claimants will receive just one monthly payment, paid into a bank account in the same way as a monthly salary

[From Universal Credit – DWP]

If you’re wondering why our clients care about this, it’s because it represents a money flow of around £2 billion per month that is up for grabs. The government has been sort of hoping that basic bank accounts will be the destination for this money, but for the reasons noted above, this is in question. In my opinion, what is needed is neither a bank account nor a pre-paid card but a payment account: a prepaid transactional account with an associated card, more like my O2 Money account than my Barclays Bank account but with additional functionality to emulate, in essence, instruments such as standing orders and direct debits.  A software wrap around a Payment Institution (PI) with an electronic money licence (ELMI) and a set of rich standard interfaces should do the trick. We can achieve financial inclusion if we employ some clear thinking around this sort of account and stop focusing on bank accounts. I thought Deutsche Bank’s response to the European Commission consultation on bank accounts in May illustrated this point well. They said

We believe that making payment accounts available to every citizen in the EU benefits all market participants. However, reasons for financial exclusion differ in the Member States and therefore might require different measures in order to achieve better financial inclusion. The percentage of people not having a bank account is an indication but not a proof that those people are actually financially excluded.5 Real financial exclusion is often associated with an inability to provide a proof of identity or domicile (e.g. immigrants, homeless people), unemployment or financial distress in general and low educational attainment.

In this one paragraph, they make very sensible points about financial inclusion but they switch between talking about “payment accounts” and “bank accounts” with no differentiation. But there clearly is a difference: a “payment account” to my mind is the type of prepaid account noted above, offered by either a bank or a Payment Institution. There are plenty of viable candidates who could offer such an account and make money from it. Retailers, to my mind, are in pole position but another obvious category is telcos. I know from one of the projects that we are working on in the UK that even among the long-term unemployed smartphone usage is very high indeed, so the mobile operators could be in a good position to offer payment accounts. It is worth highlighting that both Visa (with Vodafone) and MasterCard (with DT) have already begun forming the kind of partnerships that could deliver some new approaches.

MasterCard and Deutsche Telekom have announced that they will work together to roll out services across DT’s footprint in Europe, starting with an NFC wallet solution in Poland in Q3 and Germany following soon after. For now, the U.S. is not being factored in as part of the deal. In all, Deutsche Telekom has 93 million mobile subscribers in Europe, and 129 million world-wide… This service will also be SIM-based, the two companies say. Under the terms of the deal, MasterCard will be working with DT’s payment subsidiary ClickandBuy, which has the e-money license that is necessary to operate mobile payment services.

[From MasterCard Ties Up With T-Mobile For NFC Mobile Payments In Europe | TechCrunch]

I think, given the current state of development, companion open-loop cards make sense and offer an interchange income stream to cross-subsidise other functions. I notice that SFR, for example, announced just a card last week, much like the O2 Money card and similar offerings elsewhere. The transition to Universal Credit in the UK means, oddly, that the public sector may well stimulate creative and inventive players to enter the already crowded wallet marketplace because the carrot of the initial volume of government benefits is so great and if it does, I’m sure the combination of mobile wallets and chip-and-PIN cards will be the combination of choice. I’ve been invited by the Government Banking Service to give a talk about this at a forthcoming event so I will let you know how it all went later in the year.

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers

Cor! Look at the embossing on that!

Posted on by 3 Comments
Greyscale backing image
[Dave Birch] Since you are reading this blog post, you are undeniably familiar with the interweb. And since you are undeniably familiar with the interweb, you will be aware that it has always had, shall we say, adult areas. Let’s not be squeamish about this: you can’t go on the interweb without occasionally getting a peek behind the curtain. We’ve all been there, however inadvertently. You click on a link in an e-mail or a tweet or a web page and all of a sudden find your self looking at pictures of attractive young women in the nude, or some sexy girl-on-girl action or inappropriate pictures of under age girls in bikinis. I thought that I read in The Telegraph that the government/Mumsnet alliance were going to get ISPs to install new technology to block “The Daily Mail” from UK households unless they explicitly requested it, but apparently no such barrier on behalf of public morality has yet been erected.

You get the picture. But if you didn’t want it, stop reading now. I’m serious: if you are uncomfortable reading about what we refer to as adult services, please stop reading now, don’t read on and then send me a complaining e-mail later.

So sometimes you click and find yourself in an adult area. But you don’t expect it in a work e-mail. So I was mildly surprised, but only mildly, when a correspondent e-mailed such a link in the context of a discussion about future of online payments. (There is no reason to disclose his or her identity, so if he or she is reading, do not fear!). The link was very relevant to this discussion. Please note (and I am not joking about this) that this link is not suitable for work and you should not click on it unless you are over 18 years of age and happy to be taken to page advertising adult services. But if you want to see the link I was sent, go ahead:

Welcome to leChateau deCrypto, a cooperative of women dedicated to providing a safe and exploratory atmosphere for bit coins,

[From Chateau deCrypto]

For those of you who didn’t follow the link, it takes you to a page of adult classified advertisements where women (as far as I could see: I didn’t check all of them) offer to perform via a video link (e.g., Skype) for money. Now, it goes without saying, that as a man of the world I was well aware that such things existed, but had never actually visited any. So I was pretty shocked when I clicked on the link and saw what was there: I’d never been to a web site that accepted Bitcoin before.

That, your honour, is how I came to the world of adult web chat services. I had never given any thought to the genre before, although I’m pretty sure I’d heard of it. But I was so amazed to see these women accepting Bitcoin that I couldn’t but give thought to it. Why would they take Bitcoin? Presumably because it is sort-of-anonymous. If I were a purchaser of such services, I suppose I would be much happier with the sort-of-anonoymity of Bitcoin compared to the not-anonymity of, say, credit cards. Suppose hacktivists broke in to the adult site and posted a list of the customers somewhere? I’d much rather be BZQAHDIHEYGQA than “Dave Birch”. There are clearly a set of markets where identification of counter parties makes trade less likely. I listened to an interesting podcast about this on a plane journey recently.

Silk Road is a site where buyers and sellers can exchange goods much like eBay and Craigslist. The difference is that the identity of both the buyers and sellers is anonymous and goods are exchanged for bitcoins rather than traditional currencies.

[From Nicolas Christin on anonymous online market Silk Road]

There’s a bit more to anonymity than using Bitcoins, but you get the idea, and that set me to thinking further. Messing about setting up a Bitcoin wallet isn’t trivial. So presumably the sellers and buyers value the sort-of-anonymity highly enough to make it worth while. Which, of course, then led me to think: well, if they value sort-of-anonymity that highly then why aren’t my clients selling it to them! Or, not to put not too fine a point on it, why doesn’t my credit card issuer offer me a stealth card (name: “Card Holder”, address “17143 Non Existent Street”) that I can use to purchase adult services safe in the knowledge that neither the service provider nor hackivists can ever connect it to me. Only the issuer does that, and they know about security and encryption. (And, of course, they will respond to legitimate requests from law enforcement agencies.)

If we are going to offer such services, we need to understand the customer requirements and not ignore the signals for change from the edge. It is well-worn meme that “3G” services (i.e., girls, gambling and games) drive the adoption of new technology because they are on the edge. In the case of specifically “XXX” services, so the meme goes, it was XXX video that drove the video player into millions of households and it was the XXX rental business that tipped the technology to VHS.

It’s the unspoken rule in the world of technology; sex innovates. For generations, the urge to create, disseminate and watch pornography has driven many of the great technological advances we now take for granted.

[From iSex: How pornography has revolutionised technology]

There’s a big story here in payments too. Some of the earliest demand for payments on the web came from the adult industry, hurrying to monetize the audio/video download market. I don’t know if you’ve seen the very enjoyable movie “Middlemen” that came out back in 2009, but that portrays (rather well – it’s quite a good film) the invention of online payments for the mass market as a significant cusp in internet evolution.

Chronicles Jack Harris, one of the pioneers of internet commerce, as he wrestles with his morals and struggles not to drown in a sea of conmen, mobsters, drug addicts, and pornstars.

[From Middle Men (2009) – IMDb]

When this description says “pioneer of internet commerce”, it’s referring to credit card payments on the web. The adult business was early into the space, has constantly evolved paid content technology and business models, and has all sorts of experience with anti-fraud techniques and all the rest of it. They pioneered premium-rate SMS services and, for example, I’m reliably informed that even now, it is still the 3G services that provide the majority of MNO income from content-related services. So I couldn’t help myself from thinking, “I wonder if the adult industry, then, is telling us that Bitcoin is the way forward?”. (It’s a sad comment on the tragic trajectory of my life that that is what a picture of an attractive, naked woman makes me think about.) And so I clicked on a couple of links, Googled a couple of terms, and went off to visit the world of freelance on-line adult chat services. Remember, I do this so you don’t have to.

What I discovered on my short and unscientific walk on the wild side was genuinely interesting and I’m pretty sure will deliver insight to one or two of the strategies that we are working on for clients. I found a couple of web sites that listed these webcam services sites and I found that they fell into (very broadly speaking) two categories. There were aggregated sites where the customer buys tokens or credits with a credit card and can then spend them with any of the people listed at the site. I should say, by the way, that while most of the sites that I clicked around were women, and I’ll refer to women in the examples below, it’s not exclusively a female business.

So far so conventional. They were obviously making money, or they wouldn’t be there. So clearly there are plenty of people happy to pay with credit cards. I suppose that in days of yore when the credit card statement was a piece of paper that came through the door then men might have been reluctant to pay for such services in case someone else (e.g., their wives) read it on the statement. But I have loads of cards and no paper statements any more. I’ve got credit cards, debit cards and prepaid cards, in Sterling, Dollars and Euros. I have enough trouble finding legitimate charges to book for my work expenses. If I did put a pony on a filly, I don’t think I’d be overly concerned about it being discovered. If I wanted to put dodgy web site charges on a card, I’m spoilt for choice. And some of the sites offered alternative payment mechanisms (e.g., Ukash) for people without credit cards, so it seems they were on top of things. I don’t know what the fraud levels are and couldn’t hazard a guess at rules and rates, but these people are in business. Nevertheless, I suspect that a pseudonymous card-based product would boost business. While I was thinking about this, it did lead to an embarrassing incident. My wife came into the study late at night and found me looking at all of my different cards, spread for a picture that I was going to take to illustrate this blog. I explained that I wasn’t using them, just looking at them, but she said that this was payments of the mind and just as bad.

Image 1

The second category were essentially directories of women operating as freelancers where the transaction was with the individual woman. I thought it would be interesting to talk to some of them (this was all done by text chat or instant messaging, by the way) and ask her about payment choices (partly because I thought it would be interesting input anyway and partly, I have to admit, because I thought it might make for a cracking blog post). So I clicked on one. She wouldn’t even talk to me without upfront payment. I said that I only wanted to ask her a couple of questions . She said that if I paid, I could ask her whatever I liked. I said I’d think about it.

While I was wondering what expenses category I would book it to, and staring at the screen, she asked me to tell her my fantasies! But that wasn’t very much fun. It took ages to explain what a “flat bed” was and she’d never heard of British Airways “Golden Tickets“, used to reward cabin crew for exceptionally good service. It turned out she was Moldovan and the little US flag next to her name didn’t mean that she was American, as I’d thought, but that she spoke English (which wasn’t entirely true, to be honest, although she was pretty good on parts of the body). I didn’t realise what an export business this is for Eastern Europe. Several of the girls I tried to talk to were Romanian, Ukrainian, Bulgarian and Russian. A couple of them asked me for payment via Webmoney, but I don’t have a Webmoney account so I’ll have to ask our good friends there to set one up for me for scientific purposes!

Anyway, it took a while longer to go up and down the list to find British or American woman to talk to. But I persevered on behalf of the truth and in the end I did have a few conversations via different channels. The detailed contents of which are, naturally, not relevant to this particular blog post. But guess what. As far as I could tell, and I know that this was a small and unscientific survey, I think I saw a window into the future of payments as well as into a Basingstoke back bedroom. The women by and large didn’t take credit cards — I mean come on, if you can configure a Bitcoin wallet surely you can sign up for Square — and many didn’t take PayPal (although a few did). By far the most common form of payment that I came across was… Amazon gift certificates.

I’m serious. Some of the women even had Amazon wish lists set up so that you could pay them by selecting items from their wish lists! And here, I swear, is the start of real wish list copied from one of these sites not more than a week ago: I’ve converted it to text so as not to risk giving away any clues to the woman’s name:

  • Franca Luca 4311_4750 women “Terra” jacket, £155.00

You couldn’t, as they say, make it up. Not all of the women blanked me. I had a nice chat with a lady called Carole from Indiana, for example, who explained that Amazon gift certificates are quick and convenient (and, although I didn’t dare say it to her, not declared as taxable income). Amazon’s scale means that their gift certificates are a liquid asset that trades at par. It wouldn’t bother me to have part of my salary paid as Amazon credit and I’m sure it wouldn’t bother a lot of other people either.

A Forrester survey found that nearly a third of US consumers had a credit card on file with Amazon, compared with 18 per cent who use Apple services and 5 per cent for Google.

[From Amazon to sell Kindle Fire tablets in the UK – Telegraph]

Since most of Carole’s customers were American, they almost all had Amazon accounts and if they didn’t it took five minutes to set one up using a webmail address. So Carole’s customer logs in as “sergiolionelkunaguero@hotmail.com” (for example) and sends a gift certificate to her at “maradonnasdaughter@hotmail.com” (I made these up – I sincerely apologise if they are real e-mail addresses). It arrives in a couple of seconds. Transaction complete. He never knows her real name, she never knows his real name, but a trusted intermediary makes the transaction happen. Carole explained that she only works mornings because she has stuff to do in the afternoons, and that since she does all of her online shopping with Amazon anyway, it’s pretty convenient to stack up the gift certificates and then order stuff and that it saves her time going out shopping too. At this point, I made my excuses and left.

Later on I realised I hadn’t asked her about chargebacks. It occurred to me that she might renege on the deal and then he’d have a problem charging it back (I guess – I’m not sure entirely how that would work, so if a US reader has cancelled an Amazon gift certificate perhaps they could tell us how it worked). Amazon wasn’t the only option by the way, but it was certainly a common one. Other gift cards did crop up a few times though. Here’s an extract from another woman’s “payment instructions” section on her web site.

  • Amazon egift card – Amazon offers almost everything. One of my favorite online stores.
  • Victoria’s Secret egift card. I am a regular.
  • Agent Provocateur evoucher – I am so addicted to it.

Just to give you a snapshot of some of the other comments I saw, here are a few snippets. I’ve copied them in as text rather than links but I can assure that they were taken directly from the women’s web sites:

  • Don’t ever offer me PayPal or you will be blocked right away as scammers or time wasters.
  • Choose from my wish lift http://www.amazon.com/gp/registry/XXXXXXXXXX but I prefer an Amazon gift certificate.
  • Gift cards only please – they are very easy and gives you multiple payment options.
  • I accept credit cards through [name of specialist processor here] and I promise you it is safe and secure.
  • I accept Interac email payment, just ask me eh?

OK, not completely verbatim. I did add a one word of my own in one of them, which I leave as an exercise for the reader to guess. There were, I note, none asking for Bitcoin again. Still, after my experiment, I realised that clicking on that one link in the original e-mail had taken me on a payments journey that I would never otherwise have started and it told me, at least, that some of my assumptions about the phase of evolution in the retail payments space were validated in the most unusual way. These were that…

First of all retailer payment systems are a major factor in that next phase of payment evolution, and I would have said that even before the announcement of MCX in the USA. But it’s not just the retailer payment systems. It’s about retailer money. I remember writing several years ago about this after a friend told me that she had paid at a market with a Marks & Spencer voucher which was accepted at par. In middle England, a Waitrose voucher is wonga. The big retailers such as Tesco and Sainsbury account for such a fraction of retail payments that promises against future delivery of their goods and services can easily function as a circulating medium of exchange. (This comes very close to Edward de Bono’s “IBM Dollar”.) Remember, their business case does not depend on transactions fees. If Tesco can persuade me to load value into their wallet/app/whatever then they can surround that value with data (offers, loyalty deals, coupons and all the rest of it) that makes it worth even more to them.

Secondly, p2p transfers will stimulate new business. As was observed in Kenya with M-PESA, if you give people a simple P2P mechanism that works, then they will develop new businesses on the top of it. We (i.e., payments persons) don’t need to figure out what these business will be, we just need to enable them. The layer on top of the P2P transfers need not be generic: decent APIs mean that various organisations (retailers, again, being an obvious category) can develop their own application layers geared to specific markets. I showed an early draft of this post to a trusted non-wife opposite person of the contradictory gender, and she said that P2P means disintermediation of the pimp, which hadn’t occurred to me, so the women get to keep all of their earnings. (And she also said that she would prefer e-gift certificates in all circumstances, because paper ones are a hassle — a bit like cheques — and often get lost before you get a chance to use them.)

And thirdly, anonymity isn’t all that. People clearly do buy adult services with credit cards, and if they are sensitive about identification then a trusted intermediary can manage two-sided pseudonymity to achieve a sort-of-anonymity that is not merely adequate for commerce but beneficial to it. Nevertheless, creating controlled pseudonymity is a means to stimulate commerce in places where it otherwise would not have occurred but with an infrastructure that can reconcile that transactional pseudonymity with the legitimate requirements of society. There’s a “smash the glass” option, so that it law enforcement officials with the appropriate warrants need to find out who it was who sent money to Carole in Indiana, they can find out that it was me. I don’t want to live in a society where they could not do so.

In summary: if it is true that the adult business is a leading indicator of change, or perhaps even focusing device for weak signals for change elsewhere, then it seems to me that the role of retailers will be pivotal in determining the direction for the next generation of payment products. And I’ve got to say that the e-gift certificate business looks strong.

Please note that to protect the modesty of subjects, some of the names given in this post have been changed, as indeed have some of the facts..

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers

Stripes on a plane

Posted on by 3 Comments
Greyscale backing image
[Dave Birch] I’m flabbergasted. The past really is another country. I’m on British Airways flight 177 from London Heathrow to that other country even as I type. I’m flabbergasted because I just bought something from the on-board shop and it involved the worst payment experience I can remember since… well, since I was last in New York. And this time, I’m having the terrible payment experience before I even get there.

The cabin crew came round with the on-board shop trolley-style cart-thang and I bought something from them. And then I paid for it.

So this is what happened: I gave the crew member my BA Amex card and my BA Executive club card as have I done in the same circumstances for several years.

First of all, the POS terminal refused to accept my British Airways American Express card because it expires at the end of this month. I assume that this is a software error of the type first spotted in about 1955, so I’m going to mention it my complaint to BA and I’m sure they’ll get round to fixing it sometime.

The nice lady with the terminal said something along the lines of “I don’t suppose you have another card do you?” so I open my rolling office and choose one of the other 47 cards in there. I decide to give it a go with a Barclaycard MasterCard that doesn’t expire for a couple of years. They swipe it. It’s got a chip on it, and I know the PIN, but they swipe it. I wondered for a moment if they were real cabin crew or if this is some elaborate Eastern European mafia fraud to obtain track data and PINs for use in US ATMs, so thought I’d better remember their faces for the inevitable police fotofit session.

While I making a mental note of their basic characteristics (would I say that she was “average” height?) , the “cabin crew” (if that is, indeed who they were) asked me for my Executive Club number, because they can’t read the number from the new Executive Club cards in low light. Then they asked me for my passport.

What? Why on Earth would I give my passport to mafia-style super-fraudsters!

I ask why they want my passport, mentioning in passing that British Airways already have my passport details, and the cabin crew tell me that it’s because of high levels of card fraud. They also tell me that it’s a pain in the arse, because many passengers have put their passports away in bags for the flight and have to pfaff about getting their bags from the overhead bin and rummaging around finding their passports, which means it takes way longer to do on-board shop sales. They also said that the on-board terminals have new software that doesn’t do chip and PIN any more (they didn’t say whether this is the patch for 1999 or 2019), which is why they swiped my card and had me sign it. Bizarre.

Hold on.

A transaction that should have taken in the region of 20 seconds — insert card in terminal, enter PIN, print receipt (I don’t even care about this – they could just e-mail it to me later) — took several minutes. What’s more, a transaction that should have taken in the region of 20 seconds and minimised fraud was replaced by a transaction that, if anything, will cause fraud to rise, for the obvious reason that if I am a fraudster using bent cards on plane I already don’t care that you know who I am. You have my seat number and all of my personal details already. If the guy in 28B uses a stolen card, say, and the transaction gets charged back to BA, what are they going to do any differently now? The police (in the UK, at least) are not going to send out the CSI:Heathrow team because they get an e-mail from BA saying that passport number XYZ bought a bottle of Gordon’s with a card that was subsequently declined. What a joke. I felt really sorry for the BA cabin crew and (with their permission) asked if I might record this payment omnishambles for posterity.

After the harassed cabin crew had moved on, I couldn’t help but start to think how ludicrous this incident was. What has happened? Well done, payments industry. We’re actually going backwards. If British Airways decide to get some new software written by people who know what they are doing, here is my suggested transaction marketecture (and I don’t know why I’m giving them this for free – must be something to do with the low levels of oxygen in cabin).

  1. If the customer has a chip and PIN card, insert the card and have the customer enter the PIN. If the PIN is correct, that’s the end of it as far as BA are concerned.
  2. If the card has a magnetic stripe or a chip that doesn’t work, then by all means swipe the card, make the passenger sign the slip, demand to see their passport and record the passport details with Soviet-era efficiency. 

The way BA handled payments on BA177 LHR-JFK (08SEP12) made no sense. To take a customer’s chip and PIN card, then ignore the PIN and swipe it, ask to see a passport (which is pointless anyway, because British Airways have my passport details on file against the booking and I had to show the passport to board, so if customers are committing fraud by using counterfeit or stolen cards this won’t make any difference whatsoever) is inconvenient, slow and silly.

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers

A calibrated approach to mobile payments

Posted on by 2 Comments
Greyscale backing image
[Dave Birch] There’s an article in The Economist this week about the regulation of mobile payments. I liked it a lot, largely because it supports a prejudice of mine (that has been regurgitated with tedious regularity here for the last six or so years) about mobile payments. This is that it is the regulatory framework that determines the success of mobile payment schemes and that frameworks that incentivise competition deliver innovation and growth.

In Kenya the government took the enlightened approach of allowing M-PESA to go ahead, rather than tying Safaricom in red tape. Many of the poor countries that would most benefit from mobile money seem intent on keeping its suppliers out—mainly by insisting they should be regulated like banks.

[From Mobile-money services: Let us in | The Economist]

Indeed. It is very important to understand the essence of this proposition: regulate mobile payments lightly and allow non-banks to provide them, regulate mobile banking tightly and restrict it the activity to banks.

In many countries, phone companies are not allowed to operate as banks. In Kenya, M-Pesa was able to dodge this problem because it offered a service that no bank could or would provide.

[From Mobile money: Kenya good, India bad | beyondbrics]

Well, that was certainly part of the story. The banks didn’t want to provide these kinds of money transfer services to the mass market: they could have provided them, but they didn’t. They are other kinds of services that they don’t want to provide either, but mobile operators shouldn’t not be allowed to provide them. 

Kenya represents something of an anomaly – “the perfect coalescence of latent demand, a dominant mobile operator and a progressive regulator,” according to a report written on behalf of the GSMA, an industry association representing some 800 mobile operators. In most of the rest of the world, building global mobile money services is much more difficult.

[From Mobile Money Will Change The Way We Bank And Shop | Informilo]

Well, the latent demand is there in other countries. Many countries have a dominant operator (although there’s no reason why operators could not co-operate on this anyway). What they don’t have is progressive regulators, so it is really important that people in our industry engage regulators in continuous and constructive debate about mobile payments and learn the correct and appropriate lessons from the case studies that we have to date. A rather obvious place to use as a case study on the relationship between innovation and regulation is India. India provides a near-perfect mobile payment sandbox. In a country with billion or so mobile devices (there were 919m mobile subscribers at the end of 1Q12), there are half a million villages (out of a total of 600,000) with no banking services. There is a firm government policy toward financial inclusion (based on savings, insurance, remittance and “entrepreneurial credit”) and a clear vision of mobile as a major contributor (some might say the key contributor) to any strategies set to meet the financial inclusions goals. So it’s fertile ground for mobile payments.

By happy coincidence, the Summer 2012 edition of SPEED magazine has a long and thorough article on the short history of India’s regulation of mobile payments. Gynedi Srinivas, from the Department of Payment and Settlement Systems at the Reserve Bank of India (RBI), provides a super insight into the central bank’s thought processes, the regulations themselves and the market’s feedback. He explains in detail why the RBI opted for a bank-led model (subsequently tempered slightly as mobile operators can now act as bank correspondents and also offer prepaid accounts), saying that India chose a “calibrated approach”. This began with the initial April 2009 regulations that limited mobile payments to banks with a physical presence in India providing the service to their own customers. The following year, the National Payments Corporation of India (NPCI) set up the Interbank Mobile Payment Service (IMPS) to route the transactions. I said at the time that

The first step on the ladder of financial inclusion for this group as for many others is not banking, but payments.

[From Digital Money: The first rung]

I was making this point (in a discussion on financial inclusion) to make the point that non-bank payment accounts might be a better base for building financial inclusion than bank accounts, because I thought that the RBI rules were too restrictive. This did turn out to be the case and the framework did not unleash the tigers of the nascent sector, so the RBI subsequently revised their position to allow non-bans in general (and mobile operators in particular) to provide prepaid wallets. The rules on domestic transfer were relaxed later, easing the security requirements for transactions under 5,000 Rupees (a bit over fifty quid).

In 2009, [the RBI] mandated that a bank account is needed to send money but in 2010, it allowed ‘Other Persons’ (non-banks/NBFCs) to issue m-based semi-closed instruments with certain conditions and caps on transfer amounts. As a result, banks started offering mobile banking services. Further in 2010, it allowed semi-closed instruments to be used for bill payments and ticketing services, also, and permitted issue of co-branded instruments.

[From IBM Center for Applied Insights]

The upshot of this calibrated approach is that in India, as Mr. Srinivas concludes, “the potential of mobile payments is yet to be fully exploited”. To date, 65 banks have received approval to launch mobile services and 17 non-banks have been authorised to offer prepaid wallets, and while the volumes are displaying a “healthy upward trend”, they’re not where they should be. I’m not sure that I understand all of the reasons for this, but I think I have some insight into the poor uptake amongst the unbanked.Earlier this year, Nokia sold its Indian mobile payments company to Fino (the largest business correspondent banking business in India, with some 50 million customers). Nokia apparently decided to get out of this business because it had only attracted a million or so customers in its first couple of years.

Finnish handset maker Nokia has decided to exit mobile money business, two years after it launched the service in India… Nokia had launched mobile money in 2010 through a partnership with YES Bank. Subsequently, it signed up with Union Bank to offer services such as bill payments and money transfer. It had also launched the service independently under the Nokia Money brand which has about 2 lakh subscribers. In total, there are about 1.2 million subscribers using the Nokia service across all three platforms. Apart from India, Nokia had launched the service, based on Obopay’s mobile payment platform, in other countries, including Pakistan.

[From Business Line : Industry & Economy / Info-tech : Nokia to exit mobile money business globally]

This decision attracted considerable comment in my tiny corner of the blogosphere at the time, with sentiment dividing fairly evenly between people who thought that Nokia should stick with a successful volume business and people who thought that they should get rid of non-core businesses to focus on the challenges at hand. Many of the comments referenced M-PESA. I don’t want to go over old ground yet again, but let me make two points relevant to the discussion of Nokia Money in the specifically Indian/nerd context of this post. First of all, M-PESA uses SIM Toolkit to provide transactional security. Generally speaking, you need to be an operator to do this. Secondly, a significant component of M-PESA’s Kenyan success was, as the The Economist notes above, because of regulatory space. M-PESA in Tanzania and South Africa isn’t the same business as M-PESA in Kenya because in those countries it had to be launched as a bank partnership. Which is why it couldn’t be launched in India in its original form either.

To the first point, siince Nokia didn’t have access to the SIM and didn’t have an alternative “secure element” in the feature-phone handsets, Nokia was no different from any other non-operator trying to get into that business (they had retail outlets, but then the operators have agents). To the second point, the slow pace of development in mobile payments in countries that should have been mobile money powerhouses — such as India and Nigeria — had a lot to do with regulatory constraints that they cannot affect. Now that non-banks are allowed into that space, we should new vigour downstream. In fact. Just as Nokia Money was closing, Bharti Airtel was launching. The equivalent of a Kenyan M-PESA users might be an Indian Airtel user. It’s easy to become a mobile money user, all they have to do is…

visit nearest airtel money retailer to fill the application form and submit KYC documents (2 copies of identity proof, 1 copy of address proof, 1 passport size photo)

[From Airtel Money : Make Payments and Transfer Money Across India. How does it work ? – WirelessDuniya]

Sounds simple. And there are plenty of other choices too. There’s the SMS-based service offered across IMPS (based on the use of the “Mobile Money ID”, distinct from the mobile number and the account number), there are applications for buying train tickets on the handset, there are combination barcode/SMS solutions for retail and so forth. Yet in a country where mobile phone penetration will reach 100% in around three years’  time, we don’t seeming to be seeing “Kenyan” scale.

IMPS Reports 34.94M Mobile Money IDs, 43 Banks; Just 31,553 Transactions In May 2012

[From IMPS Reports 34.94M Mobile Money IDs, 43 Banks; Just 31,553 Transactions In May 2012 – MediaNama]

There are now 50 banks on board (and I’m pretty sure that transaction statistic is wrong: it should be 31 lakh (i.e., 3.1m) as last month the figure was 34 lakh. Still low for a country with 919m mobile subscribers, but growing. A March 2012 study says that three quarters of Indian mobile phone users use their device for mobile banking and two-thirds of them have made a payment in the last six months. That’s a few hundred million payments. Yet IMPS carries (I think – a quick Google couldn’t find the statistic) around a million payments per month, most of these payments must be digital downloads going direct to bill (I hope one of our Indian readers can comment on this).

…consumer frustration with the sucky e-commerce technology is not helping e-commerce to grow in India. Even though mobile payment is different from e-commerce, I still feel the problems plaguing the e-commerce growth will apply to m-payments at some levels and hence disappoint the existing expectations from mobile payments.

[From Mobile Payments potential huge in India, but will it really take off?]

OK, so messing around with SMS and barcodes didn’t take off in Finland or the UK either, but the technology is getting better all the time, lots of smartphones are being sold in India and the operators could go with STK/USSD if they want to. Is this just a matter of time, as the non-banks invigorate the market? Juniper (in 2011) estimated 400m Indian mobile payment users in 2015 and the current MasterCard mobile payments readiness index scores India (and Nigeria) above France and South Africa.

In 2012, 10 percent of Indian consumers are familiar with mobile payments at the point of sale and 8 percent are willing to try them.

[From • India: readiness to use mobile payments | Survey 2012]

So Indians are buying lots of music and wallpaper and games with their phones, but they’re not going to be any kind of cash replacement for the foreseeable future. (Their may be another cash replacement path in India and I will blog about that soon.) Since there won’t be cash replacement, people won’t carry mobile payment balances unless they are confident that they can get cash when necessary. Handling cash is the most expensive part of a mobile payment operation in a developing country. Shipping trucks of cash from Nairobi out to regional super-agents has proved workable in Kenya — and the super-agents skills in cash management have improved with time — so using mobile operators to organise super agent hierarchies and turning all of the little shops and micro enterprises that sell top up into cash-out points might be a way forward.

Reserve Bank of India deputy governor H R Khan on Wednesday said mobile telephone operators cannot be permitted to provide a cash-out facility from virtual wallets to customers, as such an activity would amount to ‘bypass banking’. However, they could do so if they acted as a business correspondent (BC) to a bank, he added.

[From RBI cold to mobile wallet]

I have no idea how much Indian banks charge their BCs for a cash-out transaction, but I think it would be useful to know. Anyone?

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers

Subscribe to our newsletter

You have successfully subscribed to the newsletter

There was an error while trying to send your request. Please try again.

By accepting the Terms, you consent to Consult Hyperion communicating with you regarding our events, reports and services through our regular newsletter. You can unsubscribe anytime through our newsletters or by emailing us.